OpenVPN
ssl_pkt.c
Go to the documentation of this file.
1 /*
2  * OpenVPN -- An application to securely tunnel IP networks
3  * over a single TCP/UDP port, with support for SSL/TLS-based
4  * session authentication and key exchange,
5  * packet encryption, packet authentication, and
6  * packet compression.
7  *
8  * Copyright (C) 2002-2021 OpenVPN Inc <sales@openvpn.net>
9  *
10  * This program is free software; you can redistribute it and/or modify
11  * it under the terms of the GNU General Public License version 2
12  * as published by the Free Software Foundation.
13  *
14  * This program is distributed in the hope that it will be useful,
15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17  * GNU General Public License for more details.
18  *
19  * You should have received a copy of the GNU General Public License along
20  * with this program; if not, write to the Free Software Foundation, Inc.,
21  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
22  */
23 #ifdef HAVE_CONFIG_H
24 #include "config.h"
25 #elif defined(_MSC_VER)
26 #include "config-msvc.h"
27 #endif
28 
29 #include "syshead.h"
30 
31 #include "ssl_util.h"
32 #include "ssl_pkt.h"
33 #include "ssl_common.h"
34 #include "crypto.h"
35 #include "session_id.h"
36 #include "reliable.h"
37 #include "tls_crypt.h"
38 
39 /*
40  * Dependent on hmac size, opcode size, and session_id size.
41  * Will assert if too small.
42  */
43 #define SWAP_BUF_SIZE 256
44 
62 static bool
63 swap_hmac(struct buffer *buf, const struct crypto_options *co, bool incoming)
64 {
65  ASSERT(co);
66 
67  const struct key_ctx *ctx = (incoming ? &co->key_ctx_bi.decrypt :
68  &co->key_ctx_bi.encrypt);
69  ASSERT(ctx->hmac);
70 
71  {
72  /* hmac + packet_id (8 bytes) */
73  const int hmac_size = hmac_ctx_size(ctx->hmac) + packet_id_size(true);
74 
75  /* opcode (1 byte) + session_id (8 bytes) */
76  const int osid_size = 1 + SID_SIZE;
77 
78  int e1, e2;
79  uint8_t *b = BPTR(buf);
80  uint8_t buf1[SWAP_BUF_SIZE];
81  uint8_t buf2[SWAP_BUF_SIZE];
82 
83  if (incoming)
84  {
85  e1 = osid_size;
86  e2 = hmac_size;
87  }
88  else
89  {
90  e1 = hmac_size;
91  e2 = osid_size;
92  }
93 
94  ASSERT(e1 <= SWAP_BUF_SIZE && e2 <= SWAP_BUF_SIZE);
95 
96  if (buf->len >= e1 + e2)
97  {
98  memcpy(buf1, b, e1);
99  memcpy(buf2, b + e1, e2);
100  memcpy(b, buf2, e2);
101  memcpy(b + e2, buf1, e1);
102  return true;
103  }
104  else
105  {
106  return false;
107  }
108  }
109 }
110 
111 #undef SWAP_BUF_SIZE
112 
122 static void
123 tls_wrap_control(struct tls_wrap_ctx *ctx, uint8_t header, struct buffer *buf,
124  struct session_id *session_id)
125 {
126  if (ctx->mode == TLS_WRAP_AUTH
127  || ctx->mode == TLS_WRAP_NONE)
128  {
130  ASSERT(buf_write_prepend(buf, &header, sizeof(header)));
131  }
132  if (ctx->mode == TLS_WRAP_AUTH)
133  {
134  struct buffer null = clear_buf();
135 
136  /* no encryption, only write hmac */
137  openvpn_encrypt(buf, null, &ctx->opt);
138  ASSERT(swap_hmac(buf, &ctx->opt, false));
139  }
140  else if (ctx->mode == TLS_WRAP_CRYPT)
141  {
142  ASSERT(buf_init(&ctx->work, buf->offset));
143  ASSERT(buf_write(&ctx->work, &header, sizeof(header)));
145  if (!tls_crypt_wrap(buf, &ctx->work, &ctx->opt))
146  {
147  buf->len = 0;
148  return;
149  }
150 
152  || (header >> P_OPCODE_SHIFT) == P_CONTROL_WKC_V1)
153  {
154  if (!buf_copy(&ctx->work,
155  ctx->tls_crypt_v2_wkc))
156  {
157  msg(D_TLS_ERRORS, "Could not append tls-crypt-v2 client key");
158  buf->len = 0;
159  return;
160  }
161  }
162 
163  /* Don't change the original data in buf, it's used by the reliability
164  * layer to resend on failure. */
165  *buf = ctx->work;
