From patchwork Wed Nov 4 22:29:56 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Selva Nair X-Patchwork-Id: 5602 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:6022:30a9:b0:118:2077:975e with SMTP id f41csp1049817laa; Wed, 4 Nov 2026 14:30:33 -0800 (PST) X-Forwarded-Encrypted: i=2; AKwUvBwQS8OkMkHmsQlzhMZ1EfzoUNZFwOTWqP4EOE4wLtKqdxCWbi6YTDD/JzICUWmjQICXLCnz0l9/EX8=@openvpn.net X-Received: by 2002:a05:6808:4fcc:b0:4e7:c6f2:75a6 with SMTP id 5614622812f47-5640deafdb6mr14329406b6e.68.1793831432696; Wed, 04 Nov 2026 14:30:32 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1793831432; cv=none; d=google.com; s=arc-20260327; b=AtE5vcwl/dVz4WfPOqsPHhJtP4YsHUEfV72LRIMtWK0MkCsl99wyMJrbi1ucDyl7F8 RVA7UsQ29RmESs6pOUGhyPlT3WbSPYhXxDC1ebjw68JfBDKG/wl72AnR5XgLe1g902cr szsNpPo/iARbjkIlk7Wunbp0zwXmffyWXIFRPzSTqN6SKqxhIfKioAIJayB3IzkkrkI4 aZrkgx/ShiaoUX4TJJ9dR/7RTb/2gA0JHkVIeAE8gGz1dtaBVw42UC5F8QprYQbr2h08 EUKPEFwUxw84wWhnpl4Y5VVGxoVIHvYDh38sgaHqV1ejoKPLix0lRLMyRs2w3o20ddxK WbIQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature:dkim-signature; bh=6i/M8UnyA/nIY/3R0Klqjp0PT+3TaXCzGZ4xfYOi2Sw=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=o65/wywGI20r8tpZ+kTQ9KvkL9UwpaoP9N9ia+OwGpteVIcEnbwigdZxpIzorjypjD BjIDbKSYhd8s72be6kaog1jCopWztnaGEoOsB5B+xlZEz0/k5eZkvLg7VINF+CxtHGq3 LNVEd8qJ8qUp1o5IYCHvOTFREIB/9mzoIeiZnfvza9IjVFkdWJxcD9qnvYgbw2Q3koPM FKEuaIA+j6k67W/vZmsrI1CzlP+HGgFQCNoA/Ly1f1c/oHyjnDiqsIdi+6gzISDPbhw7 KBOS2iiRri1BKKxMpGVoe0ZAlTs+5apUs2fjewsPfKXL4eLG6IOiTYRWBvsVMnemrNCI jy/Q==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=Z2PHzRMV; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=Nf4mjoxA; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=f9jLS4Lt; dkim=neutral (body hash did not verify) header.i=@gmail.com header.s=20260707 header.b=rOUU53Jy; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com; dara=neutral header.i=@openvpn.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 5614622812f47-567a9c9d8ffsi4797849b6e.2.2026.11.04.14.30.32 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 04 Nov 2026 14:30:32 -0800 (PST) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=Z2PHzRMV; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=Nf4mjoxA; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=f9jLS4Lt; dkim=neutral (body hash did not verify) header.i=@gmail.com header.s=20260707 header.b=rOUU53Jy; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com; dara=neutral header.i=@openvpn.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Unsubscribe-Post: List-Owner; bh=6i/M8UnyA/nIY/3R0Klqjp0PT+3TaXCzGZ4xfYOi2Sw=; b=Z2PHzRMViArCGm 2GWrVHdCd+hTbq8FWAzjrSLG0KjA+49w0NAEGq6WVtk+Gpepnk1FpUutXNZQGbTpgt1pX2hvVKaB7 nfLZBlkSFrqDxAIkgGPHvL1WfM69xr81AwxuET20I1zvBZ6Ih4CgS+EtkvdJDxsrdZjcjLx3KzXst TMc=; Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.100.1) (envelope-from ) id 1xOjV0-000000005cS-0s5g; Wed, 04 Nov 2026 22:30:30 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.100.1) (envelope-from ) id 1xOjUz-000000005cM-2z7Y