From patchwork Mon Nov 2 17:13:17 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Frank Lichtenheld X-Patchwork-Id: 5569 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:6022:3119:b0:118:2077:975e with SMTP id e25csp5714089laa; Mon, 2 Nov 2026 09:13:31 -0800 (PST) X-Forwarded-Encrypted: i=2; AKwUvBwjk7egcW9c1eWwrJPu6NhBUIP45lMMRwRXXHR0Y13QQ0gK3lYefqeiAZN64vKr23Ipfg4mgioZbhA=@openvpn.net X-Received: by 2002:a05:7022:5f02:b0:143:4450:e1e6 with SMTP id a92af1059eb24-1ac5c64bbc0mr14808763c88.35.1793639611057; Mon, 02 Nov 2026 09:13:31 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1793639611; cv=none; d=google.com; s=arc-20260327; b=gGrqorf0W4/84c8KJlALgWNQnj6cr+xSRiHmofvbZxdoLlud5aiGSCwP0PnTKvMF4z ST9mSrPhfYwXVKE6E6/gb2Jhf1B2Y0bVmE9yD5KFRecDLkqa8kLoNiFCTMN/bcTP01K5 mmIrNT/ugBuqL7lT0544GBAAQz1a+EwW7d7/rAOF3sQXx62TUnFlFFj4bc7IF64gl6/3 NQamdQRN7PnJcNdput9sur0ieJiZRL3tXg70ANh8V/x5GenTkOqHhjT+xc6lf7p4QxyZ 3Ynyd+U9cdk8pby10LKnvsB51B1ekRb2KJqSlktNAa2o7ND7Tv/nx2SIa0g8xYTFMUmo zVrQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:cc:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature:dkim-signature; bh=u4U0lzxYgO8tFwgs6EbmnuKi4KVsaY8aRqKg0UOXJVQ=; fh=CfxSpwd5kfiMJoL3kcov7PTxVKT7pGe/79idnx9XlBs=; b=ANcFZjEedptPP+gkltA/yCnUePkT/EwS6jiPXR35KbJ34rBC5miLPmflLgKBdIXfHa Kf5YdlnRSW5114bTeKUb4G7VnuojguerxNyhQwiSP5sF4MegdRCb5/U8Zxuw5GkAcroY qsD4fi0GMYpvVJcFr+Xape2eOQBFwIgSPZPhBvZQ2wTsF22NeKd8f4sZCF0wWHor/LWb rrAMFJTSki08ch7L4otYEL/+W50WBULiarFS853n0EA5QohbbkxtMMrDwrhwBp5B4un0 is0OD9HjxhHa2YO/3JEgoXQ63E2tb7qRsQzEKg7SNm6nKaI/QI5D+dIzHbEXRZfd6P1G EGjg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=aYRVvUMt; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=cVXQDfve; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=UBVyQqG2; dkim=neutral (body hash did not verify) header.i=@lichtenheld.com header.s=MBO0001 header.b=ksX9NQ07; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id a92af1059eb24-1ac192c256csi30236604c88.37.2026.11.02.09.13.30 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 02 Nov 2026 09:13:31 -0800 (PST) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=aYRVvUMt; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=cVXQDfve; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=UBVyQqG2; dkim=neutral (body hash did not verify) header.i=@lichtenheld.com header.s=MBO0001 header.b=ksX9NQ07; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type:Cc: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender :Resent-To:Resent-Cc:Resent-Message-ID:List-Unsubscribe-Post:List-Owner; bh=u4U0lzxYgO8tFwgs6EbmnuKi4KVsaY8aRqKg0UOXJVQ=; b=aYRVvUMtSnILe8MScaMTminLef pQJljNKvWGdQUUYvSPTcXCXOCa113MYPa47mrYp0+woVb5PiMxmPsC2Xkau0Mre5maPMnvqK9loN1 1df29DYwZaWPnIk6VFPNIjwt3BDDP04cYtknj6WPdkm/TrS1WNaWTKJ0P3X0HLCCjNGE=; Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.100.1) (envelope-from ) id 1xNvb6-000000001dS-2pEJ; Mon, 02 Nov 2026 17:13:28 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.100.1) (envelope-from ) id 1xNvb5-000000001dK-0JEg for openvpn-devel@lists.sourceforge.net; Mon, 02 Nov 2026 17:13:27 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Unsubscribe-Post:List-Subscribe:List-Post:List-Owner:List-Archive; bh=I93AYKdvgCmNyNGA2Q4rRYH84nnUYO1A7Qf/ZNYSb8Q=; b=cVXQDfvekFWojqyK00DEARwwuJ DRmdsqXgXpVuTElRXWRrOuCQATfuEI2moIakUvMJLCq8KTzOl5qIVRBrgfbvDPB9mld8cD33vuPud nB+MVb0qCb3/Q/qcU5dQa9+ndkuApoCBTOVIO5Fl+o5xfLUlIZTDrGVFATDhgQ4dcPpI=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Unsubscribe-Post: List-Subscribe:List-Post:List-Owner:List-Archive; bh=I93AYKdvgCmNyNGA2Q4rRYH84nnUYO1A7Qf/ZNYSb8Q=; b=UBVyQqG2q6SACUbTXINR/8UyPW