166  }
167 }
168 
169 void
171  struct key_state *ks,
172  struct buffer *buf,
173  struct link_socket_actual **to_link_addr,
174  int opcode,
175  int max_ack,
176  bool prepend_ack)
177 {
178  uint8_t header = ks->key_id | (opcode << P_OPCODE_SHIFT);
179 
182  (ks->rec_ack, buf, &ks->session_id_remote, max_ack, prepend_ack));
183 
184  msg(D_TLS_DEBUG, "%s(): %s", __func__, packet_opcode_name(opcode));
185 
186  tls_wrap_control(&session->tls_wrap, header, buf, &session->session_id);
187 
188  *to_link_addr = &ks->remote_addr;
189 }
190 
191 bool
193  struct tls_wrap_ctx *ctx,
194  const struct link_socket_actual *from,
195  const struct tls_options *opt)
196 {
197  struct gc_arena gc = gc_new();
198  bool ret = false;
199 
200  const uint8_t opcode = *(BPTR(buf)) >> P_OPCODE_SHIFT;
201  if ((opcode == P_CONTROL_HARD_RESET_CLIENT_V3
202  || opcode == P_CONTROL_WKC_V1)
203  && !tls_crypt_v2_extract_client_key(buf, ctx, opt))
204  {
206  "TLS Error: can not extract tls-crypt-v2 client key from %s",
207  print_link_socket_actual(from, &gc));
208  goto cleanup;
209  }
210 
211  if (ctx->mode == TLS_WRAP_AUTH)
212  {
213  struct buffer null = clear_buf();
214 
215  /* move the hmac record to the front of the packet */
216  if (!swap_hmac(buf, &ctx->opt, true))
217  {
219  "TLS Error: cannot locate HMAC in incoming packet from %s",
220  print_link_socket_actual(from, &gc));
221  gc_free(&gc);
222  return false;
223  }
224 
225  /* authenticate only (no decrypt) and remove the hmac record
226  * from the head of the buffer */
227  openvpn_decrypt(buf, null, &ctx->opt, NULL, BPTR(buf));
228  if (!buf->len)
229  {
231  "TLS Error: incoming packet authentication failed from %s",
232  print_link_socket_actual(from, &gc));
233  goto cleanup;
234  }
235 
236  }
237  else if (ctx->mode == TLS_WRAP_CRYPT)
238  {
239  struct buffer tmp = alloc_buf_gc(buf_forward_capacity_total(buf), &gc);
240  if (!tls_crypt_unwrap(buf, &tmp, &ctx->opt))
241  {
242  msg(D_TLS_ERRORS, "TLS Error: tls-crypt unwrapping failed from %s",
243  print_link_socket_actual(from, &gc));
244  goto cleanup;
245  }
246  ASSERT(buf_init(buf, buf->offset));
247  ASSERT(buf_copy(buf, &tmp));
248  buf_clear(&tmp);
249  }
250  else if (ctx->tls_crypt_v2_server_key.cipher)
251  {
252  /* If tls-crypt-v2 is enabled, require *some* wrapping */
253  msg(D_TLS_ERRORS, "TLS Error: could not determine wrapping from %s",
254  print_link_socket_actual(from, &gc));
255  /* TODO Do we want to support using tls-crypt-v2 and no control channel
256  * wrapping at all simultaneously? That would allow server admins to
257  * upgrade clients one-by-one without running a second instance, but we
258  * should not enable it by default because it breaks DoS-protection.
259  * So, add something like --tls-crypt-v2-allow-insecure-fallback ? */
260  goto cleanup;
261  }
262 
263  if (ctx->mode == TLS_WRAP_NONE || ctx->mode == TLS_WRAP_AUTH)
264  {
265  /* advance buffer pointer past opcode & session_id since our caller
266  * already read it */
267  buf_advance(buf, SID_SIZE + 1);
268  }
269 
270  ret = true;
271 cleanup:
272  gc_free(&gc);
273  return ret;
274 }
275 
276 void
278 {
279  free_buf(&state->newbuf);
281  if (state->tls_wrap_tmp.cleanup_key_ctx)
282  {
284  }
285 }
286 
287 /*
288  * This function is similar to tls_pre_decrypt, except it is called
289  * when we are in server mode and receive an initial incoming
290  * packet. Note that we don't modify
291  * any state in our parameter objects. The purpose is solely to
292  * determine whether we should generate a client instance
293  * object, in which case true is returned.
