From patchwork Sat Oct 31 07:48:34 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gert Doering X-Patchwork-Id: 5535 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:6022:3119:b0:118:2077:975e with SMTP id e25csp3043585laa; Sat, 31 Oct 2026 00:48:54 -0700 (PDT) X-Forwarded-Encrypted: i=2; AKwUvBwWOBcTBS6UmTXJxmODMGn13q0kaB5xnwioqeqITrNCRULPtkqtwplYo536Nx9Na7lut+/2FAFZwYE=@openvpn.net X-Received: by 2002:a05:7300:b08a:b0:359:9302:a526 with SMTP id 5a478bee46e88-36a4234085amr6449823eec.7.1793432934230; Sat, 31 Oct 2026 00:48:54 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1793432934; cv=none; d=google.com; s=arc-20260327; b=OiDxt3Ycz3q6AT7VEWcDe90c3zLmyOStm7jcYEPt0paQx0mpWJmjw3SfwM8HPpzLVC x4I+9Qmsb3CPMN/eqmM8WBzbTyBD1z/POIOrkyFfU7Q31IMn4j9E/TUws/pIHmuPBf7y pIY0RiLb8TjTN9tYzL0k3hp9jO+MEGuTfDS1YZoJrtJQzLYiCJYX+Ud7l1+EmElsN8z+ 6H+2mqsaTYlfdqJhTl7gYTppAsEO7PAVfVFiLCSsP+4mjC7CvXe2wp4O6cu8flOvOpbW MklndIOgN4XA6PB6ktPRXKDO9/WPW9m6PuukoL0fjTYCUhQc3ojztbVJSgt+j3o36tPQ Jwaw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=jMK/NLjpPwLal9xo5ecc9g2Dyint8F6RUl8JFQP+tQw=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=YlCECTnY59mmGpCsJtiI0JzHyxZ6NcW8EsqWW2bc5kPxL0BorvzF9SGDw+Z59pKmiN YHSTX4jaESaHoKLCfQYLG0qbNCacuoYlJM3bJwFKWN5Ficlvorf2WwWUfqlxEkNjPzFY VVbk14nPRu7VvKatNVTOZNeAMFwWgYG76YIvOdd2XzorjmLK7NWdHajbbVRk+MdXGjZq zKp/HxOhZJDiBxm6S9u3h30bEK14LuQdzHB8YNo+kbwA/NKiQ1EAJ1ePsMcjtFh9PTQE xacNlw28u8fgOPj6W/AUTCnFR5cxNy+BA3bvIs6pFhhmKVZd7erC0FO2ozwI9JVcKblU kvrA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=elg8HveF; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=SmnJEVw7; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=Sg4bea3B; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 5a478bee46e88-36a42a8d7aesi12755465eec.24.2026.10.31.00.48.53 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Sat, 31 Oct 2026 00:48:54 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=elg8HveF; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=SmnJEVw7; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=Sg4bea3B; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Unsubscribe-Post: List-Owner; bh=jMK/NLjpPwLal9xo5ecc9g2Dyint8F6RUl8JFQP+tQw=; b=elg8HveFPE40Zw 7qcvYNUYbooMuuf0qmapPPLeDkgWJksqapVM3RWZsaIFXJVp/xbpp434nX4FMcS+s038RQWWQI9cj fd8a0tuXBQh4Kj+3a/f/tuxAK40uwA7n53bSgQ5CjT0Tw2K4tmK2NzUEQuyb6WBvbpvyyzkaZ5g/I H1M=; Received: from [127.0.0.1] (helo=sfs-ml-1.v29.lw.sourceforge.com) by sfs-ml-1.v29.lw.sourceforge.com with esmtp (Exim 4.100.1) (envelope-from ) id 1xN3pa-000000004qn-1YqD; Sat, 31 Oct 2026 07:48:50 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-1.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.100.1) (envelope-from ) id 1xN3pZ-000000004qg-12KS for openvpn-devel@lists.sourceforge.net; Sat, 31 Oct 2026 07:48:49 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Unsubscribe-Post:List-Subscribe:List-Post:List-Owner:List-Archive; bh=4GwL4wR318x0nR6njNSIU2hoBKW44nKVdoLZeBj1bm8=; b=SmnJEVw7NNbVvLAFyixU5IwAvy H8EsSA8G3HlmRLe4V4FdLYVxuOWFtPqzKFPObwKhtwC0mKUXBwTb7/anmEbzYoM8ZUUYe5EhULu6L DIfWrzZ6Nwb6fU55D2qa9fEkrdIKssaadlodu0K9K1MvZLkpoGv75gEwBKmryqme6vQg=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Unsubscribe-Post: List-Subscribe:List-Post:List-Owner:List-Archive; bh=4GwL4wR318x0nR6njNSIU2hoBKW44nKVdoLZeBj1bm8=; b=Sg4bea3B+L45s3o4zAjbi9uAAc NllaqR0SfZ8IvQDF0c6d30L8C1hpkr5P13R00vMM51C+uccyR+vna5uNTjH3l+K6/DmcCipu63zkD JO9Lz6Kg7XzRcNwR3l5+j/jS/9Q8bBUKE8DXsafp226i0Zy/NH25ctG534/zIGM4skJ4=; Received: from [193.149.48.129] (helo=blue.greenie.muc.de) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.100.1) id 