OpenVPN
ssl_pkt.c
Go to the documentation of this file.
1/*
2 * OpenVPN -- An application to securely tunnel IP networks
3 * over a single TCP/UDP port, with support for SSL/TLS-based
4 * session authentication and key exchange,
5 * packet encryption, packet authentication, and
6 * packet compression.
7 *
8 * Copyright (C) 2002-2025 OpenVPN Inc <sales@openvpn.net>
9 *
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License version 2
12 * as published by the Free Software Foundation.
13 *
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
18 *
19 * You should have received a copy of the GNU General Public License along
20 * with this program; if not, see <https://www.gnu.org/licenses/>.
21 */
22#ifdef HAVE_CONFIG_H
23#include "config.h"
24#endif
25
26#include "syshead.h"
27
28#include "ssl_util.h"
29#include "ssl_pkt.h"
30#include "ssl_common.h"
31#include "crypto.h"
32#include "session_id.h"
33#include "reliable.h"
34#include "tls_crypt.h"
35
36/*
37 * Dependent on hmac size, opcode size, and session_id size.
38 * Will assert if too small.
39 */
40#define SWAP_BUF_SIZE 256
41
59static bool
60swap_hmac(struct buffer *buf, const struct crypto_options *co, bool incoming)
61{
62 ASSERT(co);
63
64 const struct key_ctx *ctx = (incoming ? &co->key_ctx_bi.decrypt : &co->key_ctx_bi.encrypt);
65 ASSERT(ctx->hmac);
66
67 {
68 /* hmac + packet_id (8 bytes) */
69 const int hmac_size = hmac_ctx_size(ctx->hmac) + packet_id_size(true);
70
71 /* opcode (1 byte) + session_id (8 bytes) */
72 const int osid_size = 1 + SID_SIZE;
73
74 int e1, e2;
75 uint8_t *b = BPTR(buf);
76 uint8_t buf1[SWAP_BUF_SIZE];
77 uint8_t buf2[SWAP_BUF_SIZE];
78
79 if (incoming)
80 {
81 e1 = osid_size;
82 e2 = hmac_size;
83 }
84 else
85 {
86 e1 = hmac_size;
87 e2 = osid_size;
88 }
89
90 ASSERT(e1 <= SWAP_BUF_SIZE && e2 <= SWAP_BUF_SIZE);
91
92 if (buf->len >= e1 + e2)
93 {
94 memcpy(buf1, b, e1);
95 memcpy(buf2, b + e1, e2);
96 memcpy(b, buf2, e2);
97 memcpy(b + e2, buf1, e1);
98 return true;
99 }
100 else
101 {
102 return false;
103 }
104 }
105}
106
107#undef SWAP_BUF_SIZE
108
118static void
119tls_wrap_control(struct tls_wrap_ctx *ctx, uint8_t header, struct buffer *buf,
120 struct session_id *session_id)
121{
122 if (ctx->mode == TLS_WRAP_AUTH || ctx->mode == TLS_WRAP_NONE)
123 {
125 ASSERT(buf_write_prepend(buf, &header, sizeof(header)));
126 }
127 if (ctx->mode == TLS_WRAP_AUTH)
128 {
129 struct buffer null = clear_buf();
130
131 /* no encryption, only write hmac */
132 openvpn_encrypt(buf, null, &ctx->opt);
133 ASSERT(swap_hmac(buf, &ctx->opt, false));
134 }
135 else if (ctx->mode == TLS_WRAP_CRYPT)
136 {
137 ASSERT(buf_init(&ctx->work, buf->offset));
138 ASSERT(buf_write(&ctx->work, &header, sizeof(header)));
140 if (!tls_crypt_wrap(buf, &ctx->work, &ctx->opt))
141 {
142 buf->len = 0;
143 return;
144 }
145
147 || (header >> P_OPCODE_SHIFT) == P_CONTROL_WKC_V1)
148 {
149 if (!buf_copy(&ctx->work, ctx->tls_crypt_v2_wkc))
150 {
151 msg(D_TLS_ERRORS, "Could not append tls-crypt-v2 client key");
