OpenVPN
ssl_pkt.c
Go to the documentation of this file.
1/*
2 * OpenVPN -- An application to securely tunnel IP networks
3 * over a single TCP/UDP port, with support for SSL/TLS-based
4 * session authentication and key exchange,
5 * packet encryption, packet authentication, and
6 * packet compression.
7 *
8 * Copyright (C) 2002-2025 OpenVPN Inc <sales@openvpn.net>
9 *
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License version 2
12 * as published by the Free Software Foundation.
13 *
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
18 *
19 * You should have received a copy of the GNU General Public License along
20 * with this program; if not, see <https://www.gnu.org/licenses/>.
21 */
22#ifdef HAVE_CONFIG_H
23#include "config.h"
24#endif
25
26#include "syshead.h"
27
28#include "ssl_util.h"
29#include "ssl_pkt.h"
30#include "ssl_common.h"
31#include "crypto.h"
32#include "session_id.h"
33#include "reliable.h"
34#include "tls_crypt.h"
35
36/*
37 * Dependent on hmac size, opcode size, and session_id size.
38 * Will assert if too small.
39 */
40#define SWAP_BUF_SIZE 256
41
59static bool
60swap_hmac(struct buffer *buf, const struct crypto_options *co, bool incoming)
61{
62 ASSERT(co);
63
64 const struct key_ctx *ctx = (incoming ? &co->key_ctx_bi.decrypt : &co->key_ctx_bi.encrypt);
65 ASSERT(ctx->hmac);
66
67 {
68 /* hmac + packet_id (8 bytes) */
69 const int hmac_size = hmac_ctx_size(ctx->hmac) + packet_id_size(true);
70
71 /* opcode (1 byte) + session_id (8 bytes) */
72 const int osid_size = 1 + SID_SIZE;
73
74 int e1, e2;
75 uint8_t *b = BPTR(buf);
76 uint8_t buf1[SWAP_BUF_SIZE];
77 uint8_t buf2[SWAP_BUF_SIZE];
78
79 if (incoming)
80 {
81 e1 = osid_size;
82 e2 = hmac_size;
83 }
84 else
85 {
86 e1 = hmac_size;
87 e2 = osid_size;
88 }
89
90 ASSERT(e1 <= SWAP_BUF_SIZE && e2 <= SWAP_BUF_SIZE);
91
92 if (buf->len >= e1 + e2)
93 {
94 memcpy(buf1, b, e1);
95 memcpy(buf2, b + e1, e2);
96 memcpy(b, buf2, e2);
97 memcpy(b + e2, buf1, e1);
98 return true;
99 }
100 else
101 {
102 return false;
103 }
104 }
105}
106
107#undef SWAP_BUF_SIZE
108
118static void
119tls_wrap_control(struct tls_wrap_ctx *ctx, uint8_t header, struct buffer *buf,
120 struct session_id *session_id)
121{
122 if (ctx->mode == TLS_WRAP_AUTH || ctx->mode == TLS_WRAP_NONE)
123 {
125 ASSERT(buf_write_prepend(buf, &header, sizeof(header)));
126 }
127 if (ctx->mode == TLS_WRAP_AUTH)
128 {
129 struct buffer null = clear_buf();
130
131 /* no encryption, only write hmac */
132 openvpn_encrypt(buf, null, &ctx->opt);
133 ASSERT(swap_hmac(buf, &ctx->opt, false));
134 }
135 else if (ctx->mode == TLS_WRAP_CRYPT)
136 {
137 ASSERT(buf_init(&ctx->work, buf->offset));
138 ASSERT(buf_write(&ctx->work, &header, sizeof(header)));
140 if (!tls_crypt_wrap(buf, &ctx->work, &ctx->opt))
141 {
142 buf->len = 0;
143 return;
144 }
145
147 || (header >> P_OPCODE_SHIFT) == P_CONTROL_WKC_V1)
148 {
149 if (!buf_copy(&ctx->work, ctx->tls_crypt_v2_wkc))
150 {
151 msg(D_TLS_ERRORS, "Could not append tls-crypt-v2 client key");
152 buf->len = 0;
153 return;
154 }
155 }
156
