Arne Schwabe has uploaded this change for review. ( https://gerrit.openvpn.net/c/openvpn/+/2169?usp=email )
Change subject: Extract tls_pre_decrypt_verify_opcode from tls_pre_decrypt ...................................................................... Extract tls_pre_decrypt_verify_opcode from tls_pre_decrypt This extracts the pre-check to verify allowed op codes into its own method to reduce the complexity. Change-Id: I86154e5c997b044f6913bddab58b43193ff539e1 Signed-off-by: Arne Schwabe <[email protected]> --- M src/openvpn/ssl.c 1 file changed, 41 insertions(+), 7 deletions(-) git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/69/2169/1 diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c index cdb94ed..5d33b84 100644 --- a/src/openvpn/ssl.c +++ b/src/openvpn/ssl.c @@ -3725,6 +3725,46 @@ *opt = NULL; } +/** + * Does a very coarse check on the received opcode. It only checks if the + * opcode is an allowed op code for the peer to send at all, not if this + * opcode is valid for the current state. + */ +static bool +tls_pre_decrypt_verify_opcode(int op, bool server, const struct link_socket_actual *from) +{ + if (op < P_FIRST_OPCODE || op > P_LAST_OPCODE) + { + if (op == P_CONTROL_HARD_RESET_CLIENT_V1 || op == P_CONTROL_HARD_RESET_SERVER_V1) + { + msg(D_TLS_ERRORS, "Peer tried unsupported key-method 1"); + } + struct gc_arena gc = gc_new(); + msg(D_TLS_ERRORS, "TLS Error: unknown opcode received from %s op=%d", + print_link_socket_actual(from, &gc), op); + gc_free(&gc); + return false; + } + + /* hard reset ? */ + if (is_hard_reset_method2(op)) + { + /* verify client -> server or server -> client connection */ + if (((op == P_CONTROL_HARD_RESET_CLIENT_V2 || op == P_CONTROL_HARD_RESET_CLIENT_V3) + && !server) + || ((op == P_CONTROL_HARD_RESET_SERVER_V2) && server)) + { + struct gc_arena gc = gc_new(); + msg(D_TLS_ERRORS, + "TLS Error: client->client or server->server connection attempted from %s", + print_link_socket_actual(from, &gc)); + gc_free(&gc); + return false; + } + } + return true; +} + /* * * When we are in TLS mode, this is the first routine which sees @@ -3783,14 +3823,8 @@ struct session_id sid; /* remote session ID */ /* verify legal opcode */ - if (op < P_FIRST_OPCODE || op > P_LAST_OPCODE) + if (!tls_pre_decrypt_verify_opcode(op, multi->opt.server, from)) { - if (op == P_CONTROL_HARD_RESET_CLIENT_V1 || op == P_CONTROL_HARD_RESET_SERVER_V1) - { - msg(D_TLS_ERRORS, "Peer tried unsupported key-method 1"); - } - msg(D_TLS_ERRORS, "TLS Error: unknown opcode received from %s op=%d", - print_link_socket_actual(from, &gc), op); goto error; } -- To view, visit https://gerrit.openvpn.net/c/openvpn/+/2169?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.openvpn.net/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I86154e5c997b044f6913bddab58b43193ff539e1 Gerrit-Change-Number: 2169 Gerrit-PatchSet: 1 Gerrit-Owner: Arne Schwabe <[email protected]> Gerrit-CC: openvpn-devel <[email protected]>
_______________________________________________ Openvpn-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-devel
