OpenVPN
|
#include "syshead.h"
#include "misc.h"
#include "ssl_common.h"
#include "ssl_verify_openssl.h"
#include "ssl_verify_backend.h"
Go to the source code of this file.
Data Structures | |
struct | cert_hash |
Structure containing the hash for a single certificate. More... | |
struct | cert_hash_set |
Structure containing the hashes for a full certificate chain. More... | |
struct | x509_track |
Macros | |
#define | MAX_CERT_DEPTH 16 |
Maximum certificate depth we will allow. More... | |
#define | VERIFY_X509_NONE 0 |
#define | VERIFY_X509_SUBJECT_DN 1 |
#define | VERIFY_X509_SUBJECT_RDN 2 |
#define | VERIFY_X509_SUBJECT_RDN_PREFIX 3 |
#define | TLS_AUTHENTICATED(multi, ks) ((ks)->state >= (S_GOT_KEY - (multi)->opt.server)) |
Check whether the ks key_state has finished the key exchange part of the OpenVPN hand shake. More... | |
#define | XT_FULL_CHAIN (1<<0) |
#define | NS_CERT_CHECK_NONE (0) |
Do not perform Netscape certificate type verification. More... | |
#define | NS_CERT_CHECK_SERVER (1<<0) |
Do not perform Netscape certificate type verification. More... | |
#define | NS_CERT_CHECK_CLIENT (1<<1) |
Do not perform Netscape certificate type verification. More... | |
#define | OPENVPN_KU_REQUIRED (0xFFFF) |
Require keyUsage to be present in cert (0xFFFF is an invalid KU value) More... | |
Enumerations | |
enum | tls_auth_status { TLS_AUTHENTICATION_SUCCEEDED =0, TLS_AUTHENTICATION_FAILED =1, TLS_AUTHENTICATION_DEFERRED =2 } |
Functions | |
enum tls_auth_status | tls_authentication_status (struct tls_multi *multi) |
Return current session authentication state of the tls_multi structure This will return TLS_AUTHENTICATION_SUCCEEDED only if the session is fully authenticated, i.e. More... | |
void | key_state_rm_auth_control_files (struct auth_deferred_status *ads) |
Remove the given key state's auth deferred status auth control file, if it exists. More... | |
void | cert_hash_free (struct cert_hash_set *chs) |
Frees the given set of certificate hashes. More... | |
void | tls_lock_cert_hash_set (struct tls_multi *multi) |
Locks the certificate hash set used in the given tunnel. More... | |
void | tls_lock_common_name (struct tls_multi *multi) |
Locks the common name field for the given tunnel. More... | |
const char * | tls_common_name (const struct tls_multi *multi, const bool null) |
Returns the common name field for the given tunnel. More... | |
const char * | tls_username (const struct tls_multi *multi, const bool null) |
Returns the username field for the given tunnel. More... | |
bool | cert_hash_compare (const struct cert_hash_set *chs1, const struct cert_hash_set *chs2) |
Compares certificates hashes, returns true if hashes are equal. More... | |
void | verify_user_pass (struct user_pass *up, struct tls_multi *multi, struct tls_session *session) |
Verify the given username and password, using either an external script, a plugin, or the management interface. More... | |
void | verify_final_auth_checks (struct tls_multi *multi, struct tls_session *session) |
Perform final authentication checks, including locking of the cn, the allowed certificate hashes, and whether a client config entry exists in the client config directory. More... | |
bool | tls_authenticate_key (struct tls_multi *multi, const unsigned int mda_key_id, const bool auth, const char *client_reason) |
void | auth_set_client_reason (struct tls_multi *multi, const char *client_reason) |
Sets the reason why authentication of a client failed. More... | |
static const char * | tls_client_reason (struct tls_multi *multi) |
void | tls_x509_clear_env (struct env_set *es) |
Remove any X509_ env variables from env_set es. More... | |
#define MAX_CERT_DEPTH 16 |
Maximum certificate depth we will allow.
Definition at line 51 of file ssl_verify.h.
Referenced by cert_hash_compare(), cert_hash_copy(), cert_hash_free(), cert_hash_remember(), and verify_cert().
#define NS_CERT_CHECK_CLIENT (1<<1) |
Do not perform Netscape certificate type verification.
Definition at line 208 of file ssl_verify.h.
Referenced by add_option(), print_nsCertType(), and x509_verify_ns_cert_type().
#define NS_CERT_CHECK_NONE (0) |
Do not perform Netscape certificate type verification.
Definition at line 204 of file ssl_verify.h.
Referenced by verify_peer_cert(), and x509_verify_ns_cert_type().
#define NS_CERT_CHECK_SERVER (1<<0) |
Do not perform Netscape certificate type verification.
Definition at line 206 of file ssl_verify.h.
Referenced by add_option(), do_option_warnings(), print_nsCertType(), and x509_verify_ns_cert_type().
#define OPENVPN_KU_REQUIRED (0xFFFF) |
Require keyUsage to be present in cert (0xFFFF is an invalid KU value)
Definition at line 211 of file ssl_verify.h.
Referenced by add_option(), and x509_verify_cert_ku().