152 buf->len = 0;
153 return;
154 }
155 }
156
157 /* Don't change the original data in buf, it's used by the reliability
158 * layer to resend on failure. */
159 *buf = ctx->work;
160 }
161}
162
163void
164write_control_auth(struct tls_session *session, struct key_state *ks, struct buffer *buf,
165 struct link_socket_actual **to_link_addr, int opcode, int max_ack,
166 bool prepend_ack)
167{
168 uint8_t header = ks->key_id | (opcode << P_OPCODE_SHIFT);
169
170 /* Workaround for Softether servers. Softether has a bug that it only
171 * allows 4 ACks in packets and drops packets if more ACKs are contained
172 * in a packet (see commit 37aa1ba5 in Softether) */
173 if (session->tls_wrap.mode == TLS_WRAP_NONE && !session->opt->server
174 && !(session->opt->crypto_flags & CO_USE_TLS_KEY_MATERIAL_EXPORT))
175 {
176 max_ack = min_int(max_ack, 4);
177 }
178
181 prepend_ack));
182
183 msg(D_TLS_DEBUG, "%s(): %s", __func__, packet_opcode_name(opcode));
184
186 &session->session_id);
187
188 *to_link_addr = &ks->remote_addr;
189}
190
191bool
192read_control_auth(struct buffer *buf, struct tls_wrap_ctx *ctx,
193 const struct link_socket_actual *from, const struct tls_options *opt,
194 bool initial_packet)
195{
196 struct gc_arena gc = gc_new();
197 bool ret = false;
198
199 const uint8_t opcode = *(BPTR(buf)) >> P_OPCODE_SHIFT;
200 if ((opcode == P_CONTROL_HARD_RESET_CLIENT_V3 || opcode == P_CONTROL_WKC_V1)
201 && !tls_crypt_v2_extract_client_key(buf, ctx, opt, initial_packet))
202 {
203 msg(D_TLS_ERRORS, "TLS Error: can not extract tls-crypt-v2 client key from %s",
205 goto cleanup;
206 }
207
208 if (ctx->mode == TLS_WRAP_AUTH)
209 {
210 struct buffer null = clear_buf();
211
212 /* move the hmac record to the front of the packet */
213 if (!swap_hmac(buf, &ctx->opt, true))
214 {
215 msg(D_TLS_ERRORS, "TLS Error: cannot locate HMAC in incoming packet from %s",
217 gc_free(&gc);
218 return false;
219 }
220
221 /* authenticate only (no decrypt) and remove the hmac record
222 * from the head of the buffer */
223 openvpn_decrypt(buf, null, &ctx->opt, NULL, BPTR(buf));
224 if (!buf->len)
225 {
226 msg(D_TLS_ERRORS, "TLS Error: incoming packet authentication failed from %s",
228 goto cleanup;
229 }
230 }
231 else if (ctx->mode == TLS_WRAP_CRYPT)
232 {
234 if (!tls_crypt_unwrap(buf, &tmp, &ctx->opt))
235 {
236 msg(D_TLS_ERRORS, "TLS Error: tls-crypt unwrapping failed from %s",
238 goto cleanup;
239 }
240 ASSERT(buf_init(buf, buf->offset));
241 ASSERT(buf_copy(buf, &tmp));
242 buf_clear(&tmp);
243 }
244 else if (ctx->tls_crypt_v2_server_key.cipher)
245 {
246 /* If tls-crypt-v2 is enabled, require *some* wrapping */
247 msg(D_TLS_ERRORS, "TLS Error: could not determine wrapping from %s",
249 /* TODO Do we want to support using tls-crypt-v2 and no control channel
250 * wrapping at all simultaneously? That would allow server admins to
251 * upgrade clients one-by-one without running a second instance, but we
252 * should not enable it by default because it breaks DoS-protection.
