From patchwork Thu Feb 28 18:32:24 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Selva Nair X-Patchwork-Id: 699 Return-Path: Delivered-To: patchwork@openvpn.net Delivered-To: patchwork@openvpn.net Received: from director9.mail.ord1d.rsapps.net ([172.31.255.6]) by backend30.mail.ord1d.rsapps.net with LMTP id II1zNCTEeFzXGQAAIUCqbw for ; Fri, 01 Mar 2019 00:33:24 -0500 Received: from proxy18.mail.iad3b.rsapps.net ([172.31.255.6]) by director9.mail.ord1d.rsapps.net with LMTP id aNQJMiTEeFzAMQAAalYnBA ; Fri, 01 Mar 2019 00:33:24 -0500 Received: from smtp8.gate.iad3b ([172.31.255.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by proxy18.mail.iad3b.rsapps.net with LMTP id SD3LLCTEeFzlXAAA3NpJmQ ; Fri, 01 Mar 2019 00:33:24 -0500 X-Spam-Threshold: 95 X-Spam-Score: 0 X-Spam-Flag: NO X-Virus-Scanned: OK X-Orig-To: openvpnslackdevel@openvpn.net X-Originating-Ip: [216.105.38.7] Authentication-Results: smtp8.gate.iad3b.rsapps.net; iprev=pass policy.iprev="216.105.38.7"; spf=pass smtp.mailfrom="openvpn-devel-bounces@lists.sourceforge.net" smtp.helo="lists.sourceforge.net"; dkim=fail (signature verification failed) header.d=sourceforge.net; dkim=fail (signature verification failed) header.d=sf.net; dkim=fail (signature verification failed) header.d=gmail.com; dmarc=fail (p=none; dis=none) header.from=gmail.com X-Suspicious-Flag: YES X-Classification-ID: 87f9a920-3be3-11e9-80b0-5254005eee35-1-1 Received: from [216.105.38.7] ([216.105.38.7:48361] helo=lists.sourceforge.net) by smtp8.gate.iad3b.rsapps.net (envelope-from ) (ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id CF/00-30745-424C87C5; Fri, 01 Mar 2019 00:33:24 -0500 Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.90_1) (envelope-from ) id 1gzami-0005c1-Ve; Fri, 01 Mar 2019 05:32:36 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) (envelope-from ) id 1gzamh-0005bu-Lt for openvpn-devel@lists.sourceforge.net; Fri, 01 Mar 2019 05:32:35 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Message-Id:Date:Subject:Cc:To:From:Sender:Reply-To: MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=Eh/1Cc10YwK1Qdd8WDYiHarXPfFbQYKv0w0y39hjKvE=; b=EGYwB/JLmSOZf2kvadPk64vbH5 l3UM2nHYTy1x7hlq9XfKryKFGJskvvo/3J8q6F9xap3gyfKnGw5saNcOFCcJHQUhORZZBOFXhvDKM 8QDXNnjRh1F/c9LLFwsSGKStPw161KQt9gDQRFhmQlgTwdJ5eDFRSXBZ0XV320SARhlk=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Message-Id:Date:Subject:Cc:To:From:Sender:Reply-To:MIME-Version: Content-Type:Content-Transfer-Encoding:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=Eh/1Cc10YwK1Qdd8WDYiHarXPfFbQYKv0w0y39hjKvE=; b=ijwBP7wkCSxZasMtQgPkjccPZm +3RU5fRrmEcmjEj1gPWnmAdCohX/f3w2VCIrC7XTQs49QndRWnlApDCpXaaJVmoFNGFupesoG6Ud6 JIgd0Ky8CNRd1+XUnPeC892YdfCUKWwZnKd0HG9Q0k1lK4+wS5FV3qSP40wgA0XtF2tg=; Received: from mail-io1-f65.google.com ([209.85.166.65]) by sfi-mx-3.v28.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.90_1) id 1gzamg-005z9L-15 for openvpn-devel@lists.sourceforge.net; Fri, 01 Mar 2019 05:32:35 +0000 Received: by mail-io1-f65.google.com with SMTP id v10so18657656iop.4 for ; Thu, 28 Feb 2019 21:32:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=Eh/1Cc10YwK1Qdd8WDYiHarXPfFbQYKv0w0y39hjKvE=; b=hWnycnwSiAXxo/ZL1SDnP1M/JSG5MSH2Vi5T+ExrjeH5eNOyiEuOzo3fSja8K+Fq70 qSZvualyaa2FMAbM+v3HVN70RDdCti/xk7Taw1Y6SgquxuJ5M7iG6IB9rqy12o4Ec2AM xnYY75uiESOMeed26AWQC89ILLeD6FXoCFdlbxbm1UeLprPpMeB/4J+eafVemCEF8x9B psdTaT5W17+qExXrigSisbd2jDQaKU+pPCckwf/i/FxwuDyH9XBAvABSLpkwff7ty4+5 DxZ34kPKpwlrzXl+rjhofSaATFUSfDWHSQBErdgPtkNNM42gpxMIDJPXLqklDhgDqbDV JDwg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=Eh/1Cc10YwK1Qdd8WDYiHarXPfFbQYKv0w0y39hjKvE=; b=Ex9soisMK5i16fGmqjW/s7HcAx2gnELxA+7UFWvYwiTwBTu0rvyMxhjfnEmo7FCsp4 JIi/CDPgibBh2n/C2paesivq02M8ODVXV8IxMv6M3gVg28QF2OrI87h2181wxs4XMOdB VcABM4bcGlsDm2D5TLlM5nhJZZ7VMlLeVWYRowf7XodaPHdSj6SC6wMIKC/m3MAcs2Kh Rdpiq9CYPcwjx1mS8qxcQmVR4Pzx4lC2OoidpyR8jyY0u+Tpjcw+oXZ9tijkzuv7fKtZ xFIXwQBFIbOo3V/MPQ7EQphgjCdq9uYxVWNKhBQ3SPNLfEb0Z4SjBDGRerVzwnu8kTlh Dydw== X-Gm-Message-State: APjAAAXTjwSTb1wFzs3Cz5EVD8pdrNlbug7tU5pLWWfOBlCHzWO7p8Mm 9j0qkgmc1bOaqVim1dRRZgT6cxPX X-Google-Smtp-Source: APXvYqwedqwRRQF6wmBLTPZ8GYp/0PH+Tc4kn9cAHe/7MkebcEdKKYB3QGYPWxRtuPo+GgXmYV+Quw== X-Received: by 2002:a5d:8896:: with SMTP id d22mr1729039ioo.249.1551418347828; Thu, 28 Feb 2019 21:32:27 -0800 (PST) Received: from saturn.home.sansel.ca (CPE40167ea0e1c2-CM788df74daaa0.cpe.net.cable.rogers.com. [99.228.215.92]) by smtp.gmail.com with ESMTPSA id f201sm3983034itf.13.2019.02.28.21.32.26 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 28 Feb 2019 21:32:26 -0800 (PST) From: selva.nair@gmail.com To: openvpn-devel@lists.sourceforge.net Date: Fri, 1 Mar 2019 00:32:24 -0500 Message-Id: <1551418344-16317-1-git-send-email-selva.nair@gmail.com> X-Mailer: git-send-email 2.1.4 X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (selva.nair[at]gmail.com) -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.166.65 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid X-Headers-End: 1gzamg-005z9L-15 Subject: [Openvpn-devel] [PATCH for-2.4] Better error message when script fails due to script-security setting X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox From: Selva Nair - Add a new return value (-2) for openvpn_execve() when external program execution is not allowed due to a low script-security setting. - Add a corresponding error message Errors and warnings in such cases will now display as "WARNING: failed running command () :" followed by "disallowed by script-security setting" on all platforms instead of the current "external program did not execute -- returned error code -1" on Windows and "external program fork failed" on other platforms. The error is FATAL for some scripts and that behaviour is unchanged. This helps the Windows GUI to detect when a connection failure results from a safer script-security setting enforced by the GUI, and show a relevant message. Note: Same as commit 01a3c876d4911 in master except for script_security() --> script_security and context change: run_command.[ch] --> misc.[ch] Signed-off-by: Selva Nair Acked-by: Gert Doering --- src/openvpn/misc.c | 93 ++++++++++++++++++++++++++++++++--------------------- src/openvpn/misc.h | 5 +++ src/openvpn/win32.c | 12 ++++--- 3 files changed, 69 insertions(+), 41 deletions(-) diff --git a/src/openvpn/misc.c b/src/openvpn/misc.c index 581a890..f44c65f 100644 --- a/src/openvpn/misc.c +++ b/src/openvpn/misc.c @@ -99,44 +99,57 @@ save_inetd_socket_descriptor(void) } /* - * Print an error message based on the status code returned by system(). + * Generate an error message based on the status code returned by openvpn_execve(). */ const char * system_error_message(int stat, struct gc_arena *gc) { struct buffer out = alloc_buf_gc(256, gc); -#ifdef _WIN32 - if (stat == -1) + + switch (stat) { - buf_printf(&out, "external program did not execute -- "); - } - buf_printf(&out, "returned error code %d", stat); + case OPENVPN_EXECVE_NOT_ALLOWED: + buf_printf(&out, "disallowed by script-security setting"); + break; + +#ifdef _WIN32 + case OPENVPN_EXECVE_ERROR: + buf_printf(&out, "external program did not execute -- "); + /* fall through */ + + default: + buf_printf(&out, "returned error code %d", stat); + break; #else /* ifdef _WIN32 */ - if (stat == -1) - { - buf_printf(&out, "external program fork failed"); - } - else if (!WIFEXITED(stat)) - { - buf_printf(&out, "external program did not exit normally"); - } - else - { - const int cmd_ret = WEXITSTATUS(stat); - if (!cmd_ret) - { - buf_printf(&out, "external program exited normally"); - } - else if (cmd_ret == 127) - { - buf_printf(&out, "could not execute external program"); - } - else - { - buf_printf(&out, "external program exited with error status: %d", cmd_ret); - } - } + + case