OpenVPN
auth_token.c
Go to the documentation of this file.
1 #ifdef HAVE_CONFIG_H
2 #include "config.h"
3 #elif defined(_MSC_VER)
4 #include "config-msvc.h"
5 #endif
6 
7 #include "syshead.h"
8 
9 #include "base64.h"
10 #include "buffer.h"
11 #include "crypto.h"
12 #include "openvpn.h"
13 #include "ssl_common.h"
14 #include "auth_token.h"
15 #include "push.h"
16 #include "integer.h"
17 #include "ssl.h"
18 #include "ssl_verify.h"
19 #include <inttypes.h>
20 
21 const char *auth_token_pem_name = "OpenVPN auth-token server key";
22 
23 #define AUTH_TOKEN_SESSION_ID_LEN 12
24 #define AUTH_TOKEN_SESSION_ID_BASE64_LEN (AUTH_TOKEN_SESSION_ID_LEN * 8 / 6)
25 
26 #if AUTH_TOKEN_SESSION_ID_LEN % 3
27 #error AUTH_TOKEN_SESSION_ID_LEN needs to be multiple a 3
28 #endif
29 
30 /* Size of the data of the token (not b64 encoded and without prefix) */
31 #define TOKEN_DATA_LEN (2 * sizeof(int64_t) + AUTH_TOKEN_SESSION_ID_LEN + 32)
32 
33 static struct key_type
35 {
36  return create_kt("none", "SHA256", "auth-gen-token");
37 }
38 
39 void
41  const struct user_pass *up)
42 {
43  if (!multi->opt.auth_token_generate)
44  {
45  return;
46  }
47 
48  int auth_token_state_flags = session->key[KS_PRIMARY].auth_token_state_flags;
49 
50  const char *state;
51 
52  if (!is_auth_token(up->password))
53  {
54  state = "Initial";
55  }
56  else if (auth_token_state_flags & AUTH_TOKEN_HMAC_OK)
57  {
58  switch (auth_token_state_flags & (AUTH_TOKEN_VALID_EMPTYUSER|AUTH_TOKEN_EXPIRED))
59  {
60  case 0:
61  state = "Authenticated";
62  break;
63 
64  case AUTH_TOKEN_EXPIRED:
65  state = "Expired";
66  break;
67 
69  state = "AuthenticatedEmptyUser";
70  break;
71 
73  state = "ExpiredEmptyUser";
74  break;
75 
76  default:
77  /* Silence compiler warning, all four possible combinations are covered */
78  ASSERT(0);
79  }
80  }
81  else
82  {
83  state = "Invalid";
84  }
85 
86  setenv_str(session->opt->es, "session_state", state);
87 
88  /* We had a valid session id before */
89  const char *session_id_source;
90  if (auth_token_state_flags & AUTH_TOKEN_HMAC_OK
91  && !(auth_token_state_flags & AUTH_TOKEN_EXPIRED))
92  {
93  session_id_source = up->password;
94  }
95  else
96  {
97  /*
98  * No session before, generate a new session token for the new session
99  */
100  if (!multi->auth_token_initial)
101  {
102  generate_auth_token(up, multi);
103  }
104  session_id_source = multi->auth_token_initial;
105  }
106  /*
107  * In the auth-token the auth token is already base64 encoded
108  * and being a multiple of 4 ensure that it a multiple of bytes
109  * in the encoding
110  */
111 
113  memcpy(session_id, session_id_source + strlen(SESSION_ID_PREFIX),
115 
116  setenv_str(session->opt->es, "session_id", session_id);
117 }
118 
119 void
120 auth_token_write_server_key_file(const char *filename)
121 {
123 }
124 
125 void
126 auth_token_init_secret(struct key_ctx *key_ctx, const char *key_file,
127  bool key_inline)
128 {
129  struct key_type kt = auth_token_kt();
130 
131  struct buffer server_secret_key = alloc_buf(2048);
132 
133  bool key_loaded = false;
134  if (key_file)
135  {
136  key_loaded = read_pem_key_file(&server_secret_key,
138  key_file, key_inline);
139  }
140  else
141  {
142  key_loaded = generate_ephemeral_key(&server_secret_key,
144  }
145 
146  if (!key_loaded)
147  {
148  msg(M_FATAL, "ERROR: Cannot load auth-token secret");
149  }
150 
151  struct key key;
152 
153  if (!buf_read(&server_secret_key, &key, sizeof(key)))
154  {
155  msg(M_FATAL, "ERROR: not enough data in auth-token secret");
156  }
157  init_key_ctx(key_ctx, &key, &kt, false, "auth-token secret");
158 
159  free_buf(&server_secret_key);
160 }
161 
