[Openvpn-devel] [M] Change in openvpn[master]: oob: Extract init_tls_wrap_ctx() control-channel wrap helper
"stipa \(Code Review\) via Openvpn-devel" <[email protected]> Wed, 29 Jul 2026 12:22:54 +0000
| Newsgroups | net.sourceforge.lists.openvpn-devel |
|---|---|
| Message-ID | <e80246bdfe3b4ea846dd9e18ca9d501da9d0490f-EmailReplacePatchSet-HTML@gerrit.openvpn.net> |
--===============1590101494992222397==
Content-Transfer-Encoding: 8bit
Content-Disposition: inline
Content-Type: multipart/alternative; boundary="bbTy6OO7cXg="; charset=UTF-8
--bbTy6OO7cXg=
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Attention is currently required from: plaisthos=2E
Hello plaisthos,
I'd =
like you to reexamine a change=2E Please visit
http://gerrit=2Eopenvpn=
=2Enet/c/openvpn/+/1749?usp=3Demail
to look at the new patch set (#14)=2E
=
Change subject: oob: Extract init_tls_wrap_ctx() control-channel wrap hel=
per
=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=
=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=
=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E
oob: Ex=
tract init_tls_wrap_ctx() control-channel wrap helper
Factor the tls-auth/=
tls-crypt wrapping-context setup out of
do_init_crypto_tls() into a reusabl=
e init_tls_wrap_ctx() helper, and expose it
in init=2Eh together with do_in=
it_tls_wrap_key(), which now takes the connection
entry to read its keys fr=
om instead of using options=2Ece=2E Both call sites pass
&c->options=2Ece, =
so there is no behavior change=2E
This lets the client --server-probe path=
build the same control-channel
wrapping context before a connection is est=
ablished, so the probe can be
wrapped with tls-auth/tls-crypt like any othe=
r control packet=2E
Change-Id: I7d8546da9ef06c2226ea77e461f9550d24894c61
S=
igned-off-by: Lev Stipakov <lev@openvpn=2Enet>
---
M src/openvpn/init=2Ec
M=
src/openvpn/init=2Eh
2 files changed, 83 insertions(+), 37 deletions(-)
=
git pull ssh://gerrit=2Eopenvpn=2Enet:29418/openvpn refs/changes/49/1749/=
14
diff --git a/src/openvpn/init=2Ec b/src/openvpn/init=2Ec
index 274c86a=
=2E=2Ee0d6a14 100644
--- a/src/openvpn/init=2Ec
+++ b/src/openvpn/init=2Ec
=
@@ -3077,13 +3077,13 @@
/*
* Initialize the tls-auth/crypt key context
=
*/
-static void
-do_init_tls_wrap_key(struct context *c)
+void
+do_init_tl=
s_wrap_key(struct context *c, const struct connection_entry *ce)
{
co=
nst struct options *options =3D &c->options;
/* TLS handshake authen=
tication (--tls-auth) */
- if (options->ce=2Etls_auth_file)
+ if (ce-=
>tls_auth_file)
{
/* Initialize key_type for tls-auth with au=
th only */
CLEAR(c->c1=2Eks=2Etls_auth_key_type);
@@ -3098,33 +309=
8,31 @@
}
crypto_read_openvpn_key(&c->c1=2Eks=2Etls_aut=
h_key_type, &c->c1=2Eks=2Etls_wrap_key,
- op=
tions->ce=2Etls_auth_file, options->ce=2Etls_auth_file_inline,
- =
options->ce=2Ekey_direction, "Control Channel Authenti=
cation",
- "tls-auth", &c->c1=2Eks=2Eorigina=
l_wrap_keydata);
+ ce->tls_auth_file, ce->tl=
s_auth_file_inline, ce->key_direction,
+ "Co=
ntrol Channel Authentication", "tls-auth",
+ =
&c->c1=2Eks=2Eoriginal_wrap_keydata);
}
/* TLS handshake encry=
ption+authentication (--tls-crypt) */
- if (options->ce=2Etls_crypt_file=
)
+ if (ce->tls_crypt_file)
{
tls_crypt_init_key(&c->c1=2E=
ks=2Etls_wrap_key, &c->c1=2Eks=2Eoriginal_wrap_keydata,
- =
options->ce=2Etls_crypt_file, options->ce=2Etls_crypt_file_inline,=
- options->tls_server);
+ =
ce->tls_crypt_file, ce->tls_crypt_file_inline, options->tls_server);
=
}
/* tls-crypt with client-specific keys (--tls-crypt-v2) */
- =
if (options->ce=2Etls_crypt_v2_file)
+ if (ce->tls_crypt_v2_file)
=
{
if (options->tls_server)
{
tls_crypt_v2_in=
