Implements the PsidCookie interface. More...

#include <psid_cookie_impl.hpp>

Inheritance diagram for openvpn::PsidCookieImpl:

Collaboration diagram for openvpn::PsidCookieImpl:

Public Member Functions
	PsidCookieImpl (ServerProto::Factory *psfp)

Intercept	intercept (Buffer &pkt_buf, const PsidCookieAddrInfoBase &pcaib) override
	Called when a potential new client session packet is received.

ProtoSessionID	get_cookie_psid () override
	Get the cookie psid from client's 2nd packet.

void	provide_psid_cookie_transport (PsidCookieTransportBase::Ptr pctb) override
	Give this component the transport needed to send the server's HARD_RESET.

Public Member Functions inherited from openvpn::PsidCookie
virtual	~PsidCookie ()=default

Public Member Functions inherited from openvpn::RC< thread_unsafe_refcount >
	RC () noexcept=default

	RC (const RC &)=delete

virtual	~RC ()=default

RC &	operator= (const RC &)=delete

olong	use_count () const noexcept
	Delegates call to RCImpl and returns the result.

Static Public Member Functions
static void	pre_threading_setup ()

Static Public Member Functions inherited from openvpn::RC< thread_unsafe_refcount >
static constexpr bool	is_thread_safe ()
	Delegates call to RCImpl and returns the result.

Static Public Attributes
static constexpr int	SID_SIZE = ProtoSessionID::SIZE

static constexpr int	OPCODE_SIZE = 1

Private Types
using	CookieHelper = ProtoContext::PsidCookieHelper

Private Member Functions
Intercept	process_clients_initial_reset_tls_auth (ConstBuffer &pkt_buf, const PsidCookieAddrInfoBase &pcaib)

Intercept	process_clients_server_reset_ack_tls_auth (ConstBuffer &pkt_buf, const PsidCookieAddrInfoBase &pcaib)

Intercept	process_clients_initial_reset_tls_crypt (Buffer &pkt_buf, const PsidCookieAddrInfoBase &pcaib, const CookieHelper &ch)

Intercept	process_clients_server_reset_ack_tls_crypt (Buffer &pkt_buf, const PsidCookieAddrInfoBase &pcaib)

ProtoSessionID	calculate_session_id_hmac (const ProtoSessionID &cli_psid, const PsidCookieAddrInfoBase &pcaib, unsigned int offset)
	Calculate the psid cookie, the ProtoSessionID hmac.

bool	check_session_id_hmac (const ProtoSessionID &srv_psid, const ProtoSessionID &cli_psid, const PsidCookieAddrInfoBase &pcaib)

std::optional< std::pair< TLSCryptInstance::Ptr, TLSCryptInstance::Ptr > >	init_tls_crypt_v2 (Buffer &pkt_buf)
	Set up a couple of TLSCryptInstance (send, recv) from a TLS crypt V2 packet's WKc.

Static Private Member Functions
static StaticKey	create_key ()

static const StaticKey &	get_key ()

Private Attributes
ProtoContext::ProtoConfig &	pcfg_

TimePtr	now_

const Time::Duration &	handwindow_

OvpnHMACInstance::Ptr	ta_hmac_recv_

OvpnHMACInstance::Ptr	ta_hmac_send_

SSLLib::CryptoAPI::HMACContext	hmac_ctx_

PsidCookieTransportBase::Ptr	pctb_

ProtoSessionID	cookie_psid_

Static Private Attributes
static constexpr CryptoAlgs::Type	digest_ = CryptoAlgs::Type::SHA256

Additional Inherited Members
Public Types inherited from openvpn::PsidCookie
enum class	Intercept { DECLINE_HANDLING , EARLY_DROP , DROP_1ST , HANDLE_1ST , DROP_2ND , HANDLE_2ND }
	Values returned by the intercept() function. More...

using	Ptr = RCPtr< PsidCookie >

Public Types inherited from openvpn::RC< thread_unsafe_refcount >
using	Ptr = RCPtr< RC >

Detailed Description

Implements the PsidCookie interface.

This code currently only supports tls-auth. The approach can be applied with minimal changes also to tls-crypt/no auth but requires more changes/protocol changes and updated clients for the tls-crypt-v2 case.

This class is not thread safe; it expects to be instantiated in each thread of a multi-threaded server implementation.

Definition at line 45 of file psid_cookie_impl.hpp.

Member Typedef Documentation

◆ CookieHelper

using openvpn::PsidCookieImpl::CookieHelper = ProtoContext::PsidCookieHelper

private

Definition at line 134 of file psid_cookie_impl.hpp.