for openvpn-devel@lists.sourceforge.net; Wed, 04 Nov 2026 22:30:29 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Unsubscribe-Post:List-Subscribe:List-Post:List-Owner:List-Archive; bh=Lel0F3Y/a4PW89cNI83OeG4cHVJ/YMPT/f4hSLr3HcA=; b=Nf4mjoxAHZw08wpSocFIIQiBSM WRHe8cw1OsJpWdtHdVv4pkgB4rCUykqzQzyykBM8qGRC+cEjZWYe69ZAnYdB7DZ3tv2yKD7eo5oD/ nd444uw81cp45M+2LkZGjWWWIqDSVXGVmS4lRUrpyuWujfXARip+okRRXTbLiRX09VVg=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Unsubscribe-Post: List-Subscribe:List-Post:List-Owner:List-Archive; bh=Lel0F3Y/a4PW89cNI83OeG4cHVJ/YMPT/f4hSLr3HcA=; b=f9jLS4LtnJKJK9kMs/RYPljaH5 6VSGmSwXmHv07p+1nfJPKyx5yxGzmmNb5KiSrzrdr5LUs9A1oYrhWb5JcEyCOtEujEG4YpE+80E/L vHvXUeLtrBldxKy2iYxlcSTgac36H7CXPxFOpf+YCsbuUrdxKEhGSCL3hucVUftEjRO0=; Received: from mail-ua1-f51.google.com ([209.85.222.51]) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.100.1) id 1xOjUz-000000000As-0Fkv for openvpn-devel@lists.sourceforge.net; Wed, 04 Nov 2026 22:30:29 +0000 Received: by mail-ua1-f51.google.com with SMTP id a1e0cc1a2514c-99a5710ec0dso22077241.1 for ; Wed, 04 Nov 2026 14:30:28 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793831423; x=1794436223; darn=lists.sourceforge.net; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Lel0F3Y/a4PW89cNI83OeG4cHVJ/YMPT/f4hSLr3HcA=; b=rOUU53JytIFKwtrWcG8YyCSAIHxBjPWs2uOkVeUgA5WQVOD3fMH+gjUsolYGecHf+o M3UqIZYPbGaYGkgTevVPHLHU4PEdVQ2k6Qr3XTlUXZ+iDosVgU0r+UyELdsWDx2Ud8k/ kMDlbEZnI4KlzLI4+3ZosV5DkpuSOpoCVIUPrwQFY2v4DdfdtW5VQxwcbinTgthZzluH drA3A2eAJahnfgxnBsucvqISf8b+J7wwAtv2xWrbfP5SXNNICv1nDHpBDD7gplVOrrKf 82qclL6H0OyBwkPYErPgA0HLIbQxScLtR2sw7t35fyWUuVd6tOHxKAikmUHD0VlJDaeG OYuA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793831423; x=1794436223; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Lel0F3Y/a4PW89cNI83OeG4cHVJ/YMPT/f4hSLr3HcA=; b=CfXe4pDkEeS0u3ogMdiymb2aUHtpWfBCwy44kTDWKS1196aRhyTp2hvWM7b87m13kO JbJdvjcvTUENIge+DqV8PBBQMxtg/CkPxYT/nX5HjTy5GVBL82EpDTT04zapeCSOC3k8 SATAqwjT2vRfXVmmSHzH5KYxZw8EAFx2T+7Uo8SsGcSXfMP3fG6xgVfqRoC7yCOI2uyD 14BxiyHyKvYayRUq5XctLu1wO7TKZfB7HqHosdwmK5LKI2525ykoQ18ay18UhFv0znRr Em+MzINFRQVtLlPSln158sVYP8aA+8JSyCJ024IWNW76dcwBO6ddRfp79KwKZ9xv1kac ty3w== X-Gm-Message-State: APuU4Z/MinIkpWX3mhGLjurdt1RwYFoLIfZDYHcKnSPxBypRXmwHkxCF ZnN+bqQi2m68Ww/mSOC02ZUASfO2B3/IjKTae9t/ZczeXFuwfuElzzf2NP6BXg== X-Gm-Gg: AYBFou0alv+ckJYX1LCOL2HOxfU81yPCSS3lu9WvwNSI3UEcrJC1SBW0YJbd0hxfja/ eUZYY97UzjDDlS0Djbm+XCVKgIsfNV83Uwfu5q5puR7Nabfl0FjjYMaPHqzZpno4iAq+JHPOR39 VU+guLWu5qFjdBe6gOf7qtrRtjteDYNqbyR0RRIoQvhJovO3J1uV76HWIlTn2eEv3m5YZS6Enjg rKsHV7tF4FsrdisFpQtIzTK7ZsrVHhK/LC5UbPR1/C0O+UsBxUMNrnPkMT7VrqkjFZpKjksCRLo DnrAq8ezXteWaKzEuHufWzcGpPeR0kw/or1yS0+UjyUc7EIq+OWKVSMeGL+u+ggxBYObCOHM3Zp OlxOyFoUSxfNhEdC5rRlSIlaFFsixRIQy4zmojj7XHSdnmX1VJqXRw2TMmLH3qbETftUPO8BPmC ZbjxODfYJ0pqSXPapgBla3ER8TcOnFyXq8W8lbpxESIjFCa3gFQ/hGVy77x6feGeCwHhOr07g24 NirzNGPGpH9ac6E8rlPgl63qzeToE5udW9qgu/CwV7GH2qMb+9Qng6g5cUvMjuBlyVCaec+pPzB HbCKQqNvSnJiZjlbGVs3X/EXIWtl X-Received: by 2002:a67:e70e:0:b0:7cc:285d:4df8 with SMTP id ada2fe7eead31-7d072baa5b6mr6946242137.12.1793831422942; Wed, 04 Nov 2026 14:30:22 -0800 (PST) Received: from neptune.lan ([174.93.27.195]) by smtp.gmail.com with ESMTPSA id ada2fe7eead31-7d28a073cbesm309763137.4.2026.11.04.14.30.