OpenVPN
ssl_pkt.c
Go to the documentation of this file.
1 /*
2  * OpenVPN -- An application to securely tunnel IP networks
3  * over a single TCP/UDP port, with support for SSL/TLS-based
4  * session authentication and key exchange,
5  * packet encryption, packet authentication, and
6  * packet compression.
7  *
8  * Copyright (C) 2002-2021 OpenVPN Inc <sales@openvpn.net>
9  *
10  * This program is free software; you can redistribute it and/or modify
11  * it under the terms of the GNU General Public License version 2
12  * as published by the Free Software Foundation.
13  *
14  * This program is distributed in the hope that it will be useful,
15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17  * GNU General Public License for more details.
18  *
19  * You should have received a copy of the GNU General Public License along
20  * with this program; if not, write to the Free Software Foundation, Inc.,
21  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
22  */
23 #ifdef HAVE_CONFIG_H
24 #include "config.h"
25 #elif defined(_MSC_VER)
26 #include "config-msvc.h"
27 #endif
28 
29 #include "syshead.h"
30 
31 #include "ssl_util.h"
32 #include "ssl_pkt.h"
33 #include "ssl_common.h"
34 #include "crypto.h"
35 #include "session_id.h"
36 #include "reliable.h"
37 #include "tls_crypt.h"
38 
39 /*
40  * Dependent on hmac size, opcode size, and session_id size.
41  * Will assert if too small.
42  */
43 #define SWAP_BUF_SIZE 256
44 
62 static bool
63 swap_hmac(struct buffer *buf, const struct crypto_options *co, bool incoming)
64 {
65  ASSERT(co);
66 
67  const struct key_ctx *ctx = (incoming ? &co->key_ctx_bi.decrypt :
68  &co->key_ctx_bi.encrypt);
69  ASSERT(ctx->hmac);
70 
71  {
72  /* hmac + packet_id (8 bytes) */
73  const int hmac_size = hmac_ctx_size(ctx->hmac) + packet_id_size(true);
74 
75  /* opcode (1 byte) + session_id (8 bytes) */
76  const int osid_size = 1 + SID_SIZE;
77 
78  int e1, e2;
79  uint8_t *b = BPTR(buf);
80  uint8_t buf1[SWAP_BUF_SIZE];
81  uint8_t buf2[SWAP_BUF_SIZE];
82 
83  if (incoming)
84  {
85  e1 = osid_size;
86  e2 = hmac_size;
87  }
88  else
89  {
90  e1 = hmac_size;
91  e2 = osid_size;
92  }
93 
94  ASSERT(e1 <= SWAP_BUF_SIZE && e2 <= SWAP_BUF_SIZE);
95 
96  if (buf->len >= e1 + e2)
97  {
98  memcpy(buf1, b, e1);
99  memcpy(buf2, b + e1, e2);
100  memcpy(b, buf2, e2);
101  memcpy(b + e2, buf1, e1);
102  return true;
103  }
104  else
105  {
106  return false;
107  }
108  }
109 }
110 
111 #undef SWAP_BUF_SIZE
112 
122 static void
123 tls_wrap_control(struct tls_wrap_ctx *ctx, uint8_t header, struct buffer *buf,
124  struct session_id *session_id)
125 {
126  if (ctx->mode == TLS_WRAP_AUTH
127  || ctx->mode == TLS_WRAP_NONE)
128  {
130  ASSERT(buf_write_prepend(buf, &header, sizeof(header)));
131  }
132  if (ctx->mode == TLS_WRAP_AUTH)
133  {
134  struct buffer null = clear_buf();
135 
136  /* no encryption, only write hmac */
137  openvpn_encrypt(buf, null, &ctx->opt);
138  ASSERT(swap_hmac(buf, &ctx->opt, false));
139  }
140  else if (ctx->mode == TLS_WRAP_CRYPT)
141  {
142  ASSERT(buf_init(&ctx->work, buf->offset));
143  ASSERT(buf_write(&ctx->work, &header, sizeof(header)));
145  if (!tls_crypt_wrap(buf, &ctx->work, &ctx->opt))
146  {
147  buf->len = 0;
148  return;
149  }
150 
152  || (header >> P_OPCODE_SHIFT) == P_CONTROL_WKC_V1)
153  {
154  if (!buf_copy(&ctx->work,
155  ctx->tls_crypt_v2_wkc))
156  {
