From patchwork Thu Dec 15 19:01:36 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Schwabe X-Patchwork-Id: 2917 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7300:c95:b0:82:e4b3:40a0 with SMTP id p21csp631580dyk; Thu, 15 Dec 2022 11:02:16 -0800 (PST) X-Google-Smtp-Source: AA0mqf6ZCmN/ZCyG81o3I8pabAcFvgbT7o+7H4sv8yJeUjWh1mJT8nYvuWsQdOtT9NTUQqq/zC5f X-Received: by 2002:a67:b34a:0:b0:3b1:4d2f:b89a with SMTP id b10-20020a67b34a000000b003b14d2fb89amr13272589vsm.28.1671130935895; Thu, 15 Dec 2022 11:02:15 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1671130935; cv=none; d=google.com; s=arc-20160816; b=a6YzAF4NOdLaYquIbH1WKpxf9epMcBBzcwjf3xn1PamF8Cr3NrYuvWyVPp+XoB4UoZ oJgx3Fkp+ilLX6AkDDn28hjZutXbCVEWsy9QSU4erZcEOxJNxLVe4PmjIXOyOHUxpoJp +WxB5d5iE6Amly9r86O5bLDi9FrHIxdNHPec791t5sUzrnV5qZMlvpkW5yTh9S8QZy9x GQ/Rm1Ty0sMqUOe4pugD6d8MoBDFLha6VtYKIjGRe0Dps12y49P6iLw/SWFN9LGcMTO0 3aoZySvLx9vkrJYjAJ9gVAuVkGn1fvqsCfkvvPm1qoLDfv+Wcod12TVD3m35veybwVg4 5ZvQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=errors-to:content-transfer-encoding:cc:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature; bh=5n1MiM0YxTXxuHBPL1Kep/L7FPwftpA0n2Z+xJiaM1s=; b=LZPavVDoRxJu08luolc+q9TygVjpwkqarrl66I6+EzPH0peOgoCKMA7MlYh/zzCTr6 XRUP2IgyGBnLi2cV9ePscu2XO7a1iPLiJLF3/HSxqByYDTKB3v8LLX+Z0va4EfPHaoSt 4eSHw0KaStwWesRcGb4UmD13nINfAx3IHLGi0Ad9WzNuoIN64pnaTdK2R8NzSdDasesb uJ6nUkza6x/C+muyIHsGbrlt6MLzvRAxwijsc1R6yPzjmzgS2ax2/P/9ceazF5qZIxlc QUqDD/EmGG3OIeNctWEpFUEKR0xdp7SxzPGDh/w+7VfcSxF9i5QPGqlJPK+vWT5j4jyr 0pYw== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=a4GcN+gs; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=BJMS4CEW; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id h30-20020a67c19e000000b003aa20a29c59si2115411vsj.471.2022.12.15.11.02.15 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Dec 2022 11:02:15 -0800 (PST) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=a4GcN+gs; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=BJMS4CEW; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from [127.0.0.1] (helo=sfs-ml-1.v29.lw.sourceforge.com) by sfs-ml-1.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1p5tUX-00011D-D3; Thu, 15 Dec 2022 19:02:01 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-1.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1p5tUS-00010t-EJ for openvpn-devel@lists.sourceforge.net; Thu, 15 Dec 2022 19:01:56 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-Id:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=SmEXbIhKlZCGnKFo9oqFHaxkU026cJ/6XWdHVGqLdtk=; b=a4GcN+gskgZOY3uyArX6Fjal4D cRfwjjOD3IDOOSfMj9UJ+iqxgErc78J5oJW9zo6Kfr/+i3hI93PNoLzMnirUCoQ2hZ9GTvpjsbypU H0aN3oorca46Ml8LCv/ZqtV/sd0K6w8mTgjJnysGYlJCooBHnKynsCpVGKSRDGss38PQ=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-Id: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=SmEXbIhKlZCGnKFo9oqFHaxkU026cJ/6XWdHVGqLdtk=; b=BJMS4CEWM3aOa9NLHm5PrAe872 kEvX+8usRn129aj4ExQzPFQcS9RYX0AxeuLBM6+kmEV4Xqxk0BdthM8N0jRlFVRop2lD9KXihhL9v 27B7ytEz9u9IrI89aWwWhPqWhxRyWro7Nmb0txA7E0qfvqd95EXmLqB5JEGiqchSdghc=; Received: from mail.blinkt.de ([192.26.174.232]) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1p5tUR-000hyo-Ts for openvpn-devel@lists.sourceforge.net; Thu, 15 Dec 2022 19:01:56 +0000 Received: from kamera.blinkt.de ([2001:638:502:390:20c:29ff:fec8:535c]) by mail.blinkt.de with smtp (Exim 4.95 (FreeBSD)) (envelope-from ) id 1p5tUF-000Kvw-8x; Thu, 15 Dec 2022 20:01:43 +0100 Received: (nullmailer pid 2107945 invoked by uid 10006); Thu, 15 Dec 2022 19:01:43 -0000 From: Arne Schwabe To: openvpn-devel@lists.sourceforge.net Date: Thu, 15 Dec 2022 20:01:36 +0100 Message-Id: <20221215190143.2107896-2-arne@rfc2549.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20221215190143.2107896-1-arne@rfc2549.org> References: <20221215190143.2107896-1-arne@rfc2549.org> MIME-Version: 1.0 X-Spam-Score: 0.3 (/) X-Spam-Report: Spam detection software, running on the system "util-spamd-1.v13.lw.sourceforge.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: This changes the password check on the management interface to be constant time. Normally the management port should not be exposed in a way that allows an attacker to even interact with it but making [...] Content analysis details: (0.3 points, 6.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.0 SPF_NONE SPF: sender does not publish an SPF Record X-Headers-End: 1p5tUR-000hyo-Ts Subject: [Openvpn-devel] [PATCH 1/8] Make management password check constant time X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Connor Edwards Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: =?utf-8?q?1752307792184075091?= X-GMAIL-MSGID: =?utf-8?q?1752307792184075091?= This changes the password check on the management interface to be constant time. Normally the management port should not be exposed in a way that allows an attacker to even interact with it but making the check constant time as an additional layer of security is always good. Reported-by: Connor Edwards Signed-off-by: Arne Schwabe --- src/openvpn/manage.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/openvpn/manage.c b/src/openvpn/manage.c index 9349b62ad..d952618e7 100644 --- a/src/openvpn/manage.c +++ b/src/openvpn/manage.c @@ -198,7 +198,11 @@ man_check_password(struct management *man, const char *line) { if (man_password_needed(man)) { - if (streq(line, man->settings.up.password)) + /* This comparison is not fixed time but since strlen(time) is based on + * the attacker choice, it should not give any indication of the real + * password length */ + if (memcmp_constant_time(line, man->settings.up.password, + min_uint(strlen(line), sizeof(man->settings.up.password))) == 0) { man->connection.password_verified = true; msg(M_CLIENT, "SUCCESS: password is correct"); From patchwork Thu Dec 15 19:01:37 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Schwabe X-Patchwork-Id: 2915 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7300:c95:b0:82:e4b3:40a0 with SMTP id p21csp631566dyk; Thu, 15 Dec 2022 11:02:15 -0800 (PST) X-Google-Smtp-Source: AA0mqf4mvG+8U76zC6xxh8nMXrBnjbHEsigvOD4ZPnWx3EF4kd+lN01XNxzZ370r2qlYsV6NQQKC X-Received: by 2002:a1f:ee4e:0:b0:3bd:f324:5500 with SMTP id m75-20020a1fee4e000000b003bdf3245500mr17123303vkh.2.1671130935332; Thu, 