Constructor & Destructor Documentation

◆ PsidCookieImpl()

openvpn::PsidCookieImpl::PsidCookieImpl ( ServerProto::Factory * psfp )

inline

Definition at line 58 of file psid_cookie_impl.hpp.

Member Function Documentation

◆ calculate_session_id_hmac()

ProtoSessionID openvpn::PsidCookieImpl::calculate_session_id_hmac	(	const ProtoSessionID &	cli_psid,
		const PsidCookieAddrInfoBase &	pcaib,
		unsigned int	offset
	)

inlineprivate

Calculate the psid cookie, the ProtoSessionID hmac.

Parameters

cli_psid	Client's protocol session id, ProtoSessionID
pcaib	Client's address information, reproducibly hashable
offset	moves the time valid time window backward from current

Returns: ProtoSessionID the psid cookie

Definition at line 432 of file psid_cookie_impl.hpp.

Here is the caller graph for this function:

◆ check_session_id_hmac()

bool openvpn::PsidCookieImpl::check_session_id_hmac	(	const ProtoSessionID &	srv_psid,
		const ProtoSessionID &	cli_psid,
		const PsidCookieAddrInfoBase &	pcaib
	)

inlineprivate

Definition at line 472 of file psid_cookie_impl.hpp.

Here is the caller graph for this function:

◆ create_key()

static StaticKey openvpn::PsidCookieImpl::create_key ( )

inlinestaticprivate

Definition at line 407 of file psid_cookie_impl.hpp.

Here is the caller graph for this function:

◆ get_cookie_psid()

ProtoSessionID openvpn::PsidCookieImpl::get_cookie_psid ( )

inlineoverridevirtual

Get the cookie psid from client's 2nd packet.

This provides the server's psid (a.k.a, the cookie_psid) as returned by the client in it's 2nd packet. It may only be called after intercept() returns HANDLE_2ND, indicating a valid psid cookie. Further, it may only be called once as it invalidates the internal data source after it sets the return value.

Returns: ProtoSessionID

Implements openvpn::PsidCookie.

Definition at line 119 of file psid_cookie_impl.hpp.

◆ get_key()

static const StaticKey & openvpn::PsidCookieImpl::get_key ( )

inlinestaticprivate

Definition at line 418 of file psid_cookie_impl.hpp.

Here is the caller graph for this function:

◆ init_tls_crypt_v2()

std::optional< std::pair< TLSCryptInstance::Ptr, TLSCryptInstance::Ptr > > openvpn::PsidCookieImpl::init_tls_crypt_v2 ( Buffer & pkt_buf )

inlineprivate

Set up a couple of TLSCryptInstance (send, recv) from a TLS crypt V2 packet's WKc.

Parameters

pkt_buf The packet holding the WKc at the end.

Returns: A pair of {send, recv} objects set up with the symmetric key. std::nullopt on error.

Definition at line 496 of file psid_cookie_impl.hpp.

Here is the caller graph for this function:

◆ intercept()

Intercept openvpn::PsidCookieImpl::intercept	(	Buffer &	pkt_buf,
		const PsidCookieAddrInfoBase &	pcaib
	)

inlineoverridevirtual

Called when a potential new client session packet is received.

Called by the server implementation when it recieves a packet for which it has no state information. Such a packet is potentially a client HARD_RESET or a 2nd client packet returning the psid cookie.

Parameters

pkt_buf	The packet received by the server implementation.
pcaib	The address information as contained in an instance of the class that the server implementation derived from the PsidCookieAddrInfoBase class

Returns: Intercept Status of the packet handling

Implements openvpn::PsidCookie.

Definition at line 90 of file psid_cookie_impl.hpp.

◆ pre_threading_setup()

static void openvpn::PsidCookieImpl::pre_threading_setup ( )

inlinestatic

Definition at line 53 of file psid_cookie_impl.hpp.

Here is the caller graph for this function:

◆ process_clients_initial_reset_tls_auth()

Intercept openvpn::PsidCookieImpl::process_clients_initial_reset_tls_auth	(	ConstBuffer &	pkt_buf,
		const PsidCookieAddrInfoBase &	pcaib
	)

inlineprivate

Definition at line 136 of file psid_cookie_impl.hpp.

Here is the caller graph for this function:

◆ process_clients_initial_reset_tls_crypt()

Intercept openvpn::PsidCookieImpl::process_clients_initial_reset_tls_crypt	(	Buffer &	pkt_buf,
		const PsidCookieAddrInfoBase &	pcaib,
		const CookieHelper &	ch
	)

inlineprivate

Definition at line 277 of file psid_cookie_impl.hpp.