253 * So, add something like --tls-crypt-v2-allow-insecure-fallback ? */
254 goto cleanup;
255 }
256
257 if (ctx->mode == TLS_WRAP_NONE || ctx->mode == TLS_WRAP_AUTH)
258 {
259 /* advance buffer pointer past opcode & session_id since our caller
260 * already read it */
261 buf_advance(buf, SID_SIZE + 1);
262 }
263
264 ret = true;
265cleanup:
266 gc_free(&gc);
267 return ret;
268}
269
270void
280
281/*
282 * This function is similar to tls_pre_decrypt, except it is called
283 * when we are in server mode and receive an initial incoming
284 * packet. Note that we don't modify any state in our parameter
285 * objects except state. The purpose is solely to
286 * determine whether we should generate a client instance
287 * object, in which case true is returned.
288 *
289 * This function is essentially the first-line HMAC firewall
290 * on the UDP port listener in --mode server mode.
291 */
294 const struct link_socket_actual *from, const struct buffer *buf)
295{
296 struct gc_arena gc = gc_new();
297 /* A packet needs to have at least an opcode and session id */
298 if (buf->len < (1 + SID_SIZE))
299 {
300 dmsg(D_TLS_STATE_ERRORS, "TLS State Error: Too short packet (length %d) received from %s",
301 buf->len, print_link_socket_actual(from, &gc));
302 goto error;
303 }
304
305 /* get opcode and key ID */
306 uint8_t pkt_firstbyte = *BPTR(buf);
307 int op = pkt_firstbyte >> P_OPCODE_SHIFT;
308 int key_id = pkt_firstbyte & P_KEY_ID_MASK;
309
310 /* this packet is from an as-yet untrusted source, so
311 * scrutinize carefully */
312
313 /* Allow only the reset packet or the first packet of the actual handshake. */
315 && op != P_CONTROL_V1 && op != P_CONTROL_WKC_V1 && op != P_ACK_V1)
316 {
317 /*
318 * This can occur due to bogus data or DoS packets.
319 */
320 dmsg(D_TLS_STATE_ERRORS, "TLS State Error: No TLS state for client %s, opcode=%d",
321 print_link_socket_actual(from, &gc), op);
322 goto error;
323 }
324
325 if (key_id != 0)
326 {
328 "TLS State Error: Unknown key ID (%d) received from %s -- 0 was expected", key_id,
330 goto error;
331 }
332
333 /* read peer session id, we do this at this point since
334 * read_control_auth will skip over it */
335 struct buffer tmp = *buf;
336 buf_advance(&tmp, 1);
337 if (!session_id_read(&state->peer_session_id, &tmp)
339 {
340 msg(D_TLS_ERRORS, "TLS Error: session-id not found in packet from %s",
342 goto error;
343 }
344
345 state->newbuf = clone_buf(buf);
346 state->tls_wrap_tmp = tas->tls_wrap;
347
348 /* HMAC test and unwrapping the encrypted part of the control message
349 * into newbuf or just setting newbuf to point to the start of control
350 * message */
351 bool status = read_control_auth(&state->newbuf, &state->tls_wrap_tmp, from, NULL, true);
352
353 if (!status)
354 {
355 goto error;
356 }
357
358 /*
359 * At this point, if --tls-auth is being used, we know that
360 * the packet has passed the HMAC test, but we don't know if
361 * it is a replay yet. We will attempt to defeat replays
362 * by not advancing to the S_START state until we
363 * receive an ACK from our first reply to the client
364 * that includes an HMAC of our randomly generated 64 bit
365 * session ID.
366 *
367 * On the other hand if --tls-auth is not being used, we
368 * will proceed to begin the TLS authentication
369 * handshake with only cursory integrity checks having
370 * been performed, since we will be leaving the task
371 * of authentication solely up to TLS.
