Module keymethod 

OpenVPN “key method 2”: the first message each side sends inside the TLS control channel.

Once the TLS handshake finishes, both peers write a plaintext record into the TLS session laid out like this (ssl.c, key_method_2_write / key_method_2_read):

u32       0                        -- literal, historical
u8        key method               -- 2, in the low bits
[48]      pre-master secret        -- CLIENT ONLY; the server omits it
[32]      random1
[32]      random2
string    options string           -- the sender's OCC options
string    username                 -- empty when not doing user/pass auth
string    password
string    peer info                -- IV_* variables; empty from a server

A string is a u16 length followed by that many bytes, and the length includes a trailing NUL, which is part of the payload. write_empty_string emits a length of zero and no bytes at all, which is what a server sends for username, password and peer info — so “empty” and “one NUL byte” are two different encodings and only the first is what the peer expects from us.

What this module does and does not do

It parses the client’s message and builds the server’s answer. It does not derive data-channel keys from the exchanged material: that needs the TLS PRF over the combined key sources, and the data channel it would key does not exist. pre_master is deliberately never copied out of the parsed struct into anything persistent.

Structs

ClientKeyMethod2

The client’s key-method-2 message, as parsed off the control channel.

Constants

KEY_METHOD_2

The only key method this server understands.

Functions

build_server_key_method_2

Build the server’s key-method-2 answer.

parse_client_key_method_2

Parse a client key-method-2 message.

peer_info_map

Peer-info lines (IV_VER=...) as a JSON-friendly map, for event data.

server_options_from_client

Derive the options string to answer with from the one the client sent.