Implements the PsidCookie interface. More...

#include <psid_cookie_impl.hpp>

Inheritance diagram for openvpn::PsidCookieImpl:

Collaboration diagram for openvpn::PsidCookieImpl:

Public Member Functions
	PsidCookieImpl (ServerProto::Factory *psfp)

Intercept	intercept (Buffer &pkt_buf, const PsidCookieAddrInfoBase &pcaib) override
	Called when a potential new client session packet is received.

ProtoSessionID	get_cookie_psid () override
	Get the cookie psid from client's 2nd packet.

void	provide_psid_cookie_transport (PsidCookieTransportBase::Ptr pctb) override
	Give this component the transport needed to send the server's HARD_RESET.

Public Member Functions inherited from openvpn::PsidCookie
virtual	~PsidCookie ()=default

Public Member Functions inherited from openvpn::RC< thread_unsafe_refcount >
	RC () noexcept=default

	RC (const RC &)=delete

virtual	~RC ()=default

RC &	operator= (const RC &)=delete

olong	use_count () const noexcept
	Delegates call to RCImpl and returns the result.

Static Public Member Functions
static void	pre_threading_setup ()

Static Public Member Functions inherited from openvpn::RC< thread_unsafe_refcount >
static constexpr bool	is_thread_safe ()
	Delegates call to RCImpl and returns the result.

Static Public Attributes
static constexpr int	SID_SIZE = ProtoSessionID::SIZE

static constexpr int	OPCODE_SIZE = 1

Private Types
using	CookieHelper = ProtoContext::PsidCookieHelper

Private Member Functions
template<typename Buf >
bool	validate_3whs_ack_payload (Buf &buf, const ProtoSessionID &cli_psid, const PsidCookieAddrInfoBase &pcaib, bool has_own_pktid=true)

Intercept	process_clients_initial_reset_tls_auth (ConstBuffer &pkt_buf, const PsidCookieAddrInfoBase &pcaib)

Intercept	process_clients_server_reset_ack_tls_auth (ConstBuffer &pkt_buf, const PsidCookieAddrInfoBase &pcaib, bool is_ack_v1)

Intercept	process_clients_initial_reset_tls_crypt (Buffer &pkt_buf, const PsidCookieAddrInfoBase &pcaib, const CookieHelper &ch)

Intercept	process_clients_server_reset_ack_tls_crypt (Buffer &pkt_buf, const PsidCookieAddrInfoBase &pcaib)

ProtoSessionID	calculate_session_id_hmac (const ProtoSessionID &cli_psid, const PsidCookieAddrInfoBase &pcaib, unsigned int offset)
	Calculate the psid cookie, the ProtoSessionID hmac.

bool	check_session_id_hmac (const ProtoSessionID &srv_psid, const ProtoSessionID &cli_psid, const PsidCookieAddrInfoBase &pcaib)

TLSCryptInstance::Ptr	init_tls_crypt_v2 (Buffer &pkt_buf, const unsigned int slice)
	Set up the one TLSCryptInstance a caller needs from a tls-crypt-v2 packet's WKc.

Static Private Member Functions
template<typename Buf >
static bool	read_id_is_early_handshake (Buf &buf)

static StaticKey	create_key ()

static const StaticKey &	get_key ()

Private Attributes
ProtoContext::ProtoConfig &	pcfg_

TimePtr	now_

const Time::Duration &	handwindow_

OvpnHMACInstance::Ptr	ta_hmac_recv_

OvpnHMACInstance::Ptr	ta_hmac_send_

SSLLib::CryptoAPI::HMACContext	hmac_ctx_

PsidCookieTransportBase::Ptr	pctb_

ProtoSessionID	cookie_psid_

Static Private Attributes
static constexpr CryptoAlgs::Type	digest_ = CryptoAlgs::Type::SHA256

Additional Inherited Members
Public Types inherited from openvpn::PsidCookie
enum class	Intercept { DECLINE_HANDLING , EARLY_DROP , DROP_1ST , HANDLE_1ST , DROP_2ND , HANDLE_2ND }
	Values returned by the intercept() function. More...

using	Ptr = RCPtr< PsidCookie >

Public Types inherited from openvpn::RC< thread_unsafe_refcount >
using	Ptr = RCPtr< RC >

Detailed Description

Implements the PsidCookie interface.

This code currently only supports tls-auth. The approach can be applied with minimal changes also to tls-crypt/no auth but requires more changes/protocol changes and updated clients for the tls-crypt-v2 case.

This class is not thread safe; it expects to be instantiated in each thread of a multi-threaded server implementation.

Definition at line 43 of file psid_cookie_impl.hpp.

Member Typedef Documentation

◆ CookieHelper

using openvpn::PsidCookieImpl::CookieHelper = ProtoContext::PsidCookieHelper

private

Definition at line 134 of file psid_cookie_impl.hpp.

Constructor & Destructor Documentation

◆ PsidCookieImpl()

openvpn::PsidCookieImpl::PsidCookieImpl ( ServerProto::Factory * psfp )

inline

Definition at line 56 of file psid_cookie_impl.hpp.

