From patchwork Wed Nov 22 03:49:47 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jim Carroll X-Patchwork-Id: 89 Return-Path: Delivered-To: patchwork@openvpn.net Delivered-To: patchwork@openvpn.net Received: from director2.mail.ord1d.rsapps.net ([172.28.255.1]) by backend31.mail.ord1d.rsapps.net (Dovecot) with LMTP id eLahALWXFVqTCgAAgoeIoA for ; Wed, 22 Nov 2017 10:28:53 -0500 Received: from director7.mail.ord1c.rsapps.net ([172.28.255.1]) by director2.mail.ord1d.rsapps.net (Dovecot) with LMTP id W8H7F7WXFVpJTgAAgYhSiA ; Wed, 22 Nov 2017 10:28:53 -0500 Received: from smtp49.gate.ord1c ([172.28.255.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by director7.mail.ord1c.rsapps.net (Dovecot) with LMTP id CEOxF7WXFVoNOAAAqdfm7w ; Wed, 22 Nov 2017 10:28:53 -0500 X-Spam-Threshold: 95 X-Spam-Score: 0 X-Spam-Flag: NO X-Virus-Scanned: OK X-Orig-To: openvpnslackdevel@openvpn.net X-Originating-Ip: [216.34.181.88] Authentication-Results: smtp49.gate.ord1c.rsapps.net; iprev=pass policy.iprev="216.34.181.88"; spf=pass smtp.mailfrom="openvpn-devel-bounces@lists.sourceforge.net" smtp.helo="lists.sourceforge.net"; dkim=fail (signature verification failed) header.d=sourceforge.net; dkim=fail (signature verification failed) header.d=sf.net; dmarc=none (p=nil; dis=none) header.from=carroll.com X-Classification-ID: d88b08be-cf99-11e7-997e-b8ca3a5bc230-1-1 Received: from [216.34.181.88] ([216.34.181.88:55586] helo=lists.sourceforge.net) by smtp49.gate.ord1c.rsapps.net (envelope-from ) (ecelerity 4.2.1.56364 r(Core:4.2.1.14)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id EA/E8-07944-4B7951A5; Wed, 22 Nov 2017 10:28:52 -0500 Received: from localhost ([127.0.0.1] helo=sfs-ml-2.v29.ch3.sourceforge.com) by sfs-ml-2.v29.ch3.sourceforge.com with esmtp (Exim 4.89) (envelope-from ) id 1eHWvl-0005Bf-Jy; Wed, 22 Nov 2017 15:27:17 +0000 Received: from sfi-mx-2.v28.ch3.sourceforge.com ([172.29.28.192] helo=mx.sourceforge.net) by sfs-ml-2.v29.ch3.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.89) (envelope-from ) id 1eHWvk-0005BZ-Aa for openvpn-devel@lists.sourceforge.net; Wed, 22 Nov 2017 15:27:16 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc: MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=eV12pzXS22EDm01zb+8lOMXKoDJOQhfDzO/v2+p/7oQ=; b=LxGtyFWd4jRXqQI1HivHkJg0t6 YIMsSnhh7Uksc363791b8c9pFUkQUiGUbaydlGTh3Cag9hE+pVOfECt3QplGhjAjHDCBPD7Ih0K+t GRq8njyEITFG6KjMOodVzpFaRAW8ZfRnX8B09V061srkO1Elz6oxO8jNAWrpH6m3QmZc=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:MIME-Version: Content-Type:Content-Transfer-Encoding:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=eV12pzXS22EDm01zb+8lOMXKoDJOQhfDzO/v2+p/7oQ=; b=VsBUrWIXGI05QEbBLQRKEbwrGS nhlmTINR+pVGurRcHknKjZkCQnYx+vSE9oUtXnKfQD6kSadDSMPa6ovcqKCKUyuo/B9Uf8CmgkgcX i0Rz/PrnQuDLCoRHqFHfe2XXyv/aj8YcDZPGeWS8Lc16nvlJBijhW80JCRyEg/7NT3jA=; Received: from smtp.hck.carroll.com ([216.44.20.203]) by sfi-mx-2.v28.ch3.sourceforge.com with esmtps (TLSv1:DHE-RSA-CAMELLIA256-SHA:256) (Exim 4.89) id 1eHWvf-0003VV-J3 for openvpn-devel@lists.sourceforge.net; Wed, 22 Nov 2017 15:27:16 +0000 Received: from AS10 (as10.as.hck.carroll.com [10.64.0.64]) by smtp.hck.carroll.com (8.14.5/8.14.5) with ESMTP id vAMEnlSW033984 for ; Wed, 22 Nov 2017 14:49:47 GMT (envelope-from jim@carroll.com) From: "Jim Carroll" To: Date: Wed, 22 Nov 2017 09:49:47 -0500 Message-ID: <00bb01d363a1$2428e260$6c7aa720$@carroll.com> X-Mailer: Microsoft Outlook 14.0 thread-index: AdNjoSCCIwOR6PYbTzOfpq6nuqh/EQ== Content-Language: en-us X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. -0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay domain -0.0 SPF_PASS SPF: sender matches SPF record X-Headers-End: 1eHWvf-0003VV-J3 Subject: [Openvpn-devel] OpenVPN + OpenSSL FIPS Object Module v2.0 causes OpenVPN to SIGSEGV X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox We are trying to get OpenVPN to work with the OpenSSL FIP Object Module v2.0, but each client connection causes our OpenVPN server to SIGSEGV. We know the line of code that is causing the problem (which I'll show below) -- but we're not sure how to convince the OpenVPN server to correctly establish FIPS compatible sessions. First things first, we've successfully built OpenSSL following the directions https://www.openssl.org/docs/fipsnotes.html. We've done a "git clone ..." of the latest version of OpenVPN (2.5). We've also modified the code to call FIPS_mode_set(1) as required by the FIPS Users Guide. FYI I've included the actual code change below this message in case someone suspects it's our code change causing the crash. Using gdb, we traced backwards and can confirm the crash happens in the module src/openvpn/ssl.c, in function tls1_PRF(), line 1722 (https://build.openvpn.net/doxygen/html/ssl_8c_source.html#l01698). The cause is actually a few lines earlier in the call to md_kt_get("MD5"). The code does not check the return value -- and in FIPS mode, MD5 is forbidden. On line 1722 when it tries to dereference the md5 pointer it crashes. I'm not sure how to resolve this issue. tls1_PRF() is building data channel keys exchanged between the client and server. It would appear to me that MD5 is "baked into" the OpenVPN key negotiation in away that cannot be simply omitted/skip/replaced, without a coordinated code change to all downstream client code as well (including IOS). Is that correct? If there is anyway through this (secret command line switches, magic incantations, howling at the moon, etc...), we'd be eternally grateful. And we'd be more than pleased to submit code changes and/or HowTo's back to the project. I'm not sure if we've run into a "can't get there from here" problem or not, but I thought I'd ask the developers. ----- Below is the code change required to activate FIPS mode. begin 666 smime.p7s M,( &"2J&2(;W#0$'`J" ,( "`0$Q"S )!@4K#@,"&@4`,( &"2J&2(;W#0$' M`0``H((.$3""!#8P@@,>H ,"`0("`0$P#08)*H9(AO<-`0$%!0`P;S$+, D& M`U4$!A,"4T4Q%# 2!