294  *
295  * This function is essentially the first-line HMAC firewall
296  * on the UDP port listener in --mode server mode.
297  */
300  struct tls_pre_decrypt_state *state,
301  const struct link_socket_actual *from,
302  const struct buffer *buf)
303 {
304  struct gc_arena gc = gc_new();
305  /* A packet needs to have at least an opcode and session id */
306  if (buf->len < (1 + SID_SIZE))
307  {
309  "TLS State Error: Too short packet (length %d) received from %s",
310  buf->len, print_link_socket_actual(from, &gc));
311  goto error;
312  }
313 
314  /* get opcode and key ID */
315  uint8_t pkt_firstbyte = *BPTR(buf);
316  int op = pkt_firstbyte >> P_OPCODE_SHIFT;
317  int key_id = pkt_firstbyte & P_KEY_ID_MASK;
318 
319  /* this packet is from an as-yet untrusted source, so
320  * scrutinize carefully */
321 
322  /* Allow only the reset packet or the first packet of the actual handshake. */
325  && op != P_CONTROL_V1
326  && op != P_CONTROL_WKC_V1
327  && op != P_ACK_V1)
328  {
329  /*
330  * This can occur due to bogus data or DoS packets.
331  */
333  "TLS State Error: No TLS state for client %s, opcode=%d",
334  print_link_socket_actual(from, &gc),
335  op);
336  goto error;
337  }
338 
339  if (key_id != 0)
340  {
342  "TLS State Error: Unknown key ID (%d) received from %s -- 0 was expected",
343  key_id,
344  print_link_socket_actual(from, &gc));
345  goto error;
346  }
347 
348  /* read peer session id, we do this at this point since
349  * read_control_auth will skip over it */
350  struct buffer tmp = *buf;
351  buf_advance(&tmp, 1);
352  if (!session_id_read(&state->peer_session_id, &tmp)
353  || !session_id_defined(&state->peer_session_id))
354  {
356  "TLS Error: session-id not found in packet from %s",
357  print_link_socket_actual(from, &gc));
358  goto error;
359  }
360 
361  state->newbuf = clone_buf(buf);
362  state->tls_wrap_tmp = tas->tls_wrap;
363 
364  /* HMAC test and unwrapping the encrypted part of the control message
365  * into newbuf or just setting newbuf to point to the start of control
366  * message */
367  bool status = read_control_auth(&state->newbuf, &state->tls_wrap_tmp,
368  from, NULL);
369 
370  if (!status)
371  {
372  goto error;
373  }
374 
375  /*
376  * At this point, if --tls-auth is being used, we know that
377  * the packet has passed the HMAC test, but we don't know if
378  * it is a replay yet. We will attempt to defeat replays
379  * by not advancing to the S_START state until we
380  * receive an ACK from our first reply to the client
381  * that includes an HMAC of our randomly generated 64 bit
382  * session ID.
383  *
384  * On the other hand if --tls-auth is not being used, we
385  * will proceed to begin the TLS authentication
386  * handshake with only cursory integrity checks having
387  * been performed, since we will be leaving the task
388  * of authentication solely up to TLS.