157  msg(D_TLS_ERRORS, "Could not append tls-crypt-v2 client key");
158  buf->len = 0;
159  return;
160  }
161  }
162 
163  /* Don't change the original data in buf, it's used by the reliability
164  * layer to resend on failure. */
165  *buf = ctx->work;
166  }
167 }
168 
169 void
171  struct key_state *ks,
172  struct buffer *buf,
173  struct link_socket_actual **to_link_addr,
174  int opcode,
175  int max_ack,
176  bool prepend_ack)
177 {
178  uint8_t header = ks->key_id | (opcode << P_OPCODE_SHIFT);
179 
180  /* Workaround for Softether servers. Softether has a bug that it only
181  * allows 4 ACks in packets and drops packets if more ACKs are contained
182  * in a packet (see commit 37aa1ba5 in Softether) */
183  if (session->tls_wrap.mode == TLS_WRAP_NONE && !session->opt->server
184  && !(session->opt->crypto_flags & CO_USE_TLS_KEY_MATERIAL_EXPORT))
185  {
186  max_ack = min_int(max_ack, 4);
187  }
188 
191  (ks->rec_ack, ks->lru_acks, buf, &ks->session_id_remote,
192  max_ack, prepend_ack));
193 
194  msg(D_TLS_DEBUG, "%s(): %s", __func__, packet_opcode_name(opcode));
195 
196  tls_wrap_control(&session->tls_wrap, header, buf, &session->session_id);
197 
198  *to_link_addr = &ks->remote_addr;
199 }
200 
201 bool
203  struct tls_wrap_ctx *ctx,
204  const struct link_socket_actual *from,
205  const struct tls_options *opt)
206 {
207  struct gc_arena gc = gc_new();
208  bool ret = false;
209 
210  const uint8_t opcode = *(BPTR(buf)) >> P_OPCODE_SHIFT;
211  if ((opcode == P_CONTROL_HARD_RESET_CLIENT_V3
212  || opcode == P_CONTROL_WKC_V1)
213  && !tls_crypt_v2_extract_client_key(buf, ctx, opt))
214  {
216  "TLS Error: can not extract tls-crypt-v2 client key from %s",
217  print_link_socket_actual(from, &gc));
218  goto cleanup;
219  }
220 
221  if (ctx->mode == TLS_WRAP_AUTH)
222  {
223  struct buffer null = clear_buf();
224 
225  /* move the hmac record to the front of the packet */
226  if (!swap_hmac(buf, &ctx->opt, true))
227  {
229  "TLS Error: cannot locate HMAC in incoming packet from %s",
230  print_link_socket_actual(from, &gc));
231  gc_free(&gc);
232  return false;
233  }
234 
235  /* authenticate only (no decrypt) and remove the hmac record
236  * from the head of the buffer */
237  openvpn_decrypt(buf, null, &ctx->opt, NULL, BPTR(buf));
238  if (!buf->len)
239  {
241  "TLS Error: incoming packet authentication failed from %s",
242  print_link_socket_actual(from, &gc));
243  goto cleanup;
244  }
245 
246  }
247  else if (ctx->mode == TLS_WRAP_CRYPT)
248  {
249  struct buffer tmp = alloc_buf_gc(buf_forward_capacity_total(buf), &gc);
250  if (!tls_crypt_unwrap(buf, &tmp, &ctx->opt))
251  {
252  msg(D_TLS_ERRORS, "TLS Error: tls-crypt unwrapping failed from %s",
253  print_link_socket_actual(from, &gc));
254  goto cleanup;
255  }
256  ASSERT(buf_init(buf, buf->offset));
257  ASSERT(buf_copy(buf, &tmp));
258  buf_clear(&tmp);
259  }
260  else if (ctx->tls_crypt_v2_server_key.cipher)
261  {
262  /* If tls-crypt-v2 is enabled, require *some* wrapping */
263  msg(D_TLS_ERRORS, "TLS Error: could not determine wrapping from %s",
264  print_link_socket_actual(from, &gc));
265  /* TODO Do we want to support using tls-crypt-v2 and no control channel
266  * wrapping at all simultaneously? That would allow server admins to
267  * upgrade clients one-by-one without running a second instance, but we
268  * should not enable it by default because it breaks DoS-protection.