it_server_key(&c->c1=2Eks=2Etls_crypt_v2_server_key, true,
- =
options->ce=2Etls_crypt_v2_file,
- =
options->ce=2Etls_crypt_v2_file_inline);
+ =
ce->tls_crypt_v2_file, ce->tls_crypt_v2_f=
ile_inline);
}
else
{
tls_crypt_v2_=
init_client_key(&c->c1=2Eks=2Etls_wrap_key, &c->c1=2Eks=2Eoriginal_wrap_key=
data,
- &c->c1=2Eks=2Etls_crypt_v2_=
wkc, options->ce=2Etls_crypt_v2_file,
- =
options->ce=2Etls_crypt_v2_file_inline);
+ =
&c->c1=2Eks=2Etls_crypt_v2_wkc, ce->tls_crypt_v2_file,
+ =
ce->tls_crypt_v2_file_inline);
=
}
/* We have to ensure that the loaded tls-crypt key is small enou=
gh
* to fit into the initial hard reset v3 packet */
@@ -3133,19 =
+3131,50 @@
/* empty ACK/message id, tls-crypt, Opcode, UDP, ipv6 =
*/
int required_size =3D 5 + wkc_len + tls_crypt_buf_overhead() + =
1 + 8 + 40;
- if (required_size > c->options=2Ece=2Etls_mtu)
+ =
if (required_size > ce->tls_mtu)
{
msg(M_WARN,
=
"ERROR: tls-crypt-v2 client key too large to work with "
=
"requested --max-packet-size %d, requires at least "
=
"--max-packet-size %d=2E Packets will ignore requested "
=
"maximum packet size",
- c->options=2Ece=2Etls_mtu, =
required_size);
+ ce->tls_mtu, required_size);
}
=
}
}
/*
+ * Configure a control-channel wrapping context (tls-auth/tl=
s-crypt) from a
+ * connection entry and the already-loaded tls-wrap key ma=
terial=2E Leaves the
+ * context in TLS_WRAP_NONE if neither tls-auth nor t=
ls-crypt is configured=2E
+ * tls-crypt-v2 specifics (WKc, server key) are =
handled by the caller=2E
+ */
+void
+init_tls_wrap_ctx(struct tls_wrap_ctx =
*tls_wrap, const struct connection_entry *ce, bool tls_client,
+ =
const struct key_schedule *ks, struct packet_id_persist *pid_persist=
)
+{
+ /* TLS handshake authentication (--tls-auth) */
+ if (ce->tls_=
auth_file)
+ {
+ tls_wrap->mode =3D TLS_WRAP_AUTH;
+ }
+
+ =
/* TLS handshake encryption (--tls-crypt) */
+ if (ce->tls_crypt_file ||=
(ce->tls_crypt_v2_file && tls_client))
+ {
+ tls_wrap->mode =3D =
TLS_WRAP_CRYPT;
+ }
+
+ if (tls_wrap->mode =3D=3D TLS_WRAP_AUTH || tl=
s_wrap->mode =3D=3D TLS_WRAP_CRYPT)
+ {
+ tls_wrap->opt=2Ekey_ctx=
_bi =3D ks->tls_wrap_key;
+ tls_wrap->opt=2Epid_persist =3D pid_pers=
ist;
+ tls_wrap->opt=2Eflags |=3D CO_PACKET_ID_LONG_FORM;
+ t=
ls_wrap->original_wrap_keydata =3D ks->original_wrap_keydata;
+ }
+}
+
+=
/*
* Initialize the persistent component of OpenVPN's TLS mode,
* which=
is preserved across SIGUSR1 resets=2E
*/
@@ -3216,7 +3245,7 @@
=
init_key_type(&c->c1=2Eks=2Ekey_type, ciphername, options->authname, true, =
warn);
/* initialize tls-auth/crypt/crypt-v2 key */
- do_=
init_tls_wrap_key(c);
+ do_init_tls_wrap_key(c, &c->options=2Ece);
=
/* initialise auth-token crypto support */
if (c->option=
s=2Eauth_token_generate)
@@ -3241,7 +3270,7 @@
* tls-auth/crypt k=
ey can be configured per connection block, therefore
* we must re=
load it as it may have changed
*/
- do_init_tls_wrap_key(c=
);
+ do_init_tls_wrap_key(c, &c->options=2Ece);
}
}
@@ -3420=
,25 +3449,9 @@
to=2Eekm_size =3D 0;
}
- /* TLS handshake=
authentication (--tls-auth) */
- if (options->ce=2Etls_auth_file)
- =
{
- to=2Etls_wrap=2Emode =3D TLS_WRAP_AUTH;
- }
-
- /* TLS han=
dshake encryption (--tls-crypt) */
- if (options->ce=2Etls_crypt_file ||=
(options->ce=2Etls_crypt_v2_file && options->tls_client))
- {
- =
to=2Etls_wrap=2Emode =3D TLS_WRAP_CRYPT;
- }
-
- if (to=2Etls_wrap=2E=
mode =3D=3D TLS_WRAP_AUTH || to=2Etls_wrap=2Emode =3D=3D TLS_WRAP_CRYPT)
- =
{
- to=2Etls_wrap=2Eopt=2Ekey_ctx_bi =3D c->c1=2Eks=2Etls_wrap_ke=
y;
- to=2Etls_wrap=2Eopt=2Epid_persist =3D &c->c1=2Epid_persist;
- =
to=2Etls_wrap=2Eopt=2Eflags |=3D CO_PACKET_ID_LONG_FORM;
- to=
=2Etls_wrap=2Eoriginal_wrap_keydata =3D c->c1=2Eks=2Eoriginal_wrap_keydata;=
- }
+ /* Control-channel wrapping (--tls-auth / --tls-crypt) */
+ =
init_tls_wrap_ctx(&to=2Etls_wrap, &c->options=2Ece, options->tls_client, &=
c->c1=2Eks,
+ &c->c1=2Epid_persist);
if (option=
s->ce=2Etls_crypt_v2_file)
{
diff --git a/src/openvpn/init=2Eh b/src/o=
penvpn/init=2Eh
index 9d5050d=2E=2E3090375 100644
--- a/src/openvpn/init=2E=
h
+++ b/src/openvpn/init=2Eh
@@ -73,6 +73,39 @@
void do_test_crypto(stru=
ct context *o);
+/**
+ * @brief Load the tls-auth/tls-crypt(-v2) key mate=
rial into c->c1=2Eks=2E
+ *
+ * Reads the key from the file configured on c=
onnection entry ce (--tls-auth,
+ * --tls-crypt or --tls-crypt-v2); a no-op=
when none of them is set=2E May be
+ * called more than once (the key can =
be configured per connection block, so it
+ * is reloaded for each connecti=
on)=2E
+ *
+ * @param c The context whose c1=2Eks key schedule is populate=
d=2E
+ * @param ce The connection entry whose tls-wrap key file is loaded=
=2E
+ */
+void do_init_tls_wrap_key(struct context *c, const struct connect=
ion_entry *ce);
+
+/**
+ * @brief Configure a control-channel wrapping cont=
ext from a connection entry
+ * and previously loaded tls-wrap key m=
aterial=2E
+ *
+ * Sets tls_wrap to TLS_WRAP_AUTH (--tls-auth) or TLS_WRAP_=
CRYPT
+ * (--tls-crypt / client --tls-crypt-v2) and installs the key contex=
t, or
+ * leaves it in TLS_WRAP_NONE when neither is configured=2E The key =
material must
+ * already have been loaded with do_init_tls_wrap_key()=2E t=
ls-crypt-v2 specifics
+ * (the wrapped client key and the server key) are l=
eft to the caller=2E
+ *
+ * @param tls_wrap The wrapping context to con=
figure=2E
+ * @param ce The connection entry selecting the wrappin=
g mode=2E
+ * @param tls_client Whether this is a TLS client (selects tls-=
crypt-v2 mode)=2E
+ * @param ks Key schedule holding the loaded tl=
s-wrap key material=2E
+ * @param pid_persist Packet-id persistence object =
to attach to the context=2E
+ */
+void init_tls_wrap_ctx(struct tls_wrap_ct=
x *tls_wrap, const struct connection_entry *ce,
+ boo=
l tls_client, const struct key_schedule *ks,
+ struct=
packet_id_persist *pid_persist);
+
void context_gc_free(struct context *c=
);
bool do_up(struct context *c, bool pulled_options, uint64_t option_ty=
pes_found);
--
To view, visit http://gerrit=2Eopenvpn=2Enet/c/openvpn/+/1=
749?usp=3Demail
To unsubscribe, or for help writing mail filters, visit htt=
p://gerrit=2Eopenvpn=2Enet/settings?usp=3Demail
Gerrit-MessageType: newpat=
chset
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: I7d85=
46da9ef06c2226ea77e461f9550d24894c61
Gerrit-Change-Number: 1749
Gerrit-Patc=
hSet: 14
Gerrit-Owner: stipa <lstipakov@gmail=2Ecom>
Gerrit-Reviewer: plais=
thos <arne-openvpn@rfc2549=2Eorg>
Gerrit-CC: openvpn-devel <openvpn-devel@l=
ists=2Esourceforge=2Enet>
Gerrit-Attention: plaisthos <arne-openvpn@rfc2549=
=2Eorg>
--bbTy6OO7cXg=
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE html><html><head><style></style></head><body><p> Attention is cur=
rently required from: plaisthos=2E </p>
<p>stipa <strong>uploaded patch set=
#14</strong> to this change=2E</p><p><a href=3D"http://gerrit=2Eopenvpn=2E=
net/c/openvpn/+/1749?usp=3Demail">View Change</a></p><pre class=3D"blocks" =
style=3D"font-family: monospace,monospace; white-space: pre-wrap;">oob: Ext=
ract init_tls_wrap_ctx() control-channel wrap helper<br><br>Factor the tls-=
auth/tls-crypt wrapping-context setup out of<br>do_init_crypto_tls() into a=
reusable init_tls_wrap_ctx() helper, and expose it<br>in init=2Eh together=
with do_init_tls_wrap_key(), which now takes the connection<br>entry to re=