162 void
163 generate_auth_token(const struct user_pass *up, struct tls_multi *multi)
164 {
165  struct gc_arena gc = gc_new();
166 
167  int64_t timestamp = htonll((uint64_t)now);
168  int64_t initial_timestamp = timestamp;
169 
170  hmac_ctx_t *ctx = multi->opt.auth_token_key.hmac;
171  ASSERT(hmac_ctx_size(ctx) == 256/8);
172 
173  uint8_t sessid[AUTH_TOKEN_SESSION_ID_LEN];
174 
175  if (multi->auth_token_initial)
176  {
177  /* Just enough space to fit 8 bytes+ 1 extra to decode a non padded
178  * base64 string (multiple of 3 bytes). 9 bytes => 12 bytes base64
179  * bytes
180  */
181  char old_tstamp_decode[9];
182 
183  /* Make a copy of the string to not modify multi->auth_token_initial */
184  char *initial_token_copy = string_alloc(multi->auth_token_initial, &gc);
185 
186  char *old_sessid = initial_token_copy + strlen(SESSION_ID_PREFIX);
187  char *old_tsamp_initial = old_sessid + AUTH_TOKEN_SESSION_ID_LEN*8/6;
188 
189  /*
190  * We null terminate the old token just after the session ID to let
191  * our base64 decode function only decode the session ID
192  */
193  old_tsamp_initial[12] = '\0';
194  ASSERT(openvpn_base64_decode(old_tsamp_initial, old_tstamp_decode, 9) == 9);
195 
196  /*
197  * Avoid old gcc (4.8.x) complaining about strict aliasing
198  * by using a temporary variable instead of doing it in one
199  * line
200  */
201  uint64_t *tstamp_ptr = (uint64_t *) old_tstamp_decode;
202  initial_timestamp = *tstamp_ptr;
203 
204  old_tsamp_initial[0] = '\0';
206  }
207  else if (!rand_bytes(sessid, AUTH_TOKEN_SESSION_ID_LEN))
208  {
209  msg( M_FATAL, "Failed to get enough randomness for "
210  "authentication token");
211  }
212 
213  /* Calculate the HMAC */
214  /* We enforce up->username to be \0 terminated in ssl.c.. Allowing username
215  * with \0 in them is asking for troubles in so many ways anyway that we
216  * ignore that corner case here
217  */
218  uint8_t hmac_output[256/8];
219 
220  hmac_ctx_reset(ctx);
221 
222  /*
223  * If the token was only valid for the empty user, also generate
224  * a new token with the empty username since we do not want to loose
225  * the information that the username cannot be trusted
226  */
227  struct key_state *ks = &multi->session[TM_ACTIVE].key[KS_PRIMARY];
229  {
230  hmac_ctx_update(ctx, (const uint8_t *) "", 0);
231  }
232  else
233  {
234  hmac_ctx_update(ctx, (uint8_t *) up->username, (int) strlen(up->username));
235  }
237  hmac_ctx_update(ctx, (uint8_t *) &initial_timestamp, sizeof(initial_timestamp));
238  hmac_ctx_update(ctx, (uint8_t *) &timestamp, sizeof(timestamp));
239  hmac_ctx_final(ctx, hmac_output);
240 
241  /* Construct the unencoded session token */
242  struct buffer token = alloc_buf_gc(
243  2*sizeof(uint64_t) + AUTH_TOKEN_SESSION_ID_LEN + 256/8, &gc);
244 
245  ASSERT(buf_write(&token, sessid, sizeof(sessid)));
246  ASSERT(buf_write(&token, &initial_timestamp, sizeof(initial_timestamp)));
247  ASSERT(buf_write(&token, &timestamp, sizeof(timestamp)));
248  ASSERT(buf_write(&token, hmac_output, sizeof(hmac_output)));
249 
250  char *b64output = NULL;
251  openvpn_base64_encode(BPTR(&token), BLEN(&token), &b64output);
252 
253  struct buffer session_token = alloc_buf_gc(
254  strlen(SESSION_ID_PREFIX) + strlen(b64output) + 1, &gc);
255 
256  ASSERT(buf_write(&session_token, SESSION_ID_PREFIX, strlen(SESSION_ID_PREFIX)));
257  ASSERT(buf_write(&session_token, b64output, (int)strlen(b64output)));
258  ASSERT(buf_write_u8(&session_token, 0));
259 
260  free(b64output);
261 
262  /* free the auth-token if defined, we will replace it with a new one */
263  free(multi->auth_token);
264  multi->auth_token = strdup((char *)BPTR(&session_token));