269  * So, add something like --tls-crypt-v2-allow-insecure-fallback ? */
270  goto cleanup;
271  }
272 
273  if (ctx->mode == TLS_WRAP_NONE || ctx->mode == TLS_WRAP_AUTH)
274  {
275  /* advance buffer pointer past opcode & session_id since our caller
276  * already read it */
277  buf_advance(buf, SID_SIZE + 1);
278  }
279 
280  ret = true;
281 cleanup:
282  gc_free(&gc);
283  return ret;
284 }
285 
286 void
288 {
289  free_buf(&state->newbuf);
291  if (state->tls_wrap_tmp.cleanup_key_ctx)
292  {
294  }
295 }
296 
297 /*
298  * This function is similar to tls_pre_decrypt, except it is called
299  * when we are in server mode and receive an initial incoming
300  * packet. Note that we don't modify
301  * any state in our parameter objects. The purpose is solely to
302  * determine whether we should generate a client instance
303  * object, in which case true is returned.
304  *
305  * This function is essentially the first-line HMAC firewall
306  * on the UDP port listener in --mode server mode.
307  */
310  struct tls_pre_decrypt_state *state,
311  const struct link_socket_actual *from,
312  const struct buffer *buf)
313 {
314  struct gc_arena gc = gc_new();
315  /* A packet needs to have at least an opcode and session id */
316  if (buf->len < (1 + SID_SIZE))
317  {
319  "TLS State Error: Too short packet (length %d) received from %s",
320  buf->len, print_link_socket_actual(from, &gc));
321  goto error;
322  }
323 
324  /* get opcode and key ID */
325  uint8_t pkt_firstbyte = *BPTR(buf);
326  int op = pkt_firstbyte >> P_OPCODE_SHIFT;
327  int key_id = pkt_firstbyte & P_KEY_ID_MASK;
328 
329  /* this packet is from an as-yet untrusted source, so
330  * scrutinize carefully */
331 
332  /* Allow only the reset packet or the first packet of the actual handshake. */
335  && op != P_CONTROL_V1
336  && op != P_CONTROL_WKC_V1
337  && op != P_ACK_V1)
338  {
339  /*
340  * This can occur due to bogus data or DoS packets.
341  */
343  "TLS State Error: No TLS state for client %s, opcode=%d",
344  print_link_socket_actual(from, &gc),
345  op);
346  goto error;
347  }
348 
349  if (key_id != 0)
350  {
352  "TLS State Error: Unknown key ID (%d) received from %s -- 0 was expected",
353  key_id,
354  print_link_socket_actual(from, &gc));
355  goto error;
356  }
357 
358  /* read peer session id, we do this at this point since
359  * read_control_auth will skip over it */
360  struct buffer tmp = *buf;
361  buf_advance(&tmp, 1);
362  if (!session_id_read(&state->peer_session_id, &tmp)
363  || !session_id_defined(&state->peer_session_id))
364  {
366  "TLS Error: session-id not found in packet from %s",
367  print_link_socket_actual(from, &gc));
368  goto error;
369  }
370 
371  state->newbuf = clone_buf(buf);
372  state->tls_wrap_tmp = tas->tls_wrap;
373 
374  /* HMAC test and unwrapping the encrypted part of the control message
375  * into newbuf or just setting newbuf to point to the start of control
376  * message */
377  bool status = read_control_auth(&state->newbuf, &state->tls_wrap_tmp,
378  from, NULL);
379 
380  if (!status)
381  {
382  goto error;
383  }
384 
385  /*
386  * At this point, if --tls-auth is being used, we know that
387  * the packet has passed the HMAC test, but we don't know if
388  * it is a replay yet. We will attempt to defeat replays
389  * by not advancing to the S_START state until we
390  * receive an ACK from our first reply to the client
391  * that includes an HMAC of our randomly generated 64 bit
392  * session ID.
393  *
394  * On the other hand if --tls-auth is not being used, we
395  * will proceed to begin the TLS authentication
396  * handshake with only cursory integrity checks having
397  * been performed, since we will be leaving the task
398  * of authentication solely up to TLS.