372 */
373 gc_free(&gc);
374 if (op == P_CONTROL_V1)
375 {
377 }
378 else if (op == P_ACK_V1)
379 {
381 }
382 else if (op == P_CONTROL_HARD_RESET_CLIENT_V3)
383 {
385 }
386 else if (op == P_CONTROL_WKC_V1)
387 {
389 }
390 else
391 {
393 }
394
395error:
397 gc_free(&gc);
398 return VERDICT_INVALID;
399}
400
401
402struct buffer
404 struct session_id *own_sid, struct session_id *remote_sid, uint8_t header,
405 bool request_resend_wkc)
406{
407 /* Copy buffer here to point at the same data but allow tls_wrap_control
408 * to potentially change buf to point to another buffer without
409 * modifying the buffer in tas */
410 struct buffer buf = tas->workbuf;
411 ASSERT(buf_init(&buf, tas->frame.buf.headroom));
412
413 /* Reliable ACK structure */
414 /* Length of the ACK structure - 1 ACK */
415 buf_write_u8(&buf, 1);
416
417 /* ACKed packet - first packet's id is always 0 */
418 buf_write_u32(&buf, 0);
419
420 /* Remote session id */
421 buf_write(&buf, remote_sid->id, SID_SIZE);
422
423 /* Packet ID of our own packet: Our reset packet is always using
424 * packet id 0 since it is the first packet */
426
427 ASSERT(buf_write(&buf, &net_pid, sizeof(net_pid)));
428
429 /* Add indication for tls-crypt-v2 to resend the WKc with the reply */
431 {
432 buf_write_u16(&buf, TLV_TYPE_EARLY_NEG_FLAGS); /* TYPE: flags */
433 buf_write_u16(&buf, sizeof(uint16_t));
435 }
436
437 /* Add tls-auth/tls-crypt wrapping, this might replace buf with
438 * ctx->work */
439 tls_wrap_control(ctx, header, &buf, own_sid);
440
441 return buf;
442}
443
446{
447 /* We assume that SHA256 is always available */
448 ASSERT(md_valid("SHA256"));
450
452 ASSERT(rand_bytes(key, sizeof(key)));
453
454 hmac_ctx_init(hmac_ctx, key, "SHA256");
455 return hmac_ctx;
456}
457
458struct session_id
459calculate_session_id_hmac(struct session_id client_sid, const struct openvpn_sockaddr *from,
460 hmac_ctx_t *hmac, int handwindow, int offset)
461{
462 union
463 {
464 uint8_t hmac_result[SHA256_DIGEST_LENGTH];
465 struct session_id sid;
466 } result;
467
468 /* Get the valid time quantisation for our hmac,
469 * we divide time by handwindow/2 and allow the previous
470 * and future session time if specified by offset */
471 uint32_t session_id_time = ntohl(now / ((handwindow + 1) / 2) + offset);
472
473 hmac_ctx_reset(hmac);
474 /* We do not care about endian here since it does not need to be
475 * portable */
476 hmac_ctx_update(hmac, (const uint8_t *)&session_id_time, sizeof(session_id_time));
477
478 /* add client IP and port */
479 switch (from->addr.sa.sa_family)
480 {
481 case AF_INET:
482 hmac_ctx_update(hmac, (const uint8_t *)&from->addr.in4, sizeof(struct sockaddr_in));
483 break;
484
485 case AF_INET6:
486 hmac_ctx_update(hmac, (const uint8_t *)&from->addr.in6, sizeof(struct sockaddr_in6));
487 break;
488 }
489
490 /* add session id of client */
491 hmac_ctx_update(hmac, client_sid.id, SID_SIZE);
492
493 hmac_ctx_final(hmac, result.hmac_result);
494
495 return result.sid;
496}
497
498bool
500 const struct openvpn_sockaddr *from,
501 hmac_ctx_t *hmac,
502 int handwindow,
503 bool pkt_is_ack)
504{
505 if (!from)
506 {
507 return false;
508 }
509
510 struct buffer buf = state->newbuf;
511 struct reliable_ack ack;
512
513 if (!reliable_ack_parse(&buf, &ack, &state->server_session_id))
514 {
515 return false;
516 }
517
518 /* Check if the packet ID of the packet or ACKED packet is <= 1 */
519 for (int i = 0; i < ack.len; i++)
520 {
521 /* This packet ACKs a packet that has a higher packet id than the
522 * ones expected in the three-way handshake, consider it as invalid
523 * for the session */
524 if (ack.packet_id[i] > 1)
525 {
526 return false;
527 }
528 }
529
530 if (!pkt_is_ack)
531 {
532 packet_id_type message_id;
533 /* Extract the packet ID from the packet */
534 if (!reliable_ack_read_packet_id(&buf, &message_id))
535 {
536 return false;
537 }
538
539 /* similar check. Anything larger than 1 is not considered part of the
540 * three-way handshake */
541 if (message_id > 1)
542 {
543 return false;
544 }
545 }
546
547
548 /* check adjacent timestamps too */
549 for (int offset = -2; offset <= 1; offset++)
550 {
551 struct session_id expected_id =
552 calculate_session_id_hmac(state->peer_session_id, from, hmac, handwindow, offset);
553
554 if (memcmp_constant_time(&expected_id, &state->server_session_id, SID_SIZE))
555 {
556 return true;
557 }
558 }
559 return false;
560}
561
562struct buffer
564{
565 /* commands on the control channel are seperated by 0x00 bytes.
