From patchwork Thu Oct 9 18:28:49 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gert Doering X-Patchwork-Id: 4491 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:7d42:b0:72f:f16c:e055 with SMTP id fr2csp1844498mab; Thu, 9 Oct 2025 11:29:12 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCWm4hEok9bG8+F4apDgY2fkUBtSJCTFnCnMDnbqlwvyU0C8XikYfVhQt6rjO4v11Y1L2Btp3GldVHk=@openvpn.net X-Google-Smtp-Source: AGHT+IGR/dk5bKbIfRQggWjIyQlpN5Tu296DdH8mzmhtaEhsh6bMzpv/hTIRpKxOmHvRy/DX/ZyF X-Received: by 2002:a05:6808:3087:b0:43f:1a5f:2823 with SMTP id 5614622812f47-4417b3b41femr4045963b6e.26.1760034552565; Thu, 09 Oct 2025 11:29:12 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1760034552; cv=none; d=google.com; s=arc-20240605; b=eRTxZ8i48PsYVCxqmm9AGSuCDkXcUduNmXvmHJfng1B2457qCFfEFw9Y3obvnz38Mg NyiglmaehiaLxltrtBtyQd8O2934DdGDxQaQr+adr+jVUmLm7C+kj/piGKfsE+teNeES xeT5kc3Lua6hK7BxWSlkBYh3+KEqMS1TB6bOa+cusnhdtxav8h3Zc0FmTJvEZgcvQf74 YaPbsgwGIy5wPnnbA5qCrXGZCQSAVKtWfm5m08L9e4MYsrqEUXUM6yVZS8/heZE5cCg2 oyAM7J/ArtUcwWORiSkPHdS0+gsTQFAKhCN2FBDOw/Ghzy3PBJEM6NLOG0Mf2UH2rv2w m9QA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=oJXjK3U3vJrc01S+PSUftAIIEpyGxCcqBr+zXKAt6oM=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=NB3oPZNslXvYP3e2UpuVcVxH8yquQr/CiW2ufQkDg7nIybbyLEPpjmMvMgvkeXNIEe 35h+3WvVR+Gt5ln82tenffP6kJRsGg6MWRNEWP8Gb7w0iSSNhNezthmWgp6fwTqRobJ3 GGSsHUxrFLEIOxuPFTv5I83nL6tk4brCCpGMUauOSiXP52Lu0IpyG11wgevmOyi59YVM J7Gxh6H2HVA6/yf+O9X3JX7Twt5YFpbKvhECPFEiCdNrzD7wZON21AlcSgIDx6D1PSlm uVFlDcrfSuUdd/vauSahvYDgYRKxTgOsVgpKZOvWFqD3s/Er7c4lhnc5G2Rh5QysXpts ixDQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=A9mDoxam; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=JWeAJ53p; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=CGdVHgnZ; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 5614622812f47-441989a9c81si29831b6e.238.2025.10.09.11.29.12 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 09 Oct 2025 11:29:12 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=A9mDoxam; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=JWeAJ53p; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=CGdVHgnZ; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=oJXjK3U3vJrc01S+PSUftAIIEpyGxCcqBr+zXKAt6oM=; b=A9mDoxamqTpfn3AbU2Gp+Rmhj9 QF2m8LL/Yki0qLDkt0warp+soNFtWrStF8Eu11iHVEwAWBwQqFU5l69yWKvsy+JjiVd2YOxbpyOjP xfPUlC6A54FbJLsFZZ1oqVu4OWCIYyqhD/2t2bCFS8Dvc9F6JUwt9ROSDSPK0fHdzH5k=; Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1v6vO2-0000PO-1N; Thu, 09 Oct 2025 18:29:10 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1v6vO0-0000PH-V4 for openvpn-devel@lists.sourceforge.net; Thu, 09 Oct 2025 18:29:08 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=CwUcJaZqyDyARPihYcWEYc1oYyU2zPsV38xgWt27WT8=; b=JWeAJ53pKfalh0fti2B/L18Tv5 Xt7rUFsBKeRJZap2hB+xcEl17JjYU8yPp58ob3UskgEtwWvVw4TC1h/FrhnkAsJ1uX22avf8HfENW FusL3O6Ifk1MjKTsDIY6ynE47bwRWw64sJxkJpydGhut5uObBbi1L33T9kEzJPiNa4lY=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=CwUcJaZqyDyARPihYcWEYc1oYyU2zPsV38xgWt27WT8=; b=CGdVHgnZ6BsItGBWqJwu+NU1zN XB0XtVyaaD6Bzalt8PEg5+5DTwTSq+EyQagtiFtcSUoCd91C4QZNAqcaIbPeFh5SR5yQL4HZ7zH/b uXrThcqTeoLem29PvAjnGIVAW9utuqp6olJ3eILetQC/pwXi1PRrU9VK5ImQKPCdFXik=; Received: from [193.149.48.134] (helo=blue.greenie.muc.de) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1v6vNz-0003N9-NK for openvpn-devel@lists.sourceforge.net; Thu, 09 Oct 2025 18:29:08 +0000 Received: from blue.greenie.muc.de (localhost [127.0.0.1]) by blue.greenie.muc.de (8.18.1/8.18.1) with ESMTP id 599IStAA018732 for ; Thu, 9 Oct 2025 20:28:55 +0200 Received: (from gert@localhost) by blue.greenie.muc.de (8.18.1/8.18.1/Submit) id 599IStQT018731 for openvpn-devel@lists.sourceforge.net; Thu, 9 Oct 2025 20:28:55 +0200 From: Gert Doering To: openvpn-devel@lists.sourceforge.net Date: Thu, 9 Oct 2025 20:28:49 +0200 Message-ID: <20251009182855.18712-1-gert@greenie.muc.de> X-Mailer: git-send-email 2.49.1 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Marco Baffo Before sending the PUSH_UPDATE message to the client, we must verify that the client has actually sent IV_PROTO_PUSH_UPDATE to the server, declaring that it supports push-updates. Content analysis details: (1.3 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS X-Headers-End: 1v6vNz-0003N9-NK Subject: [Openvpn-devel] [PATCH v2] PUSH_UPDATE server: check IV_PROTO before sending the message to the client X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: =?utf-8?q?1845529990827705087?