OpenVPN
auth_token.c
Go to the documentation of this file.
1 #ifdef HAVE_CONFIG_H
2 #include "config.h"
3 #endif
4 
5 #include "syshead.h"
6 
7 #include "base64.h"
8 #include "buffer.h"
9 #include "crypto.h"
10 #include "openvpn.h"
11 #include "ssl_common.h"
12 #include "auth_token.h"
13 #include "push.h"
14 #include "integer.h"
15 #include "ssl.h"
16 #include "ssl_verify.h"
17 #include <inttypes.h>
18 
19 const char *auth_token_pem_name = "OpenVPN auth-token server key";
20 
21 #define AUTH_TOKEN_SESSION_ID_LEN 12
22 #define AUTH_TOKEN_SESSION_ID_BASE64_LEN (AUTH_TOKEN_SESSION_ID_LEN * 8 / 6)
23 
24 #if AUTH_TOKEN_SESSION_ID_LEN % 3
25 #error AUTH_TOKEN_SESSION_ID_LEN needs to be multiple a 3
26 #endif
27 
28 /* Size of the data of the token (not b64 encoded and without prefix) */
29 #define TOKEN_DATA_LEN (2 * sizeof(int64_t) + AUTH_TOKEN_SESSION_ID_LEN + 32)
30 
31 static struct key_type
33 {
34  return create_kt("none", "SHA256", "auth-gen-token");
35 }
36 
37 void
39  const struct user_pass *up)
40 {
41  if (!multi->opt.auth_token_generate)
42  {
43  return;
44  }
45 
46  int auth_token_state_flags = session->key[KS_PRIMARY].auth_token_state_flags;
47 
48  const char *state;
49 
50  if (!is_auth_token(up->password))
51  {
52  state = "Initial";
53  }
54  else if (auth_token_state_flags & AUTH_TOKEN_HMAC_OK)
55  {
56  switch (auth_token_state_flags & (AUTH_TOKEN_VALID_EMPTYUSER|AUTH_TOKEN_EXPIRED))
57  {
58  case 0:
59  state = "Authenticated";
60  break;
61 
62  case AUTH_TOKEN_EXPIRED:
63  state = "Expired";
64  break;
65 
67  state = "AuthenticatedEmptyUser";
68  break;
69 
71  state = "ExpiredEmptyUser";
72  break;
73 
74  default:
75  /* Silence compiler warning, all four possible combinations are covered */
76  ASSERT(0);
77  }
78  }
79  else
80  {
81  state = "Invalid";
82  }
83 
84  setenv_str(session->opt->es, "session_state", state);
85 
86  /* We had a valid session id before */
87  const char *session_id_source;
88  if (auth_token_state_flags & AUTH_TOKEN_HMAC_OK
89  && !(auth_token_state_flags & AUTH_TOKEN_EXPIRED))
90  {
91  session_id_source = up->password;
92  }
93  else
94  {
95  /*
96  * No session before, generate a new session token for the new session
97  */
98  if (!multi->auth_token_initial)
99  {
100  generate_auth_token(up, multi);
101  }
102  session_id_source = multi->auth_token_initial;
103  }
104  /*
105  * In the auth-token the auth token is already base64 encoded
106  * and being a multiple of 4 ensure that it a multiple of bytes
107  * in the encoding
108  */
109 
111  memcpy(session_id, session_id_source + strlen(SESSION_ID_PREFIX),
113 
114  setenv_str(session->opt->es, "session_id", session_id);
115 }
116 
117 void
118 auth_token_write_server_key_file(const char *filename)
119 {
121 }
122 
123 void
124 auth_token_init_secret(struct key_ctx *key_ctx, const char *key_file,
125  bool key_inline)
126 {
127  struct key_type kt = auth_token_kt();
128 
129  struct buffer server_secret_key = alloc_buf(2048);
130 
131  bool key_loaded = false;
132  if (key_file)
133  {
134  key_loaded = read_pem_key_file(&server_secret_key,
136  key_file, key_inline);
137  }
138  else
139  {
140  key_loaded = generate_ephemeral_key(&server_secret_key,
142  }
143 
144  if (!key_loaded)
145  {
