Attention is currently required from: Antonio Quartulli, Arne Schwabe.
Hello Antonio Quartulli,
I'd like you to reexamine a change. Please visit
https://gerrit.openvpn.net/c/openvpn/+/2169?usp=email
to look at the new patch set (#2).
The following approvals got outdated and were removed:
Code-Review-1 by Antonio Quartulli
Change subject: Extract tls_pre_decrypt_verify_opcode from tls_pre_decrypt
......................................................................
Extract tls_pre_decrypt_verify_opcode from tls_pre_decrypt
This extracts the pre-check to verify allowed op codes into its own
method to reduce the complexity.
Change-Id: I86154e5c997b044f6913bddab58b43193ff539e1
Signed-off-by: Arne Schwabe <[email protected]>
---
M src/openvpn/ssl.c
1 file changed, 41 insertions(+), 22 deletions(-)
git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/69/2169/2
diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c
index cdb94ed..3ad7fe7 100644
--- a/src/openvpn/ssl.c
+++ b/src/openvpn/ssl.c
@@ -3725,6 +3725,46 @@
*opt = NULL;
}
+/**
+ * Does a very coarse check on the received opcode. It only checks if the
+ * opcode is an allowed op code for the peer to send at all, not if this
+ * opcode is valid for the current state.
+ */
+static bool
+tls_pre_decrypt_verify_opcode(int op, bool server, const struct
link_socket_actual *from)
+{
+ if (op < P_FIRST_OPCODE || op > P_LAST_OPCODE)
+ {
+ if (op == P_CONTROL_HARD_RESET_CLIENT_V1 || op ==
P_CONTROL_HARD_RESET_SERVER_V1)
+ {
+ msg(D_TLS_ERRORS, "Peer tried unsupported key-method 1");
+ }
+ struct gc_arena gc = gc_new();
+ msg(D_TLS_ERRORS, "TLS Error: unknown opcode received from %s op=%d",
+ print_link_socket_actual(from, &gc), op);
+ gc_free(&gc);
+ return false;
+ }
+
+ /* hard reset ? */
+ if (is_hard_reset_method2(op))
+ {
+ /* verify client -> server or server -> client connection */
+ if (((op == P_CONTROL_HARD_RESET_CLIENT_V2 || op ==
P_CONTROL_HARD_RESET_CLIENT_V3)
+ && !server)
+ || ((op == P_CONTROL_HARD_RESET_SERVER_V2) && server))
+ {
+ struct gc_arena gc = gc_new();
+ msg(D_TLS_ERRORS,
+ "TLS Error: client->client or server->server connection
attempted from %s",
+ print_link_socket_actual(from, &gc));
+ gc_free(&gc);
+ return false;
+ }
+ }
+ return true;
+}
+
/*
*
* When we are in TLS mode, this is the first routine which sees
@@ -3783,32 +3823,11 @@
struct session_id sid; /* remote session ID */
/* verify legal opcode */
- if (op < P_FIRST_OPCODE || op > P_LAST_OPCODE)
+ if (!tls_pre_decrypt_verify_opcode(op, multi->opt.server, from))
{
- if (op == P_CONTROL_HARD_RESET_CLIENT_V1 || op ==
P_CONTROL_HARD_RESET_SERVER_V1)
- {
- msg(D_TLS_ERRORS, "Peer tried unsupported key-method 1");
- }
- msg(D_TLS_ERRORS, "TLS Error: unknown opcode received from %s op=%d",
- print_link_socket_actual(from, &gc), op);
goto error;
}
- /* hard reset ? */
- if (is_hard_reset_method2(op))
- {
- /* verify client -> server or server -> client connection */
- if (((op == P_CONTROL_HARD_RESET_CLIENT_V2 || op ==
P_CONTROL_HARD_RESET_CLIENT_V3)
- && !multi->opt.server)
- || ((op == P_CONTROL_HARD_RESET_SERVER_V2) && multi->opt.server))
- {
- msg(D_TLS_ERRORS,
- "TLS Error: client->client or server->server connection
attempted from %s",
- print_link_socket_actual(from, &gc));
- goto error;
- }
- }
-
/*
* Authenticate Packet
*/
--
To view, visit https://gerrit.openvpn.net/c/openvpn/+/2169?usp=email
To unsubscribe, or for help writing mail filters, visit
https://gerrit.openvpn.net/settings?usp=email
Gerrit-MessageType: newpatchset
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: I86154e5c997b044f6913bddab58b43193ff539e1
Gerrit-Change-Number: 2169
Gerrit-PatchSet: 2
Gerrit-Owner: Arne Schwabe <[email protected]>
Gerrit-Reviewer: Antonio Quartulli <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>
Gerrit-Attention: Antonio Quartulli <[email protected]>
Gerrit-Attention: Arne Schwabe <[email protected]>
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