399  */
400  gc_free(&gc);
401  if (op == P_CONTROL_V1)
402  {
404  }
405  else if (op == P_ACK_V1)
406  {
407  return VERDICT_VALID_ACK_V1;
408  }
409  else if (op == P_CONTROL_HARD_RESET_CLIENT_V3)
410  {
411  return VERDICT_VALID_RESET_V3;
412  }
413  else if (op == P_CONTROL_WKC_V1)
414  {
415  return VERDICT_VALID_WKC_V1;
416  }
417  else
418  {
419  return VERDICT_VALID_RESET_V2;
420  }
421 
422 error:
423  tls_clear_error();
424  gc_free(&gc);
425  return VERDICT_INVALID;
426 }
427 
428 
429 struct buffer
431  struct tls_auth_standalone *tas,
432  struct session_id *own_sid,
433  struct session_id *remote_sid,
434  uint8_t header,
435  bool request_resend_wkc)
436 {
437  struct buffer buf = alloc_buf(tas->frame.buf.payload_size);
438  ASSERT(buf_init(&buf, tas->frame.buf.headroom));
439 
440  /* Reliable ACK structure */
441  /* Length of the ACK structure - 1 ACK */
442  buf_write_u8(&buf, 1);
443 
444  /* ACKed packet - first packet's id is always 0 */
445  buf_write_u32(&buf, 0);
446 
447  /* Remote session id */
448  buf_write(&buf, remote_sid->id, SID_SIZE);
449 
450  /* Packet ID of our own packet: Our reset packet is always using
451  * packet id 0 since it is the first packet */
452  packet_id_type net_pid = htonpid(0);
453 
454  ASSERT(buf_write(&buf, &net_pid, sizeof(net_pid)));
455 
456  /* Add indication for tls-crypt-v2 to resend the WKc with the reply */
457  if (request_resend_wkc)
458  {
459  buf_write_u16(&buf, TLV_TYPE_EARLY_NEG_FLAGS); /* TYPE: flags */
460  buf_write_u16(&buf, sizeof(uint16_t));
462  }
463 
464  /* Add tls-auth/tls-crypt wrapping, this might replace buf */
465  tls_wrap_control(ctx, header, &buf, own_sid);
466 
467  return buf;
468 }
469 
470 hmac_ctx_t *
472 {
473  /* We assume that SHA256 is always available */
474  ASSERT(md_valid("SHA256"));
475  hmac_ctx_t *hmac_ctx = hmac_ctx_new();
476 
477  uint8_t key[SHA256_DIGEST_LENGTH];
478  ASSERT(rand_bytes(key, sizeof(key)));
479 
480  hmac_ctx_init(hmac_ctx, key, "SHA256");
481  return hmac_ctx;
482 }
483 
484 struct session_id
486  const struct openvpn_sockaddr *from,
487  hmac_ctx_t *hmac,
488  int handwindow, int offset)
489 {
490  union {
491  uint8_t hmac_result[SHA256_DIGEST_LENGTH];
492  struct session_id sid;
493  } result;
494 
495  /* Get the valid time quantisation for our hmac,
496  * we divide time by handwindow/2 and allow the previous
497  * and future session time if specified by offset */
498  uint32_t session_id_time = now/((handwindow+1)/2) + offset;
499 
500  hmac_ctx_reset(hmac);
501  /* We do not care about endian here since it does not need to be
502  * portable */
503  hmac_ctx_update(hmac, (const uint8_t *) &session_id_time,
504  sizeof(session_id_time));
505 
506  /* add client IP and port */
507  switch (af_addr_size(from->addr.sa.sa_family))
508  {
509  case AF_INET:
510  hmac_ctx_update(hmac, (const uint8_t *) &from->addr.in4, sizeof(struct sockaddr_in));
511  break;
512 
513  case AF_INET6:
514  hmac_ctx_update(hmac, (const uint8_t *) &from->addr.in6, sizeof(struct sockaddr_in6));
515  break;
516  }
517 
518  /* add session id of client */
519  hmac_ctx_update(hmac, client_sid.id, SID_SIZE);
520 
521  hmac_ctx_final(hmac, result.hmac_result);
522 
523  return result.sid;
524 }
525 
526 bool
528  const struct openvpn_sockaddr *from,
529  hmac_ctx_t *hmac,
530  int handwindow)
531 {
532  if (!from)
533  {
534  return false;
535  }
536 
537  struct buffer buf = state->newbuf;
538  struct reliable_ack ack;
539 
540  if (!reliable_ack_parse(&buf, &ack, &state->server_session_id))
541  {
542  return false;
543  }
544 
545  /* check adjacent timestamps too */
546  for (int offset = -2; offset <= 1; offset++)
547  {
548  struct session_id expected_id =
549  calculate_session_id_hmac(state->peer_session_id, from, hmac, handwindow, offset);
550 
551  if (memcmp_constant_time(&expected_id, &state->server_session_id, SID_SIZE))
552  {
553  return true;
554  }
555  }
556  return false;
557 }
VERDICT_VALID_RESET_V2
@ VERDICT_VALID_RESET_V2
This packet is a valid reset packet from the peer (all but tls-crypt-v2)
Definition: ssl_pkt.h:85
D_TLS_DEBUG
#define D_TLS_DEBUG
Definition: errlevel.h:162
D_TLS_STATE_ERRORS
#define D_TLS_STATE_ERRORS
Definition: errlevel.h:133
SWAP_BUF_SIZE
#define SWAP_BUF_SIZE
Definition: ssl_pkt.c:43
P_KEY_ID_MASK
#define P_KEY_ID_MASK
Definition: ssl_pkt.h:38
VERDICT_INVALID
@ VERDICT_INVALID
the packet failed on of the various checks
Definition: ssl_pkt.h:96
gc_new
static struct gc_arena gc_new(void)
Definition: buffer.h:998
hmac_ctx_t
mbedtls_md_context_t hmac_ctx_t
Generic HMAC context.