157 /* Don't change the original data in buf, it's used by the reliability
158 * layer to resend on failure. */
159 *buf = ctx->work;
160 }
161}
162
163#if defined(__GNUC__) || defined(__clang__)
164#pragma GCC diagnostic push
165#pragma GCC diagnostic ignored "-Wconversion"
166#endif
167
168void
169write_control_auth(struct tls_session *session, struct key_state *ks, struct buffer *buf,
170 struct link_socket_actual **to_link_addr, int opcode, int max_ack,
171 bool prepend_ack)
172{
173 uint8_t header = ks->key_id | (opcode << P_OPCODE_SHIFT);
174
175 /* Workaround for Softether servers. Softether has a bug that it only
176 * allows 4 ACks in packets and drops packets if more ACKs are contained
177 * in a packet (see commit 37aa1ba5 in Softether) */
178 if (session->tls_wrap.mode == TLS_WRAP_NONE && !session->opt->server
179 && !(session->opt->crypto_flags & CO_USE_TLS_KEY_MATERIAL_EXPORT))
180 {
181 max_ack = min_int(max_ack, 4);
182 }
183
186 prepend_ack));
187
188 msg(D_TLS_DEBUG, "%s(): %s", __func__, packet_opcode_name(opcode));
189
191 &session->session_id);
192
193 *to_link_addr = &ks->remote_addr;
194}
195
196bool
197read_control_auth(struct buffer *buf, struct tls_wrap_ctx *ctx,
198 const struct link_socket_actual *from, const struct tls_options *opt,
199 bool initial_packet)
200{
201 struct gc_arena gc = gc_new();
202 bool ret = false;
203
204 const uint8_t opcode = *(BPTR(buf)) >> P_OPCODE_SHIFT;
205 if ((opcode == P_CONTROL_HARD_RESET_CLIENT_V3 || opcode == P_CONTROL_WKC_V1)
206 && !tls_crypt_v2_extract_client_key(buf, ctx, opt, initial_packet))
207 {
208 msg(D_TLS_ERRORS, "TLS Error: can not extract tls-crypt-v2 client key from %s",
210 goto cleanup;
211 }
212
213 if (ctx->mode == TLS_WRAP_AUTH)
214 {
215 struct buffer null = clear_buf();
216
217 /* move the hmac record to the front of the packet */
218 if (!swap_hmac(buf, &ctx->opt, true))
219 {
220 msg(D_TLS_ERRORS, "TLS Error: cannot locate HMAC in incoming packet from %s",
222 gc_free(&gc);
223 return false;
224 }
225
226 /* authenticate only (no decrypt) and remove the hmac record
227 * from the head of the buffer */
228 openvpn_decrypt(buf, null, &ctx->opt, NULL, BPTR(buf));
229 if (!buf->len)
230 {
231 msg(D_TLS_ERRORS, "TLS Error: incoming packet authentication failed from %s",
233 goto cleanup;
234 }
235 }
236 else if (ctx->mode == TLS_WRAP_CRYPT)
237 {
239 if (!tls_crypt_unwrap(buf, &tmp, &ctx->opt))
240 {
241 msg(D_TLS_ERRORS, "TLS Error: tls-crypt unwrapping failed from %s",
243 goto cleanup;
244 }
245 ASSERT(buf_init(buf, buf->offset));
246 ASSERT(buf_copy(buf, &tmp));
247 buf_clear(&tmp);
248 }
249 else if (ctx->tls_crypt_v2_server_key.cipher)
250 {
251 /* If tls-crypt-v2 is enabled, require *some* wrapping */
252 msg(D_TLS_ERRORS, "TLS Error: could not determine wrapping from %s",
254 /* TODO Do we want to support using tls-crypt-v2 and no control channel
255 * wrapping at all simultaneously? That would allow server admins to
256 * upgrade clients one-by-one without running a second instance, but we
257 * should not enable it by default because it breaks DoS-protection.