ad its keys from instead of using options=2Ece=2E Both call sites pass<br>&=
amp;c->options=2Ece, so there is no behavior change=2E<br><br>This lets =
the client --server-probe path build the same control-channel<br>wrapping c=
ontext before a connection is established, so the probe can be<br>wrapped w=
ith tls-auth/tls-crypt like any other control packet=2E<br><br>Change-Id: I=
7d8546da9ef06c2226ea77e461f9550d24894c61<br>Signed-off-by: Lev Stipakov <=
;lev@openvpn=2Enet><br>---<br>M src/openvpn/init=2Ec<br>M src/openvpn/in=
it=2Eh<br>2 files changed, 83 insertions(+), 37 deletions(-)<br><br></pre><=
pre class=3D"blocks" style=3D"font-family: monospace,monospace; white-space=
: pre-wrap;">git pull ssh://gerrit=2Eopenvpn=2Enet:29418/openvpn refs/chang=
es/49/1749/14</pre><pre style=3D"font-family: monospace,monospace; white-sp=
ace: pre-wrap;"><span>diff --git a/src/openvpn/init=2Ec b/src/openvpn/init=
=2Ec</span><br><span>index 274c86a=2E=2Ee0d6a14 100644</span><br><span>--- =
a/src/openvpn/init=2Ec</span><br><span>+++ b/src/openvpn/init=2Ec</span><br=
><span>@@ -3077,13 +3077,13 @@</span><br><span> /*</span><br><span> * Init=
ialize the tls-auth/crypt key context</span><br><span> */</span><br><span =
style=3D"color: hsl(0, 100%, 40%);">-static void</span><br><span style=3D"c=
olor: hsl(0, 100%, 40%);">-do_init_tls_wrap_key(struct context *c)</span><b=
r><span style=3D"color: hsl(120, 100%, 40%);">+void</span><br><span style=
=3D"color: hsl(120, 100%, 40%);">+do_init_tls_wrap_key(struct context *c, c=
onst struct connection_entry *ce)</span><br><span> {</span><br><span> c=
onst struct options *options =3D &c->options;</span><br><span> </spa=
n><br><span> /* TLS handshake authentication (--tls-auth) */</span><br>=
<span style=3D"color: hsl(0, 100%, 40%);">- if (options->ce=2Etls_aut=
h_file)</span><br><span style=3D"color: hsl(120, 100%, 40%);">+ if (ce-&=
gt;tls_auth_file)</span><br><span> {</span><br><span> /* Initia=
lize key_type for tls-auth with auth only */</span><br><span> CLEAR=
(c->c1=2Eks=2Etls_auth_key_type);</span><br><span>@@ -3098,33 +3098,31 @=
@</span><br><span> }</span><br><span> </span><br><span> cry=
pto_read_openvpn_key(&c->c1=2Eks=2Etls_auth_key_type, &c->c1=
=2Eks=2Etls_wrap_key,</span><br><span style=3D"color: hsl(0, 100%, 40%);">-=
options->ce=2Etls_auth_file, options->=
;ce=2Etls_auth_file_inline,</span><br><span style=3D"color: hsl(0, 100%, 40=
%);">- options->ce=2Ekey_direction, "=
;Control Channel Authentication",</span><br><span style=3D"color: hsl(=
0, 100%, 40%);">- "tls-auth", &=
;c->c1=2Eks=2Eoriginal_wrap_keydata);</span><br><span style=3D"color: hs=
l(120, 100%, 40%);">+ ce->tls_auth_file, =
ce->tls_auth_file_inline, ce->key_direction,</span><br><span style=3D=
"color: hsl(120, 100%, 40%);">+ "Contro=
l Channel Authentication", "tls-auth",</span><br><span style=
=3D"color: hsl(120, 100%, 40%);">+ &c-&g=
t;c1=2Eks=2Eoriginal_wrap_keydata);</span><br><span> }</span><br><span>=
</span><br><span> /* TLS handshake encryption+authentication (--tls-cr=
ypt) */</span><br><span style=3D"color: hsl(0, 100%, 40%);">- if (option=
s->ce=2Etls_crypt_file)</span><br><span style=3D"color: hsl(120, 100%, 4=
0%);">+ if (ce->tls_crypt_file)</span><br><span> {</span><br><spa=
n> tls_crypt_init_key(&c->c1=2Eks=2Etls_wrap_key, &c->=
;c1=2Eks=2Eoriginal_wrap_keydata,</span><br><span style=3D"color: hsl(0, 10=
0%, 40%);">- options->ce=2Etls_crypt_file, opt=
ions->ce=2Etls_crypt_file_inline,</span><br><span style=3D"color: hsl(0,=
100%, 40%);">- options->tls_server);</span><b=
r><span style=3D"color: hsl(120, 100%, 40%);">+ c=
