2 * OpenVPN -- An application to securely tunnel IP networks
3 * over a single TCP/UDP port, with support for SSL/TLS-based
4 * session authentication and key exchange,
5 * packet encryption, packet authentication, and
8 * Copyright (C) 2002-2009 OpenVPN Technologies, Inc. <sales@openvpn.net>
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License version 2
12 * as published by the Free Software Foundation.
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
19 * You should have received a copy of the GNU General Public License
20 * along with this program (see the file COPYING included with this
21 * distribution); if not, write to the Free Software Foundation, Inc.,
22 * 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
26 * These routines are designed to catch replay attacks,
27 * where a man-in-the-middle captures packets and then
28 * attempts to replay them back later.
36 #include "circ_list.h"
42 * Enables OpenVPN to be compiled in special packet_id test mode.
48 * These are the types that members of
49 * a struct packet_id_net are converted
50 * to for network transmission.
52 typedef uint32_t packet_id_type
;
53 typedef uint32_t net_time_t
;
56 * In TLS mode, when a packet ID gets to this level,
57 * start thinking about triggering a new
60 #define PACKET_ID_WRAP_TRIGGER 0xFF000000
62 /* convert a packet_id_type from host to network order */
63 #define htonpid(x) htonl(x)
65 /* convert a packet_id_type from network to host order */
66 #define ntohpid(x) ntohl(x)
68 /* convert a time_t in host order to a net_time_t in network order */
69 #define htontime(x) htonl((net_time_t)x)
71 /* convert a net_time_t in network order to a time_t in host order */
72 #define ntohtime(x) ((time_t)ntohl(x))
78 * Make packet_id_type and net_time_t small
79 * to test wraparound logic and corner cases.
82 typedef uint8_t packet_id_type
;
83 typedef uint16_t net_time_t
;
85 #define PACKET_ID_WRAP_TRIGGER 0x80
87 #define htonpid(x) (x)
88 #define ntohpid(x) (x)
89 #define htontime(x) htons((net_time_t)x)
90 #define ntohtime(x) ((time_t)ntohs(x))
95 * Printf formats for special types
97 #define packet_id_format "%u"
98 typedef unsigned int packet_id_print_type
;
101 * Maximum allowed backtrack in
102 * sequence number due to packets arriving
105 #define MIN_SEQ_BACKTRACK 0
106 #define MAX_SEQ_BACKTRACK 65536
107 #define DEFAULT_SEQ_BACKTRACK 64
110 * Maximum allowed backtrack in
111 * seconds due to packets arriving
114 #define MIN_TIME_BACKTRACK 0
115 #define MAX_TIME_BACKTRACK 600
116 #define DEFAULT_TIME_BACKTRACK 15
119 * Do a reap pass through the sequence number
120 * array once every n seconds in order to
121 * expire sequence numbers which can no longer
122 * be accepted because they would violate
125 #define SEQ_REAP_INTERVAL 5
127 CIRC_LIST (seq_list
, time_t);
130 * This is the data structure we keep on the receiving side,
131 * to check that no packet-id (i.e. sequence number + optional timestamp)
132 * is accepted more than once.
136 time_t last_reap
; /* last call of packet_id_reap */
137 time_t time
; /* highest time stamp received */
138 packet_id_type id
; /* highest sequence number received */
139 int seq_backtrack
; /* set from --replay-window */
140 int time_backtrack
; /* set from --replay-window */
141 bool initialized
; /* true if packet_id_init was called */
142 struct seq_list
*seq_list
; /* packet-id "memory" */
146 * file to facilitate cross-session persistence
149 struct packet_id_persist
151 const char *filename
;
153 time_t time
; /* time stamp */
154 packet_id_type id
; /* sequence number */
155 time_t time_last_written
;
156 packet_id_type id_last_written
;
159 struct packet_id_persist_file_image
161 time_t time
; /* time stamp */
162 packet_id_type id
; /* sequence number */
166 * Keep a record of our current packet-id state
167 * on the sending side.
169 struct packet_id_send
176 * Communicate packet-id over the wire.
177 * A short packet-id is just a 32 bit
178 * sequence number. A long packet-id
179 * includes a timestamp as well.