146  msg(M_FATAL, "ERROR: Cannot load auth-token secret");
147  }
148 
149  struct key key;
150 
151  if (!buf_read(&server_secret_key, &key, sizeof(key)))
152  {
153  msg(M_FATAL, "ERROR: not enough data in auth-token secret");
154  }
155  init_key_ctx(key_ctx, &key, &kt, false, "auth-token secret");
156 
157  free_buf(&server_secret_key);
158 }
159 
160 void
161 generate_auth_token(const struct user_pass *up, struct tls_multi *multi)
162 {
163  struct gc_arena gc = gc_new();
164 
165  int64_t timestamp = htonll((uint64_t)now);
166  int64_t initial_timestamp = timestamp;
167 
168  hmac_ctx_t *ctx = multi->opt.auth_token_key.hmac;
169  ASSERT(hmac_ctx_size(ctx) == 256/8);
170 
171  uint8_t sessid[AUTH_TOKEN_SESSION_ID_LEN];
172 
173  if (multi->auth_token_initial)
174  {
175  /* Just enough space to fit 8 bytes+ 1 extra to decode a non-padded
176  * base64 string (multiple of 3 bytes). 9 bytes => 12 bytes base64
177  * bytes
178  */
179  char old_tstamp_decode[9];
180 
181  /* Make a copy of the string to not modify multi->auth_token_initial */
182  char *initial_token_copy = string_alloc(multi->auth_token_initial, &gc);
183 
184  char *old_sessid = initial_token_copy + strlen(SESSION_ID_PREFIX);
185  char *old_tsamp_initial = old_sessid + AUTH_TOKEN_SESSION_ID_LEN*8/6;
186 
187  /*
188  * We null terminate the old token just after the session ID to let
189  * our base64 decode function only decode the session ID
190  */
191  old_tsamp_initial[12] = '\0';
192  ASSERT(openvpn_base64_decode(old_tsamp_initial, old_tstamp_decode, 9) == 9);
193 
194  /*
195  * Avoid old gcc (4.8.x) complaining about strict aliasing
196  * by using a temporary variable instead of doing it in one
197  * line
198  */
199  uint64_t *tstamp_ptr = (uint64_t *) old_tstamp_decode;
200  initial_timestamp = *tstamp_ptr;
201 
202  old_tsamp_initial[0] = '\0';
204  }
205  else if (!rand_bytes(sessid, AUTH_TOKEN_SESSION_ID_LEN))
206  {
207  msg( M_FATAL, "Failed to get enough randomness for "
208  "authentication token");
209  }
210 
211  /* Calculate the HMAC */
212  /* We enforce up->username to be \0 terminated in ssl.c.. Allowing username
213  * with \0 in them is asking for troubles in so many ways anyway that we
214  * ignore that corner case here
215  */
216  uint8_t hmac_output[256/8];
217 
218  hmac_ctx_reset(ctx);
219 
220  /*
221  * If the token was only valid for the empty user, also generate
222  * a new token with the empty username since we do not want to loose
223  * the information that the username cannot be trusted
224  */
225  struct key_state *ks = &multi->session[TM_ACTIVE].key[KS_PRIMARY];
227  {
228  hmac_ctx_update(ctx, (const uint8_t *) "", 0);
229  }
230  else
231  {
232  hmac_ctx_update(ctx, (uint8_t *) up->username, (int) strlen(up->username));
233  }
235  hmac_ctx_update(ctx, (uint8_t *) &initial_timestamp, sizeof(initial_timestamp));
236  hmac_ctx_update(ctx, (uint8_t *) &timestamp, sizeof(timestamp));
237  hmac_ctx_final(ctx, hmac_output);
238 
239  /* Construct the unencoded session token */
240  struct buffer token = alloc_buf_gc(
241  2*sizeof(uint64_t) + AUTH_TOKEN_SESSION_ID_LEN + 256/8, &gc);
242 
243  ASSERT(buf_write(&token, sessid, sizeof(sessid)));
244  ASSERT(buf_write(&token, &initial_timestamp, sizeof(initial_timestamp)));
