From patchwork Wed Nov 11 14:09:28 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gert Doering X-Patchwork-Id: 5669 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:6022:529c:b0:11a:a05e:cb97 with SMTP id x28csp492691lax; Wed, 11 Nov 2026 06:09:55 -0800 (PST) X-Forwarded-Encrypted: i=2; AL+hErHRjiQSE2II2+e/FOZ3IuTf1eptdAvv0mvt8uUno53ZQHrT/J7XAT9ED9E09iTZDBkPtQFUj7XUSJ0=@openvpn.net X-Received: by 2002:a05:7022:130d:b0:1b2:3e1d:17ee with SMTP id a92af1059eb24-1b3bef0a955mr2885207c88.9.1794406195487; Wed, 11 Nov 2026 06:09:55 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1794406195; cv=none; d=google.com; s=arc-20260327; b=Q1a7jTPQRWKT0lh2Jhi0xcy/O9XYJyBwEC7l7FM/Hgnh4Rd1O3D18b1umE2jAFmmGd ew31jVBwtfIrFo3XsHabClYF0bVayVo8CVEpQRDxc2BfJCutsXhOltJP5qkXGQQ9Qpno awlJBiCaZdRu9lSeJ8cCQSg4CHvckSOVtvWZXjBMPbpAqkPENW8dvpFytKaME7+RVRt+ BGO6T2NqXhufB5KxUt1SBzELH1MWxakmG6ADkSAUSoi85h04nsBLrqjogvrOy+7Q+2AR +Rq9NmiLAe4lKePIXE6bQDddW0csLxy0B8TIquRoRPYWb7IvhSnsHgcW290GtY9JayVM cRVQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=O6JobAO8yzyAa1b1ZBMN9mlVeeHv2OWTzhaVtby2KgE=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=ldixM6IKNvL07j801zPlOTs6rE5aOxLBwKn0SKzI39ySwPokJgVKteE4Ut+K6bcbnD yF12z1u2ZUdiztrbzCmRJJp35s/RVB+gvVSPLRlgCmqM/ZevE841yfNODOLNPDMLNWLG n02m8BGwc78FP3n/g/Mtr/cVfIplH9pzoMw9trr3Par2JZFKxuj/pkG5oEJ/uBwPzeJW HORQswCmGsJWzrhBc33z1SP1ngCqXThhvokrkKUAVKpJI2t9Zz/LmtWCNPZRzZzZcSbh Z8BU0qzVGlb9F/Cxfx/mnnTw1dLcr7oCsPYYmN8TXm2nXSZ1CIlHrj/yUU7vtWadXc6i y1/g==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b="Nh13/don"; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=kzg+4+WQ; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=I5gCxrRs; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id a92af1059eb24-1b3b5b86c28si17446486c88.50.2026.11.11.06.09.55 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 11 Nov 2026 06:09:55 -0800 (PST) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b="Nh13/don"; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=kzg+4+WQ; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=I5gCxrRs; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Unsubscribe-Post: List-Owner; bh=O6JobAO8yzyAa1b1ZBMN9mlVeeHv2OWTzhaVtby2KgE=; b=Nh13/donCgztCx KRFZovU3JFsMmQYvSZZ/s7uv/1x6YP54hSzWRxXEBt6glVfumFWJ7cH7WH1FP6xim30ARFNuvPc0r hVts1B3/Mr82RiSgpGVZN5TGxVJbCeTHXBJrPG/usQvjKvkn1gOMNANsnlPVa/32ggGt7PTnwpSwJ lh8=; Received: from [127.0.0.1] (helo=sfs-ml-2.v29.lw.sourceforge.com) by sfs-ml-2.v29.lw.sourceforge.com with esmtp (Exim 4.100.1) (envelope-from ) id 1xR91M-0000000036B-0iaD; Wed, 11 Nov 2026 14:09:52 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-2.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.100.1) (envelope-from ) id 1xR91D-0000000035W-3aD9 for openvpn-devel@lists.sourceforge.net; Wed, 11 Nov 2026 14:09:43 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Unsubscribe-Post:List-Subscribe:List-Post:List-Owner:List-Archive; bh=uOHOT6qmn7OgRwlDT/v7tC8np+i83bgO+tm9wKHYH/E=; b=kzg+4+WQXcMTFe29NhiHPYpReM NBYRqGcnnWUdk3AmlK4n6y0xYeiK2NHE9m9rp7VPvYQcw0woSRvMk/piP+SWODZp2EmsesXgt0VQ0 rWoOtAuEEKKCg1Fgvf3CqjGoKg25XczWRFf7n+pBzHbv63FVcQUTDrsHv5ibh8DvOdxw=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Unsubscribe-Post: List-Subscribe:List-Post:List-Owner:List-Archive; bh=uOHOT6qmn7OgRwlDT/v7tC8np+i83bgO+tm9wKHYH/E=; b=I5gCxrRsbiSyDcXHgv2RFQA5hQ NMDETItM6XW6at+zFDHbmCEUYE3SowroukcLxtX3o9JmEfgKndv+GlmGnepqXezLyzcpYHmi6tymT dOCulO4NduFQT7hZpoE7mWJOpMMk2u5kXLEaZ9USDbj1FCnOhm7UrGEDYS0Bv4sAiKvU=; Received: from [193.149.48.129] (helo=blue.greenie.muc.de) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.100.1) id 1xR91B-000000001Pt-31iN for openvpn-devel@lists.sourceforge.net; Wed, 11 Nov 2026 14:09:43 +0000 Received: from blue.greenie.muc.de (localhost [127.0.0.1]) by blue.greenie.muc.de (8.18.1/8.18.1) with ESMTP id 6ABE9Y68024070 for ; Wed, 11 Nov 2026 15:09:34 +0100 Received: (from gert@localhost) by blue.greenie.muc.de (8.18.2/8.18.1/Submit) id 6ABE9Yhv024069 for openvpn-devel@lists.sourceforge.net; Wed, 11 Nov 2026 15:09:34 +0100 From: Gert Doering To: openvpn-devel@lists.sourceforge.net Date: Wed, 11 Nov 2026 15:09:28 +0100 Message-ID: <20261111140934.24057-1-gert@greenie.muc.de> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-1.