Definition: crypto_mbedtls.h:46
buf_forward_capacity_total
static int buf_forward_capacity_total(const struct buffer *buf)
Definition: buffer.h:564
buffer::len
int len
Length in bytes of the actual content within the allocated memory.
Definition: buffer.h:66
P_CONTROL_HARD_RESET_CLIENT_V2
#define P_CONTROL_HARD_RESET_CLIENT_V2
Definition: ssl_pkt.h:51
tls_wrap_ctx::tls_crypt_v2_wkc
const struct buffer * tls_crypt_v2_wkc
Wrapped client key, sent to server.
Definition: ssl_common.h:273
key_state::rec_ack
struct reliable_ack * rec_ack
Definition: ssl_common.h:235
buf_init
#define buf_init(buf, offset)
Definition: buffer.h:196
tls_crypt_unwrap
bool tls_crypt_unwrap(const struct buffer *src, struct buffer *dst, struct crypto_options *opt)
Unwrap a control channel packet (decrypts, authenticates and performs replay checks).
Definition: tls_crypt.c:155
buf_write_u32
static bool buf_write_u32(struct buffer *dest, uint32_t data)
Definition: buffer.h:710
first_packet_verdict
first_packet_verdict
Definition: ssl_pkt.h:83
tls_reset_standalone
struct buffer tls_reset_standalone(struct tls_wrap_ctx *ctx, struct tls_auth_standalone *tas, struct session_id *own_sid, struct session_id *remote_sid, uint8_t header, bool request_resend_wkc)
This function creates a reset packet using the information from the tls pre decrypt state.
Definition: ssl_pkt.c:430
tls_pre_decrypt_lite
enum first_packet_verdict tls_pre_decrypt_lite(const struct tls_auth_standalone *tas, struct tls_pre_decrypt_state *state, const struct link_socket_actual *from, const struct buffer *buf)
Inspect an incoming packet for which no VPN tunnel is active, and determine whether a new VPN tunnel ...
Definition: ssl_pkt.c:309
alloc_buf_gc
struct buffer alloc_buf_gc(size_t size, struct gc_arena *gc)
Definition: buffer.c:90
config-msvc.h
key_ctx::cipher
cipher_ctx_t * cipher
Generic cipher context.
Definition: crypto.h:164
key_state::lru_acks
struct reliable_ack * lru_acks
Definition: ssl_common.h:236
P_CONTROL_WKC_V1
#define P_CONTROL_WKC_V1
Definition: ssl_pkt.h:59
session_id_hmac_init
hmac_ctx_t * session_id_hmac_init(void)
Definition: ssl_pkt.c:471
session_id_write
static bool session_id_write(const struct session_id *sid, struct buffer *buf)
Definition: session_id.h:73
VERDICT_VALID_CONTROL_V1
@ VERDICT_VALID_CONTROL_V1
This packet is a valid control packet from the peer.
Definition: ssl_pkt.h:89
buf_clear
void buf_clear(struct buffer *buf)
Definition: buffer.c:164
free_tls_pre_decrypt_state
void free_tls_pre_decrypt_state(struct tls_pre_decrypt_state *state)
Definition: ssl_pkt.c:287
frame::buf
struct frame::@5 buf
key_ctx_bi::encrypt
struct key_ctx encrypt
Cipher and/or HMAC contexts for sending direction.
Definition: crypto.h:219
dmsg
#define dmsg(flags,...)
Definition: error.h:154
swap_hmac
static bool swap_hmac(struct buffer *buf, const struct crypto_options *co, bool incoming)
Move a packet authentication HMAC + related fields to or from the front of the buffer so it can be pr...