389  */
390  gc_free(&gc);
391  if (op == P_CONTROL_V1)
392  {
394  }
395  else if (op == P_ACK_V1)
396  {
397  return VERDICT_VALID_ACK_V1;
398  }
399  else if (op == P_CONTROL_HARD_RESET_CLIENT_V3)
400  {
401  return VERDICT_VALID_RESET_V3;
402  }
403  else if (op == P_CONTROL_WKC_V1)
404  {
405  return VERDICT_VALID_WKC_V1;
406  }
407  else
408  {
409  return VERDICT_VALID_RESET_V2;
410  }
411 
412 error:
413  tls_clear_error();
414  gc_free(&gc);
415  return VERDICT_INVALID;
416 }
417 
418 
419 struct buffer
421  struct tls_auth_standalone *tas,
422  struct session_id *own_sid,
423  struct session_id *remote_sid,
424  uint8_t header,
425  bool request_resend_wkc)
426 {
427  struct buffer buf = alloc_buf(tas->frame.buf.payload_size);
428  ASSERT(buf_init(&buf, tas->frame.buf.headroom));
429 
430  /* Reliable ACK structure */
431  /* Length of the ACK structure - 1 ACK */
432  buf_write_u8(&buf, 1);
433 
434  /* ACKed packet - first packet's id is always 0 */
435  buf_write_u32(&buf, 0);
436 
437  /* Remote session id */
438  buf_write(&buf, remote_sid->id, SID_SIZE);
439 
440  /* Packet ID of our own packet: Our reset packet is always using
441  * packet id 0 since it is the first packet */
442  packet_id_type net_pid = htonpid(0);
443 
444  ASSERT(buf_write(&buf, &net_pid, sizeof(net_pid)));
445 
446  /* Add indication for tls-crypt-v2 to resend the WKc with the reply */
447  if (request_resend_wkc)
448  {
449  buf_write_u16(&buf, TLV_TYPE_EARLY_NEG_FLAGS); /* TYPE: flags */
450  buf_write_u16(&buf, sizeof(uint16_t));
452  }
453 
454  /* Add tls-auth/tls-crypt wrapping, this might replace buf */
455  tls_wrap_control(ctx, header, &buf, own_sid);
456 
457  return buf;
458 }
459 
460 hmac_ctx_t *
462 {
463  /* We assume that SHA256 is always available */
464  ASSERT(md_valid("SHA256"));
465  hmac_ctx_t *hmac_ctx = hmac_ctx_new();
466 
467  uint8_t key[SHA256_DIGEST_LENGTH];
468  ASSERT(rand_bytes(key, sizeof(key)));
469 
470  hmac_ctx_init(hmac_ctx, key, "SHA256");
471  return hmac_ctx;
472 }
473 
474 struct session_id
476  const struct openvpn_sockaddr *from,
477  hmac_ctx_t *hmac,
478  int handwindow, int offset)
479 {
480  union {
481  uint8_t hmac_result[SHA256_DIGEST_LENGTH];
482  struct session_id sid;
483  } result;
484 
485  /* Get the valid time quantisation for our hmac,
486  * we divide time by handwindow/2 and allow the previous
487  * and future session time if specified by offset */
488  uint32_t session_id_time = now/((handwindow+1)/2) + offset;
489 
490  hmac_ctx_reset(hmac);
491  /* We do not care about endian here since it does not need to be
492  * portable */
493  hmac_ctx_update(hmac, (const uint8_t *) &session_id_time,
494  sizeof(session_id_time));
495 
496  /* add client IP and port */
497  switch (af_addr_size(from->addr.sa.sa_family))
498  {
499  case AF_INET:
500  hmac_ctx_update(hmac, (const uint8_t *) &from->addr.in4, sizeof(struct sockaddr_in));
501  break;
502 
503  case AF_INET6:
504  hmac_ctx_update(hmac, (const uint8_t *) &from->addr.in6, sizeof(struct sockaddr_in6));
505  break;
506  }
507 
508  /* add session id of client */
509  hmac_ctx_update(hmac, client_sid.id, SID_SIZE);
510 
511  hmac_ctx_final(hmac, result.hmac_result);
512 
513  return result.sid;
514 }
515 
516 bool
518  const struct openvpn_sockaddr *from,
519  hmac_ctx_t *hmac,
520  int handwindow)
521 {
522  if (!from)
523  {
524  return false;
525  }
526 
527  struct buffer buf = state->newbuf;
528  struct reliable_ack ack;
529 
530  if (!reliable_ack_parse(&buf, &ack, &state->server_session_id))
531  {
532  return false;
533  }
534 
535  /* check adjacent timestamps too */
536  for (int offset = -2; offset <= 1; offset++)
537  {
538  struct session_id expected_id =
539  calculate_session_id_hmac(state->peer_session_id, from, hmac, handwindow, offset);
540 
541  if (memcmp_constant_time(&expected_id, &state->server_session_id, SID_SIZE))
542  {
543  return true;
544  }
545  }
546  return false;
547 }
VERDICT_VALID_RESET_V2
@ VERDICT_VALID_RESET_V2
This packet is a valid reset packet from the peer (all but tls-crypt-v2)
Definition: ssl_pkt.h:85
D_TLS_DEBUG
#define D_TLS_DEBUG
Definition: errlevel.h:162
D_TLS_STATE_ERRORS
#define D_TLS_STATE_ERRORS
Definition: errlevel.h:133
SWAP_BUF_SIZE
#define SWAP_BUF_SIZE
Definition: ssl_pkt.c:43
P_KEY_ID_MASK
#define P_KEY_ID_MASK
Definition: ssl_pkt.h:38
VERDICT_INVALID
@ VERDICT_INVALID
the packet failed on of the various checks
Definition: ssl_pkt.h:96
gc_new
static struct gc_arena gc_new(void)
Definition: buffer.h:998
hmac_ctx_t
mbedtls_md_context_t hmac_ctx_t
Generic HMAC context.
