Skip to contentSkip to conversation

Add management client version

PATCH In review [email protected]... 3 participants 9 messages Jan 25, 2018 – Jan 29, 2018

lore
Share & tools
lore

[email protected]...

author
#0 lore raw

PATCH 1/2 Add management client version

From: Selva Nair <[email protected]...>

- "version" command from client to management can now set the version of management interface supported by the client by specifying an optional integer parameter.

If no parameter is specified the version of OpenVPN and its management interface is returned (current behaviour).

The client version defaults to 1 which is the current version of the Management Interface.

Signed-off-by Selva Nair <[email protected]...>
---
 doc/management-notes.txt |  6 +++++-
 src/openvpn/manage.c     | 17 ++++++++++++++++-
 src/openvpn/manage.h     |  1 +
 3 files changed, 22 insertions(+), 2 deletions(-)
doc/management-notes.txt +5 -1
index 908b981..e03cd39 100644
@@ -432,8 +432,12 @@ Command examples:
 COMMAND -- version
 ------------------
 
-Show the current OpenVPN and Management Interface versions.
+Set the version (integer) of Management Interface supported by the
+client or show the current OpenVPN and Management Interface versions.
 
+Command examples:
+  version 2  -- Change management version of client to 2 (default = 1)
+  version    -- Show the version of OpenVPN and its Management Interface
 
 COMMAND -- auth-retry
 ---------------------
src/openvpn/manage.c +16 -1
index 650f9e0..c36d94d 100644
@@ -123,7 +123,7 @@ man_help(void)
     msg(M_CLIENT, "test n                 : Produce n lines of output for testing/debugging.");
     msg(M_CLIENT, "username type u        : Enter username u for a queried OpenVPN username.");
     msg(M_CLIENT, "verb [n]               : Set log verbosity level to n, or show if n is absent.");
-    msg(M_CLIENT, "version                : Show current version number.");
+    msg(M_CLIENT, "version [n]            : Set client's version to n or show current version of daemon.");
     msg(M_CLIENT, "END");
 }
 

@@ -1241,6 +1241,15 @@ man_network_change(struct management *man, bool samenetwork)
 #endif
 
 static void
+set_client_version(struct management *man, const char *version)
+{
+    if (version)
+    {
+        man->connection.client_version = atoi(version);
+    }
+}
+
+static void
 man_dispatch_command(struct management *man, struct status_output *so, const char **p, const int nparms)
 {
     struct gc_arena gc = gc_new();

@@ -1255,6 +1264,10 @@ man_dispatch_command(struct management *man, struct status_output *so, const cha
     {
         man_help();
     }
+    else if (streq(p[0], "version") && p[1])
+    {
+        set_client_version(man, p[1]);
+    }
     else if (streq(p[0], "version"))
     {
         msg(M_CLIENT, "OpenVPN Version: %s", title_string);

@@ -2508,6 +2521,8 @@ man_connection_init(struct management *man)
             man->connection.es = event_set_init(&maxevents, EVENT_METHOD_FAST);
         }
 
+        man->connection.client_version = 1; /* default version */
+
         /*
          * Listen/connect socket
          */
src/openvpn/manage.h +1 -0
index 364488f..3bd4e50 100644
@@ -318,6 +318,7 @@ struct man_connection {
     int fdtosend;
     int lastfdreceived;
 #endif
+    int client_version;
 };
 
 struct management
Signature · 1 line
2.1.4
author
#1 lore raw

PATCH 2/2 Prompt for signature using '>PK_SIGN' if the client supports it

From: Selva Nair <[email protected]...>

- Increase the management version from 1 to 2
- If the client announces support for management version > 1 prompt for signature using >PK_SIGN to which the client responds using 'pk-sig'
Older (current) clients will be continued to be prompted by '>RSA_SIGN' and can respond using 'rsa-sig'
- Remove an unused rsa_sig buffer-list variable

This facilitates a transparent transition to PK_SIG and future deprecation of RSA_SIGN

Signed-off-by Selva Nair <[email protected]...>
---
 doc/management-notes.txt  | 13 +++++++++----
 src/openvpn/manage.c      | 32 ++++++++++++++++++++++----------
 src/openvpn/manage.h      |  8 +++-----
 src/openvpn/ssl_mbedtls.c |  2 +-
 src/openvpn/ssl_openssl.c |  2 +-
 5 files changed, 36 insertions(+), 21 deletions(-)
doc/management-notes.txt +9 -4
index e03cd39..070c2d6 100644
@@ -773,8 +773,9 @@ To accept connecting to the host and port directly, use this command:
 
   proxy NONE
 
-COMMAND -- rsa-sig (OpenVPN 2.3 or higher)
-------------------------------------------
+COMMAND -- pk-sig (OpenVPN 2.5 or higher, management version > 1)
+COMMAND -- rsa-sig (OpenVPN 2.3 or higher, management version <= 1)
+-----------------------------------------------------------------
 Provides support for external storage of the private key. Requires the
 --management-external-key option. This option can be used instead of "key"
 in client mode, and allows the client to run without the need to load the