15 Dec 2022 11:02:15 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1671130935; cv=none; d=google.com; s=arc-20160816; b=LKIyKgCZV/UcexvXDh+SFGMqK7AMkIY5vT1wrk5qywNk21v6SPApv13uyi/PlVdKdP oIEu9eS2vauUWkArAyXQLpYZg1SmCGddNJVZ8fyKFXjq42DxxMW/QcOxAXg9E6JQxf0n u4p/JpfXZzSNP7b/N3unqiHDXgmIKk2mgtfxA/zdrxPPPab18JqW5jhcw0S2twqlaW0P XVZh5HgHAZARSr4QcW3NemCAin8DWRExSP0CzrTdalS2NWRwvPqAk0n7GRfj1hBQ0GMZ +m1EwtvfdkHTDn4rQxe0bt/yQSoTYnhNBGdO3/Y6eQEvQfSUpjpAEuL1UYFQ0IAWamHm TbTg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=errors-to:content-transfer-encoding:cc:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature; bh=XTX+eU+DnU5WAwL/QBJEAUjGQ1ju8tuU8h5NDBaBcS4=; b=i4Pkc0R+b0mpKmWJmNEC5zr/OFFATroBwiVNC6CXCzuvVsXG+tj87FcaFpF66R15Yh Sw9kxvAswsJEn0q2PiNp6RIq4YWP/q0FBbeaj7NRyQ395PbKsf15fJ/aLEQ5mKo80vP2 yBA5n43RlYXiqQei1RnYV7Ap0vcVRxm5RF/Ub6mMAGKDZ0DejFGvsn/dfR5qL1XwBhgw hn0whfMT1VEkxVRCrlUgzXdPx+ga45FOoTXDj4yRI1kSgalTe2XkGzldlNlpQ4fXTa+0 xFgbt6VXTcBRQ3T48COb7OonsqO3aUzbqyFg7RVcDSm1aS+F5zLPeFwvpUMk0nywOsMo fl4w== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=PNlG99cz; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=L6wwEmTl; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id b143-20020a1f1b95000000b003b7f0e38cd0si1921994vkb.298.2022.12.15.11.02.14 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Dec 2022 11:02:15 -0800 (PST) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=PNlG99cz; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=L6wwEmTl; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1p5tUV-0001xc-O7; Thu, 15 Dec 2022 19:01:59 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1p5tUS-0001wq-C0 for openvpn-devel@lists.sourceforge.net; Thu, 15 Dec 2022 19:01:56 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-Id:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=n2PEcv+Kb2dBd2nCvjG2qGDplTg78GlTf7dqsklWrSM=; b=PNlG99czMmTUkQnkZwzOGgXurs MZjEFse4hpygc7f9MDTjhz7ZJiuFy1MTkEtN8//h+sE32y3dj+G3nesNY5AAS/8s/nex2362bG8FX VfnKCgfJqny9ZRPO0TXTMnTZNvqOqUTHps1lRc74TZA/0hKYrdzZGt1KjAx4JNpIwwzQ=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-Id: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=n2PEcv+Kb2dBd2nCvjG2qGDplTg78GlTf7dqsklWrSM=; b=L6wwEmTlKETMFDKG7TRUR7pUVb 91oykHdFB9QEZ9hUkDQqF9K649pIfVGmLXqlZDBZIRoJGpaSxgdJL1AQ5vMTuZ1Im+u73Igmkyja6 WLspmsI53ksjZEBVdyu5cbX+ldbeyrgxyZQZKsV/Ivv7klu3FOsBqmIjFdngsFuIWdAA=; Received: from mail.blinkt.de ([192.26.174.232]) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1p5tUR-000hyp-Tu for openvpn-devel@lists.sourceforge.net; Thu, 15 Dec 2022 19:01:56 +0000 Received: from kamera.blinkt.de ([2001:638:502:390:20c:29ff:fec8:535c]) by mail.blinkt.de with smtp (Exim 4.95 (FreeBSD)) (envelope-from ) id 1p5tUF-000Kvy-9b; Thu, 15 Dec 2022 20:01:43 +0100 Received: (nullmailer pid 2107948 invoked by uid 10006); Thu, 15 Dec 2022 19:01:43 -0000 From: Arne Schwabe To: openvpn-devel@lists.sourceforge.net Date: Thu, 15 Dec 2022 20:01:37 +0100 Message-Id: <20221215190143.2107896-3-arne@rfc2549.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20221215190143.2107896-1-arne@rfc2549.org> References: <20221215190143.2107896-1-arne@rfc2549.org> MIME-Version: 1.0 X-Spam-Score: 0.3 (/) X-Spam-Report: Spam detection software, running on the system "util-spamd-2.v13.lw.sourceforge.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: David Sommerseth If the key_state_gen_auth_control_files() call fails, the code would just return without freeing the argv container. Instead the code should jump to an appropriate exit point where memory is being rel [...] Content analysis details: (0.3 points, 6.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.0 SPF_NONE SPF: sender does not publish an SPF Record X-Headers-End: 1p5tUR-000hyp-Tu Subject: [Openvpn-devel] [PATCH 2/8] ssl_verify: Fix memleak if creating deferred auth control files fails X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: David Sommerseth Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: =?utf-8?q?1752307792098682429?= X-GMAIL-MSGID: =?utf-8?q?1752307792098682429?= From: David Sommerseth If the key_state_gen_auth_control_files() call fails, the code would just return without freeing the argv container. Instead the code should jump to an appropriate exit point where memory is being released. Also adjust the related comment, to indicate that these deferred auth control files are really pre-created. Signed-off-by: David Sommerseth Reported-by: Trial of Bits (TOB-OVPN-2) Signed-off-by: Arne Schwabe Acked-by: Gert Doering --- src/openvpn/ssl_verify.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/openvpn/ssl_verify.c b/src/openvpn/ssl_verify.c index 76cb9f19b..228cf16e1 100644 --- a/src/openvpn/ssl_verify.c +++ b/src/openvpn/ssl_verify.c @@ -1358,12 +1358,13 @@ verify_user_pass_script(struct tls_session *session, struct tls_multi *multi, setenv_str(session->opt->es, "password", up->password); } - /* generate filename for deferred auth control file */ + /* pre-create files for deferred auth control */ if (!key_state_gen_auth_control_files(&ks->script_auth, session->opt)) { msg(D_TLS_ERRORS, "TLS Auth Error (%s): " "could not create deferred auth control file", __func__); - return OPENVPN_PLUGIN_FUNC_ERROR; + retval = OPENVPN_PLUGIN_FUNC_ERROR; + goto error; } /* call command */ @@ -1412,6 +1413,7 @@ done: platform_unlink(tmp_file); } +error: argv_free(&argv); gc_free(&gc); return retval; From patchwork Thu Dec 15 19:01:38 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Schwabe X-Patchwork-Id: 2918 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7300:c95:b0:82:e4b3:40a0 with SMTP id p21csp631598dyk; Thu, 15 Dec 2022 11:02:17 -0800 (PST) X-Google-Smtp-Source: AA0mqf53Ei+1yTd/WtDUStRwpDf+XzSVR1qzB08a3fDsXBp6itLDJnzEt5ZUSQBkJgD7jatiTBcc X-Received: by 2002:a05:7500:2d9a:b0:ea:78bf:c0de with SMTP id er26-20020a0575002d9a00b000ea78bfc0demr3196268gab.56.1671130936853; Thu, 15 Dec 2022 11:02:16 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1671130936; cv=none; d=google.com; s=arc-20160816; b=qXlSJ8nv0syd/7eWaUttC71lucWZCN0iGeLrU3jic6EtlOwyD2YGfchd8BE99y1h31 8GbeWZlApCEMAVY6B8lYfMufTf5FMjKB0Y+ZfxX3Luzu3yltM1yt5yCFwNRDLXXOy6p1 RGEACPlLySTPaIt62+sUI9vYqR1jc1yg7nNb0Y19l4uF09MSVEnCBiGZqR6rbP9UsXHj