Definition: crypto_mbedtls.h:46
buf_forward_capacity_total
static int buf_forward_capacity_total(const struct buffer *buf)
Definition: buffer.h:564
buffer::len
int len
Length in bytes of the actual content within the allocated memory.
Definition: buffer.h:66
P_CONTROL_HARD_RESET_CLIENT_V2
#define P_CONTROL_HARD_RESET_CLIENT_V2
Definition: ssl_pkt.h:51
tls_wrap_ctx::tls_crypt_v2_wkc
const struct buffer * tls_crypt_v2_wkc
Wrapped client key, sent to server.
Definition: ssl_common.h:257
key_state::rec_ack
struct reliable_ack * rec_ack
Definition: ssl_common.h:222
buf_init
#define buf_init(buf, offset)
Definition: buffer.h:196
tls_crypt_unwrap
bool tls_crypt_unwrap(const struct buffer *src, struct buffer *dst, struct crypto_options *opt)
Unwrap a control channel packet (decrypts, authenticates and performs replay checks).
Definition: tls_crypt.c:155
buf_write_u32
static bool buf_write_u32(struct buffer *dest, uint32_t data)
Definition: buffer.h:710
first_packet_verdict
first_packet_verdict
Definition: ssl_pkt.h:83
tls_wrap_ctx::mode
enum tls_wrap_ctx::@14 mode
Control channel wrapping mode.
tls_reset_standalone
struct buffer tls_reset_standalone(struct tls_wrap_ctx *ctx, struct tls_auth_standalone *tas, struct session_id *own_sid, struct session_id *remote_sid, uint8_t header, bool request_resend_wkc)
This function creates a reset packet using the information from the tls pre decrypt state.
Definition: ssl_pkt.c:420
tls_pre_decrypt_lite
enum first_packet_verdict tls_pre_decrypt_lite(const struct tls_auth_standalone *tas, struct tls_pre_decrypt_state *state, const struct link_socket_actual *from, const struct buffer *buf)
Inspect an incoming packet for which no VPN tunnel is active, and determine whether a new VPN tunnel ...
Definition: ssl_pkt.c:299
alloc_buf_gc
struct buffer alloc_buf_gc(size_t size, struct gc_arena *gc)
Definition: buffer.c:90
config-msvc.h
key_ctx::cipher
cipher_ctx_t * cipher
Generic cipher context.
Definition: crypto.h:164
P_CONTROL_WKC_V1
#define P_CONTROL_WKC_V1
Definition: ssl_pkt.h:59
session_id_hmac_init
hmac_ctx_t * session_id_hmac_init(void)
Definition: ssl_pkt.c:461
session_id_write
static bool session_id_write(const struct session_id *sid, struct buffer *buf)
Definition: session_id.h:73
VERDICT_VALID_CONTROL_V1
@ VERDICT_VALID_CONTROL_V1
This packet is a valid control packet from the peer.
Definition: ssl_pkt.h:89
buf_clear
void buf_clear(struct buffer *buf)
Definition: buffer.c:164
free_tls_pre_decrypt_state
void free_tls_pre_decrypt_state(struct tls_pre_decrypt_state *state)
Definition: ssl_pkt.c:277
frame::buf
struct frame::@5 buf
key_ctx_bi::encrypt
struct key_ctx encrypt
Cipher and/or HMAC contexts for sending direction.
Definition: crypto.h:219
dmsg
#define dmsg(flags,...)