#define VERIFY_X509_NONE 0 |
Definition at line 63 of file ssl_verify.h.
Referenced by do_option_warnings(), and verify_peer_cert().
#define VERIFY_X509_SUBJECT_DN 1 |
Definition at line 64 of file ssl_verify.h.
Referenced by add_option(), and verify_peer_cert().
#define VERIFY_X509_SUBJECT_RDN 2 |
Definition at line 65 of file ssl_verify.h.
Referenced by add_option(), and verify_peer_cert().
#define VERIFY_X509_SUBJECT_RDN_PREFIX 3 |
Definition at line 66 of file ssl_verify.h.
Referenced by add_option(), and verify_peer_cert().
#define XT_FULL_CHAIN (1<<0) |
Definition at line 195 of file ssl_verify.h.
Referenced by x509_setenv_track(), and x509_track_add().
enum tls_auth_status |
Enumerator | |
---|---|
TLS_AUTHENTICATION_SUCCEEDED | |
TLS_AUTHENTICATION_FAILED | |
TLS_AUTHENTICATION_DEFERRED |
Definition at line 68 of file ssl_verify.h.
void auth_set_client_reason | ( | struct tls_multi * | multi, |
const char * | client_reason | ||
) |
Sets the reason why authentication of a client failed.
This be will send to the client when the AUTH_FAILED message is sent An example would be "SESSION: Token expired"
multi | The multi tls struct |
client_reason | The string to send to the client as part of AUTH_FAILED |
Definition at line 833 of file ssl_verify.c.
References tls_multi::client_reason, free, and string_alloc().
Referenced by key_state_check_auth_pending_file(), multi_client_set_protocol_options(), tls_authenticate_key(), tls_multi_free(), and verify_auth_token().
bool cert_hash_compare | ( | const struct cert_hash_set * | chs1, |
const struct cert_hash_set * | chs2 | ||
) |
Compares certificates hashes, returns true if hashes are equal.
chs1 | cert 1 hash set |
chs2 | cert 2 hash set |
Definition at line 233 of file ssl_verify.c.
References cert_hash_set::ch, MAX_CERT_DEPTH, and cert_hash::sha256_hash.
Referenced by multi_process_float(), and verify_final_auth_checks().
void cert_hash_free | ( | struct cert_hash_set * | chs | ) |
Frees the given set of certificate hashes.
chs | The certificate hash set to free. |
Definition at line 219 of file ssl_verify.c.
References cert_hash_set::ch, free, and MAX_CERT_DEPTH.
Referenced by tls_multi_free(), and tls_session_free().
void key_state_rm_auth_control_files | ( | struct auth_deferred_status * | ads | ) |
Remove the given key state's auth deferred status auth control file, if it exists.
ads | The key state the remove the file for |
Remove the given key state's auth deferred status auth control file, if it exists.
Definition at line 982 of file ssl_verify.c.
References auth_deferred_status::auth_control_file, free, key_state_rm_auth_pending_file(), and platform_unlink().
Referenced by key_state_free(), key_state_gen_auth_control_files(), verify_user_pass_plugin(), and verify_user_pass_script().
bool tls_authenticate_key | ( | struct tls_multi * | multi, |
const unsigned int | mda_key_id, | ||
const bool | auth, | ||
const char * | client_reason | ||
) |
Definition at line 1217 of file ssl_verify.c.
References ACF_FAILED, ACF_SUCCEEDED, auth_set_client_reason(), get_key_scan(), KEY_SCAN_SIZE, key_state::mda_key_id, and key_state::mda_status.
Referenced by management_client_auth().
enum tls_auth_status tls_authentication_status | ( | struct tls_multi * | multi | ) |
Return current session authentication state of the tls_multi structure This will return TLS_AUTHENTICATION_SUCCEEDED only if the session is fully authenticated, i.e.
VPN traffic is allowed over it.
Checks the status of all active keys and checks if the deferred authentication has succeeded.
As a side effect this function will also transition ks->authenticated from KS_AUTH_DEFERRED to KS_AUTH_FALSE/KS_AUTH_TRUE if the deferred authentication has succeeded after last call.
multi | the tls_multi struct to operate on |
Definition at line 1135 of file ssl_verify.c.
References key_state::authenticated, D_TLS_ERRORS, dmsg, get_key_scan(), KEY_SCAN_SIZE, KS_AUTH_DEFERRED, KS_AUTH_FALSE, KS_AUTH_TRUE, now, tls_multi::tas_cache_last_update, tls_multi::tas_cache_num_updates, TLS_AUTHENTICATED, TLS_AUTHENTICATION_DEFERRED, TLS_AUTHENTICATION_FAILED, tls_authentication_status_use_cache(), TLS_AUTHENTICATION_SUCCEEDED, and update_key_auth_status().
Referenced by process_incoming_push_request(), and tls_multi_process().
|
inlinestatic |
Definition at line 231 of file ssl_verify.h.
References tls_multi::client_reason, and tls_x509_clear_env().