Definition: ssl_pkt.c:63
buf_copy
static bool buf_copy(struct buffer *dest, const struct buffer *src)
Definition: buffer.h:717
openvpn_sockaddr
Definition: socket.h:65
hmac_ctx_update
void hmac_ctx_update(hmac_ctx_t *ctx, const uint8_t *src, int src_len)
clear_buf
static struct buffer clear_buf(void)
Return an empty struct buffer.
Definition: buffer.h:209
reliable_ack_parse
bool reliable_ack_parse(struct buffer *buf, struct reliable_ack *ack, struct session_id *session_id_remote)
Parse an acknowledgment record from a received packet.
Definition: reliable.c:175
session_id.h
P_OPCODE_SHIFT
#define P_OPCODE_SHIFT
Definition: ssl_pkt.h:39
clone_buf
struct buffer clone_buf(const struct buffer *buf)
Definition: buffer.c:117
tls_crypt.h
read_control_auth
bool read_control_auth(struct buffer *buf, struct tls_wrap_ctx *ctx, const struct link_socket_actual *from, const struct tls_options *opt)
Definition: ssl_pkt.c:202
tls_pre_decrypt_state::server_session_id
struct session_id server_session_id
Definition: ssl_pkt.h:107
key_state
Security parameter state of one TLS and data channel key session.
Definition: ssl_common.h:195
key
Container for unidirectional cipher and HMAC key material.
Definition: crypto.h:149
tls_pre_decrypt_state::tls_wrap_tmp
struct tls_wrap_ctx tls_wrap_tmp
Definition: ssl_pkt.h:104
EARLY_NEG_FLAG_RESEND_WKC
#define EARLY_NEG_FLAG_RESEND_WKC
Definition: ssl_pkt.h:290
session_id
Definition: session_id.h:38
tls_auth_standalone::frame
struct frame frame
Definition: ssl_pkt.h:80
ssl_util.h
free_key_ctx_bi
void free_key_ctx_bi(struct key_ctx_bi *ctx)
Definition: crypto.c:907
tls_wrap_ctx::opt
struct crypto_options opt
Crypto state.
Definition: ssl_common.h:270
reliable.h
htonpid
#define htonpid(x)
Definition: packet_id.h:56
P_CONTROL_HARD_RESET_CLIENT_V3
#define P_CONTROL_HARD_RESET_CLIENT_V3
Definition: ssl_pkt.h:55
link_socket_actual_defined
static bool link_socket_actual_defined(const struct link_socket_actual *act)
Definition: socket.h:713
ASSERT
#define ASSERT(x)
Definition: error.h:201
tls_wrap_ctx::tls_crypt_v2_server_key
struct key_ctx tls_crypt_v2_server_key
Decrypts client keys.
Definition: ssl_common.h:272
tls_pre_decrypt_state::peer_session_id
struct session_id peer_session_id
Definition: ssl_pkt.h:106
buf_advance
static bool buf_advance(struct buffer *buf, int size)
Definition: buffer.h:623
buf_write_u16
static bool buf_write_u16(struct buffer *dest, uint16_t data)
Definition: buffer.h:703
tls_options
Definition: ssl_common.h:284
SID_SIZE
#define SID_SIZE
Definition: session_id.h:45
buf_write_prepend
static bool buf_write_prepend(struct buffer *dest, const void *src, int size)
Definition: buffer.h:685
buf_write_u8
static bool buf_write_u8(struct buffer *dest, uint8_t data)
Definition: buffer.h:697
tls_pre_decrypt_state::newbuf
struct buffer newbuf
Definition: ssl_pkt.h:105
frame::payload_size
int payload_size
the maximum size that a payload that our buffers can hold from either tun device or network link.
Definition: mtu.h:102
tls_wrap_ctx
Control channel wrapping (–tls-auth/–tls-crypt) context.
Definition: ssl_common.h:263
key_state::remote_addr
struct link_socket_actual remote_addr
Definition: ssl_common.h:223
tls_wrap_ctx::work
struct buffer work
Work buffer (only for –tls-crypt)
Definition: ssl_common.h:271
session_id_read
static bool session_id_read(struct session_id *sid, struct buffer *buf)
Definition: session_id.h:61
openvpn_encrypt
void openvpn_encrypt(struct buffer *buf, struct buffer work, struct crypto_options *opt)
Encrypt and HMAC sign a packet so that it can be sent as a data channel VPN tunnel packet to a remote...