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Nov 2026 14:30:22 -0800 (PST) From: selva.nair@gmail.com To: openvpn-devel@lists.sourceforge.net Date: Wed, 4 Nov 2026 17:29:56 -0500 Message-ID: <20261104222956.882475-1-selva.nair@gmail.com> X-Mailer: git-send-email 2.48.1 In-Reply-To: <202611042206.6A4M6owt010298@chekov.greenie.muc.de> References: <202611042206.6A4M6owt010298@chekov.greenie.muc.de> MIME-Version: 1.0 X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Selva Nair Consume the complete username line before reading the password from an auth file or inline credentials. This also fixes an exactly full username buffer leaving its newline to be read as an empty passw [...] Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider [selva.nair(at)gmail.com] 0.0 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2) [209.85.222.51 listed in wl.mailspike.net] 0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information X-Headers-End: 1xOjUz-000000000As-0Fkv Subject: [Openvpn-devel] [PATCH for 2.7] misc: Fix username overflow spilling into password X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1880824110553341272 X-GMAIL-MSGID: 1880968587903678881 From: Selva Nair Consume the complete username line before reading the password from an auth file or inline credentials. This also fixes an exactly full username buffer leaving its newline to be read as an empty password in auth files. Existing credential truncation behaviour is unchanged. Tests: Add regression coverage for long and boundary-length usernames with missing, blank, or supplied passwords in both inlined and external file inputs. For release/2.7, adapt the test temporary-directory lookup because platform_get_tmp_dir() is only available on master. Github: OpenVPN/openvpn#1140 Change-Id: I3c8c62c7d90c2b94dd1cd149b4c13b383a2303e9 Signed-off-by: Selva Nair --- src/openvpn/misc.c | 12 +++++ tests/unit_tests/openvpn/test_user_pass.c | 63 +++++++++++++++++++++++ 2 files changed, 75 insertions(+) diff --git a/src/openvpn/misc.c b/src/openvpn/misc.c index 1a23e13b..a4280cb9 100644 --- a/src/openvpn/misc.c +++ b/src/openvpn/misc.c @@ -255,6 +255,10 @@ get_user_pass_cr(struct user_pass *up, const char *auth_file, const char *prefix if (!(flags & GET_USER_PASS_PASSWORD_ONLY)) { buf_parse(&buf, '\n', up->username, USER_PASS_LEN); + /* The password starts on the next line, even if the username was truncated. */ + const char *password = strchr(auth_file, '\n'); + password = password ? password + 1 : ""; + buf_set_read(&buf, (uint8_t *)password, strlen(password) + 1); } buf_parse(&buf, '\n', up->password, USER_PASS_LEN); @@ -288,6 +292,14 @@ get_user_pass_cr(struct user_pass *up, const char *auth_file, const char *prefix msg(M_FATAL, "Error reading