e->tls_crypt_file, ce->tls_crypt_file_inline, options->tls_server)=
;</span><br><span> }</span><br><span> </span><br><span> /* tls-cryp=
t with client-specific keys (--tls-crypt-v2) */</span><br><span style=3D"co=
lor: hsl(0, 100%, 40%);">- if (options->ce=2Etls_crypt_v2_file)</span=
><br><span style=3D"color: hsl(120, 100%, 40%);">+ if (ce->tls_crypt_=
v2_file)</span><br><span> {</span><br><span> if (options->tl=
s_server)</span><br><span> {</span><br><span> tls_crypt=
_v2_init_server_key(&c->c1=2Eks=2Etls_crypt_v2_server_key, true,</sp=
an><br><span style=3D"color: hsl(0, 100%, 40%);">- =
options->ce=2Etls_crypt_v2_file,</span><br><span style=
=3D"color: hsl(0, 100%, 40%);">- op=
tions->ce=2Etls_crypt_v2_file_inline);</span><br><span style=3D"color: h=
sl(120, 100%, 40%);">+ ce->tls_c=
rypt_v2_file, ce->tls_crypt_v2_file_inline);</span><br><span> }<=
/span><br><span> else</span><br><span> {</span><br><span> =
tls_crypt_v2_init_client_key(&c->c1=2Eks=2Etls_wrap_key, =
&c->c1=2Eks=2Eoriginal_wrap_keydata,</span><br><span style=3D"color:=
hsl(0, 100%, 40%);">- &c->c=
1=2Eks=2Etls_crypt_v2_wkc, options->ce=2Etls_crypt_v2_file,</span><br><s=
pan style=3D"color: hsl(0, 100%, 40%);">- =
options->ce=2Etls_crypt_v2_file_inline);</span><br><span style=3D=
"color: hsl(120, 100%, 40%);">+ &am=
p;c->c1=2Eks=2Etls_crypt_v2_wkc, ce->tls_crypt_v2_file,</span><br><sp=
an style=3D"color: hsl(120, 100%, 40%);">+ =
ce->tls_crypt_v2_file_inline);</span><br><span> }</span>=
<br><span> /* We have to ensure that the loaded tls-crypt key is sm=
all enough</span><br><span> * to fit into the initial hard reset v=
3 packet */</span><br><span>@@ -3133,19 +3131,50 @@</span><br><span> =
/* empty ACK/message id, tls-crypt, Opcode, UDP, ipv6 */</span><br><span>=
int required_size =3D 5 + wkc_len + tls_crypt_buf_overhead() + 1 +=
8 + 40;</span><br><span> </span><br><span style=3D"color: hsl(0, 100%, 40%=
);">- if (required_size > c->options=2Ece=2Etls_mtu)</span><br=
><span style=3D"color: hsl(120, 100%, 40%);">+ if (required_size >=
; ce->tls_mtu)</span><br><span> {</span><br><span> m=
sg(M_WARN,</span><br><span> "ERROR: tls-crypt-v2 clien=
t key too large to work with "</span><br><span> "=
requested --max-packet-size %d, requires at least "</span><br><span> =
"--max-packet-size %d=2E Packets will ignore requested =
"</span><br><span> "maximum packet size",</s=
pan><br><span style=3D"color: hsl(0, 100%, 40%);">- c->op=
tions=2Ece=2Etls_mtu, required_size);</span><br><span style=3D"color: hsl(1=
20, 100%, 40%);">+ ce->tls_mtu, required_size);</span><br=
><span> }</span><br><span> }</span><br><span> }</span><br><span=
> </span><br><span> /*</span><br><span style=3D"color: hsl(120, 100%, 40%);=
">+ * Configure a control-channel wrapping context (tls-auth/tls-crypt) fro=
m a</span><br><span style=3D"color: hsl(120, 100%, 40%);">+ * connection en=
try and the already-loaded tls-wrap key material=2E Leaves the</span><br><s=
pan style=3D"color: hsl(120, 100%, 40%);">+ * context in TLS_WRAP_NONE if n=
either tls-auth nor tls-crypt is configured=2E</span><br><span style=3D"col=
or: hsl(120, 100%, 40%);">+ * tls-crypt-v2 specifics (WKc, server key) are =
handled by the caller=2E</span><br><span style=3D"color: hsl(120, 100%, 40%=
);">+ */</span><br><span style=3D"color: hsl(120, 100%, 40%);">+void</span>=
<br><span style=3D"color: hsl(120, 100%, 40%);">+init_tls_wrap_ctx(struct t=
ls_wrap_ctx *tls_wrap, const struct connection_entry *ce, bool tls_client,<=
/span><br><span style=3D"color: hsl(120, 100%, 40%);">+ co=
nst struct key_schedule *ks, struct packet_id_persist *pid_persist)</span><=
br><span style=3D"color: hsl(120, 100%, 40%);">+{</span><br><span style=3D"=