Definition: crypto.c:296
tls_pre_decrypt_state
struct that stores the temporary data for the tls lite decrypt functions
Definition: ssl_pkt.h:103
tls_crypt_wrap
bool tls_crypt_wrap(const struct buffer *src, struct buffer *dst, struct crypto_options *opt)
Wrap a control channel packet (both authenticates and encrypts the data).
Definition: tls_crypt.c:78
key_ctx
Container for one set of cipher and/or HMAC contexts.
Definition: crypto.h:162
tls_wrap_ctx::tls_crypt_v2_metadata
struct buffer tls_crypt_v2_metadata
Received from client.
Definition: ssl_common.h:275
write_control_auth
void write_control_auth(struct tls_session *session, struct key_state *ks, struct buffer *buf, struct link_socket_actual **to_link_addr, int opcode, int max_ack, bool prepend_ack)
Definition: ssl_pkt.c:170
crypto.h
key_state::session_id_remote
struct session_id session_id_remote
Definition: ssl_common.h:222
openvpn_decrypt
bool openvpn_decrypt(struct buffer *buf, struct buffer work, struct crypto_options *opt, const struct frame *frame, const uint8_t *ad_start)
HMAC verify and decrypt a data channel packet received from a remote OpenVPN peer.
Definition: crypto.c:646
hmac_ctx_final
void hmac_ctx_final(hmac_ctx_t *ctx, uint8_t *dst)
packet_id_type
uint32_t packet_id_type
Definition: packet_id.h:44
buffer
Wrapper structure for dynamically allocated memory.
Definition: buffer.h:60
calculate_session_id_hmac
struct session_id calculate_session_id_hmac(struct session_id client_sid, const struct openvpn_sockaddr *from, hmac_ctx_t *hmac, int handwindow, int offset)
Calculates the HMAC based server session id based on a client session id and socket addr.
Definition: ssl_pkt.c:485
hmac_ctx_reset
void hmac_ctx_reset(hmac_ctx_t *ctx)
tls_wrap_ctx::mode
enum tls_wrap_ctx::@16 mode
Control channel wrapping mode.
rand_bytes
int rand_bytes(uint8_t *output, int len)
Wrapper for secure random number generator.
Definition: crypto_openssl.c:556
D_TLS_ERRORS
#define D_TLS_ERRORS
Definition: errlevel.h:59
buf_write
static bool buf_write(struct buffer *dest, const void *src, size_t size)
Definition: buffer.h:673
tls_session
Security parameter state of a single session within a VPN tunnel.
Definition: ssl_common.h:460
syshead.h
BPTR
#define BPTR(buf)
Definition: buffer.h:124
session_id::id
uint8_t id[8]
Definition: session_id.h:40
session_id_defined
static bool session_id_defined(const struct session_id *sid1)
Definition: session_id.h:55
gc_arena
Garbage collection arena used to keep track of dynamically allocated memory.
Definition: buffer.h:116
key_state::key_id
int key_id
Key id for this key_state, inherited from struct tls_session.
Definition: ssl_common.h:205
buffer::offset
int offset
Offset in bytes of the actual content within the allocated memory.
Definition: buffer.h:64
tls_wrap_control
static void tls_wrap_control(struct tls_wrap_ctx *ctx, uint8_t header, struct buffer *buf, struct session_id *session_id)
Wraps a TLS control packet by adding tls-auth HMAC or tls-crypt(-v2) encryption and opcode header inc...
Definition: ssl_pkt.c:123
tls_auth_standalone::tls_wrap
struct tls_wrap_ctx tls_wrap
Definition: ssl_pkt.h:79
free_buf
void free_buf(struct buffer *buf)
Definition: buffer.c:185
memcmp_constant_time
int memcmp_constant_time(const void *a, const void *b, size_t size)
As memcmp(), but constant-time.
Definition: crypto_openssl.c:1357
SHA256_DIGEST_LENGTH
#define SHA256_DIGEST_LENGTH
Definition: crypto_mbedtls.h:75
ssl_pkt.h
tls_crypt_v2_extract_client_key
bool tls_crypt_v2_extract_client_key(struct buffer *buf, struct tls_wrap_ctx *ctx, const struct tls_options *opt)
Extract a tls-crypt-v2 client key from a P_CONTROL_HARD_RESET_CLIENT_V3 message, and load the key int...