gbo8kZ+vlWXMIRl0AZomQzLA6dRz0H1sa3WU8lB4WYGsscLs/BRMpO9/ACRZSYho4E8V yNdESFR+k/nVgl2z2zIvZ8YOn2eQlESX0Ri/teLxO25eMt1wblpoZ75qT0eWjzUJOCzQ 6TbA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature; bh=BJVXDtxgEirjH8NyO5By+qDp9fJbPFF5cIxdkWIlrFs=; b=vIrvsgIhlUL/xt6opdQp7MffeFsF/Hn1bMvYCGki4KzN1pCVE85p6Th1rLgVAqB3cJ 2B/qv8zh9MFG8ELHhwPeCIZMenikkPyji3Oxz7FILMH6mEce/FOWJQyGb7162e8x0AaG ik9UDdDG1yObX1w1ZtzlGwwvdSmcLMm+sbP3LA77zd8WZvl+9FZN0Z9kH6gseTg5nPqi lBXd+IlMlN2upVMCneIIy79pSeULNnARjGCdp84OkzMUMz00dTLyEeawV+3WsjjgPDGF mOvLtXHolMW+u6BycuwpNCgBOfcJAghe1JcMl2iK4nyJvucvRPTA9HzIEbDGP0k1SDvP /VUw== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=JkJaJCG8; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=eHrKUiA+; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id q7-20020a67d787000000b003b0a5279979si1960712vsj.611.2022.12.15.11.02.16 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Dec 2022 11:02:16 -0800 (PST) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=JkJaJCG8; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=eHrKUiA+; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1p5tUY-0001yE-49; Thu, 15 Dec 2022 19:02:02 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1p5tUS-0001xH-Vb for openvpn-devel@lists.sourceforge.net; Thu, 15 Dec 2022 19:01:56 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=kft++lb5mWfu4oaNQTvi7+noKz0ZM4S5GLugv8Ho9jo=; b=JkJaJCG88lZFofkLwLTlAtVORJ yrtv50vT6kppF/vMofbXGnS8kJimqeiQCrhOV+hpwZdS+FHig8LBPsn1+cHjyX8J/kyr0ueic1Dv7 61QePghj0U/O/oMWKjV0XYJ3pq4ROOEpJAXsDX2Fva9VEemXwg1MMVRBZfFjPM4O4Rvk=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-Id: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=kft++lb5mWfu4oaNQTvi7+noKz0ZM4S5GLugv8Ho9jo=; b=eHrKUiA+hrpxd22YwwSpeGo9rV HOpHokhJD8Ivwq7RNBGnxSwKFkMkQpWpPisoH3ivzf4RQoYfEY2ntJS8rEnepcAUO9RX50LRhOx1F wwu9GehUw/J1e6L9RKgod4jGDAhhh0hQBuY73iw+4gmpo2YexU84aJCjRfo9tcHhNPAA=; Received: from mail.blinkt.de ([192.26.174.232]) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1p5tUR-000hym-UG for openvpn-devel@lists.sourceforge.net; Thu, 15 Dec 2022 19:01:56 +0000 Received: from kamera.blinkt.de ([2001:638:502:390:20c:29ff:fec8:535c]) by mail.blinkt.de with smtp (Exim 4.95 (FreeBSD)) (envelope-from ) id 1p5tUF-000Kw0-AN for openvpn-devel@lists.sourceforge.net; Thu, 15 Dec 2022 20:01:43 +0100 Received: (nullmailer pid 2107950 invoked by uid 10006); Thu, 15 Dec 2022 19:01:43 -0000 From: Arne Schwabe To: openvpn-devel@lists.sourceforge.net Date: Thu, 15 Dec 2022 20:01:38 +0100 Message-Id: <20221215190143.2107896-4-arne@rfc2549.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20221215190143.2107896-1-arne@rfc2549.org> References: <20221215190143.2107896-1-arne@rfc2549.org> MIME-Version: 1.0 X-Spam-Score: 0.3 (/) X-Spam-Report: Spam detection software, running on the system "util-spamd-1.v13.lw.sourceforge.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: This fixes two places were we do not have enough space in the array of parameters given to parse_line for the final NULL parameter that signal the end of the parsed argument errors. Both these cases can lead to a buffer overflow. But both of these cases require root/admin access to OpenVPN: Content analysis details: (0.3 points, 6.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.0 SPF_NONE SPF: sender does not publish an SPF Record X-Headers-End: 1p5tUR-000hym-UG Subject: [Openvpn-devel] [PATCH 3/8] Ensure that argument to parse_line has always space for final sentinel X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: =?utf-8?q?1752307792862370143?= X-GMAIL-MSGID: =?utf-8?q?1752307792862370143?= This fixes two places were we do not have enough space in the array of parameters given to parse_line for the final NULL parameter that signal the end of the parsed argument errors. Both these cases can lead to a buffer overflow. But both of these cases require root/admin access to OpenVPN: - parse_argv, only able to trigger if starting openvpn from the command line, at this point you cannot gain more privileges than you already have. Way to reproduce, compile with ASAN and run: openvpn --tls-verify a a a a a a a a a a a a a a a - remove_iroutes_from_push_route_list This operates on the list of pushed entries that is generated by the server itself. So trigger this, you need to have control over config, management interface, a plugin or cdd files. The parse_argv problem was found by Trial of Bits. I found the remove_iroutes_from_push_route_list problem by looking for similar problems. Reported-By: Trial of Bits (TOB-OVPN-4) Signed-off-by: Arne Schwabe Acked-by: Gert Doering --- src/openvpn/options.c | 9 ++++----- src/openvpn/push.c | 4 ++-- 2 files changed, 6 insertions(+), 7 deletions(-) diff --git a/src/openvpn/options.c b/src/openvpn/options.c index e48e4b459..1d6c0572c 100644 --- a/src/openvpn/options.c +++ b/src/openvpn/options.c @@ -5310,8 +5310,6 @@ parse_argv(struct options *options, unsigned int *option_types_found, struct env_set *es) { - int i, j; - /* usage message */ if (argc <= 1) { @@ -5321,7 +5319,7 @@ parse_argv(struct options *options, /* config filename specified only? */ if (argc == 2 && strncmp(argv[1], "--", 2)) { - char *p[MAX_PARMS]; + char *p[MAX_PARMS+1]; CLEAR(p); p[0] = "config"; p[1] = argv[1]; @@ -5331,9 +5329,9 @@ parse_argv(struct options *options, else { /* parse command line */ - for (i = 1; i < argc; ++i) + for (int i = 1; i < argc; ++i) { - char *p[MAX_PARMS]; + char *p[MAX_PARMS+1]; CLEAR(p); p[0] = argv[i]; if (strncmp(p[0], "--", 2)) @@ -5345,6 +5343,7 @@ parse_argv(struct options *options, p[0] += 2; } + int j; for (j = 1; j < MAX_PARMS; ++j) { if (i + j < argc) diff --git a/src/openvpn/push.c b/src/openvpn/push.c index f8c747d44..ad2f3c656 100644 --- a/src/openvpn/push.c +++ b/src/openvpn/push.c @@ -1096,13 +1096,13 @@ remove_iroutes_from_push_route_list(struct options *o) /* cycle through the push list */ while (e) { - char *p[MAX_PARMS]; + char *p[MAX_PARMS+1]; bool enable = true; /* parse the push item */ CLEAR(p); if (e->enable - && parse_line(e->option, p, SIZE(p), "[PUSH_ROUTE_REMOVE]", 1, D_ROUTE_DEBUG, &gc)) + && parse_line(e->option, p, SIZE(p)-1, "[PUSH_ROUTE_REMOVE]", 1, D_ROUTE_DEBUG, &gc)) { /* is the push item a route directive? */ if (p[0] && !strcmp(p[0], "route") && !p[3] && o->iroutes) From patchwork Thu Dec 15 19:01:39 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Schwabe X-Patchwork-Id: 2916 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7300:c95:b0:82:e4b3:40a0 with SMTP id p21csp631571dyk; Thu, 15 Dec 2022 11:02:15 -0800 (PST) X-Google-Smtp-Source: AA0mqf5KDnokfBHh7UkPzT2D11/fKjQ79fQbec9NMck8hg3MobJmycBvna/CvoO+ELaImqTxpIUG X-Received: by 2002:a05:7500:3d1:b0:ea:b8b0:31eb with SMTP id p17-20020a05750003d100b000eab8b031ebmr4795524gab.33.1671130935397; Thu, 15 Dec 2022 11:02:15 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1671130935; cv=none; d=google.com; s=arc-20160816; b=Xw7myiD/Z8rQbgdT4KBsXNPP9ViJC8JEaJRpNqmufoGr+jRPY0jEznI9U8Fv1jQgnK H8iIHI1DtaN9wP/OaXtQNPjE7aM5lO/pvu088af11aDKwDAxi4P/KcOXzdQMqqv7zcpy QlO7SAQHIekLArZddjb5v5YiDMi7BOqU3ePIRMLu3wW9/1stv1EF3Ia23e9zqfhMPPGq ECPSQzO9WPglJK3AF9RADW2pGcs86rc5VpmNmLycomkbWDGa/Ym7cJT/KlNQp+SZmgyb zon7oyGtPSkYN5UOy0If4XSTHIflP3qF35PjffsDAlSYHuN7ZyHg//+x2UtSrGdiZvwg Gjmg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature; bh=IWPSKJbjyeDFYCN6mVeXyoLTljAlT7Vbif4DK+c0MQM=; b=ze5186cJnnXPcSD7d/zunQnpg1boqdgxukRanIN60eIIUjN3VPdOXx+w+wrL8GWbpq LyL/mGWHpJjPwitYfTJDiJUrkuMjTZ0PB36eFo3JOdO1ihjzqRczxzKocxlZe0YfWgKE wow0rWQEvkk+Gqtr2rfyZLGrLXPL9yzLx+UvjZxUw8aADuAgTzAcoSVD82Dl8OWH55/m 51WGrx9EbmTfltRIN2hIznwsb1N+XvmRQRQtCbx69EMUdEHvkeGtC8VYDhr4ihYgCV7B ZWYdnj2MsK95q17LhLtBatL0STFXCdIFWCCgmBTnlo0t0ljgwNkiHXLwtDt3pNw9bYaH xjPw== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=B6R5ZlZ4; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b="ZH/2Hva5"; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id v15-20020a67c00f000000b003adac6a792csi1951461vsi.24.2022.12.15.11.02.15 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Dec 2022 11:02:15 -0800 (PST) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=B6R5ZlZ4; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b="ZH/2Hva5"; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from [127.0.0.1] (helo=sfs-ml-2.v29.lw.sourceforge.com) by sfs-ml-2.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1p5tUT-0007BA-F9; Thu, 15 Dec 2022 19:01:57 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-2.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1p5tUP-0007Ao-Gm for openvpn-devel@lists.sourceforge.net; Thu, 15 Dec 2022 19:01:53 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=CfMi6dEy7BT7g8R85F4sWUaWRfF47pqc153H6I7QQxw=; b=B6R5ZlZ4yPO0PvSiC2U4qjacvw JtbrBseb5UpBFfVhoYtIT/pXgNmik3Rq8mciuDa3XtmThc9KkTHF7fTeHj1RsI4uEVfQSIkYP7J+s HNx2O86k1lKs2jfIu0EpFNY4hzBYP8VoLUe2ZZAnHPQojs/GYDOH8rPT+rQ9uv4Xpr74=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-Id: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=CfMi6dEy7BT7g8R85F4sWUaWRfF47pqc153H6I7QQxw=; b=ZH/2Hva58L4k0rUrrSs77oNRkd cGbqvU3KyodsmZ9gy/tbFA6PtfR8nvUsKhUcfqQYw4B5dXEAeCoM0nPr0dEtX4bHegtrdc75cSzcu aIBOpCz/Abp0T93OnR+jgIKVjoLu3zEMIArB92KmguwIWVUJfAgY6oCq7Mu8ixWPqp10=; Received: from mail.blinkt.de ([192.26.174.232]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1p5tUN-0001Gj-Id for openvpn-devel@lists.sourceforge.net; Thu, 15 Dec 2022 19:01:53 +0000 Received: from kamera.blinkt.de ([2001:638:502:390:20c:29ff:fec8:535c]) by mail.blinkt.de with smtp (Exim 4.95 (FreeBSD)) (envelope-from ) id 1p5tUF-000Kw4-Bu for openvpn-devel@lists.sourceforge.net; Thu, 15 Dec 2022 20:01:43 +0100 Received: (nullmailer pid 2107953 invoked by uid 10006); Thu, 15 Dec 2022 19:01:43 -0000 From: Arne Schwabe To: openvpn-devel@lists.sourceforge.net Date: Thu, 15 Dec 2022 20:01:39 +0100 Message-Id: <20221215190143.2107896-5-arne@rfc2549.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20221215190143.2107896-1-arne@rfc2549.org> References: <20221215190143.2107896-1-arne@rfc2549.org> MIME-Version: 1.0 X-Spam-Score: 0.3 (/) X-Spam-Report: Spam detection software, running on the system "util-spamd-2.v13.lw.sourceforge.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Signed-off-by: Arne Schwabe --- src/openvpn/misc.h | 1 + src/openvpn/ntlm.c | 13 +++++++++++++ 2 files changed, 14 insertions(+) diff --git a/src/openvpn/misc.h b/src/openvpn/misc.h index 2a6c0b8b3..6a883f70a 100644 --- a/src/openvpn/misc.h +++ b/src/openvpn/misc.h @@ -67,6 +67,7 @@ struct user_pass #else #define USER_PASS_LEN [...] Content analysis details: (0.3 points, 6.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.0 SPF_NONE SPF: sender does not publish an SPF Record X-Headers-End: 1p5tUN-0001Gj-Id Subject: [Openvpn-devel] [PATCH 4/8] Improve documentation on user/password requirement and unicodize function X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: =?utf-8?q?1752307791657942835?= X-GMAIL-MSGID: =?utf-8?q?1752307791657942835?= Signed-off-by: Arne Schwabe Acked-by: Gert Doering --- src/openvpn/misc.h | 1 + src/openvpn/ntlm.c | 13 +++++++++++++ 2 files changed, 14 insertions(+) diff --git a/src/openvpn/misc.h b/src/openvpn/misc.h index 2a6c0b8b3..6a883f70a 100644 --- a/src/openvpn/misc.h +++ b/src/openvpn/misc.h @@ -67,6 +67,7 @@ struct user_pass #else #define USER_PASS_LEN 128 #endif + /* Note that username and password are expected to be null-terminated */ char username[USER_PASS_LEN]; char password[USER_PASS_LEN]; }; diff --git a/src/openvpn/ntlm.c b/src/openvpn/ntlm.c index 72c13130a..20527d442 100644 --- a/src/openvpn/ntlm.c +++ b/src/openvpn/ntlm.c @@ -140,6 +140,19 @@ my_strupr(char *str) } } +/** + * This function expects a null-terminated string in src and will + * copy it (including the terminating NUL byte), + * alternating it with 0 to dst. + * + * This basically will transform a ASCII string into valid UTF-16. + * Characters that are 8bit in src, will get the same treatment, resulting in + * invalid or wrong unicode code points. + * + * @note the function will blindly assume that dst has double + * the space of src. + * @return the length of the number of bytes written to dst + */ static int unicodize(char *dst, const char *src) { From patchwork Thu Dec 15 19:01:40 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Schwabe X-Patchwork-Id: 2919 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7300:c95:b0:82:e4b3:40a0 with SMTP id p21csp631681dyk; Thu, 15 Dec 2022 11:02:21 -0800 (PST) X-Google-Smtp-Source: AA0mqf51KVuPLY2N/+2Vas+HNohG6lSxlqJ/VrEXE9ZrWymR45v4XjNFsm+dfiN3BioF8Uxdiqt/ X-Received: by 2002:a05:6102:3128:b0:3b1:3719:f2cf with SMTP id f8-20020a056102312800b003b13719f2cfmr18477208vsh.24.1671130937496; Thu, 15 Dec 2022 11:02:17 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1671130937; cv=none; d=google.com; s=arc-20160816; b=ERQy8tAkLqPouHyhQEFw3IbhimVq02ubgmIz+XVUURC27VawnCGl1JS5ClG1buvWo5 yNOq8hfu3mS7UcerB+Wulsh0+1l0Q4h0LJ0hmKQtYLo9RaaoncBeocffFdbW3hXIbWGO E6irf8piPRZDV1FQtGdE0dYstmeMwSHvlN3bTjW+7b+4+k9nIQpfs10uD58Spc16cBBQ PGIqhG4Hr5oQQj3c4Ca8wEFm/T9LJ2y0eFnnkXJYG+ySUcaTcm6qoEPTl025/9yWoJKD Y93GH4tLQ320kaDQqDQNjbRoKw8GfMiLGuqdrOm3CA04YxiQPt4kp9HVa1gzOAwLId/B gTaA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature; bh=ffK+TD/B52Ei/WV2g8wXI3FYKqDgfzWj+MdGohje+uQ=; b=ybB8YZh2TXQEXxpiNBTN7hguCQmlQVneo/DhyGyr6I6+bl5lRSWo+yTKsvwV+FvW8C OHS84sbWtTTM+oHtQK6VkNqxBqBs8ZwC6R2KrTBeAmPiUiPQ4u5eYEy5DBTZxQDAozMw 8JKl5WhL7DruLqAmuq0ylib6f6VGANKtH31/aBszYoQApPr7kTUOWlkmNwBXBReQlVk1 L9aGJL7riVUAETXMVgqMdUYwGbeij8BcYjYks/Rruv0+vzugIcFVBM2q+cqF23r5T1/A LD9Jcb4hoovPxb1zUhu0y79XpxAvb5P6I5oF5k/5TFBg6TNdULSZWa93GREWe3sHvDVQ Rdxg== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b="ibf/l7uF"; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=lQmSbALl; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id c19-20020a67e013000000b003aa236621efsi2002270vsl.499.2022.12.15.11.02.16 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Dec 2022 11:02:17 -0800 (PST) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b="ibf/l7uF"; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=lQmSbALl; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from [127.0.0.1] (helo=sfs-ml-1.v29.lw.sourceforge.com) by sfs-ml-1.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1p5tUR-00010m-1P; Thu, 15 Dec 2022 19:01:55 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-1.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1p5tUP-00010e-G0 for openvpn-devel@lists.sourceforge.net; Thu, 15 Dec 2022 19:01:53 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=xPgk6Ey0syzEm9M58VHUVKS5LFciu8DEx3T3k9c7d44=; b=ibf/l7uFbSAF0SL3Yc99dG8E5r NMlfawLCcGUSB/0ESzSe9nHs8BlmWGYllkWhBkXDY7p47u0tfh4Yl48ZR3DOWPJvd3x8amuikU420 26ix21SQOvgozH9G5TJeXxxSW45jBfku67Ldwxl6yg1L0TqQw7tL7hthgOwOzT6eeeSI=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-Id: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=xPgk6Ey0syzEm9M58VHUVKS5LFciu8DEx3T3k9c7d44=; b=lQmSbALlaLrP57RA5aekzOXzVC sW8WUY9AyL9BtyHhSi2wNhpDqSLIuOpJlVmaBKCx44NNfsgwour315ZzPIiJZWwPu7ePZV6cK0DFo Xd9CoiJI/EHnRkihXjAH/LyXEwZRL5cPoSggI5OYk8EvHEuf4IXk81LlmhtkPMb1CP4E=; Received: from mail.blinkt.de ([192.26.174.232]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1p5tUN-0001Gi-If for openvpn-devel@lists.sourceforge.net; Thu, 15 Dec 2022 19:01:53 +0000 Received: from kamera.blinkt.de ([2001:638:502:390:20c:29ff:fec8:535c]) by mail.blinkt.de with smtp (Exim 4.95 (FreeBSD)) (envelope-from ) id 1p5tUF-000Kw2-B8 for openvpn-devel@lists.sourceforge.net; Thu, 15 Dec 2022 20:01:43 +0100 Received: (nullmailer pid 2107956 invoked by uid 10006); Thu, 15 Dec 2022 19:01:43 -0000 From: Arne Schwabe To: openvpn-devel@lists.sourceforge.net Date: Thu, 15 Dec 2022 20:01:40 +0100 Message-Id: <20221215190143.2107896-6-arne@rfc2549.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20221215190143.2107896-1-arne@rfc2549.org> References: <20221215190143.2107896-1-arne@rfc2549.org> MIME-Version: 1.0 X-Spam-Score: 0.3 (/) X-Spam-Report: Spam detection software, running on the system "util-spamd-1.v13.lw.sourceforge.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: These empty blocks are intentional but trigger code checkers and were pointed out by Trail of Bits in the security audits. Add comments to them or eliminate them whatever makes more sense. For fallthrough C23 [1] has a standard way to signal that but we not adding a C23 feature to our codebase, so use a comment for now. Content analysis details: (0.3 points, 6.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.0 SPF_NONE SPF: sender does not publish an SPF Record X-Headers-End: 1p5tUN-0001Gi-If Subject: [Openvpn-devel] [PATCH 5/8] Eliminate or comment empty blocks and switch fallthrough X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: =?utf-8?q?1752307793754970408?= X-GMAIL-MSGID: =?utf-8?q?1752307793754970408?= These empty blocks are intentional but trigger code checkers and were pointed out by Trail of Bits in the security audits. Add comments to them or eliminate them whatever makes more sense. For fallthrough C23 [1] has a standard way to signal that but we not adding a C23 feature to our codebase, so use a comment for now. [1] https://en.cppreference.com/w/c/language/attributes/fallthrough Signed-off-by: Arne Schwabe Acked-by: Gert Doering --- src/openvpn/comp-lz4.c | 1 + src/openvpn/crypto.c | 1 + src/openvpn/init.c | 1 + src/openvpn/lzo.c | 1 + src/openvpn/options.c | 5 +-- src/openvpn/ssl_openssl.c | 68 ++++++++++++++++++--------------------- 6 files changed, 36 insertions(+), 41 deletions(-) diff --git a/src/openvpn/comp-lz4.c b/src/openvpn/comp-lz4.c index b456182e7..b54775b7e 100644 --- a/src/openvpn/comp-lz4.c +++ b/src/openvpn/comp-lz4.c @@ -237,6 +237,7 @@ lz4_decompress(struct buffer *buf, struct buffer work, } else if (c == NO_COMPRESS_BYTE_SWAP) /* packet was not compressed */ { + /* nothing to do */ } else { diff --git a/src/openvpn/crypto.c b/src/openvpn/crypto.c index d266716c7..d735d7160 100644 --- a/src/openvpn/crypto.c +++ b/src/openvpn/crypto.c @@ -1300,6 +1300,7 @@ read_key_file(struct key2 *key2, const char *file, const unsigned int flags) } else if (isspace(c)) { + /* ignore white space characters */ } else { diff --git a/src/openvpn/init.c b/src/openvpn/init.c index 74b380327..219bff84c 100644 --- a/src/openvpn/init.c +++ b/src/openvpn/init.c @@ -2921,6 +2921,7 @@ do_init_crypto_tls_c1(struct context *c) case AR_INTERACT: ssl_purge_auth(false); + /* Intentional [[fallthrough]]; */ case AR_NOINTERACT: c->sig->signal_received = SIGUSR1; /* SOFT-SIGUSR1 -- Password failure error */ diff --git a/src/openvpn/lzo.c b/src/openvpn/lzo.c index 39e833cb3..ef6c4c8d7 100644 --- a/src/openvpn/lzo.c +++ b/src/openvpn/lzo.c @@ -250,6 +250,7 @@ lzo_decompress(struct buffer *buf, struct buffer