258 * So, add something like --tls-crypt-v2-allow-insecure-fallback ? */
259 goto cleanup;
260 }
261
262 if (ctx->mode == TLS_WRAP_NONE || ctx->mode == TLS_WRAP_AUTH)
263 {
264 /* advance buffer pointer past opcode & session_id since our caller
265 * already read it */
266 buf_advance(buf, SID_SIZE + 1);
267 }
268
269 ret = true;
270cleanup:
271 gc_free(&gc);
272 return ret;
273}
274
275void
285
286/*
287 * This function is similar to tls_pre_decrypt, except it is called
288 * when we are in server mode and receive an initial incoming
289 * packet. Note that we don't modify any state in our parameter
290 * objects except state. The purpose is solely to
291 * determine whether we should generate a client instance
292 * object, in which case true is returned.
293 *
294 * This function is essentially the first-line HMAC firewall
295 * on the UDP port listener in --mode server mode.
296 */
299 const struct link_socket_actual *from, const struct buffer *buf)
300{
301 struct gc_arena gc = gc_new();
302 /* A packet needs to have at least an opcode and session id */
303 if (buf->len < (1 + SID_SIZE))
304 {
305 dmsg(D_TLS_STATE_ERRORS, "TLS State Error: Too short packet (length %d) received from %s",
306 buf->len, print_link_socket_actual(from, &gc));
307 goto error;
308 }
309
310 /* get opcode and key ID */
311 uint8_t pkt_firstbyte = *BPTR(buf);
312 int op = pkt_firstbyte >> P_OPCODE_SHIFT;
313 int key_id = pkt_firstbyte & P_KEY_ID_MASK;
314
315 /* this packet is from an as-yet untrusted source, so
316 * scrutinize carefully */
317
318 /* Allow only the reset packet or the first packet of the actual handshake. */
320 && op != P_CONTROL_V1 && op != P_CONTROL_WKC_V1 && op != P_ACK_V1)
321 {
322 /*
323 * This can occur due to bogus data or DoS packets.
324 */
325 dmsg(D_TLS_STATE_ERRORS, "TLS State Error: No TLS state for client %s, opcode=%d",
326 print_link_socket_actual(from, &gc), op);
327 goto error;
328 }
329
330 if (key_id != 0)
331 {
333 "TLS State Error: Unknown key ID (%d) received from %s -- 0 was expected", key_id,
335 goto error;
336 }
337
338 /* read peer session id, we do this at this point since
339 * read_control_auth will skip over it */
340 struct buffer tmp = *buf;
341 buf_advance(&tmp, 1);
342 if (!session_id_read(&state->peer_session_id, &tmp)
344 {
345 msg(D_TLS_ERRORS, "TLS Error: session-id not found in packet from %s",
347 goto error;
348 }
349
350 state->newbuf = clone_buf(buf);
351 state->tls_wrap_tmp = tas->tls_wrap;
352
353 /* HMAC test and unwrapping the encrypted part of the control message
354 * into newbuf or just setting newbuf to point to the start of control
355 * message */
356 bool status = read_control_auth(&state->newbuf, &state->tls_wrap_tmp, from, NULL, true);
357
358 if (!status)
359 {
360 goto error;
361 }
362
363 /*
364 * At this point, if --tls-auth is being used, we know that
365 * the packet has passed the HMAC test, but we don't know if
366 * it is a replay yet. We will attempt to defeat replays
367 * by not advancing to the S_START state until we
368 * receive an ACK from our first reply to the client
369 * that includes an HMAC of our randomly generated 64 bit
370 * session ID.
371 *
372 * On the other hand if --tls-auth is not being used, we
373 * will proceed to begin the TLS authentication
374 * handshake with only cursory integrity checks having
375 * been performed, since we will be leaving the task
376 * of authentication solely up to TLS.