Definition: error.h:154
swap_hmac
static bool swap_hmac(struct buffer *buf, const struct crypto_options *co, bool incoming)
Move a packet authentication HMAC + related fields to or from the front of the buffer so it can be pr...
Definition: ssl_pkt.c:63
buf_copy
static bool buf_copy(struct buffer *dest, const struct buffer *src)
Definition: buffer.h:717
openvpn_sockaddr
Definition: socket.h:64
hmac_ctx_update
void hmac_ctx_update(hmac_ctx_t *ctx, const uint8_t *src, int src_len)
clear_buf
static struct buffer clear_buf(void)
Return an empty struct buffer.
Definition: buffer.h:209
reliable_ack_parse
bool reliable_ack_parse(struct buffer *buf, struct reliable_ack *ack, struct session_id *session_id_remote)
Parse an acknowledgment record from a received packet.
Definition: reliable.c:182
session_id.h
P_OPCODE_SHIFT
#define P_OPCODE_SHIFT
Definition: ssl_pkt.h:39
clone_buf
struct buffer clone_buf(const struct buffer *buf)
Definition: buffer.c:117
tls_crypt.h
read_control_auth
bool read_control_auth(struct buffer *buf, struct tls_wrap_ctx *ctx, const struct link_socket_actual *from, const struct tls_options *opt)
Definition: ssl_pkt.c:192
tls_pre_decrypt_state::server_session_id
struct session_id server_session_id
Definition: ssl_pkt.h:107
key_state
Security parameter state of one TLS and data channel key session.
Definition: ssl_common.h:188
key
Container for unidirectional cipher and HMAC key material.
Definition: crypto.h:149
tls_pre_decrypt_state::tls_wrap_tmp
struct tls_wrap_ctx tls_wrap_tmp
Definition: ssl_pkt.h:104
EARLY_NEG_FLAG_RESEND_WKC
#define EARLY_NEG_FLAG_RESEND_WKC
Definition: ssl_pkt.h:290
session_id
Definition: session_id.h:38
tls_auth_standalone::frame
struct frame frame
Definition: ssl_pkt.h:80
ssl_util.h
free_key_ctx_bi
void free_key_ctx_bi(struct key_ctx_bi *ctx)
Definition: crypto.c:907
tls_wrap_ctx::opt
struct crypto_options opt
Crypto state.
Definition: ssl_common.h:254
reliable.h
htonpid
#define htonpid(x)
Definition: packet_id.h:56
P_CONTROL_HARD_RESET_CLIENT_V3
#define P_CONTROL_HARD_RESET_CLIENT_V3
Definition: ssl_pkt.h:55
link_socket_actual_defined
static bool link_socket_actual_defined(const struct link_socket_actual *act)
Definition: socket.h:711
ASSERT
#define ASSERT(x)
Definition: error.h:201
tls_wrap_ctx::tls_crypt_v2_server_key
struct key_ctx tls_crypt_v2_server_key
Decrypts client keys.
Definition: ssl_common.h:256
tls_pre_decrypt_state::peer_session_id
struct session_id peer_session_id
Definition: ssl_pkt.h:106
buf_advance
static bool buf_advance(struct buffer *buf, int size)
Definition: buffer.h:623
buf_write_u16
static bool buf_write_u16(struct buffer *dest, uint16_t data)
Definition: buffer.h:703
tls_options
Definition: ssl_common.h:268
SID_SIZE
#define SID_SIZE
Definition: session_id.h:45
buf_write_prepend
static bool buf_write_prepend(struct buffer *dest, const void *src, int size)
Definition: buffer.h:685
buf_write_u8
static bool buf_write_u8(struct buffer *dest, uint8_t data)
Definition: buffer.h:697
tls_pre_decrypt_state::newbuf
struct buffer newbuf
Definition: ssl_pkt.h:105
frame::payload_size
int payload_size
the maximum size that a payload that our buffers can hold from either tun device or network link.
Definition: mtu.h:97
tls_wrap_ctx
Control channel wrapping (–tls-auth/–tls-crypt) context.
Definition: ssl_common.h:247
key_state::remote_addr
struct link_socket_actual remote_addr
Definition: ssl_common.h:210
reliable_ack_write
bool reliable_ack_write(struct reliable_ack *ack, struct buffer *buf, const struct session_id *sid, int max, bool prepend)
Write a packet ID acknowledgment record to a buffer.