color: hsl(120, 100%, 40%);">+ /* TLS handshake authentication (--tls-au=
th) */</span><br><span style=3D"color: hsl(120, 100%, 40%);">+ if (ce-&g=
t;tls_auth_file)</span><br><span style=3D"color: hsl(120, 100%, 40%);">+ =
{</span><br><span style=3D"color: hsl(120, 100%, 40%);">+ tls_wrap-=
>mode =3D TLS_WRAP_AUTH;</span><br><span style=3D"color: hsl(120, 100%, =
40%);">+ }</span><br><span style=3D"color: hsl(120, 100%, 40%);">+</span=
><br><span style=3D"color: hsl(120, 100%, 40%);">+ /* TLS handshake encr=
yption (--tls-crypt) */</span><br><span style=3D"color: hsl(120, 100%, 40%)=
;">+ if (ce->tls_crypt_file || (ce->tls_crypt_v2_file && t=
ls_client))</span><br><span style=3D"color: hsl(120, 100%, 40%);">+ {</s=
pan><br><span style=3D"color: hsl(120, 100%, 40%);">+ tls_wrap->m=
ode =3D TLS_WRAP_CRYPT;</span><br><span style=3D"color: hsl(120, 100%, 40%)=
;">+ }</span><br><span style=3D"color: hsl(120, 100%, 40%);">+</span><br=
><span style=3D"color: hsl(120, 100%, 40%);">+ if (tls_wrap->mode =3D=
=3D TLS_WRAP_AUTH || tls_wrap->mode =3D=3D TLS_WRAP_CRYPT)</span><br><sp=
an style=3D"color: hsl(120, 100%, 40%);">+ {</span><br><span style=3D"co=
lor: hsl(120, 100%, 40%);">+ tls_wrap->opt=2Ekey_ctx_bi =3D ks-&g=
t;tls_wrap_key;</span><br><span style=3D"color: hsl(120, 100%, 40%);">+ =
tls_wrap->opt=2Epid_persist =3D pid_persist;</span><br><span style=
=3D"color: hsl(120, 100%, 40%);">+ tls_wrap->opt=2Eflags |=3D CO_=
PACKET_ID_LONG_FORM;</span><br><span style=3D"color: hsl(120, 100%, 40%);">=
+ tls_wrap->original_wrap_keydata =3D ks->original_wrap_keydat=
a;</span><br><span style=3D"color: hsl(120, 100%, 40%);">+ }</span><br><=
span style=3D"color: hsl(120, 100%, 40%);">+}</span><br><span style=3D"colo=
r: hsl(120, 100%, 40%);">+</span><br><span style=3D"color: hsl(120, 100%, 4=
0%);">+/*</span><br><span> * Initialize the persistent component of OpenVP=
N's TLS mode,</span><br><span> * which is preserved across SIGUSR1 res=
ets=2E</span><br><span> */</span><br><span>@@ -3216,7 +3245,7 @@</span><br=
><span> init_key_type(&c->c1=2Eks=2Ekey_type, ciphername, op=
tions->authname, true, warn);</span><br><span> </span><br><span> =
/* initialize tls-auth/crypt/crypt-v2 key */</span><br><span style=3D"colo=
r: hsl(0, 100%, 40%);">- do_init_tls_wrap_key(c);</span><br><span st=
yle=3D"color: hsl(120, 100%, 40%);">+ do_init_tls_wrap_key(c, &c=
->options=2Ece);</span><br><span> </span><br><span> /* initialis=
e auth-token crypto support */</span><br><span> if (c->options=
=2Eauth_token_generate)</span><br><span>@@ -3241,7 +3270,7 @@</span><br><sp=
an> * tls-auth/crypt key can be configured per connection block, t=
herefore</span><br><span> * we must reload it as it may have chang=
ed</span><br><span> */</span><br><span style=3D"color: hsl(0, 100%=
, 40%);">- do_init_tls_wrap_key(c);</span><br><span style=3D"color: =
hsl(120, 100%, 40%);">+ do_init_tls_wrap_key(c, &c->options=
=2Ece);</span><br><span> }</span><br><span> }</span><br><span> </span><=
br><span>@@ -3420,25 +3449,9 @@</span><br><span> to=2Eekm_size =3D =
0;</span><br><span> }</span><br><span> </span><br><span style=3D"color:=
hsl(0, 100%, 40%);">- /* TLS handshake authentication (--tls-auth) */</=
span><br><span style=3D"color: hsl(0, 100%, 40%);">- if (options->ce=
=2Etls_auth_file)</span><br><span style=3D"color: hsl(0, 100%, 40%);">- =
{</span><br><span style=3D"color: hsl(0, 100%, 40%);">- to=2Etls_wra=
p=2Emode =3D TLS_WRAP_AUTH;</span><br><span style=3D"color: hsl(0, 100%, 40=
%);">- }</span><br><span style=3D"color: hsl(0, 100%, 40%);">-</span><br=
><span style=3D"color: hsl(0, 100%, 40%);">- /* TLS handshake encryption=