377 */
378 gc_free(&gc);
379 if (op == P_CONTROL_V1)
380 {
382 }
383 else if (op == P_ACK_V1)
384 {
386 }
387 else if (op == P_CONTROL_HARD_RESET_CLIENT_V3)
388 {
390 }
391 else if (op == P_CONTROL_WKC_V1)
392 {
394 }
395 else
396 {
398 }
399
400error:
402 gc_free(&gc);
403 return VERDICT_INVALID;
404}
405
406
407struct buffer
409 struct session_id *own_sid, struct session_id *remote_sid, uint8_t header,
410 bool request_resend_wkc)
411{
412 /* Copy buffer here to point at the same data but allow tls_wrap_control
413 * to potentially change buf to point to another buffer without
414 * modifying the buffer in tas */
415 struct buffer buf = tas->workbuf;
416 ASSERT(buf_init(&buf, tas->frame.buf.headroom));
417
418 /* Reliable ACK structure */
419 /* Length of the ACK structure - 1 ACK */
420 buf_write_u8(&buf, 1);
421
422 /* ACKed packet - first packet's id is always 0 */
423 buf_write_u32(&buf, 0);
424
425 /* Remote session id */
426 buf_write(&buf, remote_sid->id, SID_SIZE);
427
428 /* Packet ID of our own packet: Our reset packet is always using
429 * packet id 0 since it is the first packet */
431
432 ASSERT(buf_write(&buf, &net_pid, sizeof(net_pid)));
433
434 /* Add indication for tls-crypt-v2 to resend the WKc with the reply */
436 {
437 buf_write_u16(&buf, TLV_TYPE_EARLY_NEG_FLAGS); /* TYPE: flags */
438 buf_write_u16(&buf, sizeof(uint16_t));
440 }
441
442 /* Add tls-auth/tls-crypt wrapping, this might replace buf with
443 * ctx->work */
444 tls_wrap_control(ctx, header, &buf, own_sid);
445
446 return buf;
447}
448
451{
452 /* We assume that SHA256 is always available */
453 ASSERT(md_valid("SHA256"));
455
457 ASSERT(rand_bytes(key, sizeof(key)));
458
459 hmac_ctx_init(hmac_ctx, key, "SHA256");
460 return hmac_ctx;
461}
462
463struct session_id
464calculate_session_id_hmac(struct session_id client_sid, const struct openvpn_sockaddr *from,
465 hmac_ctx_t *hmac, int handwindow, int offset)
466{
467 union
468 {
469 uint8_t hmac_result[SHA256_DIGEST_LENGTH];
470 struct session_id sid;
471 } result;
472
473 /* Get the valid time quantisation for our hmac,
474 * we divide time by handwindow/2 and allow the previous
475 * and future session time if specified by offset */
476 uint32_t session_id_time = ntohl(now / ((handwindow + 1) / 2) + offset);
477
478 hmac_ctx_reset(hmac);
479 /* We do not care about endian here since it does not need to be
480 * portable */
481 hmac_ctx_update(hmac, (const uint8_t *)&session_id_time, sizeof(session_id_time));
482
483 /* add client IP and port */
484 switch (from->addr.sa.sa_family)
485 {
486 case AF_INET:
487 hmac_ctx_update(hmac, (const uint8_t *)&from->addr.in4, sizeof(struct sockaddr_in));
488 break;
489
490 case AF_INET6:
491 hmac_ctx_update(hmac, (const uint8_t *)&from->addr.in6, sizeof(struct sockaddr_in6));
492 break;
493 }
494
495 /* add session id of client */
496 hmac_ctx_update(hmac, client_sid.id, SID_SIZE);
497
498 hmac_ctx_final(hmac, result.hmac_result);
499
500 return result.sid;
501}
502
503#if defined(__GNUC__) || defined(__clang__)
504#pragma GCC diagnostic pop
505#endif
506
507bool
509 const struct openvpn_sockaddr *from,
510 hmac_ctx_t *hmac,
511 int handwindow,
512 bool pkt_is_ack)
513{
514 if (!from)
515 {
516 return false;
517 }
518
519 struct buffer buf = state->newbuf;
520 struct reliable_ack ack;
521
522 if (!reliable_ack_parse(&buf, &ack, &state->server_session_id))
523 {
524 return false;
525 }
526
527 /* Check if the packet ID of the packet or ACKED packet is <= 1 */
528 for (int i = 0; i < ack.len; i++)
529 {
530 /* This packet ACKs a packet that has a higher packet id than the
531 * ones expected in the three-way handshake, consider it as invalid
532 * for the session */
533 if (ack.packet_id[i] > 1)
534 {
535 return false;
536 }
537 }
538
539 if (!pkt_is_ack)
540 {
541 packet_id_type message_id;
542 /* Extract the packet ID from the packet */
543 if (!reliable_ack_read_packet_id(&buf, &message_id))
544 {
545 return false;
546 }
547
548 /* similar check. Anything larger than 1 is not considered part of the
549 * three-way handshake */
550 if (message_id > 1)
551 {
552 return false;
553 }
554 }
555
556
557 /* check adjacent timestamps too */
558 for (int offset = -2; offset <= 1; offset++)
559 {
560 struct session_id expected_id =
561 calculate_session_id_hmac(state->peer_session_id, from, hmac, handwindow, offset);
562
563 if (memcmp_constant_time(&expected_id, &state->server_session_id, SID_SIZE))
564 {
565 return true;
566 }
567 }
568 return false;
569}
570
571struct buffer
573{
574 /* commands on the control channel are seperated by 0x00 bytes.
