From patchwork Sun Aug 30 03:14:40 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Schwabe X-Patchwork-Id: 1405 Return-Path: Delivered-To: patchwork@openvpn.net Delivered-To: patchwork@openvpn.net Received: from director8.mail.ord1d.rsapps.net ([172.31.255.6]) by backend41.mail.ord1d.rsapps.net with LMTP id 0OeNBeSmS184OgAAqwncew for ; Sun, 30 Aug 2020 09:17:24 -0400 Received: from proxy9.mail.iad3b.rsapps.net ([172.31.255.6]) by director8.mail.ord1d.rsapps.net with LMTP id uGN6BeSmS19YFwAAfY0hYg (envelope-from ) for ; Sun, 30 Aug 2020 09:17:24 -0400 Received: from smtp10.gate.iad3b ([172.31.255.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by proxy9.mail.iad3b.rsapps.net with LMTPS id MAHbOeOmS1/6UwAAC4PSzw (envelope-from ) for ; Sun, 30 Aug 2020 09:17:23 -0400 X-Spam-Threshold: 95 X-Spam-Score: 0 X-Spam-Flag: NO X-Virus-Scanned: OK X-Orig-To: openvpnslackdevel@openvpn.net X-Originating-Ip: [216.105.38.7] Authentication-Results: smtp10.gate.iad3b.rsapps.net; iprev=pass policy.iprev="216.105.38.7"; spf=pass smtp.mailfrom="openvpn-devel-bounces@lists.sourceforge.net" smtp.helo="lists.sourceforge.net"; dkim=fail (signature verification failed) header.d=sourceforge.net; dkim=fail (signature verification failed) header.d=sf.net; dmarc=none (p=nil; dis=none) header.from=rfc2549.org X-Suspicious-Flag: YES X-Classification-ID: 236c80b4-eac3-11ea-b778-52540055034d-1-1 Received: from [216.105.38.7] ([216.105.38.7:34076] helo=lists.sourceforge.net) by smtp10.gate.iad3b.rsapps.net (envelope-from ) (ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id 38/6A-00711-2E6AB4F5; Sun, 30 Aug 2020 09:17:23 -0400 Received: from [127.0.0.1] (helo=sfs-ml-1.v29.lw.sourceforge.com) by sfs-ml-1.v29.lw.sourceforge.com with esmtp (Exim 4.90_1) (envelope-from ) id 1kCNAb-0004TX-FC; Sun, 30 Aug 2020 13:14:53 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-1.v29.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kCNAa-0004TD-Af for openvpn-devel@lists.sourceforge.net; Sun, 30 Aug 2020 13:14:52 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc: MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=X/JWsiNAxRRhbowX0V/43tvT4O+Pz3i0G+MZDvtqxZg=; b=gYnJyCPE7bqa85c1BvaggJrVAx x8H8+gZNGWQK/Du2hEI8tW7U6LDK6tZwQIMURaLTN3ChLP6D57GYEaAV4FK+9i2qXRHZBKdkel6sS JrGF8Vkt3MLelrZYuNM+JCKPPvvHOxjzawusqXrnmn0+WGy6AGPg8JP2w45ADidDIOFw=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc:MIME-Version: Content-Type:Content-Transfer-Encoding:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=X/JWsiNAxRRhbowX0V/43tvT4O+Pz3i0G+MZDvtqxZg=; b=aq/oNPn/cWnQWXDdjokO32SQP6 ZO5VS8INppaD1u4lwS+hhRUOvXtptmAo78vsFLSKuAosBvSWv773T6RyX7XfWgJTfUcKeOYj92g3o PVXOuOnstT1V2tmM5OEVIh7I1yBjYpuC2kXaZT3XVKU7nIMYiT/v/TxJVXSQelWsZNik=; Received: from mail.blinkt.de ([192.26.174.232]) by sfi-mx-4.v28.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.92.2) id 1kCNAW-009y8h-BD for openvpn-devel@lists.sourceforge.net; Sun, 30 Aug 2020 13:14:52 +0000 Received: from kamera.blinkt.de ([2001:638:502:390:20c:29ff:fec8:535c]) by mail.blinkt.de with smtp (Exim 4.94 (FreeBSD)) (envelope-from ) id 1kCNAP-000JTH-Ji for openvpn-devel@lists.sourceforge.net; Sun, 30 Aug 2020 15:14:41 +0200 Received: (nullmailer pid 10979 invoked by uid 10006); Sun, 30 Aug 2020 13:14:40 -0000 From: Arne Schwabe To: openvpn-devel@lists.sourceforge.net Date: Sun, 30 Aug 2020 15:14:40 +0200 Message-Id: <20200830131440.10933-1-arne@rfc2549.org> X-Mailer: git-send-email 2.17.1 X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. 0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.0 SPF_NONE SPF: sender does not publish an SPF Record 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: rfc2549.org] 0.2 AWL AWL: Adjusted score from AWL reputation of From: address X-Headers-End: 1kCNAW-009y8h-BD Subject: [Openvpn-devel] [PATCH v2] Fix client NCP OCC fallback when server and client cipher are identical X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox If we do not get a cipher pushed we call tls_poor_mans_ncp to determine whether we can use the server's cipher. Inherited from OpenVPN 2.4's code we only did this check when the ciphers were different. Since OpenVPN 2.5 does not assume that our cipher we report in OCC (options->ciphername) is always a valid cipher we always need to perform this check. V2: Only call tls_item_in_cipher_list if remote_cipher is non-null to avoid calling strcmp with NULL. Reported-By: Rafael Gava Signed-off-by: Arne Schwabe Acked-by: Gert Doering --- src/openvpn/ssl_ncp.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/src/openvpn/ssl_ncp.c b/src/openvpn/ssl_ncp.c index c9ab85ce..55496395 100644 --- a/src/openvpn/ssl_ncp.c +++ b/src/openvpn/ssl_ncp.c @@ -269,14 +269,11 @@ static bool tls_poor_mans_ncp(struct options *o, const char *remote_ciphername) { if (remote_ciphername - && 0 != strcmp(o->ciphername, remote_ciphername)) + && tls_item_in_cipher_list(remote_ciphername, o->ncp_ciphers)) { - if (tls_item_in_cipher_list(remote_ciphername, o->ncp_ciphers)) - { - o->ciphername = string_alloc(remote_ciphername, &o->gc); - msg(D_TLS_DEBUG_LOW, "Using peer cipher '%s'", o->ciphername); - return true; - } + o->ciphername = string_alloc(remote_ciphername, &o->gc); + msg(D_TLS_DEBUG_LOW, "Using peer cipher '%s'", o->ciphername); + return true; } return false; }