Definition: reliable.c:219
tls_wrap_ctx::work
struct buffer work
Work buffer (only for –tls-crypt)
Definition: ssl_common.h:255
session_id_read
static bool session_id_read(struct session_id *sid, struct buffer *buf)
Definition: session_id.h:61
openvpn_encrypt
void openvpn_encrypt(struct buffer *buf, struct buffer work, struct crypto_options *opt)
Encrypt and HMAC sign a packet so that it can be sent as a data channel VPN tunnel packet to a remote...
Definition: crypto.c:296
tls_pre_decrypt_state
struct that stores the temporary data for the tls lite decrypt functions
Definition: ssl_pkt.h:103
tls_crypt_wrap
bool tls_crypt_wrap(const struct buffer *src, struct buffer *dst, struct crypto_options *opt)
Wrap a control channel packet (both authenticates and encrypts the data).
Definition: tls_crypt.c:78
key_ctx
Container for one set of cipher and/or HMAC contexts.
Definition: crypto.h:162
tls_wrap_ctx::tls_crypt_v2_metadata
struct buffer tls_crypt_v2_metadata
Received from client.
Definition: ssl_common.h:259
write_control_auth
void write_control_auth(struct tls_session *session, struct key_state *ks, struct buffer *buf, struct link_socket_actual **to_link_addr, int opcode, int max_ack, bool prepend_ack)
Definition: ssl_pkt.c:170
crypto.h
key_state::session_id_remote
struct session_id session_id_remote
Definition: ssl_common.h:209
openvpn_decrypt
bool openvpn_decrypt(struct buffer *buf, struct buffer work, struct crypto_options *opt, const struct frame *frame, const uint8_t *ad_start)
HMAC verify and decrypt a data channel packet received from a remote OpenVPN peer.
Definition: crypto.c:646
hmac_ctx_final
void hmac_ctx_final(hmac_ctx_t *ctx, uint8_t *dst)
packet_id_type
uint32_t packet_id_type
Definition: packet_id.h:44
buffer
Wrapper structure for dynamically allocated memory.
Definition: buffer.h:60
calculate_session_id_hmac
struct session_id calculate_session_id_hmac(struct session_id client_sid, const struct openvpn_sockaddr *from, hmac_ctx_t *hmac, int handwindow, int offset)
Calculates the HMAC based server session id based on a client session id and socket addr.
Definition: ssl_pkt.c:475
hmac_ctx_reset
void hmac_ctx_reset(hmac_ctx_t *ctx)
rand_bytes
int rand_bytes(uint8_t *output, int len)
Wrapper for secure random number generator.
Definition: crypto_openssl.c:556
D_TLS_ERRORS
#define D_TLS_ERRORS
Definition: errlevel.h:59
buf_write
static bool buf_write(struct buffer *dest, const void *src, size_t size)
Definition: buffer.h:673
tls_session
Security parameter state of a single session within a VPN tunnel.
Definition: ssl_common.h:439
syshead.h
BPTR
#define BPTR(buf)
Definition: buffer.h:124
session_id::id
uint8_t id[8]
Definition: session_id.h:40
session_id_defined
static bool session_id_defined(const struct session_id *sid1)
Definition: session_id.h:55
gc_arena
Garbage collection arena used to keep track of dynamically allocated memory.
Definition: buffer.h:116
key_state::key_id
int key_id
Key id for this key_state, inherited from struct tls_session.
Definition: ssl_common.h:198
buffer::offset
int offset
Offset in bytes of the actual content within the allocated memory.
Definition: buffer.h:64
tls_wrap_control
static void tls_wrap_control(struct tls_wrap_ctx *ctx, uint8_t header, struct buffer *buf, struct session_id *session_id)
Wraps a TLS control packet by adding tls-auth HMAC or tls-crypt(-v2) encryption and opcode header inc...
Definition: ssl_pkt.c:123
tls_auth_standalone::tls_wrap
struct tls_wrap_ctx tls_wrap
Definition: ssl_pkt.h:79
free_buf
void free_buf(struct buffer *buf)
Definition: buffer.c:185
memcmp_constant_time
int memcmp_constant_time(const void *a, const void *b, size_t size)
As memcmp(), but constant-time.