Definition: tls_crypt.c:542
status
static SERVICE_STATUS status
Definition: interactive.c:56
packet_id_size
static int packet_id_size(bool long_form)
Definition: packet_id.h:310
print_link_socket_actual
const char * print_link_socket_actual(const struct link_socket_actual *act, struct gc_arena *gc)
Definition: socket.c:2814
min_int
static int min_int(int x, int y)
Definition: integer.h:82
gc_free
static void gc_free(struct gc_arena *a)
Definition: buffer.h:1006
session_id_write_prepend
static bool session_id_write_prepend(const struct session_id *sid, struct buffer *buf)
Definition: session_id.h:67
P_ACK_V1
#define P_ACK_V1
Definition: ssl_pkt.h:46
VERDICT_VALID_RESET_V3
@ VERDICT_VALID_RESET_V3
This is a valid v3 reset (tls-crypt-v2)
Definition: ssl_pkt.h:87
crypto_options::key_ctx_bi
struct key_ctx_bi key_ctx_bi
OpenSSL cipher and HMAC contexts for both sending and receiving directions.
Definition: crypto.h:232
now
time_t now
Definition: otime.c:36
check_session_id_hmac
bool check_session_id_hmac(struct tls_pre_decrypt_state *state, const struct openvpn_sockaddr *from, hmac_ctx_t *hmac, int handwindow)
Checks if a control packet has a correct HMAC server session id.
Definition: ssl_pkt.c:527
P_CONTROL_V1
#define P_CONTROL_V1
Definition: ssl_pkt.h:45
config.h
hmac_ctx_new
hmac_ctx_t * hmac_ctx_new(void)
Definition: crypto_openssl.c:1198
ssl_common.h
hmac_ctx_init
void hmac_ctx_init(hmac_ctx_t *ctx, const uint8_t *key, const char *mdname)
session
Definition: keyingmaterialexporter.c:56
md_valid
bool md_valid(const char *digest)
Return if a message digest parameters is valid given the name of the digest.
Definition: crypto_openssl.c:1050
reliable_ack_write
bool reliable_ack_write(struct reliable_ack *ack, struct reliable_ack *ack_mru, struct buffer *buf, const struct session_id *sid, int max, bool prepend)
Write a packet ID acknowledgment record to a buffer.
Definition: reliable.c:257
key_ctx::hmac
hmac_ctx_t * hmac
Generic HMAC context.
Definition: crypto.h:165
VERDICT_VALID_ACK_V1
@ VERDICT_VALID_ACK_V1
This packet is a valid ACK control packet from the peer, i.e.
Definition: ssl_pkt.h:92
CO_USE_TLS_KEY_MATERIAL_EXPORT
#define CO_USE_TLS_KEY_MATERIAL_EXPORT
Bit-flag indicating that data channel key derivation is done using TLS keying material export [RFC570...
Definition: crypto.h:255
alloc_buf
struct buffer alloc_buf(size_t size)
Definition: buffer.c:64
af_addr_size
static int af_addr_size(sa_family_t af)
Definition: socket.h:867
reliable_ack
The acknowledgment structure in which packet IDs are stored for later acknowledgment.
Definition: reliable.h:61
VERDICT_VALID_WKC_V1
@ VERDICT_VALID_WKC_V1
The packet is a valid control packet with appended wrapped client key.
Definition: ssl_pkt.h:94
msg
#define msg(flags,...)
Definition: error.h:150
tls_clear_error
void tls_clear_error(void)
Clear the underlying SSL library's error state.
key_ctx_bi::decrypt
struct key_ctx decrypt
cipher and/or HMAC contexts for receiving direction.
Definition: crypto.h:221
tls_wrap_ctx::cleanup_key_ctx
bool cleanup_key_ctx
opt.key_ctx_bi is owned by this context
Definition: ssl_common.h:276
frame::headroom
int headroom
the headroom in the buffer, this is choosen to allow all potential header to be added before the pack...
Definition: mtu.h:108
hmac_ctx_size
int hmac_ctx_size(hmac_ctx_t *ctx)
crypto_options
Security parameter state for processing data channel packets.
Definition: crypto.h:230
packet_opcode_name
static const char * packet_opcode_name(int op)
Definition: ssl_pkt.h:234
tls_auth_standalone
Definition: ssl_pkt.h:77
TLV_TYPE_EARLY_NEG_FLAGS
#define TLV_TYPE_EARLY_NEG_FLAGS
Definition: ssl_pkt.h:289