From patchwork Wed Jul 15 20:22:02 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Gert Doering X-Patchwork-Id: 5110 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:b0c1:b0:878:4d70:ff7f with SMTP id p1csp10323maw; Wed, 15 Jul 2026 13:22:33 -0700 (PDT) X-Forwarded-Encrypted: i=2; AHgh+Rpo2A/gkLA+SNg1LwLHXwzC7TiXhR5kfeLJpQj5DlZAAc6X5mVTHCuHIhrjImNBeyYIODeHJUU2h3U=@openvpn.net X-Received: by 2002:a05:6830:4910:b0:7e9:b4d0:53a2 with SMTP id 46e09a7af769-7ec09857ce7mr11008123a34.27.1784146953580; Wed, 15 Jul 2026 13:22:33 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1784146953; cv=none; d=google.com; s=arc-20260327; b=IXyTFW2KgxrKhLAI+aSmzUuWYRU9q98iUyYYLedesKYO9tJEaldZ7eFUv46wUoZv3s 2w7PLIMaUFF+YAZ8JHDGPDkjezdT0/T82P5SxuLLzqpV3fol2KRj2bQLDF35CIPQUsnu Q/GVHfy+aEOY6t73Wxjms59BjdS/ROBNVY1+KZb572sUINe8L/9uUTkLVwQ7HYIch2mP DiQCOaWuktts58lujE+0zfFR8jqMW5AHKvlJrabuIPujgKf77M41iCK0aKCd3kE/uqtt mWT4BXFZndkIuoN206DRwGQxD+JW+0r2H4dEs5IimAYvKHuYERcjseatAIm4m6T/uF9u YD5A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=DbZ7ZiSrTW0/QkuLeLKhDiw844GI6YbElvbk970uJYg=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=sKqNzRxp0qmYx5Lh/sNyltz6LAf3rVepDdDNQS2K2E+YXUIHH/OpKs3uWQ1f7A6Nht gdRGywSc25I+4hub2W3dLR+2bT/E2kEAJV1T1xTKHZgPtdvRbDLcn1ewM4kXbT628jR0 SZNbXxlp080X/U8CKdvOy/AuXogl3MhCtmebnJ7dcsBWE2FfBiGAs/rUllKIPGGqTkVc 4nVOHD1Jogbtc+3ok6cDsyLbtsjTCD5p34d/2aTL52Viwczgr3KleeOBX5HTKIWZj6eA FOBV8hPVeW9Qp8N5BmrmSGpAfNEB6qdhRLeTgRnWfLYFlCHCCCBjM+9+PvVt2tAP8cWd XZMw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=IINiEPYa; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=hSLBs3ra; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=I0p06tDp; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 46e09a7af769-7ebcb4b63a8si20085847a34.79.2026.07.15.13.22.32 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 15 Jul 2026 13:22:33 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=IINiEPYa; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=hSLBs3ra; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=I0p06tDp; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=DbZ7ZiSrTW0/QkuLeLKhDiw844GI6YbElvbk970uJYg=; b=IINiEPYaGJGsfa2d29sY99ijFj mD5S5hRns3cnWdnzNc0158usVp+aI4P+/NcY4ca9W+gEq6k+k1g20MPMAZfC6/l4UE+P3Gi5l6fXB XnrJoU15riaGzBcZjRYfLNomvzd1BGR/Ohhbkj3VqIkeJjDC8kX8SPbpYOvfLIE01/r8=; Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1wk67e-00036g-4c; Wed, 15 Jul 2026 20:22:26 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1wk67d-00036a-AR for openvpn-devel@lists.sourceforge.net; Wed, 15 Jul 2026 20:22:25 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:Content-Type:MIME-Version :References:In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=OMBcyCPEUS6oRYLIpFJZ/1pl2Yt9Vj42w2CmYMqsa+U=; b=hSLBs3ra7o3eIt+e99oOL/wH+I hjxdJDt+qxrK6Y4KcJwAdasDX3ZPYcZL02WyXTFCrw+ovUpdeaUM1pJaGzkDctmJszh/u3xEDQIus cHCWV6zjiAg1x/mebIIqb6+o3fjpfjTq7YDbeYR7qzyoPb3i5FMlZW0tF5a4xodElFqE=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:Content-Type:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=OMBcyCPEUS6oRYLIpFJZ/1pl2Yt9Vj42w2CmYMqsa+U=; b=I0p06tDp+hGO07uZ7NWISnonMw 4KFrvJKQ7I68Kiop4BAESzj2LcytTC1lEwXZsuDf+q9HsuYyERAG7YqmnIHYynKciiUjIxDLASykt hK71er0rffWQ3JiIjjrgl5RsfhXhuSeAKjElT61RTRtc67vg0mM5Ivcq4MXI+Ku87cxs=; Received: from [193.149.48.129] (helo=blue.greenie.muc.de) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1wk67b-0007Qj-1P for openvpn-devel@lists.sourceforge.net; Wed, 15 Jul 2026 20:22:25 +0000 Received: from blue.greenie.muc.de (localhost [127.0.0.1]) by blue.greenie.muc.de (8.18.1/8.18.1) with ESMTP id 66FKMBtV009053 for ; Wed, 15 Jul 2026 22:22:11 +0200 Received: (from gert@localhost) by blue.greenie.muc.de (8.18.2/8.18.1/Submit) id 66FKMAmO009052 for openvpn-devel@lists.sourceforge.net; Wed, 15 Jul 2026 22:22:10 +0200 From: Gert Doering To: openvpn-devel@lists.sourceforge.net Date: Wed, 15 Jul 2026 22:22:02 +0200 Message-ID: <20260715202210.9010-1-gert@greenie.muc.de> X-Mailer: git-send-email 2.53.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-1.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: rootvector2 Github: OpenVPN/openvpn#1044 This has also been reported twice as a security relevant bug, but only later than the original finding - and it isn't. Content analysis details: (1.3 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS X-Headers-End: 1wk67b-0007Qj-1P Subject: [Openvpn-devel] [PATCH v2] proto: correct 802.1Q length check in is_ipv_X X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1870813676147215013 X-GMAIL-MSGID: 1870813676147215013 From: rootvector2 Github: OpenVPN/openvpn#1044 This has also been reported twice as a security relevant bug, but only later than the original finding - and it isn't. While --client-nat would modify a 32bit integer "after the packet" (the place where an IPv4 address would be, in a well-formed packet), the underlying buffer is always max-frame sized, and we never look at the "modified integer" afterwards, so there are no consequences warranting allocation of a CVE ID. Signed-off-by: rootvector2 Acked-by: Arne Schwabe Acked-by: Antonio Quartulli Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1789 Reported-By: 章鱼哥 (www.aipyaipy.com) Reported-By: Yu Zhang Wong Change-Id: I8219c6295acf28ff10ddb2fcc285f813c42fa8fe --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1789 This mail reflects revision 2 of this Change. Acked-by according to Gerrit (reflected above): Arne Schwabe Antonio Quartulli diff --git a/src/openvpn/proto.c b/src/openvpn/proto.c index 13fe0a5..785c021 100644 --- a/src/openvpn/proto.c +++ b/src/openvpn/proto.c @@ -70,7 +70,7 @@ if (proto == htons(OPENVPN_ETH_P_8021Q)) { const struct openvpn_8021qhdr *evh; - if (BLENZ(buf) < sizeof(struct openvpn_ethhdr) + sizeof(struct openvpn_iphdr)) + if (BLENZ(buf) < sizeof(struct openvpn_8021qhdr) + sizeof(struct openvpn_iphdr)) { return false; }