1xN3pX-000000000ub-3yEO for openvpn-devel@lists.sourceforge.net; Sat, 31 Oct 2026 07:48:49 +0000 Received: from blue.greenie.muc.de (localhost [127.0.0.1]) by blue.greenie.muc.de (8.18.1/8.18.1) with ESMTP id 69V7meMv027560 for ; Sat, 31 Oct 2026 08:48:40 +0100 Received: (from gert@localhost) by blue.greenie.muc.de (8.18.2/8.18.1/Submit) id 69V7mebj027559 for openvpn-devel@lists.sourceforge.net; Sat, 31 Oct 2026 08:48:40 +0100 From: Gert Doering To: openvpn-devel@lists.sourceforge.net Date: Sat, 31 Oct 2026 08:48:34 +0100 Message-ID: <20261031074840.27546-1-gert@greenie.muc.de> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Selva Nair Increase the buffer size from 128 to 256 to accommodate a reasonably long username and static challenge message when both are included in the prompt. Print a warning if the text is truncated. Content analysis details: (1.3 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS X-Headers-End: 1xN3pX-000000000ub-3yEO Subject: [Openvpn-devel] [PATCH v2] Increase the buffer size for alert-message in management user-pass query X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1880550732455680822 X-GMAIL-MSGID: 1880550732455680822 From: Selva Nair Increase the buffer size from 128 to 256 to accommodate a reasonably long username and static challenge message when both are included in the prompt. Print a warning if the text is truncated. If the encoded " UN:" string is longer than 128 bytes, skip adding it to the prompt. Print a warning. This caters to up to about 90 bytes long usernames. Change-Id: Iea14ef08268e6f6309e4bac4acff27958da8b045 Signed-off-by: Selva Nair Acked-by: Razvan Cojocaru Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2073 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2073 This mail reflects revision 2 of this Change. Acked-by according to Gerrit (reflected above): Razvan Cojocaru diff --git a/src/openvpn/manage.c b/src/openvpn/manage.c index 65e2881..16864c8 100644 --- a/src/openvpn/manage.c +++ b/src/openvpn/manage.c @@ -3618,7 +3618,7 @@ { volatile int signal_received = 0; const bool standalone_disabled_save = man->persist.standalone_disabled; - struct buffer alert_msg = alloc_buf_gc(128, &gc); + struct buffer alert_msg = alloc_buf_gc(256, &gc); const char *alert_type = NULL; const char *prefix = NULL; unsigned int up_query_mode = 0; @@ -3680,23 +3680,31 @@ * Indicate it in the prompt as base64 encoded. */ char *user64 = NULL; - if (openvpn_base64_encode(up->username, (int)strlen(up->username), &user64) != -1) + const int user64_len = openvpn_base64_encode(up->username, (int)strlen(up->username), &user64); + if (user64_len == -1) { - buf_printf(&alert_msg, " UN:%s", user64); + msg(M_NONFATAL, "ERROR: could not base64-encode username"); + } + else if (user64_len + 4 > 128) + { + msg(M_WARN | M_INFO, "Preferred username too long for user-pass prompt sent to management; omitting UN: hint."); } else { - msg(M_NONFATAL, "ERROR: could not base64-encode username"); + buf_printf(&alert_msg, " UN:%s", user64); } free(user64); } if (sc) { - buf_printf(&alert_msg, " SC:%d,%s", - BOOL_CAST(flags & GET_USER_PASS_STATIC_CHALLENGE_ECHO) - | (BOOL_CAST(flags & GET_USER_PASS_STATIC_CHALLENGE_CONCAT) << 1), - sc); + if (!buf_printf(&alert_msg, " SC:%d,%s", + BOOL_CAST(flags & GET_USER_PASS_STATIC_CHALLENGE_ECHO) + | (BOOL_CAST(flags & GET_USER_PASS_STATIC_CHALLENGE_CONCAT) << 1), + sc)) + { + msg(M_WARN | M_INFO, "SC: in user-pass prompt sent to management got truncated."); + } } man_wait_for_client_connection(man, &signal_received, 0, MWCC_PASSWORD_WAIT);