OPENVPN_EXECVE_ERROR: + buf_printf(&out, "external program fork failed"); + break; + + default: + if (!WIFEXITED(stat)) + { + buf_printf(&out, "external program did not exit normally"); + } + else + { + const int cmd_ret = WEXITSTATUS(stat); + if (!cmd_ret) + { + buf_printf(&out, "external program exited normally"); + } + else if (cmd_ret == OPENVPN_EXECVE_FAILURE) + { + buf_printf(&out, "could not execute external program"); + } + else + { + buf_printf(&out, "external program exited with error status: %d", cmd_ret); + } + } + break; #endif /* ifdef _WIN32 */ + } return (const char *)out.data; } @@ -186,12 +199,14 @@ openvpn_execve_allowed(const unsigned int flags) * Run execve() inside a fork(). Designed to replicate the semantics of system() but * in a safer way that doesn't require the invocation of a shell or the risks * assocated with formatting and parsing a command line. + * Returns the exit status of child, OPENVPN_EXECVE_NOT_ALLOWED if openvpn_execve_allowed() + * returns false, or OPENVPN_EXECVE_ERROR on other errors. */ int openvpn_execve(const struct argv *a, const struct env_set *es, const unsigned int flags) { struct gc_arena gc = gc_new(); - int ret = -1; + int ret = OPENVPN_EXECVE_ERROR; static bool warn_shown = false; if (a && a->argv[0]) @@ -208,7 +223,7 @@ openvpn_execve(const struct argv *a, const struct env_set *es, const unsigned in if (pid == (pid_t)0) /* child side */ { execve(cmd, argv, envp); - exit(127); + exit(OPENVPN_EXECVE_FAILURE); } else if (pid < (pid_t)0) /* fork failed */ { @@ -218,14 +233,18 @@ openvpn_execve(const struct argv *a, const struct env_set *es, const unsigned in { if (waitpid(pid, &ret, 0) != pid) { - ret = -1; + ret = OPENVPN_EXECVE_ERROR; } } } - else if (!warn_shown && (script_security < SSEC_SCRIPTS)) + else { - msg(M_WARN, SCRIPT_SECURITY_WARNING); - warn_shown = true; + ret = OPENVPN_EXECVE_NOT_ALLOWED; + if (!warn_shown && (script_security < SSEC_SCRIPTS)) + { + msg(M_WARN, SCRIPT_SECURITY_WARNING); + warn_shown = true; + } } #else /* if defined(ENABLE_FEATURE_EXECVE) */ msg(M_WARN, "openvpn_execve: execve function not available"); @@ -272,7 +291,7 @@ openvpn_popen(const struct argv *a, const struct env_set *es) close(pipe_stdout[0]); /* Close read end */ dup2(pipe_stdout[1],1); execve(cmd, argv, envp); - exit(127); + exit(OPENVPN_EXECVE_FAILURE); } else if (pid > (pid_t)0) /* parent side */ { diff --git a/src/openvpn/misc.h b/src/openvpn/misc.h index a64ddcc..8a34f43 100644 --- a/src/openvpn/misc.h +++ b/src/openvpn/misc.h @@ -57,6 +57,11 @@ struct env_set { const char *system_error_message(int, struct gc_arena *gc); +/* openvpn_execve return codes */ +#define OPENVPN_EXECVE_ERROR -1 /* generic error while forking to run an external program */ +#define OPENVPN_EXECVE_NOT_ALLOWED -2 /* external program not run due to script security */ +#define OPENVPN_EXECVE_FAILURE 127 /* exit code passed back from child when execve fails */ + /* wrapper around the execve() call */ int openvpn_popen(const struct argv *a, const struct env_set *es); diff --git a/src/openvpn/win32.c b/src/openvpn/win32.c index 29bbb84..c3e38cc 100644 --- a/src/openvpn/win32.c +++ b/src/openvpn/win32.c @@ -1088,7 +1088,7 @@ wide_cmd_line(const struct argv *a, struct gc_arena *gc) int openvpn_execve(const struct argv *a, const struct env_set *es, const unsigned int flags) { - int ret = -1; + int ret = OPENVPN_EXECVE_ERROR; static bool exec_warn = false; if (a && a->argv[0]) @@ -1137,10 +1137,14 @@ openvpn_execve(const struct argv *a, const struct env_set *es, const unsigned in free(env); gc_free(&gc); } - else if (!exec_warn && (script_security < SSEC_SCRIPTS)) + else { - msg(M_WARN, SCRIPT_SECURITY_WARNING); - exec_warn = true; + ret = OPENVPN_EXECVE_NOT_ALLOWED; + if (!exec_warn && (script_security < SSEC_SCRIPTS)) + { + msg(M_WARN, SCRIPT_SECURITY_WARNING); + exec_warn = true; + } } } else