265 
266  dmsg(D_SHOW_KEYS, "Generated token for client: %s (%s)",
267  multi->auth_token, up->username);
268 
269  if (!multi->auth_token_initial)
270  {
271  /*
272  * Save the initial auth token to continue using the same session ID
273  * and timestamp in updates
274  */
275  multi->auth_token_initial = strdup(multi->auth_token);
276  }
277 
278  gc_free(&gc);
279 }
280 
281 
282 static bool
283 check_hmac_token(hmac_ctx_t *ctx, const uint8_t *b64decoded, const char *username)
284 {
285  ASSERT(hmac_ctx_size(ctx) == 256/8);
286 
287  uint8_t hmac_output[256/8];
288 
289  hmac_ctx_reset(ctx);
290  hmac_ctx_update(ctx, (uint8_t *) username, (int)strlen(username));
291  hmac_ctx_update(ctx, b64decoded, TOKEN_DATA_LEN - 256/8);
292  hmac_ctx_final(ctx, hmac_output);
293 
294  const uint8_t *hmac = b64decoded + TOKEN_DATA_LEN - 256/8;
295  return memcmp_constant_time(&hmac_output, hmac, 32) == 0;
296 }
297 
298 unsigned int
299 verify_auth_token(struct user_pass *up, struct tls_multi *multi,
300  struct tls_session *session)
301 {
302  /*
303  * Base64 is <= input and input is < USER_PASS_LEN, so using USER_PASS_LEN
304  * is safe here but a bit overkill
305  */
306  uint8_t b64decoded[USER_PASS_LEN];
307  int decoded_len = openvpn_base64_decode(up->password + strlen(SESSION_ID_PREFIX),
308  b64decoded, USER_PASS_LEN);
309 
310  /*
311  * Ensure that the decoded data is the size of the
312  * timestamp + hmac + session id
313  */
314  if (decoded_len != TOKEN_DATA_LEN)
315  {
316  msg(M_WARN, "ERROR: --auth-token wrong size (%d!=%d)",
317  decoded_len, (int) TOKEN_DATA_LEN);
318  return 0;
319  }
320 
321  unsigned int ret = 0;
322 
323  const uint8_t *sessid = b64decoded;
324  const uint8_t *tstamp_initial = sessid + AUTH_TOKEN_SESSION_ID_LEN;
325  const uint8_t *tstamp = tstamp_initial + sizeof(int64_t);
326 
327  uint64_t timestamp = ntohll(*((uint64_t *) (tstamp)));
328  uint64_t timestamp_initial = ntohll(*((uint64_t *) (tstamp_initial)));
329 
330  hmac_ctx_t *ctx = multi->opt.auth_token_key.hmac;
331  if (check_hmac_token(ctx, b64decoded, up->username))
332  {
333  ret |= AUTH_TOKEN_HMAC_OK;
334  }
335  else if (check_hmac_token(ctx, b64decoded, ""))
336  {
337  ret |= AUTH_TOKEN_HMAC_OK;
339  /* overwrite the username of the client with the empty one */
340  strcpy(up->username, "");
341  }
342  else
343  {
344  msg(M_WARN, "--auth-gen-token: HMAC on token from client failed (%s)",
345  up->username);
346  return 0;
347  }
348 
349  /* Accept session tokens that not expired are in the acceptable range
350  * for renogiations */
351  bool in_renegotiation_time = now >= timestamp
352  && now < timestamp + 2 * session->opt->renegotiate_seconds;
353 
354  if (!in_renegotiation_time)
355  {
356  ret |= AUTH_TOKEN_EXPIRED;
357  }
358 
359  /* Sanity check the initial timestamp */
360  if (timestamp < timestamp_initial)
361  {
362  msg(M_WARN, "Initial timestamp (%" PRIu64 " in token from client earlier than "
363  "current timestamp %" PRIu64 ". Broken/unsynchronised clock?",
364  timestamp_initial, timestamp);
365  ret |= AUTH_TOKEN_EXPIRED;
366  }
367 
368  if (multi->opt.auth_token_lifetime
369  && now > timestamp_initial + multi->opt.auth_token_lifetime)
370  {
371  ret |= AUTH_TOKEN_EXPIRED;
372  }
373 
374  if (ret & AUTH_TOKEN_EXPIRED)
375  {
376  /* Tell client that the session token is expired */
377  auth_set_client_reason(multi, "SESSION: token expired");
378  msg(M_INFO, "--auth-gen-token: auth-token from client expired");
379  }
380 
381  /* Check that we do have the same session ID in the token as in our stored
382  * auth-token to ensure that it did not change.