575 * cmdlen does not include the 0 byte of the string */
576 int cmdlen = (int)strnlen(BSTR(buf), BLEN(buf));
577
578 if (cmdlen >= BLEN(buf))
579 {
580 buf_advance(buf, cmdlen);
581 /* Return empty buffer */
582 struct buffer empty = { 0 };
583 return empty;
584 }
585
586 /* include the NUL byte and ensure NUL termination */
587 cmdlen += 1;
588
589 /* Construct a buffer that only holds the current command and
590 * its closing NUL byte */
592 buf_write(&cmdbuf, BPTR(buf), cmdlen);
593
594 /* Remove \r and \n at the end of the buffer to avoid
595 * problems with scripts and other that add extra \r and \n */
597
598 /* check we have only printable characters or null byte in the
599 * command string and no newlines */
601 {
602 msg(D_PUSH_ERRORS, "WARNING: Received control with invalid characters: %s",
603 format_hex(BPTR(&cmdbuf), BLEN(&cmdbuf), 256, gc));
604 cmdbuf.len = 0;
605 }
606
607 buf_advance(buf, cmdlen);
608 return cmdbuf;
609}
void free_buf(struct buffer *buf)
Definition buffer.c:184
void buf_clear(struct buffer *buf)
Definition buffer.c:163
struct buffer clone_buf(const struct buffer *buf)
Definition buffer.c:116
bool string_check_buf(struct buffer *buf, const unsigned int inclusive, const unsigned int exclusive)
Check a buffer if it only consists of allowed characters.
Definition buffer.c:1074
struct buffer alloc_buf_gc(size_t size, struct gc_arena *gc)
Definition buffer.c:89
void buf_chomp(struct buffer *buf)
Definition buffer.c:554
static bool buf_write_u16(struct buffer *dest, uint16_t data)
Definition buffer.h:690
static char * format_hex(const uint8_t *data, int size, int maxoutput, struct gc_arena *gc)
Definition buffer.h:503
#define BSTR(buf)
Definition buffer.h:128
static struct buffer clear_buf(void)
Return an empty struct buffer.
Definition buffer.h:222
static bool buf_copy(struct buffer *dest, const struct buffer *src)
Definition buffer.h:704
#define BPTR(buf)
Definition buffer.h:123
static bool buf_write_u32(struct buffer *dest, uint32_t data)
Definition buffer.h:697
static bool buf_write_prepend(struct buffer *dest, const void *src, int size)
Definition buffer.h:672
#define CC_CRLF
carriage return or newline
Definition buffer.h:904
static bool buf_advance(struct buffer *buf, int size)
Definition buffer.h:616
static bool buf_write(struct buffer *dest, const void *src, size_t size)
Definition buffer.h:660
static bool buf_write_u8(struct buffer *dest, uint8_t data)
Definition buffer.h:684
#define BLEN(buf)
Definition buffer.h:126
#define CC_NULL
null character \0
Definition buffer.h:868
static void gc_free(struct gc_arena *a)
Definition buffer.h:1015
#define CC_PRINT
printable (>= 32, != 127)
Definition buffer.h:875
#define buf_init(buf, offset)
Definition buffer.h:209
static struct gc_arena gc_new(void)
Definition buffer.h:1007
static int buf_forward_capacity_total(const struct buffer *buf)
Definition buffer.h:557
void free_key_ctx_bi(struct key_ctx_bi *ctx)
Definition crypto.c:1099
Data Channel Cryptography Module.