566 * cmdlen does not include the 0 byte of the string */
567 int cmdlen = (int)strnlen(BSTR(buf), BLEN(buf));
568
569 if (cmdlen >= BLEN(buf))
570 {
571 buf_advance(buf, cmdlen);
572 /* Return empty buffer */
573 struct buffer empty = { 0 };
574 return empty;
575 }
576
577 /* include the NUL byte and ensure NUL termination */
578 cmdlen += 1;
579
580 /* Construct a buffer that only holds the current command and
581 * its closing NUL byte */
583 buf_write(&cmdbuf, BPTR(buf), cmdlen);
584
585 /* Remove \r and \n at the end of the buffer to avoid
586 * problems with scripts and other that add extra \r and \n */
588
589 /* check we have only printable characters or null byte in the
590 * command string and no newlines */
592 {
593 msg(D_PUSH_ERRORS, "WARNING: Received control with invalid characters: %s",
594 format_hex(BPTR(&cmdbuf), BLEN(&cmdbuf), 256, gc));
595 cmdbuf.len = 0;
596 }
597
598 buf_advance(buf, cmdlen);
599 return cmdbuf;
600}
void free_buf(struct buffer *buf)
Definition buffer.c:184
void buf_clear(struct buffer *buf)
Definition buffer.c:163
struct buffer clone_buf(const struct buffer *buf)
Definition buffer.c:116
bool string_check_buf(struct buffer *buf, const unsigned int inclusive, const unsigned int exclusive)
Check a buffer if it only consists of allowed characters.
Definition buffer.c:1074
struct buffer alloc_buf_gc(size_t size, struct gc_arena *gc)
Definition buffer.c:89
void buf_chomp(struct buffer *buf)
Definition buffer.c:554
static bool buf_write_u16(struct buffer *dest, uint16_t data)
Definition buffer.h:690
static char * format_hex(const uint8_t *data, int size, int maxoutput, struct gc_arena *gc)
Definition buffer.h:503
#define BSTR(buf)
Definition buffer.h:128
static struct buffer clear_buf(void)
Return an empty struct buffer.
Definition buffer.h:222
static bool buf_copy(struct buffer *dest, const struct buffer *src)
Definition buffer.h:704
#define BPTR(buf)
Definition buffer.h:123
static bool buf_write_u32(struct buffer *dest, uint32_t data)
Definition buffer.h:697
static bool buf_write_prepend(struct buffer *dest, const void *src, int size)
Definition buffer.h:672
#define CC_CRLF
carriage return or newline
Definition buffer.h:904
static bool buf_advance(struct buffer *buf, int size)
Definition buffer.h:616
static bool buf_write(struct buffer *dest, const void *src, size_t size)
Definition buffer.h:660
static bool buf_write_u8(struct buffer *dest, uint8_t data)
Definition buffer.h:684
#define BLEN(buf)
Definition buffer.h:126
#define CC_NULL
null character \0
Definition buffer.h:868
static void gc_free(struct gc_arena *a)
Definition buffer.h:1015
#define CC_PRINT
printable (>= 32, != 127)
Definition buffer.h:875
#define buf_init(buf, offset)
Definition buffer.h:209
static struct gc_arena gc_new(void)
Definition buffer.h:1007
static int buf_forward_capacity_total(const struct buffer *buf)
Definition buffer.h:557
void free_key_ctx_bi(struct key_ctx_bi *ctx)
Definition crypto.c:1094
Data Channel Cryptography Module.
