diff options
| author | Arne Schwabe | 2022-05-02 17:43:10 +0200 |
|---|---|---|
| committer | Gert Doering | 2022-05-05 12:12:55 +0200 |
| commit | b364711486dc6371ad2659a5aa190941136f4f04 (patch) | |
| tree | 0c766020ff14f07d5041ae5cb34767a506e99ce6 /doc | |
| parent | 870af5f54967821c72074a7c5c60e10a4561d95e (diff) | |
| download | openvpn-b364711486dc6371ad2659a5aa190941136f4f04.zip openvpn-b364711486dc6371ad2659a5aa190941136f4f04.tar.gz | |
Implement stateless HMAC-based sesssion-id three-way-handshake
OpenVPN currently has a bit of a weakness in its early three way handshake
A single client reset packet (first packet of the handshake) will
- trigger creating a session on the server side leading to potential
ressource exhaustion
- make the server respond with 3 answers trying to get an ACK for its
P_CONTROL_HARD_RESET_SERVER_V2 answer making it an amplification
Instead of allocating a connection for each client on the initial packet
OpenVPN will now calculate a session id based on a HMAC that serves as
verifiable cookie that can be checked for authenticity when the client
responds with it. This eliminates the amplification attack and resource
exhaustion attacks.
For tls-crypt-v2 clients the HMAC based handshake is not used yet (will
be added in one of the next patches).
Patch v2: rebase on master
patch v3: fix unit tests, improve comment/style of code
Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: Frank Lichtenheld <frank@lichtenheld.com>
Message-Id: <20220502154310.836947-1-arne@rfc2549.org>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24262.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/doxygen/doc_protocol_overview.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/doc/doxygen/doc_protocol_overview.h b/doc/doxygen/doc_protocol_overview.h index f26ce3a..37de1cb 100644 --- a/doc/doxygen/doc_protocol_overview.h +++ b/doc/doxygen/doc_protocol_overview.h @@ -118,6 +118,8 @@ * parts: * * - local \c session_id (random 64 bit value to identify TLS session). + * (the tls-server side uses a HMAC of the client to create a pseudo + * random number for a SYN Cookie like approach) * - HMAC signature of entire encapsulation header for HMAC firewall * [only if \c --tls-auth is specified] (usually 16 or 20 bytes). * - packet-id for replay protection (4 or 8 bytes, includes sequence |