(--tls-crypt) */</span><br><span style=3D"color: hsl(0, 100%, 40%);">- =
if (options->ce=2Etls_crypt_file || (options->ce=2Etls_crypt_v2_file =
&& options->tls_client))</span><br><span style=3D"color: hsl(0, =
100%, 40%);">- {</span><br><span style=3D"color: hsl(0, 100%, 40%);">- =
to=2Etls_wrap=2Emode =3D TLS_WRAP_CRYPT;</span><br><span style=3D"col=
or: hsl(0, 100%, 40%);">- }</span><br><span style=3D"color: hsl(0, 100%,=
40%);">-</span><br><span style=3D"color: hsl(0, 100%, 40%);">- if (to=
=2Etls_wrap=2Emode =3D=3D TLS_WRAP_AUTH || to=2Etls_wrap=2Emode =3D=3D TLS_=
WRAP_CRYPT)</span><br><span style=3D"color: hsl(0, 100%, 40%);">- {</spa=
n><br><span style=3D"color: hsl(0, 100%, 40%);">- to=2Etls_wrap=2Eop=
t=2Ekey_ctx_bi =3D c->c1=2Eks=2Etls_wrap_key;</span><br><span style=3D"c=
olor: hsl(0, 100%, 40%);">- to=2Etls_wrap=2Eopt=2Epid_persist =3D &a=
mp;c->c1=2Epid_persist;</span><br><span style=3D"color: hsl(0, 100%, 40%=
);">- to=2Etls_wrap=2Eopt=2Eflags |=3D CO_PACKET_ID_LONG_FORM;</span=
><br><span style=3D"color: hsl(0, 100%, 40%);">- to=2Etls_wrap=2Eori=
ginal_wrap_keydata =3D c->c1=2Eks=2Eoriginal_wrap_keydata;</span><br><sp=
an style=3D"color: hsl(0, 100%, 40%);">- }</span><br><span style=3D"colo=
r: hsl(120, 100%, 40%);">+ /* Control-channel wrapping (--tls-auth / --t=
ls-crypt) */</span><br><span style=3D"color: hsl(120, 100%, 40%);">+ ini=
t_tls_wrap_ctx(&to=2Etls_wrap, &c->options=2Ece, options->tls=
_client, &c->c1=2Eks,</span><br><span style=3D"color: hsl(120, 100%,=
40%);">+ &c->c1=2Epid_persist);</span><br><spa=
n> </span><br><span> if (options->ce=2Etls_crypt_v2_file)</span><br>=
<span> {</span><br><span>diff --git a/src/openvpn/init=2Eh b/src/openvp=
n/init=2Eh</span><br><span>index 9d5050d=2E=2E3090375 100644</span><br><spa=
n>--- a/src/openvpn/init=2Eh</span><br><span>+++ b/src/openvpn/init=2Eh</sp=
an><br><span>@@ -73,6 +73,39 @@</span><br><span> </span><br><span> void do_=
test_crypto(struct context *o);</span><br><span> </span><br><span style=3D"=
color: hsl(120, 100%, 40%);">+/**</span><br><span style=3D"color: hsl(120, =
100%, 40%);">+ * @brief Load the tls-auth/tls-crypt(-v2) key material into =
c->c1=2Eks=2E</span><br><span style=3D"color: hsl(120, 100%, 40%);">+ *<=
/span><br><span style=3D"color: hsl(120, 100%, 40%);">+ * Reads the key fro=
m the file configured on connection entry ce (--tls-auth,</span><br><span s=
tyle=3D"color: hsl(120, 100%, 40%);">+ * --tls-crypt or --tls-crypt-v2); a =
no-op when none of them is set=2E May be</span><br><span style=3D"color: hs=
l(120, 100%, 40%);">+ * called more than once (the key can be configured pe=
r connection block, so it</span><br><span style=3D"color: hsl(120, 100%, 40=
%);">+ * is reloaded for each connection)=2E</span><br><span style=3D"color=
: hsl(120, 100%, 40%);">+ *</span><br><span style=3D"color: hsl(120, 100%, =
40%);">+ * @param c The context whose c1=2Eks key schedule is populated=2E=
</span><br><span style=3D"color: hsl(120, 100%, 40%);">+ * @param ce The co=
nnection entry whose tls-wrap key file is loaded=2E</span><br><span style=
=3D"color: hsl(120, 100%, 40%);">+ */</span><br><span style=3D"color: hsl(1=
20, 100%, 40%);">+void do_init_tls_wrap_key(struct context *c, const struct=
connection_entry *ce);</span><br><span style=3D"color: hsl(120, 100%, 40%)=
;">+</span><br><span style=3D"color: hsl(120, 100%, 40%);">+/**</span><br><=
span style=3D"color: hsl(120, 100%, 40%);">+ * @brief Configure a control-c=
hannel wrapping context from a connection entry</span><br><span style=3D"co=
lor: hsl(120, 100%, 40%);">+ * and previously loaded tls-wrap key ma=
terial=2E</span><br><span style=3D"color: hsl(120, 100%, 40%);">+ *</span><=
