upstream/openvpn
1
0
Fork 0
mirror of https://github.com/OpenVPN/openvpn.git synced 2026-06-09 00:42:51 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

protocol_dump: tls-crypt support

Browse source 
Add support for tls-crypt packets in protocol_dump(). Currently,
protocol_dump() will print garbage for tls-crypt packets.

This patch makes protocol_dump print the clear text parts of the packet such
as the auth tag and replay packet id. It does not try to print the wKc for
HARD_RESET_CLIENT_V3 or CONTROL_WKC_V1 packets.  It also intentionally
does not print ENCRYPTED placeholders for ack list and DATA, to cut down
on the noise.

Signed-off-by: Reynir Björnsson <reynir@reynir.dk>

Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <8237adde-2523-9e48-5cd4-070463887dc1@gmail.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27310.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 227799b834)
This commit is contained in:
Reynir Björnsson 2023-10-26 16:55:32 +02:00 committed by Gert Doering
parent 3b0d9489cc
commit 0a39d1c1e2
3 changed files with 29 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
src/openvpn/openvpn.h
View file

@ -541,7 +541,8 @@ struct context
#define PROTO_DUMP(buf, gc) protocol_dump((buf), \
PROTO_DUMP_FLAGS \
|(c->c2.tls_multi ? PD_TLS : 0) \
|(c->options.tls_auth_file ? md_kt_size(c->c1.ks.key_type.digest) : 0), \
|(c->options.tls_auth_file ? md_kt_size(c->c1.ks.key_type.digest) : 0) \
|(c->options.tls_crypt_file || c->options.tls_crypt_v2_file ? PD_TLS_CRYPT : 0), \
gc)
/* this represents "disabled peer-id" */

26
src/openvpn/ssl.c
View file

@ -4275,6 +4275,32 @@ protocol_dump(struct buffer *buffer, unsigned int flags, struct gc_arena *gc)
}
buf_printf(&out, " pid=%s", packet_id_net_print(&pin, (flags & PD_VERBOSE), gc));
}
/*
* packet_id + tls-crypt hmac
*/
if (flags & PD_TLS_CRYPT)
{
struct packet_id_net pin;
uint8_t tls_crypt_hmac[TLS_CRYPT_TAG_SIZE];
if (!packet_id_read(&pin, &buf, true))
{
goto done;
}
buf_printf(&out, " pid=%s", packet_id_net_print(&pin, (flags & PD_VERBOSE), gc));
if (!buf_read(&buf, tls_crypt_hmac, TLS_CRYPT_TAG_SIZE))
{
goto done;
}
if (flags & PD_VERBOSE)
{
buf_printf(&out, " tls_crypt_hmac=%s", format_hex(tls_crypt_hmac, TLS_CRYPT_TAG_SIZE, 0, gc));
}
/*
* Remainder is encrypted and optional wKc
*/
goto done;
}
/*
* ACK list

1
src/openvpn/ssl.h
View file

@ -525,6 +525,7 @@ tls_set_single_session(struct tls_multi *multi)
#define PD_SHOW_DATA (1<<8)
#define PD_TLS (1<<9)
#define PD_VERBOSE (1<<10)
#define PD_TLS_CRYPT (1<<11)
const char *protocol_dump(struct buffer *buffer,
unsigned int flags,