@-5! H3"T%D9%1R=7-T($%",28P) 8#500+$QU!9&14 M'1E%PTP,# U,S Q,#0X,SA:%PTR,# U,S Q,#0X M,SA:,&\Q"S )!@-5! 83`E-%,10P$@8#500*$PM!9&14FQ$SEZ0I M3'V3G[U*O)/M`QKCC\_E;5!:UI=,K(D%3IQE\/>)V:0#P.K&&J7A2/GH>A:E#&`JCIJ&DF&)"K3+!/(ZLZ3X38W\Z?X6EON]="UVM$Y,>M[FU! M7W):<0@WLWEEI%F@E#?W`"\-PI)RVM X DRU0:, L& M`U4=#P0$`P(!!C /!@-5'1,!`?\$!3 #`0'_,(&9!@-5'2,$@9$P@8Z %*V] MF'HTM";W^L0F5.\#O> DRU0:H7.D<3!O,0LP"08#500&$P)313$4,!(&`U4$ M"A,+061D5')U8'9 M'EL4!R,V98^PV'>[K$%L1V"#4;#Y,CWG_/8F$\> %J6_6OR'SWAYB2&:XDP' M"H8UO/+>4<32EK?L,`E$4+8Z]%N#!WT9UYR2M[/1"M(63:[H<4KPC:^$PWFO6-^>7NG"0U JVK=CXK#]O:, M&D(%4=1%]9^G8B%H%2!#/)GG?+TDV*F1%W.(/U8;,3@8M'$/FLW(#IZ.+AOA MC)B#RQ\Q\41,Q@1S279@#\?XO1> :R[IS$P.6IIY#R *+M6>8R8>59*4V((7 M6GO0O,>/3H8$,(($KS""`Y>@`P(!`@(1`. CRQ42@U.)K6%N>E1G:R$P#08) M*H9(AO<-`0$+!0`P;S$+, D&`U4$!A,"4T4Q%# 2!@-5! H3"T%D9%1R=7-T M($%",28P) 8#500+$QU!9&14'1E%PTQ-#$R,C(P M,# P,#!:%PTR,# U,S Q,#0X,SA:,(&;,0LP"08#500&$P)'0C$;,!D&`U4$ M"!,21W)E871EE,93G!2';Q6 MI@8FM[A)X);G4:OQ\%H3216CM(P;8+QZ44*G>8RD(M\784Z1U78C"A332@)_ MMAT)@&ZE!#W9NKL6_J&'J2Y#4D,6?*\R4,BF3UKI"-C/DR6<>XCH,&3FI/A6 M@/TJ)!0S%YFL1.5IBZ-&!DO",]3I0)\&L+&LDT"YM0B3.IPJ4Z,0VST@83Q5 M`X[93G8E`B$I^J-\<79/[N%?@>G[5(#;PWLU4K>$WB(]+# M,7]9O5(WL#-I M+4/K^M:E\9=W9U&,V>XGZ[RE!SAVC*2I./_?C/4#K$F^RO=SF3H/,JNPP#@8#51T/`0'_! 0#`@&&,!(&`U4=$P$!_P0(, 8!`?\"`0`P'08# M51TE!!8P% 8(*P8!!04'`P(&""L&`04%!P,$,!$&`U4=( 0*, @P!@8$51T@ M`#!$!@-5'1\$/3 [,#F@-Z UAC-H='1P.B\O8W)L+G5S97)T'1EJSMCY=K5<^_LX/M[XJ/_\$(CG,JVC4T^Y$L8`[*H+=38 MNT)+D&F%$-NF-S3H>^ !$*6Y+,KF'$K8F0W!AN*0DOM:0FHC(1#I M913V2A :)OI\BON;,((% M(#""! B@`P(!`@(1`(+-2':;XZ#&U!G>^P&7OJPP#08)*H9(AO<-`0$+!0`P M@9LQ"S )!@-5! 83`D=",1LP&08#500($Q)'%PTQ-S Q,3@P,# P,#!:%PTR,# Q M,3@R,S4Y-3E:," Q'C ;EY]ERMD$,P;8"I7X M?^ /F69VS8/L_HEV(J#N= $S];)Z)NSNCEKQQL*V\)X*[3:U#K&RT"]7`^(9 M/]<<)D]QC$]^CQB)W6&GH=]!S)"#BX#@1Q)ZRNK%`>L!^4T4%*7SH4#L9W*4 MT$5<*UR%\T_56N':GCA]ND5XQ(/B6G)$ M+.45284OBU4BNP&F^_G1,%^"$.,_`")HQ!K_IW :.=0"J38^R&!!*H#$V>"H M\A*[L =HF*&;G2L'<8*^T%BY+7S.3D[>P=G4O*#;+C4>,]Q8'MX2A9@G$#LC M'5]WL4$YZ?=VZ+H"B_33;&T"`P$``:."`=P/T;X" O18ML(68VK@Z M(7<123 .!@-5'0\!`?\$! ,"!: P# 8#51T3`0'_! (P`# =!@-5'24$%C 4 M!@@K!@$%!0<#! 8(*P8!!04'`P(P1@8#51T@!#\P/3 [!@PK!@$$`;(Q`0(! M`P4P*S I!@@K!@$%!0<"`18=:'1T<',Z+R]S96-U:PFSC@28531Y 1V MH"=?*@"]NZ7+1X&;TMD)/=KS<3BZN1X<*%FAF5TT8@\9&Y)W7&M28.,GF/5, MV'!"E<-"(+ZQU&52)<8(H0D6.RB<5"5L#EHH-[8IB]:W7W0)9A M3OF,X]<-(XS5!1:/Q-+\ZA; \X:\/*#59:$JD)8S.TZ20:Q(!CUZ+E[A M!-V6+Y9+9_#2CX G4C7LD,*>D_T?J?X.7^&M(*ZE=+5X$_)7^:4-5GJCO[GY MC*7/4G($(0-WOR4%FOT?("3\(>%>:3!;!@DJADB& M]PT!"0\Q3C!,, H&""J&2(;W#0,', X&""J&2(;W#0,"`@(`@# -!@@JADB& M]PT#`@(!0# '!@4K#@,"!S -!@@JADB&]PT#`@(!*# '!@4K#@,"&C"!P@8) M*P8!! &"-Q $,8&T,(&Q,(&;,0LP"08#500&$P)'0C$;,!D&`U4$"!,21W)E M871EN[\@L*L^56WC+ IW`+5$#A"_%*,IF?PK$F(N MV1D!5G84:>;X>EGR*I*N$+Y-H<3[M$SKJ7U,U:^O8@T?%^>\%#/OS H#$]Q, MDG-2*'X5HT6W]ZSSIM3TC:1V&0L]E3)).<1/0..7P] %O.='_- F&[ZARD&8 MGJ0:>T7`958"%,5PRUI$Q!)3.D;K;4?ZL!UD=6LVW*3V+S,Q"FG*O!2 J9K;G61*B9_\R[XCA*VEX6W00@SNIF@M\@V