diff mbox series

[Openvpn-devel,v2] Increase the buffer size for alert-message in management user-pass query

Message ID 20261031074840.27546-1-gert@greenie.muc.de
State New
Headers
Series [Openvpn-devel,v2] Increase the buffer size for alert-message in management user-pass query |

Commit Message

Gert Doering Oct. 31, 2026, 7:48 a.m. UTC 
  From: Selva Nair <selva.nair@gmail.com>

Increase the buffer size from 128 to 256 to accommodate a reasonably
long username and static challenge message when both are included in
the prompt. Print a warning if the text is truncated.

If the encoded " UN:<username-base64>" string is longer than 128 bytes,
skip adding it to the prompt. Print a warning. This caters to up to
about 90 bytes long usernames.

Change-Id: Iea14ef08268e6f6309e4bac4acff27958da8b045
Signed-off-by: Selva Nair <selva.nair@gmail.com>
Acked-by: Razvan Cojocaru <razvanc@mailbox.org>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2073
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2073
This mail reflects revision 2 of this Change.

Acked-by according to Gerrit (reflected above):
Razvan Cojocaru <razvanc@mailbox.org>
diff mbox series

Patch

diff --git a/src/openvpn/manage.c b/src/openvpn/manage.c
index 65e2881..16864c8 100644
--- a/src/openvpn/manage.c
+++ b/src/openvpn/manage.c
@@ -3618,7 +3618,7 @@ 
     {
         volatile int signal_received = 0;
         const bool standalone_disabled_save = man->persist.standalone_disabled;
-        struct buffer alert_msg = alloc_buf_gc(128, &gc);
+        struct buffer alert_msg = alloc_buf_gc(256, &gc);
         const char *alert_type = NULL;
         const char *prefix = NULL;
         unsigned int up_query_mode = 0;
@@ -3680,23 +3680,31 @@ 
              * Indicate it in the prompt as base64 encoded.
              */
             char *user64 = NULL;
-            if (openvpn_base64_encode(up->username, (int)strlen(up->username), &user64) != -1)
+            const int user64_len = openvpn_base64_encode(up->username, (int)strlen(up->username), &user64);
+            if (user64_len == -1)
             {
-                buf_printf(&alert_msg, " UN:%s", user64);
+                msg(M_NONFATAL, "ERROR: could not base64-encode username");
+            }
+            else if (user64_len + 4 > 128)
+            {
+                msg(M_WARN | M_INFO, "Preferred username too long for user-pass prompt sent to management; omitting UN:<username> hint.");
             }
             else
             {
-                msg(M_NONFATAL, "ERROR: could not base64-encode username");
+                buf_printf(&alert_msg, " UN:%s", user64);
             }
             free(user64);
         }
 
         if (sc)
         {
-            buf_printf(&alert_msg, " SC:%d,%s",
-                       BOOL_CAST(flags & GET_USER_PASS_STATIC_CHALLENGE_ECHO)
-                           | (BOOL_CAST(flags & GET_USER_PASS_STATIC_CHALLENGE_CONCAT) << 1),
-                       sc);
+            if (!buf_printf(&alert_msg, " SC:%d,%s",
+                            BOOL_CAST(flags & GET_USER_PASS_STATIC_CHALLENGE_ECHO)
+                                | (BOOL_CAST(flags & GET_USER_PASS_STATIC_CHALLENGE_CONCAT) << 1),
+                            sc))
+            {
+                msg(M_WARN | M_INFO, "SC:<challenge-text> in user-pass prompt sent to management got truncated.");
+            }
         }
 
         man_wait_for_client_connection(man, &signal_received, 0, MWCC_PASSWORD_WAIT);