@@ -782,13 +783,14 @@ actual private key. When the SSL protocol needs to perform an RSA sign
 operation, the data to be signed will be sent to the management interface
 via a notification as follows:
 
->RSA_SIGN:[BASE64_DATA]
+>PK_SIGN:[BASE64_DATA] (if client announces support for management version > 1)
+>RSA_SIGN:[BASE64_DATA] (only older clients will be prompted like this)
 
 The management interface client should then create a PKCS#1 v1.5 signature of
 the (decoded) BASE64_DATA using the private key and return the SSL signature as
 follows:
 
-rsa-sig
+pk-sig   (or rsa-sig)
 [BASE64_SIG_LINE]
 .
 .

@@ -801,6 +803,9 @@ Base64 encoded output of RSA_private_encrypt() (OpenSSL) or mbedtls_pk_sign()
 This capability is intended to allow the use of arbitrary cryptographic
 service providers with OpenVPN via the management interface.
 
+New and updated clients are expected to use the version command to announce
+a version > 1 and handle '>PK_SIGN' prompt and respond with 'pk-sig'.
+
 COMMAND -- certificate (OpenVPN 2.4 or higher)
 ----------------------------------------------
 Provides support for external storage of the certificate. Requires the
src/openvpn/manage.c +22 -10
index c36d94d..ca793a9 100644
@@ -111,7 +111,9 @@ man_help(void)
 #endif
 #endif
 #ifdef MANAGMENT_EXTERNAL_KEY
-    msg(M_CLIENT, "rsa-sig                : Enter an RSA signature in response to >RSA_SIGN challenge");
+    msg(M_CLIENT, "rsa-sig                : Enter a signature in response to >RSA_SIGN challenge");
+    msg(M_CLIENT, "                         Enter signature base64 on subsequent lines followed by END");
+    msg(M_CLIENT, "pk-sig                 : Enter a signature in response to >PK_SIGN challenge");
     msg(M_CLIENT, "                         Enter signature base64 on subsequent lines followed by END");
     msg(M_CLIENT, "certificate            : Enter a client certificate in response to >NEED-CERT challenge");
     msg(M_CLIENT, "                         Enter certificate base64 on subsequent lines followed by END");

@@ -935,7 +937,7 @@ in_extra_dispatch(struct management *man)
 
 #endif /* ifdef MANAGEMENT_PF */
 #ifdef MANAGMENT_EXTERNAL_KEY
-        case IEC_RSA_SIGN:
+        case IEC_PK_SIGN:
             man->connection.ext_key_state = EKS_READY;
             buffer_list_free(man->connection.ext_key_input);
             man->connection.ext_key_input = man->connection.in_extra;

@@ -1103,18 +1105,18 @@ man_client_pf(struct management *man, const char *cid_str)
 #ifdef MANAGMENT_EXTERNAL_KEY
 
 static void
-man_rsa_sig(struct management *man)
+man_pk_sig(struct management *man, const char *cmd_name)
 {
     struct man_connection *mc = &man->connection;
     if (mc->ext_key_state == EKS_SOLICIT)
     {
         mc->ext_key_state = EKS_INPUT;
-        mc->in_extra_cmd = IEC_RSA_SIGN;
+        mc->in_extra_cmd = IEC_PK_SIGN;
         in_extra_reset(mc, IER_NEW);
     }
     else
     {
-        msg(M_CLIENT, "ERROR: The rsa-sig command is not currently available");
+        msg(M_CLIENT, "ERROR: The %s command is not currently available", cmd_name);
     }
 }
 

@@ -1527,7 +1529,11 @@ man_dispatch_command(struct management *man, struct status_output *so, const cha
 #ifdef MANAGMENT_EXTERNAL_KEY
     else if (streq(p[0], "rsa-sig"))
     {
-        man_rsa_sig(man);
+        man_pk_sig(man, "rsa-sig");
+    }
+    else if (streq(p[0], "pk-sig"))
+    {
+        man_pk_sig(man, "pk-sig");
     }
     else if (streq(p[0], "certificate"))
     {