Member Function Documentation

◆ calculate_session_id_hmac()

ProtoSessionID openvpn::PsidCookieImpl::calculate_session_id_hmac	(	const ProtoSessionID &	cli_psid,
		const PsidCookieAddrInfoBase &	pcaib,
		unsigned int	offset
	)

inlineprivate

Calculate the psid cookie, the ProtoSessionID hmac.

Parameters

cli_psid	Client's protocol session id, ProtoSessionID
pcaib	Client's address information, reproducibly hashable
offset	moves the time valid time window backward from current

Returns: ProtoSessionID the psid cookie

Definition at line 469 of file psid_cookie_impl.hpp.

Here is the caller graph for this function:

◆ check_session_id_hmac()

bool openvpn::PsidCookieImpl::check_session_id_hmac	(	const ProtoSessionID &	srv_psid,
		const ProtoSessionID &	cli_psid,
		const PsidCookieAddrInfoBase &	pcaib
	)

inlineprivate

Definition at line 509 of file psid_cookie_impl.hpp.

Here is the caller graph for this function:

◆ create_key()

static StaticKey openvpn::PsidCookieImpl::create_key ( )

inlinestaticprivate

Definition at line 444 of file psid_cookie_impl.hpp.

Here is the caller graph for this function:

◆ get_cookie_psid()

ProtoSessionID openvpn::PsidCookieImpl::get_cookie_psid ( )

inlineoverridevirtual

Get the cookie psid from client's 2nd packet.

This provides the server's psid (a.k.a, the cookie_psid) as returned by the client in it's 2nd packet. It may only be called after intercept() returns HANDLE_2ND, indicating a valid psid cookie. Further, it may only be called once as it invalidates the internal data source after it sets the return value.

Returns: ProtoSessionID

Implements openvpn::PsidCookie.

Definition at line 119 of file psid_cookie_impl.hpp.

◆ get_key()

static const StaticKey & openvpn::PsidCookieImpl::get_key ( )

inlinestaticprivate

Definition at line 455 of file psid_cookie_impl.hpp.

Here is the caller graph for this function:

◆ init_tls_crypt_v2()

TLSCryptInstance::Ptr openvpn::PsidCookieImpl::init_tls_crypt_v2	(	Buffer &	pkt_buf,
		const unsigned int	slice
	)

inlineprivate

Set up the one TLSCryptInstance a caller needs from a tls-crypt-v2 packet's WKc.

Parameters

pkt_buf	The packet holding the WKc at the end.
slice	OpenVPNStaticKey::ENCRYPT for the object that wraps this layer's reply, DECRYPT for the one that reads the client's packet.

Returns: The object, keyed. Null on error.

Definition at line 536 of file psid_cookie_impl.hpp.

Here is the caller graph for this function:

◆ intercept()

Intercept openvpn::PsidCookieImpl::intercept	(	Buffer &	pkt_buf,
		const PsidCookieAddrInfoBase &	pcaib
	)

inlineoverridevirtual

Called when a potential new client session packet is received.

Called by the server implementation when it recieves a packet for which it has no state information. Such a packet is potentially a client HARD_RESET or a 2nd client packet returning the psid cookie.

Parameters

pkt_buf	The packet received by the server implementation.
pcaib	The address information as contained in an instance of the class that the server implementation derived from the PsidCookieAddrInfoBase class

Returns: Intercept Status of the packet handling

Implements openvpn::PsidCookie.

Definition at line 88 of file psid_cookie_impl.hpp.

◆ pre_threading_setup()

static void openvpn::PsidCookieImpl::pre_threading_setup ( )

inlinestatic

Definition at line 51 of file psid_cookie_impl.hpp.

Here is the caller graph for this function:

◆ process_clients_initial_reset_tls_auth()

Intercept openvpn::PsidCookieImpl::process_clients_initial_reset_tls_auth	(	ConstBuffer &	pkt_buf,
		const PsidCookieAddrInfoBase &	pcaib
	)

inlineprivate

Definition at line 175 of file psid_cookie_impl.hpp.

Here is the caller graph for this function:

◆ process_clients_initial_reset_tls_crypt()

Intercept openvpn::PsidCookieImpl::process_clients_initial_reset_tls_crypt	(	Buffer &	pkt_buf,
		const PsidCookieAddrInfoBase &	pcaib,
		const CookieHelper &	ch
	)

inlineprivate

Definition at line 303 of file psid_cookie_impl.hpp.

Here is the caller graph for this function:

◆ process_clients_server_reset_ack_tls_auth()

Intercept openvpn::PsidCookieImpl::process_clients_server_reset_ack_tls_auth	(	ConstBuffer &	pkt_buf,
		const PsidCookieAddrInfoBase &	pcaib,
		bool	is_ack_v1
	)

inlineprivate

Definition at line 260 of file psid_cookie_impl.hpp.