#define CO_USE_TLS_KEY_MATERIAL_EXPORT
Bit-flag indicating that data channel key derivation is done using TLS keying material export [RFC570...
Definition crypto.h:357
int memcmp_constant_time(const void *a, const void *b, size_t size)
As memcmp(), but constant-time.
void hmac_ctx_update(hmac_ctx_t *ctx, const uint8_t *src, int src_len)
hmac_ctx_t * hmac_ctx_new(void)
void hmac_ctx_reset(hmac_ctx_t *ctx)
void hmac_ctx_init(hmac_ctx_t *ctx, const uint8_t *key, const char *mdname)
void hmac_ctx_final(hmac_ctx_t *ctx, uint8_t *dst)
bool md_valid(const char *digest)
Return if a message digest parameters is valid given the name of the digest.
int hmac_ctx_size(hmac_ctx_t *ctx)
int rand_bytes(uint8_t *output, int len)
Wrapper for secure random number generator.
mbedtls_md_context_t hmac_ctx_t
Generic HMAC context.
#define SHA256_DIGEST_LENGTH
#define D_TLS_STATE_ERRORS
Definition errlevel.h:133
#define D_PUSH_ERRORS
Definition errlevel.h:66
#define D_TLS_ERRORS
Definition errlevel.h:58
#define D_TLS_DEBUG
Definition errlevel.h:164
enum first_packet_verdict tls_pre_decrypt_lite(const struct tls_auth_standalone *tas, struct tls_pre_decrypt_state *state, const struct link_socket_actual *from, const struct buffer *buf)
Inspect an incoming packet for which no VPN tunnel is active, and determine whether a new VPN tunnel ...
Definition ssl_pkt.c:298
void openvpn_encrypt(struct buffer *buf, struct buffer work, struct crypto_options *opt)
Encrypt and HMAC sign a packet so that it can be sent as a data channel VPN tunnel packet to a remote...
Definition crypto.c:327
bool openvpn_decrypt(struct buffer *buf, struct buffer work, struct crypto_options *opt, const struct frame *frame, const uint8_t *ad_start)
HMAC verify and decrypt a data channel packet received from a remote OpenVPN peer.
Definition crypto.c:778
bool reliable_ack_read_packet_id(struct buffer *buf, packet_id_type *pid)
Read the packet ID of a received packet.
Definition reliable.c:109
bool reliable_ack_parse(struct buffer *buf, struct reliable_ack *ack, struct session_id *session_id_remote)
Parse an acknowledgment record from a received packet.
Definition reliable.c:166
bool reliable_ack_write(struct reliable_ack *ack, struct reliable_ack *ack_mru, struct buffer *buf, const struct session_id *sid, int max, bool prepend)
Write a packet ID acknowledgment record to a buffer.
Definition reliable.c:248
bool tls_crypt_v2_extract_client_key(struct buffer *buf, struct tls_wrap_ctx *ctx, const struct tls_options *opt, bool initial_packet)
Extract a tls-crypt-v2 client key from a P_CONTROL_HARD_RESET_CLIENT_V3 message, and load the key int...
Definition tls_crypt.c:587
bool tls_crypt_unwrap(const struct buffer *src, struct buffer *dst, struct crypto_options *opt)
Unwrap a control channel packet (decrypts, authenticates and performs replay checks).
Definition tls_crypt.c:214
bool tls_crypt_wrap(const struct buffer *src, struct buffer *dst, struct crypto_options *opt)
Wrap a control channel packet (both authenticates and encrypts the data).
Definition tls_crypt.c:136
static int min_int(int x, int y)
Definition integer.h:105
static SERVICE_STATUS status
Definition interactive.c:51
#define dmsg(flags,...)
Definition error.h:172
#define msg(flags,...)