383  * This also compares the prefix and session part of the
384  * tokens, which should be identical if the session ID stayed the same */
385  if (multi->auth_token_initial
388  {
389  msg(M_WARN, "--auth-gen-token: session id in token changed (Rejecting "
390  "token.");
391  ret = 0;
392  }
393  return ret;
394 }
395 
396 void
398 {
399  if (multi)
400  {
401  if (multi->auth_token)
402  {
403  secure_memzero(multi->auth_token, strlen(multi->auth_token));
404  free(multi->auth_token);
405  }
406  if (multi->auth_token_initial)
407  {
409  strlen(multi->auth_token_initial));
410  free(multi->auth_token_initial);
411  }
412  multi->auth_token = NULL;
413  multi->auth_token_initial = NULL;
414  }
415 }
416 
417 void
419 {
420  /*
421  * Auth token already sent to client, update auth-token on client.
422  * The initial auth-token is sent as part of the push message, for this
423  * update we need to schedule an extra push message.
424  *
425  * Otherwise the auth-token get pushed out as part of the "normal"
426  * push-reply
427  */
428  bool is_renegotiation = session->key[KS_PRIMARY].key_id != 0;
429 
430  if (multi->auth_token_initial && is_renegotiation)
431  {
432  /*
433  * We do not explicitly reschedule the sending of the
434  * control message here. This might delay this reply
435  * a few seconds but this message is not time critical
436  */
438  }
439 }
SESSION_ID_PREFIX
#define SESSION_ID_PREFIX
The prefix given to auth tokens start with, this prefix is special cased to not show up in log files ...
Definition: auth_token.h:115
openvpn_base64_decode
int openvpn_base64_decode(const char *str, void *data, int size)
Definition: base64.c:160
tls_multi::auth_token
char * auth_token
If server sends a generated auth-token, this is the token to use for future user/pass authentications...
Definition: ssl_common.h:604
M_INFO
#define M_INFO
Definition: errlevel.h:55
buf_read
static bool buf_read(struct buffer *src, void *dest, int size)
Definition: buffer.h:783
send_push_reply_auth_token
void send_push_reply_auth_token(struct tls_multi *multi)
Sends a push reply message only containin the auth-token to update the auth-token on the client.
Definition: push.c:650
gc_new
static struct gc_arena gc_new(void)
Definition: buffer.h:998
hmac_ctx_t
mbedtls_md_context_t hmac_ctx_t
Generic HMAC context.
Definition: crypto_mbedtls.h:46
auth_token.h
verify_auth_token
unsigned int verify_auth_token(struct user_pass *up, struct tls_multi *multi, struct tls_session *session)
Verifies the auth token to be in the format that generate_auth_token create and checks if the token i...
Definition: auth_token.c:299
M_FATAL
#define M_FATAL
Definition: error.h:95
is_auth_token
static bool is_auth_token(const char *password)
Return if the password string has the format of a password.
Definition: auth_token.h:127
key_state::auth_token_state_flags
int auth_token_state_flags
The state of the auth-token sent from the client.
Definition: ssl_common.h:192
KS_PRIMARY
#define KS_PRIMARY
Primary key state index.
Definition: ssl_common.h:416
resend_auth_token_renegotiation
void resend_auth_token_renegotiation(struct tls_multi *multi, struct tls_session *session)
Checks if a client should be sent a new auth token to update its current auth-token.