username from %s authfile: %s", prefix, auth_file); } + if (!strchr(up->username, '\n')) + { + /* Consume the rest of the username line before reading the password. */ + int c; + while ((c = fgetc(fp)) != '\n' && c != EOF) + { + } + } } chomp(up->username); diff --git a/tests/unit_tests/openvpn/test_user_pass.c b/tests/unit_tests/openvpn/test_user_pass.c index 5ad4730b..a0206296 100644 --- a/tests/unit_tests/openvpn/test_user_pass.c +++ b/tests/unit_tests/openvpn/test_user_pass.c @@ -366,6 +366,68 @@ test_get_user_pass_authfile_file(void **state) assert_string_equal(up.password, "fuser"); } +static void +test_get_user_pass_long_username(void **state) +{ + struct gc_arena gc = gc_new(); +#ifdef _WIN32 + const char *tmpdir = win_get_tempdir(); +#else + const char *tmpdir = getenv("TMPDIR"); + if (!tmpdir) + { + tmpdir = "/tmp"; + } +#endif + assert_non_null(tmpdir); + const char *authfile = platform_create_temp_file(tmpdir, "user_pass", &gc); + assert_non_null(authfile); + const size_t lengths[] = { USER_PASS_LEN - 2, USER_PASS_LEN - 1, USER_PASS_LEN + 10 }; + const char *endings[] = { "", "\n", "\n\n", "\nfpassword\n", "\r\nfpassword\r\n" }; + + const bool inline_mode[] = { false, true }; + for (size_t mode = 0; mode < SIZE(inline_mode); mode++) + { + const bool use_inline_creds = inline_mode[mode]; + for (size_t i = 0; i < SIZE(lengths); i++) + { + for (size_t j = 0; j < SIZE(endings); j++) + { + struct user_pass up = { 0 }; + char creds[USER_PASS_LEN + 64]; + memset(creds, 'u', lengths[i]); + strcpy(creds + lengths[i], endings[j]); + if (!use_inline_creds) + { + FILE *fp = platform_fopen(authfile, "w"); + assert_non_null(fp); + assert_true(fputs(creds, fp) >= 0); + assert_int_equal(fclose(fp), 0); + } + + const bool missing_password = j < 3; + if (missing_password) + { + expect_string(query_user_exec_builtin, query_user[i].prompt, + "Enter UT Password:"); + will_return(query_user_exec_builtin, "cpassword"); + } + will_return(query_user_exec_builtin, true); + assert_true(get_user_pass_cr(&up, use_inline_creds ? creds : authfile, "UT", + use_inline_creds ? GET_USER_PASS_INLINE_CREDS : 0, NULL)); + /* Truncation must not change where the password line starts. */ + creds[lengths[i] < USER_PASS_LEN ? lengths[i] : USER_PASS_LEN - 1] = '\0'; + assert_true(up.defined); + assert_string_equal(up.username, creds); + assert_string_equal(up.password, + missing_password ? "cpassword" : "fpassword"); + } + } + } + assert_true(platform_unlink(authfile)); + gc_free(&gc); +} + #ifdef ENABLE_MANAGEMENT static void test_get_user_pass_dynamic_challenge(void **state) @@ -474,6 +536,7 @@ const struct CMUnitTest user_pass_tests[] = { cmocka_unit_test(test_get_user_pass_inline_creds), cmocka_unit_test(test_get_user_pass_authfile_stdin), cmocka_unit_test(test_get_user_pass_authfile_file), + cmocka_unit_test(test_get_user_pass_long_username), #ifdef ENABLE_MANAGEMENT cmocka_unit_test(test_get_user_pass_dynamic_challenge), cmocka_unit_test(test_get_user_pass_static_challenge),