245  ASSERT(buf_write(&token, &timestamp, sizeof(timestamp)));
246  ASSERT(buf_write(&token, hmac_output, sizeof(hmac_output)));
247 
248  char *b64output = NULL;
249  openvpn_base64_encode(BPTR(&token), BLEN(&token), &b64output);
250 
251  struct buffer session_token = alloc_buf_gc(
252  strlen(SESSION_ID_PREFIX) + strlen(b64output) + 1, &gc);
253 
254  ASSERT(buf_write(&session_token, SESSION_ID_PREFIX, strlen(SESSION_ID_PREFIX)));
255  ASSERT(buf_write(&session_token, b64output, (int)strlen(b64output)));
256  ASSERT(buf_write_u8(&session_token, 0));
257 
258  free(b64output);
259 
260  /* free the auth-token if defined, we will replace it with a new one */
261  free(multi->auth_token);
262  multi->auth_token = strdup((char *)BPTR(&session_token));
263 
264  dmsg(D_SHOW_KEYS, "Generated token for client: %s (%s)",
265  multi->auth_token, up->username);
266 
267  if (!multi->auth_token_initial)
268  {
269  /*
270  * Save the initial auth token to continue using the same session ID
271  * and timestamp in updates
272  */
273  multi->auth_token_initial = strdup(multi->auth_token);
274  }
275 
276  gc_free(&gc);
277 }
278 
279 
280 static bool
281 check_hmac_token(hmac_ctx_t *ctx, const uint8_t *b64decoded, const char *username)
282 {
283  ASSERT(hmac_ctx_size(ctx) == 256/8);
284 
285  uint8_t hmac_output[256/8];
286 
287  hmac_ctx_reset(ctx);
288  hmac_ctx_update(ctx, (uint8_t *) username, (int)strlen(username));
289  hmac_ctx_update(ctx, b64decoded, TOKEN_DATA_LEN - 256/8);
290  hmac_ctx_final(ctx, hmac_output);
291 
292  const uint8_t *hmac = b64decoded + TOKEN_DATA_LEN - 256/8;
293  return memcmp_constant_time(&hmac_output, hmac, 32) == 0;
294 }
295 
296 unsigned int
297 verify_auth_token(struct user_pass *up, struct tls_multi *multi,
298  struct tls_session *session)
299 {
300  /*
301  * Base64 is <= input and input is < USER_PASS_LEN, so using USER_PASS_LEN
302  * is safe here but a bit overkill
303  */
304  uint8_t b64decoded[USER_PASS_LEN];
305  int decoded_len = openvpn_base64_decode(up->password + strlen(SESSION_ID_PREFIX),
306  b64decoded, USER_PASS_LEN);
307 
308  /*
309  * Ensure that the decoded data is the size of the
310  * timestamp + hmac + session id
311  */
312  if (decoded_len != TOKEN_DATA_LEN)
313  {
314  msg(M_WARN, "ERROR: --auth-token wrong size (%d!=%d)",
315  decoded_len, (int) TOKEN_DATA_LEN);
316  return 0;
317  }
318 
319  unsigned int ret = 0;
320 
321  const uint8_t *sessid = b64decoded;
322  const uint8_t *tstamp_initial = sessid + AUTH_TOKEN_SESSION_ID_LEN;
323  const uint8_t *tstamp = tstamp_initial + sizeof(int64_t);
324 
325  /* tstamp, tstamp_initial might not be aligned to an uint64, use memcpy
326  * to avoid unaligned access */
327  uint64_t timestamp = 0, timestamp_initial = 0;
328  memcpy(&timestamp, tstamp, sizeof(uint64_t));
329  timestamp = ntohll(timestamp);
330 
331  memcpy(&timestamp_initial, tstamp_initial, sizeof(uint64_t));
332  timestamp_initial = ntohll(timestamp_initial);
333 
334  hmac_ctx_t *ctx = multi->opt.auth_token_key.hmac;
335  if (check_hmac_token(ctx, b64decoded, up->username))
336  {
337  ret |= AUTH_TOKEN_HMAC_OK;
338  }
339  else if (check_hmac_token(ctx, b64decoded, ""))
340  {
341  ret |= AUTH_TOKEN_HMAC_OK;
343  /* overwrite the username of the client with the empty one */
