diff mbox series

[Openvpn-devel,v2] Extract tls_pre_decrypt_verify_opcode from tls_pre_decrypt

Message ID 20261111140934.24057-1-gert@greenie.muc.de
State New
Headers
Series [Openvpn-devel,v2] Extract tls_pre_decrypt_verify_opcode from tls_pre_decrypt |

Commit Message

Gert Doering Nov. 11, 2026, 2:09 p.m. UTC 
  From: Arne Schwabe <arne@rfc2549.org>

This extracts the pre-check to verify allowed op codes into its own
method to reduce the complexity.

Change-Id: I86154e5c997b044f6913bddab58b43193ff539e1
Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: Antonio Quartulli <antonio@mandelbit.com>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2169
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2169
This mail reflects revision 2 of this Change.

Acked-by according to Gerrit (reflected above):
Antonio Quartulli <antonio@mandelbit.com>
diff mbox series

Patch

diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c
index cdb94ed..3ad7fe7 100644
--- a/src/openvpn/ssl.c
+++ b/src/openvpn/ssl.c
@@ -3725,6 +3725,46 @@ 
     *opt = NULL;
 }
 
+/**
+ * Does a very coarse check on the received opcode. It only checks if the
+ * opcode is an allowed op code for the peer to send at all, not if this
+ * opcode is valid for the current state.
+ */
+static bool
+tls_pre_decrypt_verify_opcode(int op, bool server, const struct link_socket_actual *from)
+{
+    if (op < P_FIRST_OPCODE || op > P_LAST_OPCODE)
+    {
+        if (op == P_CONTROL_HARD_RESET_CLIENT_V1 || op == P_CONTROL_HARD_RESET_SERVER_V1)
+        {
+            msg(D_TLS_ERRORS, "Peer tried unsupported key-method 1");
+        }
+        struct gc_arena gc = gc_new();
+        msg(D_TLS_ERRORS, "TLS Error: unknown opcode received from %s op=%d",
+            print_link_socket_actual(from, &gc), op);
+        gc_free(&gc);
+        return false;
+    }
+
+    /* hard reset ? */
+    if (is_hard_reset_method2(op))
+    {
+        /* verify client -> server or server -> client connection */
+        if (((op == P_CONTROL_HARD_RESET_CLIENT_V2 || op == P_CONTROL_HARD_RESET_CLIENT_V3)
+             && !server)
+            || ((op == P_CONTROL_HARD_RESET_SERVER_V2) && server))
+        {
+            struct gc_arena gc = gc_new();
+            msg(D_TLS_ERRORS,
+                "TLS Error: client->client or server->server connection attempted from %s",
+                print_link_socket_actual(from, &gc));
+            gc_free(&gc);
+            return false;
+        }
+    }
+    return true;
+}
+
 /*
  *
  * When we are in TLS mode, this is the first routine which sees
@@ -3783,32 +3823,11 @@ 
     struct session_id sid; /* remote session ID */
 
     /* verify legal opcode */
-    if (op < P_FIRST_OPCODE || op > P_LAST_OPCODE)
+    if (!tls_pre_decrypt_verify_opcode(op, multi->opt.server, from))
     {
-        if (op == P_CONTROL_HARD_RESET_CLIENT_V1 || op == P_CONTROL_HARD_RESET_SERVER_V1)
-        {
-            msg(D_TLS_ERRORS, "Peer tried unsupported key-method 1");
-        }
-        msg(D_TLS_ERRORS, "TLS Error: unknown opcode received from %s op=%d",
-            print_link_socket_actual(from, &gc), op);
         goto error;
     }
 
-    /* hard reset ? */
-    if (is_hard_reset_method2(op))
-    {
-        /* verify client -> server or server -> client connection */
-        if (((op == P_CONTROL_HARD_RESET_CLIENT_V2 || op == P_CONTROL_HARD_RESET_CLIENT_V3)
-             && !multi->opt.server)
-            || ((op == P_CONTROL_HARD_RESET_SERVER_V2) && multi->opt.server))
-        {
-            msg(D_TLS_ERRORS,
-                "TLS Error: client->client or server->server connection attempted from %s",
-                print_link_socket_actual(from, &gc));
-            goto error;
-        }
-    }
-
     /*
      * Authenticate Packet
      */