Definition error.h:152
#define ASSERT(x)
Definition error.h:219
time_t now
Definition otime.c:33
#define htonpid(x)
Definition packet_id.h:61
uint32_t packet_id_type
Definition packet_id.h:45
static int packet_id_size(bool long_form)
Definition packet_id.h:322
Reliability Layer module header file.
static bool session_id_write_prepend(const struct session_id *sid, struct buffer *buf)
Definition session_id.h:65
static bool session_id_write(const struct session_id *sid, struct buffer *buf)
Definition session_id.h:71
static bool session_id_defined(const struct session_id *sid1)
Definition session_id.h:53
static bool session_id_read(struct session_id *sid, struct buffer *buf)
Definition session_id.h:59
#define SID_SIZE
Definition session_id.h:44
const char * print_link_socket_actual(const struct link_socket_actual *act, struct gc_arena *gc)
static bool link_socket_actual_defined(const struct link_socket_actual *act)
void tls_clear_error(void)
Clear the underlying SSL library's error state.
Control Channel Common Data Structures.
static void tls_wrap_control(struct tls_wrap_ctx *ctx, uint8_t header, struct buffer *buf, struct session_id *session_id)
Wraps a TLS control packet by adding tls-auth HMAC or tls-crypt(-v2) encryption and opcode header inc...
Definition ssl_pkt.c:119
struct session_id calculate_session_id_hmac(struct session_id client_sid, const struct openvpn_sockaddr *from, hmac_ctx_t *hmac, int handwindow, int offset)
Calculates the HMAC based server session id based on a client session id and socket addr.
Definition ssl_pkt.c:464
void free_tls_pre_decrypt_state(struct tls_pre_decrypt_state *state)
Definition ssl_pkt.c:276
void write_control_auth(struct tls_session *session, struct key_state *ks, struct buffer *buf, struct link_socket_actual **to_link_addr, int opcode, int max_ack, bool prepend_ack)
Definition ssl_pkt.c:169
static bool swap_hmac(struct buffer *buf, const struct crypto_options *co, bool incoming)
Move a packet authentication HMAC + related fields to or from the front of the buffer so it can be pr...
Definition ssl_pkt.c:60
hmac_ctx_t * session_id_hmac_init(void)
Definition ssl_pkt.c:450
struct buffer extract_command_buffer(struct buffer *buf, struct gc_arena *gc)
Extracts a control channel message from buf and adjusts the size of buf after the message has been ex...
Definition ssl_pkt.c:572
#define SWAP_BUF_SIZE
Definition ssl_pkt.c:40
bool read_control_auth(struct buffer *buf, struct tls_wrap_ctx *ctx, const struct link_socket_actual *from, const struct tls_options *opt, bool initial_packet)
Read a control channel authentication record.
Definition ssl_pkt.c:197
bool check_session_hmac_and_pkt_id(struct tls_pre_decrypt_state *state, const struct openvpn_sockaddr *from, hmac_ctx_t *hmac, int handwindow, bool pkt_is_ack)
Checks if a control packet has a correct HMAC server session id.
Definition ssl_pkt.c:508
struct buffer tls_reset_standalone(struct tls_wrap_ctx *ctx, struct tls_auth_standalone *tas, struct session_id *own_sid, struct session_id *remote_sid, uint8_t header, bool request_resend_wkc)
This function creates a reset packet using the information from the tls pre decrypt state.
Definition ssl_pkt.c:408
SSL control channel wrap/unwrap and decode functions.
#define EARLY_NEG_FLAG_RESEND_WKC
Definition ssl_pkt.h:323
#define P_OPCODE_SHIFT
Definition ssl_pkt.h:39
#define TLV_TYPE_EARLY_NEG_FLAGS
Definition ssl_pkt.h:322
#define P_ACK_V1
Definition ssl_pkt.h:46
#define P_CONTROL_WKC_V1
Definition ssl_pkt.h:59
#define P_KEY_ID_MASK
Definition ssl_pkt.h:38
static const char * packet_opcode_name(int op)
Definition ssl_pkt.h:241
#define P_CONTROL_V1
Definition ssl_pkt.h:45
first_packet_verdict
Definition ssl_pkt.h:85
@ VERDICT_VALID_ACK_V1
This packet is a valid ACK control packet from the peer, i.e.