= X-GMAIL-MSGID: =?utf-8?q?1845529990827705087?= From: Marco Baffo Before sending the PUSH_UPDATE message to the client, we must verify that the client has actually sent IV_PROTO_PUSH_UPDATE to the server, declaring that it supports push-updates. Also fixed a gc_arena memory leak in one of the error paths and asserted mi->context.c2.tls_multi . Change-Id: I7c28da72be11c7efbed3068fbfc65f2959227bec Signed-off-by: Marco Baffo Acked-by: Gert Doering Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1255 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1255 This mail reflects revision 2 of this Change. Acked-by according to Gerrit (reflected above): Gert Doering diff --git a/src/openvpn/push_util.c b/src/openvpn/push_util.c index f306104..3fa099c 100644 --- a/src/openvpn/push_util.c +++ b/src/openvpn/push_util.c @@ -7,6 +7,7 @@ #ifdef ENABLE_MANAGEMENT #include "multi.h" +#include "ssl_util.h" #endif #if defined(__GNUC__) || defined(__clang__) @@ -174,20 +175,32 @@ buf_string_compare_advance(&msgs[i], push_update_cmd); if (process_incoming_push_update(c, pull_permission_mask(c), option_types_found, &msgs[i], true) == PUSH_MSG_ERROR) { - msg(M_WARN, "Failed to process push update message sent to client ID: %u", - c->c2.tls_multi ? c->c2.tls_multi->peer_id : UINT32_MAX); + msg(M_WARN, "Failed to process push update message sent to client ID: %u", c->c2.tls_multi->peer_id); continue; } c->options.push_option_types_found |= *option_types_found; if (!options_postprocess_pull(&c->options, c->c2.es)) { - msg(M_WARN, "Failed to post-process push update message sent to client ID: %u", - c->c2.tls_multi ? c->c2.tls_multi->peer_id : UINT32_MAX); + msg(M_WARN, "Failed to post-process push update message sent to client ID: %u", c->c2.tls_multi->peer_id); } } return true; } +/* Return true if the client supports push-update */ +static bool +support_push_update(struct multi_instance *mi) +{ + ASSERT(mi->context.c2.tls_multi); + const unsigned int iv_proto_peer = extract_iv_proto(mi->context.c2.tls_multi->peer_info); + if (!(iv_proto_peer & IV_PROTO_PUSH_UPDATE)) + { + return false; + } + + return true; +} + int send_push_update(struct multi_context *m, const void *target, const char *msg, const push_update_type type, const int push_bundle_size) { @@ -228,9 +241,17 @@ if (!mi) { + gc_free(&gc); return -ENOENT; } + if (!support_push_update(mi)) + { + msg(M_CLIENT, "PUSH_UPDATE: not sending message to unsupported peer with ID: %u", mi->context.c2.tls_multi->peer_id); + gc_free(&gc); + return 0; + } + const char *old_ip = mi->context.options.ifconfig_local; const char *old_ipv6 = mi->context.options.ifconfig_ipv6_local; if (!mi->halt @@ -259,7 +280,7 @@ { struct multi_instance *curr_mi = he->value; - if (curr_mi->halt) + if (curr_mi->halt || !support_push_update(curr_mi)) { continue; } @@ -270,8 +291,7 @@ const char *old_ipv6 = curr_mi->context.options.ifconfig_ipv6_local; if (!send_single_push_update(&curr_mi->context, msgs, &option_types_found)) { - msg(M_CLIENT, "ERROR: Peer ID: %u has not been updated", - curr_mi->context.c2.tls_multi ? curr_mi->context.c2.tls_multi->peer_id : UINT32_MAX); + msg(M_CLIENT, "ERROR: Peer ID: %u has not been updated", curr_mi->context.c2.tls_multi->peer_id); continue; } if (option_types_found & OPT_P_UP) diff --git a/tests/unit_tests/openvpn/test_push_update_msg.c b/tests/unit_tests/openvpn/test_push_update_msg.c index 6e49f14..60596ed 100644 --- a/tests/unit_tests/openvpn/test_push_update_msg.c +++ b/tests/unit_tests/openvpn/test_push_update_msg.c @@ -144,7 +144,13 @@ { return true; } -#endif /* ifndef ENABLE_MANAGEMENT */ + +unsigned int +extract_iv_proto(const char *peer_info) +{ + return IV_PROTO_PUSH_UPDATE; +} +#endif /* ifdef ENABLE_MANAGEMENT */ /* tests */ @@ -464,6 +470,7 @@ struct multi_context *m = calloc(1, sizeof(struct multi_context)); m->instances = calloc(1, sizeof(struct multi_instance *)); struct multi_instance *mi = calloc(1, sizeof(struct multi_instance)); + mi->context.c2.tls_multi = calloc(1, sizeof(struct tls_multi)); *(m->instances) = mi; m->top.options.disable_dco = true; *state = m; @@ -474,6 +481,7 @@ teardown2(void **state) { struct multi_context *m = *state; + free((*(m->instances))->context.c2.tls_multi); free(*(m->instances)); free(m->instances); free(m);