br><span style=3D"color: hsl(120, 100%, 40%);">+ * Sets tls_wrap to TLS_WRA=
P_AUTH (--tls-auth) or TLS_WRAP_CRYPT</span><br><span style=3D"color: hsl(1=
20, 100%, 40%);">+ * (--tls-crypt / client --tls-crypt-v2) and installs the=
key context, or</span><br><span style=3D"color: hsl(120, 100%, 40%);">+ * =
leaves it in TLS_WRAP_NONE when neither is configured=2E The key material m=
ust</span><br><span style=3D"color: hsl(120, 100%, 40%);">+ * already have =
been loaded with do_init_tls_wrap_key()=2E tls-crypt-v2 specifics</span><br=
><span style=3D"color: hsl(120, 100%, 40%);">+ * (the wrapped client key an=
d the server key) are left to the caller=2E</span><br><span style=3D"color:=
hsl(120, 100%, 40%);">+ *</span><br><span style=3D"color: hsl(120, 100%, 4=
0%);">+ * @param tls_wrap The wrapping context to configure=2E</span><br=
><span style=3D"color: hsl(120, 100%, 40%);">+ * @param ce The con=
nection entry selecting the wrapping mode=2E</span><br><span style=3D"color=
: hsl(120, 100%, 40%);">+ * @param tls_client Whether this is a TLS client=
(selects tls-crypt-v2 mode)=2E</span><br><span style=3D"color: hsl(120, 10=
0%, 40%);">+ * @param ks Key schedule holding the loaded tls-wrap =
key material=2E</span><br><span style=3D"color: hsl(120, 100%, 40%);">+ * @=
param pid_persist Packet-id persistence object to attach to the context=2E<=
/span><br><span style=3D"color: hsl(120, 100%, 40%);">+ */</span><br><span =
style=3D"color: hsl(120, 100%, 40%);">+void init_tls_wrap_ctx(struct tls_wr=
ap_ctx *tls_wrap, const struct connection_entry *ce,</span><br><span style=
=3D"color: hsl(120, 100%, 40%);">+ bool tls_client, c=
onst struct key_schedule *ks,</span><br><span style=3D"color: hsl(120, 100%=
, 40%);">+ struct packet_id_persist *pid_persist);</s=
pan><br><span style=3D"color: hsl(120, 100%, 40%);">+</span><br><span> void=
context_gc_free(struct context *c);</span><br><span> </span><br><span> boo=
l do_up(struct context *c, bool pulled_options, uint64_t option_types_found=
);</span><br><span></span><br></pre><p>To view, visit <a href=3D"http://ger=
rit=2Eopenvpn=2Enet/c/openvpn/+/1749?usp=3Demail">change 1749</a>=2E To uns=
ubscribe, or for help writing mail filters, visit <a href=3D"http://gerrit=
=2Eopenvpn=2Enet/settings?usp=3Demail">settings</a>=2E</p><div itemscope it=
emtype=3D"http://schema=2Eorg/EmailMessage"><div itemscope itemprop=3D"acti=
on" itemtype=3D"http://schema=2Eorg/ViewAction"><link itemprop=3D"url" href=
=3D"http://gerrit=2Eopenvpn=2Enet/c/openvpn/+/1749?usp=3Demail"/><meta item=
prop=3D"name" content=3D"View Change"/></div></div>
<div style=3D"display:=
none"> Gerrit-MessageType: newpatchset </div>
<div style=3D"display:none"> =
Gerrit-Project: openvpn </div>
<div style=3D"display:none"> Gerrit-Branch: =
master </div>
<div style=3D"display:none"> Gerrit-Change-Id: I7d8546da9ef06=
c2226ea77e461f9550d24894c61 </div>
<div style=3D"display:none"> Gerrit-Chan=
ge-Number: 1749 </div>
<div style=3D"display:none"> Gerrit-PatchSet: 14 </d=
iv>
<div style=3D"display:none"> Gerrit-Owner: stipa <lstipakov@gmail=2E=
com> </div>
<div style=3D"display:none"> Gerrit-Reviewer: plaisthos <=
arne-openvpn@rfc2549=2Eorg> </div>
<div style=3D"display:none"> Gerrit-C=
C: openvpn-devel <openvpn-devel@lists=2Esourceforge=2Enet> </div>
<di=
v style=3D"display:none"> Gerrit-Attention: plaisthos <arne-openvpn@rfc2=
549=2Eorg> </div>
</body></html>
--bbTy6OO7cXg=--
--===============1590101494992222397==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
--===============1590101494992222397==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
--===============1590101494992222397==--