Definition ssl_pkt.h:94
@ VERDICT_VALID_WKC_V1
The packet is a valid control packet with appended wrapped client key.
Definition ssl_pkt.h:96
@ VERDICT_VALID_RESET_V2
This packet is a valid reset packet from the peer (all but tls-crypt-v2)
Definition ssl_pkt.h:87
@ VERDICT_INVALID
the packet failed on of the various checks
Definition ssl_pkt.h:98
@ VERDICT_VALID_RESET_V3
This is a valid v3 reset (tls-crypt-v2)
Definition ssl_pkt.h:89
@ VERDICT_VALID_CONTROL_V1
This packet is a valid control packet from the peer.
Definition ssl_pkt.h:91
#define P_CONTROL_HARD_RESET_CLIENT_V2
Definition ssl_pkt.h:51
static struct tls_wrap_ctx * tls_session_get_tls_wrap(struct tls_session *session, int key_id)
Determines if the current session should use the renegotiation tls wrap struct instead the normal one...
Definition ssl_pkt.h:292
#define P_CONTROL_HARD_RESET_CLIENT_V3
Definition ssl_pkt.h:55
SSL utility functions.
Wrapper structure for dynamically allocated memory.
Definition buffer.h:60
int len
Length in bytes of the actual content within the allocated memory.
Definition buffer.h:65
int offset
Offset in bytes of the actual content within the allocated memory.
Definition buffer.h:63
Security parameter state for processing data channel packets.
Definition crypto.h:293
struct key_ctx_bi key_ctx_bi
OpenSSL cipher and HMAC contexts for both sending and receiving directions.
Definition crypto.h:294
Garbage collection arena used to keep track of dynamically allocated memory.
Definition buffer.h:116
struct key_ctx decrypt
cipher and/or HMAC contexts for receiving direction.
Definition crypto.h:283
struct key_ctx encrypt
Cipher and/or HMAC contexts for sending direction.
Definition crypto.h:281
Container for one set of cipher and/or HMAC contexts.
Definition crypto.h:202
cipher_ctx_t * cipher
Generic cipher context.
Definition crypto.h:203
hmac_ctx_t * hmac
Generic HMAC context.
Definition crypto.h:204
Security parameter state of one TLS and data channel key session.
Definition ssl_common.h:208
struct link_socket_actual remote_addr
Definition ssl_common.h:235
struct reliable_ack * rec_ack
Definition ssl_common.h:247
struct session_id session_id_remote
Definition ssl_common.h:234
int key_id
Key id for this key_state, inherited from struct tls_session.
Definition ssl_common.h:217
struct reliable_ack * lru_acks
Definition ssl_common.h:248
Container for unidirectional cipher and HMAC key material.
Definition crypto.h:152
The acknowledgment structure in which packet IDs are stored for later acknowledgment.
Definition reliable.h:64
struct that stores the temporary data for the tls lite decrypt functions
Definition ssl_pkt.h:106
struct session_id peer_session_id
Definition ssl_pkt.h:109
struct session_id server_session_id
Definition ssl_pkt.h:110
struct buffer newbuf
Definition ssl_pkt.h:108
struct tls_wrap_ctx tls_wrap_tmp
Definition ssl_pkt.h:107
Security parameter state of a single session within a VPN tunnel.
Definition ssl_common.h:490
Control channel wrapping (–tls-auth/–tls-crypt) context.
Definition ssl_common.h:276
struct buffer tls_crypt_v2_metadata
Received from client.
Definition ssl_common.h:288
bool cleanup_key_ctx
opt.key_ctx_bi is owned by this context
Definition ssl_common.h:289
struct crypto_options opt
Crypto state.
Definition ssl_common.h:283
enum tls_wrap_ctx::@28 mode
Control channel wrapping mode.
struct buffer work
Work buffer (only for –tls-crypt)
Definition ssl_common.h:284
struct key_ctx tls_crypt_v2_server_key
Decrypts client keys.
Definition ssl_common.h:285
const struct buffer * tls_crypt_v2_wkc
Wrapped client key, sent to server.
Definition ssl_common.h:286
static int cleanup(void **state)
struct gc_arena gc
Definition test_ssl.c:131