#define CO_USE_TLS_KEY_MATERIAL_EXPORT
Bit-flag indicating that data channel key derivation is done using TLS keying material export [RFC570...
Definition crypto.h:357
int memcmp_constant_time(const void *a, const void *b, size_t size)
As memcmp(), but constant-time.
void hmac_ctx_update(hmac_ctx_t *ctx, const uint8_t *src, int src_len)
hmac_ctx_t * hmac_ctx_new(void)
void hmac_ctx_reset(hmac_ctx_t *ctx)
void hmac_ctx_init(hmac_ctx_t *ctx, const uint8_t *key, const char *mdname)
void hmac_ctx_final(hmac_ctx_t *ctx, uint8_t *dst)
bool md_valid(const char *digest)
Return if a message digest parameters is valid given the name of the digest.
int hmac_ctx_size(hmac_ctx_t *ctx)
int rand_bytes(uint8_t *output, int len)
Wrapper for secure random number generator.
mbedtls_md_context_t hmac_ctx_t
Generic HMAC context.
#define SHA256_DIGEST_LENGTH
#define D_TLS_STATE_ERRORS
Definition errlevel.h:133
#define D_PUSH_ERRORS
Definition errlevel.h:66
#define D_TLS_ERRORS
Definition errlevel.h:58
#define D_TLS_DEBUG
Definition errlevel.h:164
enum first_packet_verdict tls_pre_decrypt_lite(const struct tls_auth_standalone *tas, struct tls_pre_decrypt_state *state, const struct link_socket_actual *from, const struct buffer *buf)
Inspect an incoming packet for which no VPN tunnel is active, and determine whether a new VPN tunnel ...
Definition ssl_pkt.c:293
void openvpn_encrypt(struct buffer *buf, struct buffer work, struct crypto_options *opt)
Encrypt and HMAC sign a packet so that it can be sent as a data channel VPN tunnel packet to a remote...
Definition crypto.c:322
bool openvpn_decrypt(struct buffer *buf, struct buffer work, struct crypto_options *opt, const struct frame *frame, const uint8_t *ad_start)
HMAC verify and decrypt a data channel packet received from a remote OpenVPN peer.
Definition crypto.c:773
bool reliable_ack_read_packet_id(struct buffer *buf, packet_id_type *pid)
Read the packet ID of a received packet.
Definition reliable.c:109
bool reliable_ack_parse(struct buffer *buf, struct reliable_ack *ack, struct session_id *session_id_remote)
Parse an acknowledgment record from a received packet.
Definition reliable.c:166
bool reliable_ack_write(struct reliable_ack *ack, struct reliable_ack *ack_mru, struct buffer *buf, const struct session_id *sid, int max, bool prepend)
Write a packet ID acknowledgment record to a buffer.
Definition reliable.c:248
bool tls_crypt_v2_extract_client_key(struct buffer *buf, struct tls_wrap_ctx *ctx, const struct tls_options *opt, bool initial_packet)
Extract a tls-crypt-v2 client key from a P_CONTROL_HARD_RESET_CLIENT_V3 message, and load the key int...
Definition tls_crypt.c:578
bool tls_crypt_unwrap(const struct buffer *src, struct buffer *dst, struct crypto_options *opt)
Unwrap a control channel packet (decrypts, authenticates and performs replay checks).
Definition tls_crypt.c:209
bool tls_crypt_wrap(const struct buffer *src, struct buffer *dst, struct crypto_options *opt)
Wrap a control channel packet (both authenticates and encrypts the data).
Definition tls_crypt.c:136
static int min_int(int x, int y)
Definition integer.h:105
static SERVICE_STATUS status
Definition interactive.c:51
#define dmsg(flags,...)
Definition error.h:170
#define msg(flags,...)