Definition: auth_token.c:418
tls_multi::session
struct tls_session session[TM_SIZE]
Array of tls_session objects representing control channel sessions with the remote peer.
Definition: ssl_common.h:635
add_session_token_env
void add_session_token_env(struct tls_session *session, struct tls_multi *multi, const struct user_pass *up)
Put the session id, and auth token status into the environment if auth-token is enabled.
Definition: auth_token.c:40
tls_options::auth_token_key
struct key_ctx auth_token_key
Definition: ssl_common.h:361
user_pass::username
char username[USER_PASS_LEN]
Definition: misc.h:70
alloc_buf_gc
struct buffer alloc_buf_gc(size_t size, struct gc_arena *gc)
Definition: buffer.c:90
config-msvc.h
session::key
char key[48]
Definition: keyingmaterialexporter.c:58
openvpn.h
openvpn_base64_encode
int openvpn_base64_encode(const void *data, int size, char **str)
Definition: base64.c:54
dmsg
#define dmsg(flags,...)
Definition: error.h:154
hmac_ctx_update
void hmac_ctx_update(hmac_ctx_t *ctx, const uint8_t *src, int src_len)
tls_multi
Security parameter state for a single VPN tunnel.
Definition: ssl_common.h:550
key_state
Security parameter state of one TLS and data channel key session.
Definition: ssl_common.h:188
key
Container for unidirectional cipher and HMAC key material.
Definition: crypto.h:149
tls_options::auth_token_generate
bool auth_token_generate
Generate auth-tokens on successful user/pass auth,seet via options->auth_token_generate.
Definition: ssl_common.h:355
check_hmac_token
static bool check_hmac_token(hmac_ctx_t *ctx, const uint8_t *b64decoded, const char *username)
Definition: auth_token.c:283
AUTH_TOKEN_VALID_EMPTYUSER
#define AUTH_TOKEN_VALID_EMPTYUSER
Auth-token is only valid for an empty username and not the username actually supplied from the client...
Definition: ssl_common.h:616
session_id
Definition: session_id.h:38
TM_ACTIVE
#define TM_ACTIVE
Active tls_session.
Definition: ssl_common.h:493
string_alloc
char * string_alloc(const char *str, struct gc_arena *gc)
Definition: buffer.c:662
secure_memzero
static void secure_memzero(void *data, size_t len)
Securely zeroise memory.
Definition: buffer.h:401
AUTH_TOKEN_SESSION_ID_LEN
#define AUTH_TOKEN_SESSION_ID_LEN
Definition: auth_token.c:23
ssl_verify.h
ASSERT
#define ASSERT(x)
Definition: error.h:201
BLEN
#define BLEN(buf)
Definition: buffer.h:127
buf_write_u8
static bool buf_write_u8(struct buffer *dest, uint8_t data)
Definition: buffer.h:697
tls_session::key
struct key_state key[KS_SIZE]
Definition: ssl_common.h:473
tls_multi::opt
struct tls_options opt
Definition: ssl_common.h:556
init_key_ctx
void init_key_ctx(struct key_ctx *ctx, const struct key *key, const struct key_type *kt, int enc, const char *prefix)
Definition: crypto.c:825
push.h
M_WARN
#define M_WARN
Definition: error.h:97
key_ctx
Container for one set of cipher and/or HMAC contexts.
Definition: crypto.h:162
crypto.h
AUTH_TOKEN_SESSION_ID_BASE64_LEN
#define AUTH_TOKEN_SESSION_ID_BASE64_LEN
Definition: auth_token.c:24
base64.h
generate_ephemeral_key
bool generate_ephemeral_key(struct buffer *key, const char *key_name)
Generate ephermal key material into the key structure.
Definition: crypto.c:1759
hmac_ctx_final
void hmac_ctx_final(hmac_ctx_t *ctx, uint8_t *dst)
auth_token_init_secret
void auth_token_init_secret(struct key_ctx *key_ctx, const char *key_file, bool key_inline)
Loads an HMAC secret from a file or if no file is present generates a epheremal secret for the run ti...
Definition: auth_token.c:126
buffer
Wrapper structure for dynamically allocated memory.