Here is the caller graph for this function:

◆ process_clients_server_reset_ack_tls_crypt()

Intercept openvpn::PsidCookieImpl::process_clients_server_reset_ack_tls_crypt	(	Buffer &	pkt_buf,
		const PsidCookieAddrInfoBase &	pcaib
	)

inlineprivate

Definition at line 389 of file psid_cookie_impl.hpp.

Here is the caller graph for this function:

◆ provide_psid_cookie_transport()

void openvpn::PsidCookieImpl::provide_psid_cookie_transport ( PsidCookieTransportBase::Ptr pctb )

inlineoverridevirtual

Give this component the transport needed to send the server's HARD_RESET.

The server implementation must call this method before the intercept() function is asked to handle a packet

Parameters

pctb	The transport capability as provided by the server implementation's object derived from the PsidCookieTransportBase class

Implements openvpn::PsidCookie.

Definition at line 126 of file psid_cookie_impl.hpp.

◆ read_id_is_early_handshake()

template<typename Buf >

static bool openvpn::PsidCookieImpl::read_id_is_early_handshake ( Buf & buf )

inlinestaticprivate

Definition at line 139 of file psid_cookie_impl.hpp.

Here is the caller graph for this function:

◆ validate_3whs_ack_payload()

template<typename Buf >

bool openvpn::PsidCookieImpl::validate_3whs_ack_payload	(	Buf &	buf,
		const ProtoSessionID &	cli_psid,
		const PsidCookieAddrInfoBase &	pcaib,
		bool	has_own_pktid = `true`
	)

inlineprivate

Definition at line 153 of file psid_cookie_impl.hpp.

Here is the caller graph for this function:

Member Data Documentation

◆ cookie_psid_

ProtoSessionID openvpn::PsidCookieImpl::cookie_psid_

private

Definition at line 577 of file psid_cookie_impl.hpp.

◆ digest_

constexpr CryptoAlgs::Type openvpn::PsidCookieImpl::digest_ = CryptoAlgs::Type::SHA256

staticconstexprprivate

Definition at line 564 of file psid_cookie_impl.hpp.

◆ handwindow_

const Time::Duration& openvpn::PsidCookieImpl::handwindow_

private

Definition at line 568 of file psid_cookie_impl.hpp.

◆ hmac_ctx_

SSLLib::CryptoAPI::HMACContext openvpn::PsidCookieImpl::hmac_ctx_

private

Definition at line 574 of file psid_cookie_impl.hpp.

◆ now_

TimePtr openvpn::PsidCookieImpl::now_

private

Definition at line 567 of file psid_cookie_impl.hpp.

◆ OPCODE_SIZE

constexpr int openvpn::PsidCookieImpl::OPCODE_SIZE = 1

staticconstexpr

Definition at line 47 of file psid_cookie_impl.hpp.

◆ pcfg_

ProtoContext::ProtoConfig& openvpn::PsidCookieImpl::pcfg_

private

Definition at line 566 of file psid_cookie_impl.hpp.

◆ pctb_

PsidCookieTransportBase::Ptr openvpn::PsidCookieImpl::pctb_

private

Definition at line 576 of file psid_cookie_impl.hpp.

◆ SID_SIZE

constexpr int openvpn::PsidCookieImpl::SID_SIZE = ProtoSessionID::SIZE

staticconstexpr

Definition at line 46 of file psid_cookie_impl.hpp.

◆ ta_hmac_recv_

OvpnHMACInstance::Ptr openvpn::PsidCookieImpl::ta_hmac_recv_

private

Definition at line 570 of file psid_cookie_impl.hpp.

◆ ta_hmac_send_

OvpnHMACInstance::Ptr openvpn::PsidCookieImpl::ta_hmac_send_

private

Definition at line 571 of file psid_cookie_impl.hpp.

The documentation for this class was generated from the following file:

openvpn/ssl/psid_cookie_impl.hpp

Public Member Functions

Static Public Member Functions

Static Public Attributes

Private Types

Private Member Functions

Static Private Member Functions

Private Attributes

Static Private Attributes

Additional Inherited Members

Detailed Description

Member Typedef Documentation

◆ CookieHelper

Constructor & Destructor Documentation

◆ PsidCookieImpl()

Member Function Documentation

◆ calculate_session_id_hmac()

◆ check_session_id_hmac()

◆ create_key()

◆ get_cookie_psid()

◆ get_key()

◆ init_tls_crypt_v2()

◆ intercept()

◆ pre_threading_setup()

◆ process_clients_initial_reset_tls_auth()

◆ process_clients_initial_reset_tls_crypt()

◆ process_clients_server_reset_ack_tls_auth()

◆ process_clients_server_reset_ack_tls_crypt()

◆ provide_psid_cookie_transport()

◆ read_id_is_early_handshake()

◆ validate_3whs_ack_payload()

Member Data Documentation

◆ cookie_psid_

◆ digest_

◆ handwindow_

◆ hmac_ctx_

◆ now_

◆ OPCODE_SIZE

◆ pcfg_

◆ pctb_

◆ SID_SIZE

◆ ta_hmac_recv_

◆ ta_hmac_send_