Here is the caller graph for this function:

◆ process_clients_server_reset_ack_tls_auth()

Intercept openvpn::PsidCookieImpl::process_clients_server_reset_ack_tls_auth	(	ConstBuffer &	pkt_buf,
		const PsidCookieAddrInfoBase &	pcaib
	)

inlineprivate

Definition at line 221 of file psid_cookie_impl.hpp.

Here is the caller graph for this function:

◆ process_clients_server_reset_ack_tls_crypt()

Intercept openvpn::PsidCookieImpl::process_clients_server_reset_ack_tls_crypt	(	Buffer &	pkt_buf,
		const PsidCookieAddrInfoBase &	pcaib
	)

inlineprivate

Definition at line 352 of file psid_cookie_impl.hpp.

Here is the caller graph for this function:

◆ provide_psid_cookie_transport()

void openvpn::PsidCookieImpl::provide_psid_cookie_transport ( PsidCookieTransportBase::Ptr pctb )

inlineoverridevirtual

Give this component the transport needed to send the server's HARD_RESET.

The server implementation must call this method before the intercept() function is asked to handle a packet

Parameters

pctb	The transport capability as provided by the server implementation's object derived from the PsidCookieTransportBase class

Implements openvpn::PsidCookie.

Definition at line 126 of file psid_cookie_impl.hpp.

Member Data Documentation

◆ cookie_psid_

ProtoSessionID openvpn::PsidCookieImpl::cookie_psid_

private

Definition at line 537 of file psid_cookie_impl.hpp.

◆ digest_

constexpr CryptoAlgs::Type openvpn::PsidCookieImpl::digest_ = CryptoAlgs::Type::SHA256

staticconstexprprivate

Definition at line 524 of file psid_cookie_impl.hpp.

◆ handwindow_

const Time::Duration& openvpn::PsidCookieImpl::handwindow_

private

Definition at line 528 of file psid_cookie_impl.hpp.

◆ hmac_ctx_

SSLLib::CryptoAPI::HMACContext openvpn::PsidCookieImpl::hmac_ctx_

private

Definition at line 534 of file psid_cookie_impl.hpp.

◆ now_

TimePtr openvpn::PsidCookieImpl::now_

private

Definition at line 527 of file psid_cookie_impl.hpp.

◆ OPCODE_SIZE

constexpr int openvpn::PsidCookieImpl::OPCODE_SIZE = 1

staticconstexpr

Definition at line 49 of file psid_cookie_impl.hpp.

◆ pcfg_

ProtoContext::ProtoConfig& openvpn::PsidCookieImpl::pcfg_

private

Definition at line 526 of file psid_cookie_impl.hpp.

◆ pctb_

PsidCookieTransportBase::Ptr openvpn::PsidCookieImpl::pctb_

private

Definition at line 536 of file psid_cookie_impl.hpp.

◆ SID_SIZE

constexpr int openvpn::PsidCookieImpl::SID_SIZE = ProtoSessionID::SIZE

staticconstexpr

Definition at line 48 of file psid_cookie_impl.hpp.

◆ ta_hmac_recv_

OvpnHMACInstance::Ptr openvpn::PsidCookieImpl::ta_hmac_recv_

private

Definition at line 530 of file psid_cookie_impl.hpp.

◆ ta_hmac_send_

OvpnHMACInstance::Ptr openvpn::PsidCookieImpl::ta_hmac_send_

private

Definition at line 531 of file psid_cookie_impl.hpp.

The documentation for this class was generated from the following file:

openvpn/ssl/psid_cookie_impl.hpp

Public Member Functions

Static Public Member Functions

Static Public Attributes

Private Types

Private Member Functions

Static Private Member Functions

Private Attributes

Static Private Attributes

Additional Inherited Members

Detailed Description

Member Typedef Documentation

◆ CookieHelper

Constructor & Destructor Documentation

◆ PsidCookieImpl()

Member Function Documentation

◆ calculate_session_id_hmac()

◆ check_session_id_hmac()

◆ create_key()

◆ get_cookie_psid()

◆ get_key()

◆ init_tls_crypt_v2()

◆ intercept()

◆ pre_threading_setup()

◆ process_clients_initial_reset_tls_auth()

◆ process_clients_initial_reset_tls_crypt()

◆ process_clients_server_reset_ack_tls_auth()

◆ process_clients_server_reset_ack_tls_crypt()

◆ provide_psid_cookie_transport()

Member Data Documentation

◆ cookie_psid_

◆ digest_

◆ handwindow_

◆ hmac_ctx_

◆ now_

◆ OPCODE_SIZE

◆ pcfg_

◆ pctb_

◆ SID_SIZE

◆ ta_hmac_recv_

◆ ta_hmac_send_