work, } else if (c == NO_COMPRESS_BYTE) /* packet was not compressed */ { + /* nothing to do */ } else { diff --git a/src/openvpn/options.c b/src/openvpn/options.c index 1d6c0572c..4383c953e 100644 --- a/src/openvpn/options.c +++ b/src/openvpn/options.c @@ -2973,10 +2973,7 @@ options_postprocess_verify_ce(const struct options *options, "--auth-user-pass"); } } - else if (sum == 2) - { - } - else + else if (sum != 2) { msg(M_USAGE, "If you use one of --cert or --key, you must use them both"); } diff --git a/src/openvpn/ssl_openssl.c b/src/openvpn/ssl_openssl.c index cd6d84246..dbf909269 100644 --- a/src/openvpn/ssl_openssl.c +++ b/src/openvpn/ssl_openssl.c @@ -1826,10 +1826,7 @@ bio_write(BIO *bio, const uint8_t *data, int size, const char *desc) if (i < 0) { - if (BIO_should_retry(bio)) - { - } - else + if (!BIO_should_retry(bio)) { crypto_msg(D_TLS_ERRORS, "TLS ERROR: BIO write %s error", desc); ret = -1; @@ -1873,51 +1870,48 @@ bio_write_post(const int status, struct buffer *buf) static int bio_read(BIO *bio, struct buffer *buf, const char *desc) { - int i; - int ret = 0; ASSERT(buf->len >= 0); if (buf->len) { + /* we only want to write empty buffers, ignore read request + * if the buffer is not empty */ + return 0; } - else - { - int len = buf_forward_capacity(buf); + int len = buf_forward_capacity(buf); - /* - * BIO_read brackets most of the serious RSA - * key negotiation number crunching. - */ - i = BIO_read(bio, BPTR(buf), len); + /* + * BIO_read brackets most of the serious RSA + * key negotiation number crunching. + */ + int i = BIO_read(bio, BPTR(buf), len); - VALGRIND_MAKE_READABLE((void *) &i, sizeof(i)); + VALGRIND_MAKE_READABLE((void *) &i, sizeof(i)); #ifdef BIO_DEBUG - bio_debug_data("read", bio, BPTR(buf), i, desc); + bio_debug_data("read", bio, BPTR(buf), i, desc); #endif - if (i < 0) - { - if (BIO_should_retry(bio)) - { - } - else - { - crypto_msg(D_TLS_ERRORS, "TLS_ERROR: BIO read %s error", desc); - buf->len = 0; - ret = -1; - ERR_clear_error(); - } - } - else if (!i) + + int ret = 0; + if (i < 0) + { + if (!BIO_should_retry(bio)) { + crypto_msg(D_TLS_ERRORS, "TLS_ERROR: BIO read %s error", desc); buf->len = 0; + ret = -1; + ERR_clear_error(); } - else - { /* successful read */ - dmsg(D_HANDSHAKE_VERBOSE, "BIO read %s %d bytes", desc, i); - buf->len = i; - ret = 1; - VALGRIND_MAKE_READABLE((void *) BPTR(buf), BLEN(buf)); - } + } + else if (!i) + { + buf->len = 0; + } + else + { /* successful read */ + dmsg(D_HANDSHAKE_VERBOSE, "BIO read %s %d bytes", desc, i); + buf->len = i; + ret = 1; + VALGRIND_MAKE_READABLE((void *) BPTR(buf), BLEN(buf)); } return ret; } From patchwork Thu Dec 15 19:01:41 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Schwabe X-Patchwork-Id: 2914 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7300:c95:b0:82:e4b3:40a0 with SMTP id p21csp631570dyk; Thu, 15 Dec 2022 11:02:15 -0800 (PST) X-Google-Smtp-Source: AA0mqf666YRfcQD4f4fm6dBpTRNGJeMezWj6Z/fw9w+p2uxXMRJW0CopJTxb4w4gQyxl3/pJ426o X-Received: by 2002:a05:6102:390a:b0:3af:3240:976b with SMTP id e10-20020a056102390a00b003af3240976bmr24248371vsu.7.1671130935381; Thu, 15 Dec 2022 11:02:15 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1671130935; cv=none; d=google.com; s=arc-20160816; b=q2Bpp6jp0BXoo3xVfvW4rSrpz8flG1mqNLfSR8kKRpPcHq+qa9g9R+6kdv7wN97rVu 2GFi920SOixfSTREHzndjJozD9svyRlew9uWAku64o9mVS3g3RxWtUaqcXcu8MsLYKSS bfAuxj9lch13O/TvDZXbxYMd63AZnmXP2iGV0upIEZxwTPQA1Wm0PHMU+u5PPLOAvZhJ hEbE2HmHKLjAH1DztI04hmL/AZFHojl46+NV6FQJ9sxBnU/WYvYskhXAz5bJW3EKnhic AZTLjpnZltBzusiYEp2x3aAwxRaBLojPp6ty5Q6zwwJlGgIneMePE1pYLESkU5qoATlS 4H7w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature; bh=/33Zc3v/30KJVIwK48cide88YgUvgqU/L13eLKI0XhQ=; b=oDWtN1QbiiVbV3U/uLkJ/PNfZLOhe7ik4bXhCDFBkxEJ9VZ0NcY9rztuXtQIRSLNHf +ZhzUVqt+7zVIHP4rOnW47bKPnHYLMv5/kLDa2rmTXiJvczoeHbvYFuPT3aSdKmJF2OD gcbhouvA9P3JtqDizu2S1E5Bwxg1UMS8qkqSV41jMUSxyNsCZxf+wlQRaijf7nJPLptK cfB7MSlhSNpwws1bYf2siovNw8aIsTNYOUyg0/ZYwnZ3uA1oTok9EhzZ6BrXt9cppk0F uYxWffDxECCPLWkNbJGIbD86QULtPKEnQhvpCp92r2RT5d/Civo5Ck5ZoqKcZSE383it wEEg== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=imLVIzxp; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=ZjyTurDF; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id b10-20020a67b20a000000b003b3576a2435si1906582vsf.772.2022.12.15.11.02.15 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Dec 2022 11:02:15 -0800 (PST) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=imLVIzxp; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=ZjyTurDF; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1p5tUS-0001x7-Sy; Thu, 15 Dec 2022 19:01:56 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1p5tUP-0001wj-UE for openvpn-devel@lists.sourceforge.net; Thu, 15 Dec 2022 19:01:53 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=SNWBrmc6UEoQbPnl8r7iByQwbdUlk1zrLTvGT9IpYXM=; b=imLVIzxpJnbl9EMCW5gk0fFU2N FAUxvOzTJ66ulYI7ILZ+jbk59elbXXc9tA2GCjoVsGtWl9YKv2Q7gdIBor8RQGwShbyhcRsPxO49z 8BAi62YrnCoiYwpH7ovbMT3AoJf2yYVs6uUcoqvBsC20AZAUUyxiljQac2E2Lou4AwCk=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-Id: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=SNWBrmc6UEoQbPnl8r7iByQwbdUlk1zrLTvGT9IpYXM=; b=ZjyTurDFbPLTj+S+V64iEagE6I tbNlhE2h+ZihQIKrG6BNL38ghOlXPzfup1hlZLD+a2AadzB3+rjH9K/n2kr0JWvzdF8haOwqOW/8t FEuncNpqL3c/JPNpCv4bVD36DCvgs7/ARmgqRN569089mOUa0hDiq98mODY1xCGOTL3U=; Received: from mail.blinkt.de ([192.26.174.232]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1p5tUN-0001Gk-Ij for openvpn-devel@lists.sourceforge.net; Thu, 15 Dec 2022 19:01:53 +0000 Received: from kamera.blinkt.de ([2001:638:502:390:20c:29ff:fec8:535c]) by mail.blinkt.de with smtp (Exim 4.95 (FreeBSD)) (envelope-from ) id 1p5tUF-000Kw6-Ca for openvpn-devel@lists.sourceforge.net; Thu, 15 Dec 2022 20:01:43 +0100 Received: (nullmailer pid 2107959 invoked by uid 10006); Thu, 15 Dec 2022 19:01:43 -0000 From: Arne Schwabe To: openvpn-devel@lists.sourceforge.net Date: Thu, 15 Dec 2022 20:01:41 +0100 Message-Id: <20221215190143.2107896-7-arne@rfc2549.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20221215190143.2107896-1-arne@rfc2549.org> References: <20221215190143.2107896-1-arne@rfc2549.org> MIME-Version: 1.0 X-Spam-Score: 0.3 (/) X-Spam-Report: Spam detection software, running on the system "util-spamd-2.v13.lw.sourceforge.