344  strcpy(up->username, "");
345  }
346  else
347  {
348  msg(M_WARN, "--auth-gen-token: HMAC on token from client failed (%s)",
349  up->username);
350  return 0;
351  }
352 
353  /* Accept session tokens only if their timestamp is in the acceptable range
354  * for renegotiations */
355  bool in_renegotiation_time = now >= timestamp
356  && now < timestamp + 2 * session->opt->auth_token_renewal;
357 
358  if (!in_renegotiation_time)
359  {
360  msg(M_WARN, "Timestamp (%" PRIu64 ") of auth-token is out of the renewal window",
361  timestamp);
362  ret |= AUTH_TOKEN_EXPIRED;
363  }
364 
365  /* Sanity check the initial timestamp */
366  if (timestamp < timestamp_initial)
367  {
368  msg(M_WARN, "Initial timestamp (%" PRIu64 ") in token from client earlier than "
369  "current timestamp %" PRIu64 ". Broken/unsynchronised clock?",
370  timestamp_initial, timestamp);
371  ret |= AUTH_TOKEN_EXPIRED;
372  }
373 
374  if (multi->opt.auth_token_lifetime
375  && now > timestamp_initial + multi->opt.auth_token_lifetime)
376  {
377  ret |= AUTH_TOKEN_EXPIRED;
378  }
379 
380  if (ret & AUTH_TOKEN_EXPIRED)
381  {
382  /* Tell client that the session token is expired */
383  auth_set_client_reason(multi, "SESSION: token expired");
384  msg(M_INFO, "--auth-gen-token: auth-token from client expired");
385  }
386 
387  /* Check that we do have the same session ID in the token as in our stored
388  * auth-token to ensure that it did not change.
389  * This also compares the prefix and session part of the
390  * tokens, which should be identical if the session ID stayed the same */
391  if (multi->auth_token_initial
394  {
395  msg(M_WARN, "--auth-gen-token: session id in token changed (Rejecting "
396  "token.");
397  ret = 0;
398  }
399  return ret;
400 }
401 
402 void
404 {
405  if (multi)
406  {
407  if (multi->auth_token)
408  {
409  secure_memzero(multi->auth_token, strlen(multi->auth_token));
410  free(multi->auth_token);
411  }
412  if (multi->auth_token_initial)
413  {
415  strlen(multi->auth_token_initial));
416  free(multi->auth_token_initial);
417  }
418  multi->auth_token = NULL;
419  multi->auth_token_initial = NULL;
420  }
421 }
422 
423 void
425 {
426  struct tls_multi *multi = c->c2.tls_multi;
427  struct tls_session *session = &multi->session[TM_ACTIVE];
428 
429  if (get_primary_key(multi)->state < S_GENERATED_KEYS
430  || get_primary_key(multi)->authenticated != KS_AUTH_TRUE)
431  {
432  /* the currently active session is still in renegotiation or another
433  * not fully authorized state. We are either very close to a
434  * renegotiation or have deauthorized the client. In both cases
435  * we just ignore the request to send another token
436  */
437  return;
438  }
439 
440  if (!multi->auth_token_initial)
441  {
442  msg(D_SHOW_KEYS, "initial auth-token not generated yet, skipping "
443  "auth-token renewal.");
444  return;
445  }
446 
447  if (!multi->locked_username)
448  {
449  msg(D_SHOW_KEYS, "username not locked, skipping auth-token renewal.");
450  return;
451  }
452 
453  struct user_pass up;
454  strncpynt(up.username, multi->locked_username, sizeof(up.username));
455 
456  generate_auth_token(&up, multi);
457 
459 }
460 
461 void
463 {
464  /*
465  * Auth token already sent to client, update auth-token on client.