@@ -3663,14 +3669,20 @@ management_query_multiline_flatten(struct management *man,
 
 char *
 /* returns allocated base64 signature */
-management_query_rsa_sig(struct management *man,
+management_query_pk_sig(struct management *man,
                          const char *b64_data)
 {
-    return management_query_multiline_flatten(man, b64_data, "RSA_SIGN", "rsa-sign",
-                                              &man->connection.ext_key_state, &man->connection.ext_key_input);
+    const char *prompt = "PK_SIGN";
+    const char *desc = "pk-sign";
+    if (man->connection.client_version <= 1)
+    {
+        prompt = "RSA_SIGN";
+        desc = "rsa-sign";
+    }
+    return management_query_multiline_flatten(man, b64_data, prompt, desc,
+            &man->connection.ext_key_state, &man->connection.ext_key_input);
 }
 
-
 char *
 management_query_cert(struct management *man, const char *cert_name)
 {
src/openvpn/manage.h +3 -5
index 3bd4e50..1b3a393 100644
@@ -31,7 +31,7 @@
 #include "socket.h"
 #include "mroute.h"
 
-#define MANAGEMENT_VERSION                      1
+#define MANAGEMENT_VERSION                      2
 #define MANAGEMENT_N_PASSWORD_RETRIES           3
 #define MANAGEMENT_LOG_HISTORY_INITIAL_SIZE   100
 #define MANAGEMENT_ECHO_BUFFER_SIZE           100

@@ -281,6 +281,7 @@ struct man_connection {
 #define IEC_CLIENT_PF   2
 #define IEC_RSA_SIGN    3
 #define IEC_CERTIFICATE 4
+#define IEC_PK_SIGN     5
     int in_extra_cmd;
     struct buffer_list *in_extra;
 #ifdef MANAGEMENT_DEF_AUTH

@@ -311,9 +312,6 @@ struct man_connection {
     int up_query_mode;
     struct user_pass up_query;
 
-#ifdef MANAGMENT_EXTERNAL_KEY
-    struct buffer_list *rsa_sig;
-#endif
 #ifdef TARGET_ANDROID
     int fdtosend;
     int lastfdreceived;

@@ -440,7 +438,7 @@ void management_learn_addr(struct management *management,
 
 #ifdef MANAGMENT_EXTERNAL_KEY
 
-char *management_query_rsa_sig(struct management *man, const char *b64_data);
+char *management_query_pk_sig(struct management *man, const char *b64_data);
 
 char *management_query_cert(struct management *man, const char *cert_name);
src/openvpn/ssl_mbedtls.c +1 -1
index d503162..b65db3f 100644
@@ -583,7 +583,7 @@ external_pkcs1_sign( void *ctx_voidptr,
     /* call MI for signature */
     if (management)
     {
-        out_b64 = management_query_rsa_sig(management, in_b64);
+        out_b64 = management_query_pk_sig(management, in_b64);
     }
     if (!out_b64)
     {
src/openvpn/ssl_openssl.c +1 -1
index 01be656..242b464 100644
@@ -1068,7 +1068,7 @@ rsa_priv_enc(int flen, const unsigned char *from, unsigned char *to, RSA *rsa, i
     /* call MI for signature */
     if (management)
     {
-        out_b64 = management_query_rsa_sig(management, in_b64);
+        out_b64 = management_query_pk_sig(management, in_b64);
     }
     if (!out_b64)
     {
Signature · 1 line
2.1.4
Acked-by on v1 2/2
#2 lore raw

Re: [Openvpn-devel] [PATCH 2/2] Prompt for signature using '>PK_SIGN' if the client supports it

Am 25.01.18 um 20:41 schrieb [email protected]...:

Quoted 10 lines

From: Selva Nair <[email protected]...>

- Increase the management version from 1 to 2
- If the client announces support for management version > 1 prompt for signature using >PK_SIGN to which the client responds using 'pk-sig'
Older (current) clients will be continued to be prompted by '>RSA_SIGN' and can respond using 'rsa-sig'
- Remove an unused rsa_sig buffer-list variable

Acked-by Arne Schwabe <[email protected]...>

Arne

#3 lore raw

Re: [Openvpn-devel] [PATCH 2/2] Prompt for signature using '>PK_SIGN' if the client supports it

In reply to [email protected]...

Hi,

Quoted 10 lines · On Thu, Jan 25, 2018 at 02:41:01PM -0500, [email protected]... wrote:

From: Selva Nair <[email protected]...>

- Increase the management version from 1 to 2
- If the client announces support for management version > 1 prompt for signature using >PK_SIGN to which the client responds using 'pk-sig'
Older (current) clients will be continued to be prompted by '>RSA_SIGN' and can respond using 'rsa-sig'
- Remove an unused rsa_sig buffer-list variable

Quoted 2 lines

This facilitates a transparent transition to PK_SIG and future deprecation of RSA_SIGN

I'm a bit confused about the sequence of patches here. Is this one dependent on one of the other PK_SIGN related patches? Or standalone and could be applied to master "as is"?

gert

Signature · 3 lines
now what should I write here...