Definition error.h:150
#define ASSERT(x)
Definition error.h:217
time_t now
Definition otime.c:33
#define htonpid(x)
Definition packet_id.h:61
uint32_t packet_id_type
Definition packet_id.h:45
static int packet_id_size(bool long_form)
Definition packet_id.h:313
Reliability Layer module header file.
static bool session_id_write_prepend(const struct session_id *sid, struct buffer *buf)
Definition session_id.h:65
static bool session_id_write(const struct session_id *sid, struct buffer *buf)
Definition session_id.h:71
static bool session_id_defined(const struct session_id *sid1)
Definition session_id.h:53
static bool session_id_read(struct session_id *sid, struct buffer *buf)
Definition session_id.h:59
#define SID_SIZE
Definition session_id.h:44
const char * print_link_socket_actual(const struct link_socket_actual *act, struct gc_arena *gc)
static bool link_socket_actual_defined(const struct link_socket_actual *act)
void tls_clear_error(void)
Clear the underlying SSL library's error state.
Control Channel Common Data Structures.
static void tls_wrap_control(struct tls_wrap_ctx *ctx, uint8_t header, struct buffer *buf, struct session_id *session_id)
Wraps a TLS control packet by adding tls-auth HMAC or tls-crypt(-v2) encryption and opcode header inc...
Definition ssl_pkt.c:119
struct session_id calculate_session_id_hmac(struct session_id client_sid, const struct openvpn_sockaddr *from, hmac_ctx_t *hmac, int handwindow, int offset)
Calculates the HMAC based server session id based on a client session id and socket addr.
Definition ssl_pkt.c:459
void free_tls_pre_decrypt_state(struct tls_pre_decrypt_state *state)
Definition ssl_pkt.c:271
void write_control_auth(struct tls_session *session, struct key_state *ks, struct buffer *buf, struct link_socket_actual **to_link_addr, int opcode, int max_ack, bool prepend_ack)
Definition ssl_pkt.c:164
static bool swap_hmac(struct buffer *buf, const struct crypto_options *co, bool incoming)
Move a packet authentication HMAC + related fields to or from the front of the buffer so it can be pr...
Definition ssl_pkt.c:60
hmac_ctx_t * session_id_hmac_init(void)
Definition ssl_pkt.c:445
struct buffer extract_command_buffer(struct buffer *buf, struct gc_arena *gc)
Extracts a control channel message from buf and adjusts the size of buf after the message has been ex...
Definition ssl_pkt.c:563
#define SWAP_BUF_SIZE
Definition ssl_pkt.c:40
bool read_control_auth(struct buffer *buf, struct tls_wrap_ctx *ctx, const struct link_socket_actual *from, const struct tls_options *opt, bool initial_packet)
Read a control channel authentication record.
Definition ssl_pkt.c:192
bool check_session_hmac_and_pkt_id(struct tls_pre_decrypt_state *state, const struct openvpn_sockaddr *from, hmac_ctx_t *hmac, int handwindow, bool pkt_is_ack)
Checks if a control packet has a correct HMAC server session id.
Definition ssl_pkt.c:499
struct buffer tls_reset_standalone(struct tls_wrap_ctx *ctx, struct tls_auth_standalone *tas, struct session_id *own_sid, struct session_id *remote_sid, uint8_t header, bool request_resend_wkc)
This function creates a reset packet using the information from the tls pre decrypt state.
Definition ssl_pkt.c:403
SSL control channel wrap/unwrap and decode functions.
#define EARLY_NEG_FLAG_RESEND_WKC
Definition ssl_pkt.h:323
#define P_OPCODE_SHIFT
Definition ssl_pkt.h:39
#define TLV_TYPE_EARLY_NEG_FLAGS
Definition ssl_pkt.h:322
#define P_ACK_V1
Definition ssl_pkt.h:46
#define P_CONTROL_WKC_V1
Definition ssl_pkt.h:59
#define P_KEY_ID_MASK
Definition ssl_pkt.h:38
static const char * packet_opcode_name(int op)
Definition ssl_pkt.h:241
#define P_CONTROL_V1
Definition ssl_pkt.h:45
first_packet_verdict
Definition ssl_pkt.h:85
@ VERDICT_VALID_ACK_V1
This packet is a valid ACK control packet from the peer, i.e.
Definition ssl_pkt.h:94
@ VERDICT_VALID_WKC_V1
The packet is a valid control packet with appended wrapped client key.