466  * The initial auth-token is sent as part of the push message, for this
467  * update we need to schedule an extra push message.
468  *
469  * Otherwise, the auth-token get pushed out as part of the "normal"
470  * push-reply
471  */
472  if (multi->auth_token_initial)
473  {
474  /*
475  * We do not explicitly reschedule the sending of the
476  * control message here. This might delay this reply
477  * a few seconds but this message is not time critical
478  */
480  }
481 }
SESSION_ID_PREFIX
#define SESSION_ID_PREFIX
The prefix given to auth tokens start with, this prefix is special cased to not show up in log files ...
Definition: auth_token.h:115
openvpn_base64_decode
int openvpn_base64_decode(const char *str, void *data, int size)
Definition: base64.c:158
S_GENERATED_KEYS
#define S_GENERATED_KEYS
The data channel keys have been generated The TLS session is fully authenticated when reaching this s...
Definition: ssl_common.h:101
tls_multi::auth_token
char * auth_token
If server sends a generated auth-token, this is the token to use for future user/pass authentications...
Definition: ssl_common.h:644
M_INFO
#define M_INFO
Definition: errlevel.h:55
key_state::auth_token_state_flags
unsigned int auth_token_state_flags
The state of the auth-token sent from the client.
Definition: ssl_common.h:202
buf_read
static bool buf_read(struct buffer *src, void *dest, int size)
Definition: buffer.h:783
send_push_reply_auth_token
void send_push_reply_auth_token(struct tls_multi *multi)
Sends a push reply message only containin the auth-token to update the auth-token on the client.
Definition: push.c:755
gc_new
static struct gc_arena gc_new(void)
Definition: buffer.h:1030
hmac_ctx_t
mbedtls_md_context_t hmac_ctx_t
Generic HMAC context.
Definition: crypto_mbedtls.h:46
auth_token.h
verify_auth_token
unsigned int verify_auth_token(struct user_pass *up, struct tls_multi *multi, struct tls_session *session)
Verifies the auth token to be in the format that generate_auth_token create and checks if the token i...
Definition: auth_token.c:297
context_2::tls_multi
struct tls_multi * tls_multi
TLS state structure for this VPN tunnel.
Definition: openvpn.h:326
M_FATAL
#define M_FATAL
Definition: error.h:89
is_auth_token
static bool is_auth_token(const char *password)
Return if the password string has the format of a password.
Definition: auth_token.h:127
KS_PRIMARY
#define KS_PRIMARY
Primary key state index.
Definition: ssl_common.h:448
context
Contains all state information for one tunnel.
Definition: openvpn.h:476
resend_auth_token_renegotiation
void resend_auth_token_renegotiation(struct tls_multi *multi, struct tls_session *session)
Checks if a client should be sent a new auth token to update its current auth-token.
Definition: auth_token.c:462
tls_multi::session
struct tls_session session[TM_SIZE]
Array of tls_session objects representing control channel sessions with the remote peer.
Definition: ssl_common.h:675
add_session_token_env
void add_session_token_env(struct tls_session *session, struct tls_multi *multi, const struct user_pass *up)
Put the session id, and auth token status into the environment if auth-token is enabled.
Definition: auth_token.c:38
tls_options::auth_token_key
struct key_ctx auth_token_key
Definition: ssl_common.h:391
user_pass::username
char username[USER_PASS_LEN]
Definition: misc.h:71
alloc_buf_gc
struct buffer alloc_buf_gc(size_t size, struct gc_arena *gc)
Definition: buffer.c:88
session::key
char key[48]
Definition: keyingmaterialexporter.c:58
openvpn.h
openvpn_base64_encode
int openvpn_base64_encode(const void *data, int size, char **str)
Definition: base64.c:52
get_primary_key
static const struct key_state * get_primary_key(const struct tls_multi *multi)
gets an item of key_state objects in the order they should be scanned by data channel modules.
Definition: ssl_common.h:722
dmsg
#define dmsg(flags,...)