181 * Long packet-ids are used as IVs for
184 * This data structure is always sent
185 * over the net in network byte order,
186 * by calling htonpid, ntohpid,
187 * htontime, and ntohtime on the
188 * data elements to change them
189 * to and from standard sizes.
191 * In addition, time is converted to
192 * a net_time_t before sending,
193 * since openvpn always
194 * uses a 32-bit time_t but some
195 * 64 bit platforms use a
201 time_t time
; /* converted to net_time_t before transmission */
206 struct packet_id_send send
;
207 struct packet_id_rec rec
;
210 void packet_id_init (struct packet_id
*p
, int seq_backtrack
, int time_backtrack
);
211 void packet_id_free (struct packet_id
*p
);
213 /* should we accept an incoming packet id ? */
214 bool packet_id_test (const struct packet_id_rec
*p
,
215 const struct packet_id_net
*pin
);
217 /* change our current state to reflect an accepted packet id */
218 void packet_id_add (struct packet_id_rec
*p
,
219 const struct packet_id_net
*pin
);
221 /* expire TIME_BACKTRACK sequence numbers */
222 void packet_id_reap (struct packet_id_rec
*p
);
225 * packet ID persistence
228 /* initialize the packet_id_persist structure in a disabled state */
229 void packet_id_persist_init (struct packet_id_persist
*p
);
231 /* close the file descriptor if it is open, and switch to disabled state */
232 void packet_id_persist_close (struct packet_id_persist
*p
);
234 /* load persisted rec packet_id (time and id) only once from file, and set state to enabled */
235 void packet_id_persist_load (struct packet_id_persist
*p
, const char *filename
);
237 /* save persisted rec packet_id (time and id) to file (only if enabled state) */
238 void packet_id_persist_save (struct packet_id_persist
*p
);
240 /* transfer packet_id_persist -> packet_id */
241 void packet_id_persist_load_obj (const struct packet_id_persist
*p
, struct packet_id
* pid
);
243 /* return an ascii string representing a packet_id_persist object */
244 const char *packet_id_persist_print (const struct packet_id_persist
*p
, struct gc_arena
*gc
);
247 * Read/write a packet ID to/from the buffer. Short form is sequence number
248 * only. Long form is sequence number and timestamp.
251 bool packet_id_read (struct packet_id_net
*pin
, struct buffer
*buf
, bool long_form
);
252 bool packet_id_write (const struct packet_id_net
*pin
, struct buffer
*buf
, bool long_form
, bool prepend
);
258 /* are we in enabled state? */
260 packet_id_persist_enabled (const struct packet_id_persist
*p
)
265 /* transfer packet_id -> packet_id_persist */
267 packet_id_persist_save_obj (struct packet_id_persist
*p
, const struct packet_id
* pid
)
269 if (packet_id_persist_enabled (p
) && pid
->rec
.time
)
271 p
->time
= pid
->rec
.time
;
276 const char* packet_id_net_print(const struct packet_id_net
*pin
, bool print_timestamp
, struct gc_arena
*gc
);
279 void packet_id_interactive_test();
283 packet_id_size (bool long_form
)
285 return sizeof (packet_id_type
) + (long_form
? sizeof (net_time_t
) : 0);
289 packet_id_close_to_wrapping (const struct packet_id_send
*p
)
291 return p
->id
>= PACKET_ID_WRAP_TRIGGER
;
295 * Allocate an outgoing packet id.
296 * Sequence number ranges from 1 to 2^32-1.
297 * In long_form, a time_t is added as well.
300 packet_id_alloc_outgoing (struct packet_id_send
*p
, struct packet_id_net
*pin
, bool long_form
)
315 check_timestamp_delta (time_t remote
, unsigned int max_delta
)
318 const time_t local_now
= now
;
320 if (local_now
>= remote
)
321 abs
= local_now
- remote
;
323 abs
= remote
- local_now
;
324 return abs
<= max_delta
;
328 packet_id_reap_test (struct packet_id_rec
*p
)
330 if (p
->last_reap
+ SEQ_REAP_INTERVAL
<= now
)
334 #endif /* PACKET_ID_H */
335 #endif /* USE_CRYPTO */