swIHK1QDsW8REMA2XcvGydT25g35ixX1NFNA4b7fREeitx/NW3dQ5ZXpuFGr4o57H40I6gCYHTeWl Fo0x4msd2IF0lZe8v5NuX6AwQ+VSqy+e0AhnDRxVgQsNM7cxMD82LGsCvG3bzmbXl0Cg=; Received: from mout-p-201.mailbox.org ([80.241.56.171]) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.100.1) id 1xNvb3-000000006GY-2zaB for openvpn-devel@lists.sourceforge.net; Mon, 02 Nov 2026 17:13:26 +0000 Received: from smtp2.mailbox.org (smtp2.mailbox.org [IPv6:2001:67c:2050:b231:465::2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519MLKEM768 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-p-201.mailbox.org (Postfix) with ESMTPS id 4jJJF973sGzMlGl; Mon, 02 Nov 2026 18:13:17 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lichtenheld.com; s=MBO0001; t=1793639598; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=I93AYKdvgCmNyNGA2Q4rRYH84nnUYO1A7Qf/ZNYSb8Q=; b=ksX9NQ07EPDjHXE0zo12wztRx79ZIR8/HgWAGqMfoimaMycn4txa4qGv3TydB6psiY/EKj CDn1McSkiM2ZXjvm8zbovU6TUww+FKqsc4fHBFnPp3xdQx7gnRZ6Q/Pw6m1EXotrD+wWuX DiFX4fSSe6+1ncXXP9o8HeoXlBCm8LTnLPs/tuMIuTWg6Z1QvITV+ftcph4he0LeEp1VWc J7oEo2wzj5/fwWBOFaRaBzjyhWthT1xqHbRnQdkP+Nm+wsKAriFGUnpG4/VwcJW6JzslXx egPUZFtnvXvSnEiCjhTVhr9YDRr9S8uPmflqGhc2NOt5JL7JpbPChqzDazlE1w== Authentication-Results: outgoing_mbo_mout; dkim=none; spf=pass (outgoing_mbo_mout: domain of frank@lichtenheld.com designates 2001:67c:2050:b231:465::2 as permitted sender) smtp.mailfrom=frank@lichtenheld.com From: Frank Lichtenheld To: openvpn-devel@lists.sourceforge.net Date: Mon, 2 Nov 2026 18:13:17 +0100 Message-ID: <20261102171317.113895-1-frank@lichtenheld.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 X-Rspamd-Queue-Id: 4jJJF973sGzMlGl X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Razvan Cojocaru tls_crypt_wrap() and tls_crypt_unwrap() passed BPTR(dst) to cipher_ctx_final(), which would overwrite the start of dst if final produced output. Use BEND(dst), as the tls-crypt-v2 code does. No functi [...] Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain X-Headers-End: 1xNvb3-000000006GY-2zaB Subject: [Openvpn-devel] [PATCH v2] tls_crypt: append cipher final output at buffer end X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Arne Schwabe Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1880767448647877793 X-GMAIL-MSGID: 1880767448647877793 From: Razvan Cojocaru tls_crypt_wrap() and tls_crypt_unwrap() passed BPTR(dst) to cipher_ctx_final(), which would overwrite the start of dst if final produced output. Use BEND(dst), as the tls-crypt-v2 code does. No functional change with AES-256-CTR, whose final produces 0 bytes. Change-Id: Ie0f902ae5aa8e549f76f2cf32facda43eac18915 Signed-off-by: Razvan Cojocaru Acked-by: Arne Schwabe Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2083 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2083 This mail reflects revision 2 of this Change. Acked-by according to Gerrit (reflected above): Arne Schwabe diff --git a/src/openvpn/tls_crypt.c b/src/openvpn/tls_crypt.c index 23c7975..d015004 100644 --- a/src/openvpn/tls_crypt.c +++ b/src/openvpn/tls_crypt.c @@ -191,7 +191,7 @@ int outlen = 0; ASSERT(cipher_ctx_update(ctx->cipher, BEND(dst), &outlen, CBPTR(src), BLEN(src))); ASSERT(buf_inc_len(dst, outlen)); - ASSERT(cipher_ctx_final(ctx->cipher, BPTR(dst), &outlen)); + ASSERT(cipher_ctx_final(ctx->cipher, BEND(dst), &outlen)); ASSERT(buf_inc_len(dst, outlen)); } @@ -247,7 +247,7 @@ CRYPT_ERROR("cipher update failed"); } ASSERT(buf_inc_len(dst, outlen)); - if (!cipher_ctx_final(ctx->cipher, BPTR(dst), &outlen)) + if (!cipher_ctx_final(ctx->cipher, BEND(dst), &outlen)) { CRYPT_ERROR("cipher final failed"); }