Referenced by process_incoming_push_request().
const char* tls_common_name | ( | const struct tls_multi * | multi, |
const bool | null | ||
) |
Returns the common name field for the given tunnel.
multi | The tunnel to return the common name for |
null | Whether null may be returned. If not, "UNDEF" will be returned. |
Definition at line 112 of file ssl_verify.c.
References tls_session::common_name, tls_multi::session, and TM_ACTIVE.
Referenced by format_common_name(), learn_address_script(), management_callback_kill_by_cn(), multi_client_connect_setenv(), multi_client_connect_source_ccd(), multi_delete_dup(), multi_instance_string(), multi_print_status(), multi_process_float(), multi_select_virtual_addr(), and send_control_channel_string_dowork().
void tls_lock_cert_hash_set | ( | struct tls_multi * | multi | ) |
Locks the certificate hash set used in the given tunnel.
multi | The tunnel to lock |
Definition at line 291 of file ssl_verify.c.
References cert_hash_copy(), tls_session::cert_hash_set, tls_multi::locked_cert_hash_set, tls_multi::session, and TM_ACTIVE.
Referenced by multi_client_connect_early_setup().
void tls_lock_common_name | ( | struct tls_multi * | multi | ) |
Locks the common name field for the given tunnel.
multi | The tunnel to lock |
Definition at line 137 of file ssl_verify.c.
References tls_session::common_name, tls_multi::locked_cn, tls_multi::session, string_alloc(), and TM_ACTIVE.
Referenced by multi_client_connect_early_setup().
const char* tls_username | ( | const struct tls_multi * | multi, |
const bool | null | ||
) |
Returns the username field for the given tunnel.
multi | The tunnel to return the username for |
null | Whether null may be returned. If not, "UNDEF" will be returned. |
Definition at line 176 of file ssl_verify.c.
References tls_multi::locked_username.
Referenced by multi_print_status().
void tls_x509_clear_env | ( | struct env_set * | es | ) |
Remove any X509_ env variables from env_set es.
Definition at line 1703 of file ssl_verify.c.
References env_set_del(), env_set::list, env_item::next, and env_item::string.
Referenced by tls_client_reason(), and tls_process().
void verify_final_auth_checks | ( | struct tls_multi * | multi, |
struct tls_session * | session | ||
) |
Perform final authentication checks, including locking of the cn, the allowed certificate hashes, and whether a client config entry exists in the client config directory.
multi | The TLS multi structure to verify locked structures. |
session | The current TLS session |
Definition at line 1641 of file ssl_verify.c.
References key_state::authenticated, CCD_DEFAULT, cert_hash_compare(), tls_session::cert_hash_set, tls_options::client_config_dir_exclusive, tls_session::common_name, D_TLS_ERRORS, gc_free(), gc_new(), tls_session::key, KS_AUTH_FALSE, KS_PRIMARY, tls_multi::locked_cert_hash_set, tls_multi::locked_cn, msg, tls_session::opt, platform_gen_path(), platform_test_file(), set_common_name(), tls_deauthenticate(), and wipe_auth_token().
Referenced by key_method_2_read().
void verify_user_pass | ( | struct user_pass * | up, |
struct tls_multi * | multi, | ||
struct tls_session * | session | ||
) |
Verify the given username and password, using either an external script, a plugin, or the management interface.
If authentication succeeds, the appropriate state is filled into the session's primary key state's authenticated field. Authentication may also be deferred, in which case the key state's auth_deferred field is filled in.
up | The username and password to verify. |
multi | The TLS multi structure to verify usernames against. |
session | The current TLS session |
Verify the given username and password, using either an external script, a plugin, or the management interface.
Will set session->ks[KS_PRIMARY].authenticated according to result of the username/password verification
Definition at line 1466 of file ssl_verify.c.
References tls_multi::auth_token, tls_options::auth_token_call_auth, AUTH_TOKEN_EXPIRED, tls_options::auth_token_generate, AUTH_TOKEN_HMAC_OK, tls_multi::auth_token_initial, key_state::auth_token_state_flags, tls_options::auth_user_pass_verify_script, key_state::authenticated, CC_CRLF, CC_PRINT, D_HANDSHAKE, D_TLS_ERRORS, ENABLE_MANAGEMENT, generate_auth_token(), is_auth_token(), tls_session::key, KMDA_DEF, KMDA_ERROR, KMDA_UNDEF, KS_AUTH_DEFERRED, KS_AUTH_FALSE, KS_AUTH_TRUE, KS_PRIMARY, M_WARN, management_enable_def_auth(), msg, OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY, OPENVPN_PLUGIN_FUNC_DEFERRED, OPENVPN_PLUGIN_FUNC_ERROR, OPENVPN_PLUGIN_FUNC_SUCCESS, tls_session::opt, user_pass::password, plugin_defined(), tls_options::plugins, set_common_name(), set_verify_user_pass_env(), tls_options::ssl_flags, SSLF_USERNAME_AS_COMMON_NAME, string_mod(), string_mod_remap_name(), tls_lock_username(), TLS_USERNAME_LEN, user_pass::username, verify_auth_token(), verify_user_pass_management(), verify_user_pass_plugin(), verify_user_pass_script(), and wipe_auth_token().
Referenced by key_method_2_read().