Definition ssl_pkt.h:96
@ VERDICT_VALID_RESET_V2
This packet is a valid reset packet from the peer (all but tls-crypt-v2)
Definition ssl_pkt.h:87
@ VERDICT_INVALID
the packet failed on of the various checks
Definition ssl_pkt.h:98
@ VERDICT_VALID_RESET_V3
This is a valid v3 reset (tls-crypt-v2)
Definition ssl_pkt.h:89
@ VERDICT_VALID_CONTROL_V1
This packet is a valid control packet from the peer.
Definition ssl_pkt.h:91
#define P_CONTROL_HARD_RESET_CLIENT_V2
Definition ssl_pkt.h:51
static struct tls_wrap_ctx * tls_session_get_tls_wrap(struct tls_session *session, int key_id)
Determines if the current session should use the renegotiation tls wrap struct instead the normal one...
Definition ssl_pkt.h:292
#define P_CONTROL_HARD_RESET_CLIENT_V3
Definition ssl_pkt.h:55
SSL utility functions.
Wrapper structure for dynamically allocated memory.
Definition buffer.h:60
int len
Length in bytes of the actual content within the allocated memory.
Definition buffer.h:65
int offset
Offset in bytes of the actual content within the allocated memory.
Definition buffer.h:63
Security parameter state for processing data channel packets.
Definition crypto.h:293
struct key_ctx_bi key_ctx_bi
OpenSSL cipher and HMAC contexts for both sending and receiving directions.
Definition crypto.h:294
Garbage collection arena used to keep track of dynamically allocated memory.
Definition buffer.h:116
struct key_ctx decrypt
cipher and/or HMAC contexts for receiving direction.
Definition crypto.h:283
struct key_ctx encrypt
Cipher and/or HMAC contexts for sending direction.
Definition crypto.h:281
Container for one set of cipher and/or HMAC contexts.
Definition crypto.h:202
cipher_ctx_t * cipher
Generic cipher context.
Definition crypto.h:203
hmac_ctx_t * hmac
Generic HMAC context.
Definition crypto.h:204
Security parameter state of one TLS and data channel key session.
Definition ssl_common.h:208
struct link_socket_actual remote_addr
Definition ssl_common.h:235
struct reliable_ack * rec_ack
Definition ssl_common.h:247
struct session_id session_id_remote
Definition ssl_common.h:234
int key_id
Key id for this key_state, inherited from struct tls_session.
Definition ssl_common.h:217
struct reliable_ack * lru_acks
Definition ssl_common.h:248
Container for unidirectional cipher and HMAC key material.
Definition crypto.h:152
The acknowledgment structure in which packet IDs are stored for later acknowledgment.
Definition reliable.h:64
struct that stores the temporary data for the tls lite decrypt functions
Definition ssl_pkt.h:106
struct session_id peer_session_id
Definition ssl_pkt.h:109
struct session_id server_session_id
Definition ssl_pkt.h:110
struct buffer newbuf
Definition ssl_pkt.h:108
struct tls_wrap_ctx tls_wrap_tmp
Definition ssl_pkt.h:107
Security parameter state of a single session within a VPN tunnel.
Definition ssl_common.h:490
Control channel wrapping (–tls-auth/–tls-crypt) context.
Definition ssl_common.h:276
struct buffer tls_crypt_v2_metadata
Received from client.
Definition ssl_common.h:288
bool cleanup_key_ctx
opt.key_ctx_bi is owned by this context
Definition ssl_common.h:289
struct crypto_options opt
Crypto state.
Definition ssl_common.h:283
enum tls_wrap_ctx::@28 mode
Control channel wrapping mode.
struct buffer work
Work buffer (only for –tls-crypt)
Definition ssl_common.h:284
struct key_ctx tls_crypt_v2_server_key
Decrypts client keys.
Definition ssl_common.h:285
const struct buffer * tls_crypt_v2_wkc
Wrapped client key, sent to server.
Definition ssl_common.h:286
static int cleanup(void **state)
struct gc_arena gc
Definition test_ssl.c:154