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Reported-By: Trail of Bits Signed-off-by: Arne Schwabe --- src/openvpn/forward.c | 3 --- src/openvpn/multi.c | 2 -- 2 files changed, 5 deletions(-) diff --git a/src/openvpn/forward.c b/src/openvpn/forward.c index 7924fd5c6..c04511ee1 100644 --- a/src/openvpn/forward.c +++ b/src/openvpn/forward.c @@ -1869,8 +1869,6 @@ process_outgoing_link(struct [...] Content analysis details: (0.3 points, 6.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.0 SPF_NONE SPF: sender does not publish an SPF Record X-Headers-End: 1p5tUN-0001Gk-Ij Subject: [Openvpn-devel] [PATCH 6/8] Remove unused gc_arena X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: =?utf-8?q?1752307791616957270?= X-GMAIL-MSGID: =?utf-8?q?1752307791616957270?= Reported-By: Trail of Bits Signed-off-by: Arne Schwabe Acked-by: Gert Doering --- src/openvpn/forward.c | 3 --- src/openvpn/multi.c | 2 -- 2 files changed, 5 deletions(-) diff --git a/src/openvpn/forward.c b/src/openvpn/forward.c index 7924fd5c6..c04511ee1 100644 --- a/src/openvpn/forward.c +++ b/src/openvpn/forward.c @@ -1869,8 +1869,6 @@ process_outgoing_link(struct context *c) void process_outgoing_tun(struct context *c) { - struct gc_arena gc = gc_new(); - /* * Set up for write() call to TUN/TAP * device. @@ -1956,7 +1954,6 @@ process_outgoing_tun(struct context *c) buf_reset(&c->c2.to_tun); perf_pop(); - gc_free(&gc); } void diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c index 870e3fa61..fcb308151 100644 --- a/src/openvpn/multi.c +++ b/src/openvpn/multi.c @@ -3497,7 +3497,6 @@ multi_process_incoming_link(struct multi_context *m, struct multi_instance *inst bool multi_process_incoming_tun(struct multi_context *m, const unsigned int mpp_flags) { - struct gc_arena gc = gc_new(); bool ret = true; if (BLEN(&m->top.c2.buf) > 0) @@ -3583,7 +3582,6 @@ multi_process_incoming_tun(struct multi_context *m, const unsigned int mpp_flags } } } - gc_free(&gc); return ret; } From patchwork Thu Dec 15 19:01:42 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Schwabe X-Patchwork-Id: 2920 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7300:c95:b0:82:e4b3:40a0 with SMTP id p21csp632025dyk; Thu, 15 Dec 2022 11:02:43 -0800 (PST) X-Google-Smtp-Source: AA0mqf56h5WKXZSXal0Ge0zPPtNBWAN/1imcXTahILxStjiBAEqtTSTNfIZyVqc5UgyMOnK49u8Q X-Received: by 2002:a05:6102:4ad:b0:3b5:1c66:8462 with SMTP id r13-20020a05610204ad00b003b51c668462mr8263318vsa.12.1671130962898; Thu, 15 Dec 2022 11:02:42 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1671130962; cv=none; d=google.com; s=arc-20160816; b=COofd1OGhhXAmhkZBWpid5yZKZH3GXogL7JuySXR5qp8xl2YmfSDOrvPv1mtHRzJmW gCjeX8zdo9Tcsy7lYxFCZ7z1x+m3gwWUxYbZK26XxmUTDjVuI5W6y1uTJATxIQbkTD1u RKFvb7ZGo5JvDUnYH2AdH8dh/Ufg9vxNnKNTmN/vz9LRCcceHFe9Yzr1ge4nycmnsLIT OG2TS5VmwnDikOaa3IT3chNFtoCvAlYCtYeJ094Wsrcdnhz6uUwU7pPofkpvfNhjRw2E bw+eZJ3ed9/0NYRnEZUz2YmmE5HsigD8BjYT0fEmIgbP3IH3FH0PVcRJ6apU1ScVWxss nEMQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature; bh=2EOLnSbHcplVkeDPYcx1okOXGyCwEoJr1dvmcl3vxuo=; b=gzHtmJYMOCeochFfFhG60Dxlet90GnSAIPowau6tX8sHeQXRtJDjKoXjFkkrkvzH7v kbKtMBwv2OUVVCX7V1YNQtaQXWZOdKoQFfNy/AW6uUWdNoe64RMyxJYAyst/Q/Ic+J/n Lfm6q0XpfOpeLt2FXCw/NfEPxhfGnL2lMyuiGIZygBykKYgXd3GgCuaibWOymZSomq4Q vl9R2cFeII+KY0aYx+Wzin6XAe1Aer+cz+0HpIi7FGhgr03nINphYSr6CY34LhF2CYdj 7DCTGwuE50ECB+33hRupSFt0cg0OPGTgBVSWjkpf+JHMl6QcLk9TYl94EUMABHGsnVm6 JbfQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=LePoKAHc; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=gTdvjGfB; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id i40-20020a0561023d2800b003b089fe31d4si2087774vsv.607.2022.12.15.11.02.42 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Dec 2022 11:02:42 -0800 (PST) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=LePoKAHc; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=gTdvjGfB; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1p5tUS-0001ww-IQ; Thu, 15 Dec 2022 19:01:56 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1p5tUP-0001wd-GP for openvpn-devel@lists.sourceforge.net; Thu, 15 Dec 2022 19:01:53 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=iG3eXgeYj3d1z2qZgvLRpwa/d2iMZ6vMs99ge3pSG1k=; b=LePoKAHcvywdwyRpMoD/kzCxvF xT8M/0YFu4D2wVMIHOK9Db+PsnlfGVXAZYYQuAWBLp6XGv8w9dWJ3INpHbrw7CaKj+MCV2Flr2O9j dzYxk87cx/YBP8psWRPwQf9XLFiU7MANTXbtC2iABemvUpy4W4nxhSlOE4ktbB4hYqws=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-Id: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=iG3eXgeYj3d1z2qZgvLRpwa/d2iMZ6vMs99ge3pSG1k=; b=gTdvjGfBMxqwWRLBb7+LLGk4DJ j+wYxgar/g6d0OqsWbnRaYKigcq3/6sQ3vIU57vnuzKvSJP14nRLitTGF43hCKO+U2FNOUjmQerER JkkA/VrUpIvcq9q6u6JgFm4vrHVhJuZt4Rn/rHi/ZYsLwRLsdyi/phypxeT/0TxT4dAU=; Received: from mail.blinkt.de ([192.26.174.232]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1p5tUN-0001Gl-IZ for openvpn-devel@lists.sourceforge.net; Thu, 15 Dec 2022 19:01:53 +0000 Received: from kamera.blinkt.de ([2001:638:502:390:20c:29ff:fec8:535c]) by mail.blinkt.de with smtp (Exim 4.95 (FreeBSD)) (envelope-from ) id 1p5tUF-000KwF-E0 for openvpn-devel@lists.sourceforge.net; Thu, 15 Dec 2022 20:01:43 +0100 Received: (nullmailer pid 2107961 invoked by uid 10006); Thu, 15 Dec 2022 19:01:43 -0000 From: Arne Schwabe To: openvpn-devel@lists.sourceforge.net Date: Thu, 15 Dec 2022 20:01:42 +0100 Message-Id: <20221215190143.2107896-8-arne@rfc2549.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20221215190143.2107896-1-arne@rfc2549.org> References: <20221215190143.2107896-1-arne@rfc2549.org> MIME-Version: 1.0 X-Spam-Score: 0.3 (/) X-Spam-Report: Spam detection software, running on the system "util-spamd-2.v13.lw.sourceforge.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Reported-By: Trail of Bits Signed-off-by: Arne Schwabe --- src/openvpn/misc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/openvpn/misc.c b/src/openvpn/misc.c index d78106cdc..551606e0e 100644 --- a/src/openvpn/misc.c +++ b/src/openvpn/misc.c @@ -258, 6 +258, 7 @@ get_user_pass_cr(struct user_pass *up, msg( [...] Content analysis details: (0.3 points, 6.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.0 SPF_NONE SPF: sender does not publish an SPF Record X-Headers-End: 1p5tUN-0001Gl-IZ Subject: [Openvpn-devel] [PATCH 7/8] Fix corner case that might lead to leaked file descriptor X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: =?utf-8?q?1752307820148811268?