Gert Doering - Munich, Germany                             [email protected]...
#4 lore raw

Re: [Openvpn-devel] [PATCH 2/2] Prompt for signature using '>PK_SIGN' if the client supports it

Am 29.01.18 um 09:25 schrieb Gert Doering:

Quoted 13 lines

Hi,

Quoted 10 lines · On Thu, Jan 25, 2018 at 02:41:01PM -0500, [email protected]... wrote:

From: Selva Nair <[email protected]...>

- Increase the management version from 1 to 2
- If the client announces support for management version > 1 prompt for signature using >PK_SIGN to which the client responds using 'pk-sig'
Older (current) clients will be continued to be prompted by '>RSA_SIGN' and can respond using 'rsa-sig'
- Remove an unused rsa_sig buffer-list variable

Quoted 7 lines
Quoted 2 lines

This facilitates a transparent transition to PK_SIG and future deprecation of RSA_SIGN

I'm a bit confused about the sequence of patches here. Is this one dependent on one of the other PK_SIGN related patches? Or standalone and could be applied to master "as is"?

These patches implement just PK_SIGN instead of RSA-SIGN but do not implement ec cert support. So yes these two patches are applied first and the EC patch comes third.

Arne

author
#5 lore raw

Re: [Openvpn-devel] [PATCH 2/2] Prompt for signature using '>PK_SIGN' if the client supports it

In reply to Gert Doering

Hi,

Quoted 13 lines · Gert Doering

Hi,

Quoted 10 lines · On Thu, Jan 25, 2018 at 02:41:01PM -0500, [email protected]... wrote:

From: Selva Nair <[email protected]...>

- Increase the management version from 1 to 2
- If the client announces support for management version > 1 prompt for signature using >PK_SIGN to which the client responds using 'pk-sig'
Older (current) clients will be continued to be prompted by '>RSA_SIGN' and can respond using 'rsa-sig'
- Remove an unused rsa_sig buffer-list variable

Quoted 6 lines
Quoted 2 lines

This facilitates a transparent transition to PK_SIG and future deprecation of RSA_SIGN

I'm a bit confused about the sequence of patches here. Is this one dependent on one of the other PK_SIGN related patches? Or standalone and could be applied to master "as is"?

Yes this two-patch set is standalone. Here is a gist:

A: change RSA_SIGN to PK_SIGN if client supports it (2 patches)
- [Openvpn-devel,1/2] Add management client version
- [Openvpn-devel,2/2] Prompt for signature using '>PK_SIGN' if the client supports it

B: ecdsa signature via management (one patch)
- [Openvpn-devel,v3,2/3] Allow external EC key through --management-external-key (patch 1 of this series already applied, patch 3 abandoned)

A is standalone, B needs A.

In retrospect, I should have just started a new series. The presence of similar patches for cryptoapicert adds even more to the confusion. Also getting patchwork to correctly identify v2 of a series would help a bit. Its failing likely because of the [Openvpn-devel] in our subject line; if so it could be fixed by a simple patch to patchwork.

Selva

#6 lore raw

[Openvpn-devel] [PATCH applied] Re: Prompt for signature using '>PK_SIGN' if the client supports it

In reply to [email protected]...

Your patch has been applied to the master branch.

commit e7995f3c62597eb963483b96db619f3e5cd4cf13

Author: Selva Nair
Date:   Thu Jan 25 14:41:01 2018 -0500
     Prompt for signature using '>PK_SIGN' if the client supports it

     Signed-off-by: Selva Nair <[email protected]...>
     Acked-by: Arne Schwabe <[email protected]...>
     Message-Id: <[email protected]...>
     URL: https://www.mail-archive.com/[email protected]/msg16364.html
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering

Acked-by on v1 1/2
#7 lore raw
In reply to [email protected]...

Am 25.01.18 um 20:41 schrieb [email protected]...:

Quoted 11 lines

From: Selva Nair <[email protected]...>

- "version" command from client to management can now set the version of management interface supported by the client by specifying an optional integer parameter.

If no parameter is specified the version of OpenVPN and its management interface is returned (current behaviour).

The client version defaults to 1 which is the current version of the Management Interface.

Acked-by Arne Schwabe <[email protected]...>
#8 lore raw
In reply to [email protected]...

Your patch has been applied to the master branch.

commit 686fe9ce54c6913f638b80dd7c28d393aa0cadb1

Author: Selva Nair
Date:   Thu Jan 25 14:41:00 2018 -0500
     Add management client version

     Signed-off-by: Selva Nair <[email protected]...>
     Acked-by: Arne Schwabe <[email protected]...>
     Message-Id: <[email protected]...>
     URL: https://www.mail-archive.com/[email protected]/msg16363.html
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering