auth-gen-token: Generate an auth-token per client

When --auth-gen-token is used a random token key is generated for
each client after a successful user/password authentication.  This
token is expected to be returned in the password field on the
following authentications.

The token is 256 bits long and BASE64 encoded before it is stored.

  v2 - Fix Doxygen comment typo
     - Don't exceed 80 chars line length

Signed-off-by: David Sommerseth <davids@openvpn.net>
Acked-by: Steffan Karger <steffan@karger.me>
Message-Id: <1477684124-26083-4-git-send-email-davids@openvpn.net>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg12820.html

diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c
index cbe925f2b0534bdbbb7f10b9e3342a8f35fb98c7..4a0cd6f3fd71faa66155ee970380b20f9477d99d 100644 (file)
--- a/src/openvpn/ssl.c
+++ b/src/openvpn/ssl.c
@@ -1194,6 +1194,12 @@ tls_multi_free (struct tls_multi *multi, bool clear)
 
   cert_hash_free (multi->locked_cert_hash_set);
 
+  if (multi->auth_token)
+    {
+      memset (multi->auth_token, 0, AUTH_TOKEN_SIZE);
+      free (multi->auth_token);
+    }
+
   for (i = 0; i < TM_SIZE; ++i)
     tls_session_free (&multi->session[i], false);
 

diff --git a/src/openvpn/ssl_common.h b/src/openvpn/ssl_common.h
index 50c4a9ca3597efe7abbcb93c0d339c094bc1bbb0..9b63a1293ebff212c602e865c698a07ac6e5553f 100644 (file)
--- a/src/openvpn/ssl_common.h
+++ b/src/openvpn/ssl_common.h
@@ -351,6 +351,9 @@ struct tls_options
 /** @} name Index of key_state objects within a tls_session structure */
 /** @} addtogroup control_processor */
 
+#define AUTH_TOKEN_SIZE 32      /**< Size of server side generated auth tokens.
+                                 *   32 bytes == 256 bits
+                                 */
 
 /**
  * Security parameter state of a single session within a VPN tunnel.
@@ -525,6 +528,11 @@ struct tls_multi
   uint32_t peer_id;
   bool use_peer_id;
 
+  char *auth_token;      /**< If server sends a generated auth-token,
+                          *   this is the token to use for future
+                          *   user/pass authentications in this session.
+                          */
+  time_t auth_token_tstamp; /**< timestamp of the generated token */
   /*
    * Our session objects.
    */

diff --git a/src/openvpn/ssl_verify.c b/src/openvpn/ssl_verify.c
index d0c22b84ece1bdc80a925b55df15190f77932d7a..0ac5689fbb1df6737d7024a8de623239116d34db 100644 (file)
--- a/src/openvpn/ssl_verify.c
+++ b/src/openvpn/ssl_verify.c
@@ -39,6 +39,8 @@
 
 #include "misc.h"
 #include "manage.h"
+#include "otime.h"
+#include "base64.h"
 #include "ssl_verify.h"
 #include "ssl_verify_backend.h"
 
@@ -1174,6 +1176,43 @@ verify_user_pass(struct user_pass *up, struct tls_multi *multi,
       if (man_def_auth != KMDA_UNDEF)
        ks->auth_deferred = true;
 #endif
+
+      if ((session->opt->auth_token_generate) && (NULL == multi->auth_token))
+       {
+         /* Server is configured with --auth-gen-token but no token has yet
+          * been generated for this client.  Generate one and save it.
+          */
+         uint8_t tok[AUTH_TOKEN_SIZE];
+
+         if (!rand_bytes(tok, AUTH_TOKEN_SIZE))
+           {
+             msg( M_FATAL, "Failed to get enough randomness for "
+                   "authentication token");
+           }
+
+         /* The token should be longer than the input when
+           * being base64 encoded
+           */
+         if( openvpn_base64_encode(tok, AUTH_TOKEN_SIZE,
+                                    &multi->auth_token) < AUTH_TOKEN_SIZE)
+           {
+             msg(D_TLS_ERRORS, "BASE64 encoding of token failed. "
+                  "No auth-token will be activated now");
+             if (multi->auth_token)
+               {
+                 memset (multi->auth_token, 0, AUTH_TOKEN_SIZE);
+                 free (multi->auth_token);
+                 multi->auth_token = NULL;
+               }
+           }
+         else
+           {
+             multi->auth_token_tstamp = now;
+             dmsg (D_SHOW_KEYS, "Generated token for client: %s",
+                    multi->auth_token);
+           }
+       }
+
       if ((session->opt->ssl_flags & SSLF_USERNAME_AS_COMMON_NAME))
        set_common_name (session, up->username);
 #ifdef ENABLE_DEF_AUTH