Definition: error.h:148
hmac_ctx_update
void hmac_ctx_update(hmac_ctx_t *ctx, const uint8_t *src, int src_len)
check_send_auth_token
void check_send_auth_token(struct context *c)
Checks if the timer to resend the auth-token has expired and if a new auth-token should be send to th...
Definition: auth_token.c:424
tls_multi
Security parameter state for a single VPN tunnel.
Definition: ssl_common.h:590
key_state
Security parameter state of one TLS and data channel key session.
Definition: ssl_common.h:198
key
Container for unidirectional cipher and HMAC key material.
Definition: crypto.h:149
tls_options::auth_token_generate
bool auth_token_generate
Generate auth-tokens on successful user/pass auth,seet via options->auth_token_generate.
Definition: ssl_common.h:384
check_hmac_token
static bool check_hmac_token(hmac_ctx_t *ctx, const uint8_t *b64decoded, const char *username)
Definition: auth_token.c:281
AUTH_TOKEN_VALID_EMPTYUSER
#define AUTH_TOKEN_VALID_EMPTYUSER
Auth-token is only valid for an empty username and not the username actually supplied from the client...
Definition: ssl_common.h:656
session_id
Definition: session_id.h:38
context::c2
struct context_2 c2
Level 2 context.
Definition: openvpn.h:517
TM_ACTIVE
#define TM_ACTIVE
Active tls_session.
Definition: ssl_common.h:529
string_alloc
char * string_alloc(const char *str, struct gc_arena *gc)
Definition: buffer.c:667
secure_memzero
static void secure_memzero(void *data, size_t len)
Securely zeroise memory.
Definition: buffer.h:414
AUTH_TOKEN_SESSION_ID_LEN
#define AUTH_TOKEN_SESSION_ID_LEN
Definition: auth_token.c:21
ssl_verify.h
ASSERT
#define ASSERT(x)
Definition: error.h:195
BLEN
#define BLEN(buf)
Definition: buffer.h:127
buf_write_u8
static bool buf_write_u8(struct buffer *dest, uint8_t data)
Definition: buffer.h:697
tls_session::key
struct key_state key[KS_SIZE]
Definition: ssl_common.h:509
tls_multi::opt
struct tls_options opt
Definition: ssl_common.h:596
init_key_ctx
void init_key_ctx(struct key_ctx *ctx, const struct key *key, const struct key_type *kt, int enc, const char *prefix)
Definition: crypto.c:824
push.h
M_WARN
#define M_WARN
Definition: error.h:91
key_ctx
Container for one set of cipher and/or HMAC contexts.
Definition: crypto.h:162
crypto.h
AUTH_TOKEN_SESSION_ID_BASE64_LEN
#define AUTH_TOKEN_SESSION_ID_BASE64_LEN
Definition: auth_token.c:22
base64.h
generate_ephemeral_key
bool generate_ephemeral_key(struct buffer *key, const char *key_name)
Generate ephermal key material into the key structure.
Definition: crypto.c:1738
hmac_ctx_final
void hmac_ctx_final(hmac_ctx_t *ctx, uint8_t *dst)
KS_AUTH_TRUE
@ KS_AUTH_TRUE
Key state is authenticated.
Definition: ssl_common.h:150
auth_token_init_secret
void auth_token_init_secret(struct key_ctx *key_ctx, const char *key_file, bool key_inline)
Loads an HMAC secret from a file or if no file is present generates a epheremal secret for the run ti...
Definition: auth_token.c:124
buffer
Wrapper structure for dynamically allocated memory.
Definition: buffer.h:60
ntohll
#define ntohll(x)
Definition: integer.h:35
hmac_ctx_reset
void hmac_ctx_reset(hmac_ctx_t *ctx)
rand_bytes
int rand_bytes(uint8_t *output, int len)
Wrapper for secure random number generator.