Definition: buffer.h:60
ntohll
#define ntohll(x)
Definition: integer.h:35
hmac_ctx_reset
void hmac_ctx_reset(hmac_ctx_t *ctx)
rand_bytes
int rand_bytes(uint8_t *output, int len)
Wrapper for secure random number generator.
Definition: crypto_openssl.c:556
auth_token_kt
static struct key_type auth_token_kt(void)
Definition: auth_token.c:34
key_type
Definition: crypto.h:139
buf_write
static bool buf_write(struct buffer *dest, const void *src, size_t size)
Definition: buffer.h:673
auth_token_write_server_key_file
void auth_token_write_server_key_file(const char *filename)
Generate a auth-token server secret key, and write to file.
Definition: auth_token.c:120
ssl.h
tls_session
Security parameter state of a single session within a VPN tunnel.
Definition: ssl_common.h:439
generate_auth_token
void generate_auth_token(const struct user_pass *up, struct tls_multi *multi)
Generate an auth token based on username and timestamp.
Definition: auth_token.c:163
buffer.h
syshead.h
BPTR
#define BPTR(buf)
Definition: buffer.h:124
create_kt
static struct key_type create_kt(const char *cipher, const char *md, const char *optname)
Creates and validates an instance of struct key_type with the provided algs.
Definition: crypto.h:569
auth_token_pem_name
const char * auth_token_pem_name
Definition: auth_token.c:21
gc_arena
Garbage collection arena used to keep track of dynamically allocated memory.
Definition: buffer.h:116
setenv_str
void setenv_str(struct env_set *es, const char *name, const char *value)
Definition: env_set.c:285
tls_options::auth_token_lifetime
unsigned int auth_token_lifetime
Definition: ssl_common.h:359
free_buf
void free_buf(struct buffer *buf)
Definition: buffer.c:185
memcmp_constant_time
int memcmp_constant_time(const void *a, const void *b, size_t size)
As memcmp(), but constant-time.
Definition: crypto_openssl.c:1357
AUTH_TOKEN_HMAC_OK
#define AUTH_TOKEN_HMAC_OK
Auth-token sent from client has valid hmac.
Definition: ssl_common.h:612
write_pem_key_file
void write_pem_key_file(const char *filename, const char *pem_name)
Generate a server key with enough randomness to fill a key struct and write to file.
Definition: crypto.c:1721
AUTH_TOKEN_EXPIRED
#define AUTH_TOKEN_EXPIRED
Auth-token sent from client has expired.
Definition: ssl_common.h:614
htonll
#define htonll(x)
Definition: integer.h:30
auth_set_client_reason
void auth_set_client_reason(struct tls_multi *multi, const char *client_reason)
Sets the reason why authentication of a client failed.
Definition: ssl_verify.c:835
gc_free
static void gc_free(struct gc_arena *a)
Definition: buffer.h:1006
USER_PASS_LEN
#define USER_PASS_LEN
Definition: misc.h:68
now
time_t now
Definition: otime.c:36
wipe_auth_token
void wipe_auth_token(struct tls_multi *multi)
Wipes the authentication token out of the memory, frees and cleans up related buffers and flags.
Definition: auth_token.c:397
config.h
TOKEN_DATA_LEN
#define TOKEN_DATA_LEN
Definition: auth_token.c:31
ssl_common.h
read_pem_key_file
bool read_pem_key_file(struct buffer *key, const char *pem_name, const char *key_file, bool key_inline)
Read key material from a PEM encoded files into the key structure.
Definition: crypto.c:1777
D_SHOW_KEYS
#define D_SHOW_KEYS
Definition: errlevel.h:118
user_pass::password
char password[USER_PASS_LEN]
Definition: misc.h:71
session
Definition: keyingmaterialexporter.c:56
key_ctx::hmac
hmac_ctx_t * hmac
Generic HMAC context.
Definition: crypto.h:165
tls_multi::auth_token_initial
char * auth_token_initial
The first auth-token we sent to a client.
Definition: ssl_common.h:608
user_pass
Definition: misc.h:56
alloc_buf
struct buffer alloc_buf(size_t size)
Definition: buffer.c:64
msg
#define msg(flags,...)
Definition: error.h:150
integer.h
hmac_ctx_size
int hmac_ctx_size(hmac_ctx_t *ctx)