Attention is currently required from: plaisthos.
Hello plaisthos,
I'd like you to do a code review.
Please visit
http://gerrit.openvpn.net/c/openvpn/+/1415?usp=email
to review the following change.
Change subject: pull-filter: improve documentation
......................................................................
pull-filter: improve documentation
Pull-filter uses a simple string comparison and could be defeated by
unusual formatting of pushed option strings. Document that this
option is not meant to be used as a security measure.
Reported by: <[email protected]>
Change-Id: I2c8d40038e52fbdff1c56f93db1e6a2f9255c59a
Signed-off-by: Selva Nair <[email protected]>
---
M doc/man-sections/client-options.rst
1 file changed, 8 insertions(+), 0 deletions(-)
git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/15/1415/1
diff --git a/doc/man-sections/client-options.rst
b/doc/man-sections/client-options.rst
index e8523d9..f3073f8 100644
--- a/doc/man-sections/client-options.rst
+++ b/doc/man-sections/client-options.rst
@@ -345,6 +345,14 @@
next remote succeeds. To silently ignore an option pushed by the server,
use :code:`ignore`.
+ *Warning:* ``pull-filter`` cannot be relied upon as a security measure to
+ protect against offending options pushed by a server. For example, the
+ filter could be defeated by pushing options with extra spaces between
+ tokens or other formatting variations. In such situations, an "allow-list"
+ approach using a generic ``pull-filter ignore`` followed by more specific
+ ``pull-filter accept`` directives should be preferred over a "deny-list"
+ approach.
+
--push-peer-info
Push additional information about the client to server. The following
data is always pushed to the server:
--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1415?usp=email
To unsubscribe, or for help writing mail filters, visit
http://gerrit.openvpn.net/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: I2c8d40038e52fbdff1c56f93db1e6a2f9255c59a
Gerrit-Change-Number: 1415
Gerrit-PatchSet: 1
Gerrit-Owner: selvanair <[email protected]>
Gerrit-Reviewer: plaisthos <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>
Gerrit-Attention: plaisthos <[email protected]>
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