Definition: crypto_openssl.c:592
auth_token_kt
static struct key_type auth_token_kt(void)
Definition: auth_token.c:32
key_type
Definition: crypto.h:139
buf_write
static bool buf_write(struct buffer *dest, const void *src, size_t size)
Definition: buffer.h:673
auth_token_write_server_key_file
void auth_token_write_server_key_file(const char *filename)
Generate a auth-token server secret key, and write to file.
Definition: auth_token.c:118
ssl.h
tls_session
Security parameter state of a single session within a VPN tunnel.
Definition: ssl_common.h:471
generate_auth_token
void generate_auth_token(const struct user_pass *up, struct tls_multi *multi)
Generate an auth token based on username and timestamp.
Definition: auth_token.c:161
buffer.h
syshead.h
BPTR
#define BPTR(buf)
Definition: buffer.h:124
create_kt
static struct key_type create_kt(const char *cipher, const char *md, const char *optname)
Creates and validates an instance of struct key_type with the provided algs.
Definition: crypto.h:576
auth_token_pem_name
const char * auth_token_pem_name
Definition: auth_token.c:19
gc_arena
Garbage collection arena used to keep track of dynamically allocated memory.
Definition: buffer.h:116
setenv_str
void setenv_str(struct env_set *es, const char *name, const char *value)
Definition: env_set.c:283
strncpynt
static void strncpynt(char *dest, const char *src, size_t maxlen)
Definition: buffer.h:361
tls_options::auth_token_lifetime
unsigned int auth_token_lifetime
Definition: ssl_common.h:388
free_buf
void free_buf(struct buffer *buf)
Definition: buffer.c:183
memcmp_constant_time
int memcmp_constant_time(const void *a, const void *b, size_t size)
As memcmp(), but constant-time.
Definition: crypto_openssl.c:1345
AUTH_TOKEN_HMAC_OK
#define AUTH_TOKEN_HMAC_OK
Auth-token sent from client has valid hmac.
Definition: ssl_common.h:652
write_pem_key_file
void write_pem_key_file(const char *filename, const char *pem_name)
Generate a server key with enough randomness to fill a key struct and write to file.
Definition: crypto.c:1700
AUTH_TOKEN_EXPIRED
#define AUTH_TOKEN_EXPIRED
Auth-token sent from client has expired.
Definition: ssl_common.h:654
htonll
#define htonll(x)
Definition: integer.h:30
auth_set_client_reason
void auth_set_client_reason(struct tls_multi *multi, const char *client_reason)
Sets the reason why authentication of a client failed.
Definition: ssl_verify.c:817
gc_free
static void gc_free(struct gc_arena *a)
Definition: buffer.h:1038
USER_PASS_LEN
#define USER_PASS_LEN
Definition: misc.h:68
now
time_t now
Definition: otime.c:34
wipe_auth_token
void wipe_auth_token(struct tls_multi *multi)
Wipes the authentication token out of the memory, frees and cleans up related buffers and flags.
Definition: auth_token.c:403
config.h
TOKEN_DATA_LEN
#define TOKEN_DATA_LEN
Definition: auth_token.c:29
ssl_common.h
read_pem_key_file
bool read_pem_key_file(struct buffer *key, const char *pem_name, const char *key_file, bool key_inline)
Read key material from a PEM encoded files into the key structure.
Definition: crypto.c:1756
D_SHOW_KEYS
#define D_SHOW_KEYS
Definition: errlevel.h:121
user_pass::password
char password[USER_PASS_LEN]
Definition: misc.h:72
session
Definition: keyingmaterialexporter.c:56
key_ctx::hmac
hmac_ctx_t * hmac
Generic HMAC context.
Definition: crypto.h:165
tls_multi::locked_username
char * locked_username
Definition: ssl_common.h:624
tls_multi::auth_token_initial
char * auth_token_initial
The first auth-token we sent to a client.
Definition: ssl_common.h:648
user_pass
Definition: misc.h:56
alloc_buf
struct buffer alloc_buf(size_t size)
Definition: buffer.c:62
msg
#define msg(flags,...)
Definition: error.h:144
integer.h
hmac_ctx_size
int hmac_ctx_size(hmac_ctx_t *ctx)