= X-GMAIL-MSGID: =?utf-8?q?1752307820148811268?= Reported-By: Trail of Bits Signed-off-by: Arne Schwabe Acked-by: Gert Doering --- src/openvpn/misc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/openvpn/misc.c b/src/openvpn/misc.c index d78106cdc..551606e0e 100644 --- a/src/openvpn/misc.c +++ b/src/openvpn/misc.c @@ -258,6 +258,7 @@ get_user_pass_cr(struct user_pass *up, msg(D_LOW, "No password found in %s authfile '%s'. Querying the management interface", prefix, auth_file); if (!auth_user_pass_mgmt(up, prefix, flags, auth_challenge)) { + fclose(fp); return false; } } From patchwork Thu Dec 15 19:01:43 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Schwabe X-Patchwork-Id: 2921 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7300:c95:b0:82:e4b3:40a0 with SMTP id p21csp632042dyk; Thu, 15 Dec 2022 11:02:43 -0800 (PST) X-Google-Smtp-Source: AMrXdXu7ou9A37XXT5WnaVo7YckuCHmd2Hs6IZWIqkkvqrASJK2OaK8ANiSbaNt+YBtq8vZbMvZS X-Received: by 2002:a05:7508:5411:b0:48:ad14:d0e9 with SMTP id ed17-20020a057508541100b00048ad14d0e9mr585524gbb.0.1671130963576; Thu, 15 Dec 2022 11:02:43 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1671130963; cv=none; d=google.com; s=arc-20160816; b=eKWJo293DkAA4AZTmjiX5JA5OYiyb/rD/GR3tc2ojOFCuJGcsk9kOs21p1OhOAdlSY CIlFdrHsbIlWCGg+b1MaQpZkmWqkrwZqnZqpbkzn09AtL59lw2KqPs6LgEtgIx/uFB4j fNwK5uf7YVsX2bH/kGa77DZycHOTMi5jjAyJh5v5Mux+xg52kVtxf999wr8dcyvfPYZz Xy99Yn1W4YvHq9/fan5Njle7f/kZEb7olJ7R8+to64qQzRf3IOK9PBwcnQQ3UYw7x6ih +gMNs+S1WqE4slzxITswIJUd9/AOD4qe+QYz16WZFcTMuNVudWgwTLwKeHhMUjKOHZUg 8hsA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature; bh=Xkr29BMNLPYrNSvWr1sHivnds/ZOD/zzgNgWv5kRp3I=; b=HqA2qdSeL+Esr7nm/vMg0M7M97AHLNqLd3VFDjahyb5hOh1INuiklu1Akm1w+QsrUc 5p6tZT4KsfsEGPENm6Uhlh8kwt509YCGaEFNLGW+LCSTsjvpJ528DyAZzxH8rSep8jVy 3Ny8rOjWC7TI7wmOPrpev/Yg3eZT+Z/2eilEzEc1RYa0D+OeI5aNfCHCntwKRoPX7xBg pQEGo6VOOPuIutbPxgLiAX7ygSNAuJ87mAHahXR/fWitnhDGHT3jzOp0aQvztANeioJ5 c3PDRNK6x+dB+TqFiwOnAJhbEZxuGR1EhPK0gCXTBN78JlN5+sU2bQMiXV4vAlEGvNt2 l15A== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=nLzm5YGS; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=XF+uVrWe; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id f43-20020ab049ee000000b004183c5db8besi2000345uad.158.2022.12.15.11.02.43 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Dec 2022 11:02:43 -0800 (PST) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=nLzm5YGS; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=XF+uVrWe; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from [127.0.0.1] (helo=sfs-ml-1.v29.lw.sourceforge.com) by sfs-ml-1.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1p5tUX-00011Q-NS; Thu, 15 Dec 2022 19:02:01 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-1.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1p5tUS-000110-W2 for openvpn-devel@lists.sourceforge.net; Thu, 15 Dec 2022 19:01:56 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=RFB8ouURpxG9/2dJW2nYiCQaJu4ecRucP93ZywvtgS4=; b=nLzm5YGSSXvNxkarCHErzyr81T 736zxIPWTnju2FGbB14y0OVbDa0zsnp6NAdtHqBpyEEnsGHLaELTKNHP4b0JJtf2nd1+ulfu7aP3R UG3NDFcDLritdTVOrGa1sFzYISO2dFAcFlRWGkM4+ZcJUHpxxTpVnPqKkoDrbqgQpz+Y=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-Id: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=RFB8ouURpxG9/2dJW2nYiCQaJu4ecRucP93ZywvtgS4=; b=XF+uVrWeIYMJCcmw59fV5mOPGR yS8+raWEykr96U9A0MQhl+xKiP99Vcie9hMC2OY/CNimRIN/M5mTi7q8kl3CmaCOr2uFukigkeR4U ZOcA0MD7F+5Feo5qAfOh6DcKcrH26ldA/InuCHglZnGEx98YWgBKVH18e5L4F5lMG98E=; Received: from mail.blinkt.de ([192.26.174.232]) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1p5tUR-000hyn-UR for openvpn-devel@lists.sourceforge.net; Thu, 15 Dec 2022 19:01:56 +0000 Received: from kamera.blinkt.de ([2001:638:502:390:20c:29ff:fec8:535c]) by mail.blinkt.de with smtp (Exim 4.95 (FreeBSD)) (envelope-from ) id 1p5tUF-000KwC-DI for openvpn-devel@lists.sourceforge.net; Thu, 15 Dec 2022 20:01:43 +0100 Received: (nullmailer pid 2107964 invoked by uid 10006); Thu, 15 Dec 2022 19:01:43 -0000 From: Arne Schwabe To: openvpn-devel@lists.sourceforge.net Date: Thu, 15 Dec 2022 20:01:43 +0100 Message-Id: <20221215190143.2107896-9-arne@rfc2549.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20221215190143.2107896-1-arne@rfc2549.org> References: <20221215190143.2107896-1-arne@rfc2549.org> MIME-Version: 1.0 X-Spam-Score: 0.3 (/) X-Spam-Report: Spam detection software, running on the system "util-spamd-1.v13.lw.sourceforge.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: NTLMv1 is ancient and not considered secure anymore and we are not aware of any users or software still requiring this feature. Additionally it currently depends on our "doing single DES using 3DES" workaround for OpenSSL (cipher_des_encrypt_ecb). So removing NTLMv1 will also allow us to remove that workaround. Content analysis details: (0.3 points, 6.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.0 SPF_NONE SPF: sender does not publish an SPF Record X-Headers-End: 1p5tUR-000hyn-UR Subject: [Openvpn-devel] [PATCH 8/8] Deprecate NTLMv1 proxy auth method. X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: =?utf-8?q?1752307821597457555?= X-GMAIL-MSGID: =?utf-8?q?1752307821597457555?= NTLMv1 is ancient and not considered secure anymore and we are not aware of any users or software still requiring this feature. Additionally it currently depends on our "doing single DES using 3DES" workaround for OpenSSL (cipher_des_encrypt_ecb). So removing NTLMv1 will also allow us to remove that workaround. Reported-By: Trial of Bits (TOB-OVPN-7) Signed-off-by: Arne Schwabe Acked-by: Gert Doering --- src/openvpn/proxy.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/openvpn/proxy.c b/src/openvpn/proxy.c index ed7201616..633caee09 100644 --- a/src/openvpn/proxy.c +++ b/src/openvpn/proxy.c @@ -519,6 +519,8 @@ http_proxy_new(const struct http_proxy_options *o) #if NTLM else if (!strcmp(o->auth_method_string, "ntlm")) { + msg(M_INFO, "NTLM v1 authentication is deprecated and will be removed in " + "OpenVPN 2.7"); p->auth_method = HTTP_AUTH_NTLM; } else if (!strcmp(o->auth_method_string, "ntlm2"))