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Arne Schwabe This extracts the pre-check to verify allowed op codes into its own method to reduce the complexity. Change-Id: I86154e5c997b044f6913bddab58b43193ff539e1 Signed-off-by: Arne Schwabe Acked-by: Antonio Quartulli Gerrit URL: https://gerrit.openvpn.net/c/openvpn [...] Content analysis details: (1.3 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS X-Headers-End: 1xR91B-000000001Pt-31iN Subject: [Openvpn-devel] [PATCH v2] Extract tls_pre_decrypt_verify_opcode from tls_pre_decrypt X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1881571270972970246 X-GMAIL-MSGID: 1881571270972970246 From: Arne Schwabe This extracts the pre-check to verify allowed op codes into its own method to reduce the complexity. Change-Id: I86154e5c997b044f6913bddab58b43193ff539e1 Signed-off-by: Arne Schwabe Acked-by: Antonio Quartulli Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2169 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2169 This mail reflects revision 2 of this Change. Acked-by according to Gerrit (reflected above): Antonio Quartulli diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c index cdb94ed..3ad7fe7 100644 --- a/src/openvpn/ssl.c +++ b/src/openvpn/ssl.c @@ -3725,6 +3725,46 @@ *opt = NULL; } +/** + * Does a very coarse check on the received opcode. It only checks if the + * opcode is an allowed op code for the peer to send at all, not if this + * opcode is valid for the current state. + */ +static bool +tls_pre_decrypt_verify_opcode(int op, bool server, const struct link_socket_actual *from) +{ + if (op < P_FIRST_OPCODE || op > P_LAST_OPCODE) + { + if (op == P_CONTROL_HARD_RESET_CLIENT_V1 || op == P_CONTROL_HARD_RESET_SERVER_V1) + { + msg(D_TLS_ERRORS, "Peer tried unsupported key-method 1"); + } + struct gc_arena gc = gc_new(); + msg(D_TLS_ERRORS, "TLS Error: unknown opcode received from %s op=%d", + print_link_socket_actual(from, &gc), op); + gc_free(&gc); + return false; + } + + /* hard reset ? */ + if (is_hard_reset_method2(op)) + { + /* verify client -> server or server -> client connection */ + if (((op == P_CONTROL_HARD_RESET_CLIENT_V2 || op == P_CONTROL_HARD_RESET_CLIENT_V3) + && !server) + || ((op == P_CONTROL_HARD_RESET_SERVER_V2) && server)) + { + struct gc_arena gc = gc_new(); + msg(D_TLS_ERRORS, + "TLS Error: client->client or server->server connection attempted from %s", + print_link_socket_actual(from, &gc)); + gc_free(&gc); + return false; + } + } + return true; +} + /* * * When we are in TLS mode, this is the first routine which sees @@ -3783,32 +3823,11 @@ struct session_id sid; /* remote session ID */ /* verify legal opcode */ - if (op < P_FIRST_OPCODE || op > P_LAST_OPCODE) + if (!tls_pre_decrypt_verify_opcode(op, multi->opt.server, from)) { - if (op == P_CONTROL_HARD_RESET_CLIENT_V1 || op == P_CONTROL_HARD_RESET_SERVER_V1) - { - msg(D_TLS_ERRORS, "Peer tried unsupported key-method 1"); - } - msg(D_TLS_ERRORS, "TLS Error: unknown opcode received from %s op=%d", - print_link_socket_actual(from, &gc), op); goto error; } - /* hard reset ? */ - if (is_hard_reset_method2(op)) - { - /* verify client -> server or server -> client connection */ - if (((op == P_CONTROL_HARD_RESET_CLIENT_V2 || op == P_CONTROL_HARD_RESET_CLIENT_V3) - && !multi->opt.server) - || ((op == P_CONTROL_HARD_RESET_SERVER_V2) && multi->opt.server)) - { - msg(D_TLS_ERRORS, - "TLS Error: client->client or server->server connection attempted from %s", - print_link_socket_actual(from, &gc)); - goto error; - } - } - /* * Authenticate Packet */