Definition: crypto_openssl.c:1357
SHA256_DIGEST_LENGTH
#define SHA256_DIGEST_LENGTH
Definition: crypto_mbedtls.h:75
ssl_pkt.h
tls_crypt_v2_extract_client_key
bool tls_crypt_v2_extract_client_key(struct buffer *buf, struct tls_wrap_ctx *ctx, const struct tls_options *opt)
Extract a tls-crypt-v2 client key from a P_CONTROL_HARD_RESET_CLIENT_V3 message, and load the key int...
Definition: tls_crypt.c:542
status
static SERVICE_STATUS status
Definition: interactive.c:56
packet_id_size
static int packet_id_size(bool long_form)
Definition: packet_id.h:310
print_link_socket_actual
const char * print_link_socket_actual(const struct link_socket_actual *act, struct gc_arena *gc)
Definition: socket.c:2763
gc_free
static void gc_free(struct gc_arena *a)
Definition: buffer.h:1006
session_id_write_prepend
static bool session_id_write_prepend(const struct session_id *sid, struct buffer *buf)
Definition: session_id.h:67
P_ACK_V1
#define P_ACK_V1
Definition: ssl_pkt.h:46
VERDICT_VALID_RESET_V3
@ VERDICT_VALID_RESET_V3
This is a valid v3 reset (tls-crypt-v2)
Definition: ssl_pkt.h:87
crypto_options::key_ctx_bi
struct key_ctx_bi key_ctx_bi
OpenSSL cipher and HMAC contexts for both sending and receiving directions.
Definition: crypto.h:232
now
time_t now
Definition: otime.c:36
check_session_id_hmac
bool check_session_id_hmac(struct tls_pre_decrypt_state *state, const struct openvpn_sockaddr *from, hmac_ctx_t *hmac, int handwindow)
Checks if a control packet has a correct HMAC server session id.
Definition: ssl_pkt.c:517
P_CONTROL_V1
#define P_CONTROL_V1
Definition: ssl_pkt.h:45
config.h
hmac_ctx_new
hmac_ctx_t * hmac_ctx_new(void)
Definition: crypto_openssl.c:1198
ssl_common.h
hmac_ctx_init
void hmac_ctx_init(hmac_ctx_t *ctx, const uint8_t *key, const char *mdname)
session
Definition: keyingmaterialexporter.c:56
md_valid
bool md_valid(const char *digest)
Return if a message digest parameters is valid given the name of the digest.
Definition: crypto_openssl.c:1050
key_ctx::hmac
hmac_ctx_t * hmac
Generic HMAC context.
Definition: crypto.h:165
VERDICT_VALID_ACK_V1
@ VERDICT_VALID_ACK_V1
This packet is a valid ACK control packet from the peer, i.e.
Definition: ssl_pkt.h:92
alloc_buf
struct buffer alloc_buf(size_t size)
Definition: buffer.c:64
af_addr_size
static int af_addr_size(sa_family_t af)
Definition: socket.h:879
reliable_ack
The acknowledgment structure in which packet IDs are stored for later acknowledgment.
Definition: reliable.h:61
VERDICT_VALID_WKC_V1
@ VERDICT_VALID_WKC_V1
The packet is a valid control packet with appended wrapped client key.
Definition: ssl_pkt.h:94
msg
#define msg(flags,...)
Definition: error.h:150
tls_clear_error
void tls_clear_error(void)
Clear the underlying SSL library's error state.
key_ctx_bi::decrypt
struct key_ctx decrypt
cipher and/or HMAC contexts for receiving direction.
Definition: crypto.h:221
tls_wrap_ctx::cleanup_key_ctx
bool cleanup_key_ctx
opt.key_ctx_bi is owned by this context
Definition: ssl_common.h:260
frame::headroom
int headroom
the headroom in the buffer, this is choosen to allow all potential header to be added before the pack...
Definition: mtu.h:103
hmac_ctx_size
int hmac_ctx_size(hmac_ctx_t *ctx)
crypto_options
Security parameter state for processing data channel packets.
Definition: crypto.h:230
packet_opcode_name
static const char * packet_opcode_name(int op)
Definition: ssl_pkt.h:234
tls_auth_standalone
Definition: ssl_pkt.h:77
TLV_TYPE_EARLY_NEG_FLAGS
#define TLV_TYPE_EARLY_NEG_FLAGS
Definition: ssl_pkt.h:289