Attention is currently required from: plaisthos.
Hello plaisthos,
I'd like you to reexamine a change. Please visit
http://gerrit.openvpn.net/c/openvpn/+/1768?usp=email
to look at the new patch set (#13).
Change subject: oob: advertise a connect_lifetime in the probe reply
......................................................................
oob: advertise a connect_lifetime in the probe reply
A server answering an out-of-band SERVER_PROBE now also advertises a
connect_lifetime in the PROBE_REPLY: how long, in seconds, a probing client may
use the reply as the server's HARD_RESET when it starts a handshake.
The value is inferred, not configurable: the reply is only usable as that reset
while its stateless SYN-cookie is valid, i.e. the guaranteed cookie window of
~handshake_window (2 quantised buckets; see check_session_hmac_and_pkt_id), so
the server advertises exactly that. A probe that arrived as
P_CONTROL_OOB_WKC_V1 also gets OOB_PROBE_REPLY_FLAG_RESEND_WKC, telling the
client to resend the WKc when completing the handshake, since the server keeps
no state.
Only the wire advertisement is added here -- the server puts both values into
the probe_reply it builds for an accepted probe. The client side that acts on
them follows.
Change-Id: Ib2b6c2246f9d9c0a505292ee8d879f714901ffae
Signed-off-by: Lev Stipakov <[email protected]>
---
M src/openvpn/mudp.c
M src/openvpn/oob.h
2 files changed, 21 insertions(+), 0 deletions(-)
git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/68/1768/13
diff --git a/src/openvpn/mudp.c b/src/openvpn/mudp.c
index 43aa732..92a38d5 100644
--- a/src/openvpn/mudp.c
+++ b/src/openvpn/mudp.c
@@ -249,12 +249,27 @@
return false;
}
+ /* A tls-crypt-v2 client must resend the WKc if it later uses this
reply
+ * to start a handshake, since we keep no state. */
+ uint32_t reply_flags =
+ (verdict == VERDICT_VALID_OOB_WKC_V1) ?
OOB_PROBE_REPLY_FLAG_RESEND_WKC : 0;
+
+ /* The client's third packet validates only while its SYN-cookie does,
so
+ * the advertised connect_lifetime is inferred (not configurable): the
+ * guaranteed cookie window of ~handshake_window (2 quantised buckets;
see
+ * check_session_hmac_and_pkt_id). Advertising more would make the
client
+ * trust an already-expired cookie. (RFC: connect_lifetime is how long
the
+ * server considers the reply valid.) */
+ int connect_lifetime = 2 * ((handwindow + 1) / 2);
+
/* the echo of the peer's session id, plus what we advertise */
struct oob_probe_reply reply = {
.peer_session_id = state->peer_session_id,
.priority = (uint16_t)m->top.options.server_probe_reply_priority,
.weight = (uint16_t)m->top.options.server_probe_reply_weight,
.max_latency_diff =
(uint16_t)m->top.options.server_probe_reply_max_latency_diff,
+ .connect_lifetime = (uint16_t)connect_lifetime,
+ .flags = reply_flags,
};
/* Our session id is a stateless SYN cookie (the same HMAC the
three-way
diff --git a/src/openvpn/oob.h b/src/openvpn/oob.h
index e637b90..65282e3 100644
--- a/src/openvpn/oob.h
+++ b/src/openvpn/oob.h
@@ -158,6 +158,12 @@
*/
bool oob_timestamp_in_window(uint64_t probe_ts, uint64_t now, uint64_t
window_secs);
+/* probe_reply flags (the reply TLV's 32-bit flags field) */
+/* bit 0: the client must resend the wrapped client key (via P_CONTROL_WKC_V1)
+ * when it completes the handshake started from this reply. Set
+ * by a tls-crypt-v2 server, which is stateless and discarded the WKc. */
+#define OOB_PROBE_REPLY_FLAG_RESEND_WKC 0x1
+
/**
* Decide whether a received SERVER_PROBE is answered. Combines
* oob_server_probe_read() and oob_timestamp_in_window(): the probe is dropped
--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1768?usp=email
To unsubscribe, or for help writing mail filters, visit
http://gerrit.openvpn.net/settings?usp=email
Gerrit-MessageType: newpatchset
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Ib2b6c2246f9d9c0a505292ee8d879f714901ffae
Gerrit-Change-Number: 1768
Gerrit-PatchSet: 13
Gerrit-Owner: stipa <[email protected]>
Gerrit-Reviewer: plaisthos <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>
Gerrit-Attention: plaisthos <[email protected]>
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
