Gert Doering has submitted this change. ( https://gerrit.openvpn.net/c/openvpn/+/1478?usp=email )
Change subject: tls: reject incoming reneg request if primary key is not fully valid ...................................................................... tls: reject incoming reneg request if primary key is not fully valid Incoming P_CONTROL_SOFT_RESET_V1 can arrive while the active key is not yet fully valid for renegotiation. This includes the window where we are still waiting for auth_deferred_expire (derived from handshake/reneg timing), as well as cases where deferred or mid-session auth later leaves the key non-authenticated even though state is S_GENERATED_KEYS. This patch keeps read_control_auth as the first gate, then rejects the incoming renegotiation requests unless the primary key is KS_AUTH_TRUE and auth_deferred_expire has passed. The rejected request is not counted as a TLS error, since soft TLS errors trigger an instance restart in TCP mode. Change-Id: I704c560fa23c03237d0f8adc30908a617265a5a1 Signed-off-by: Ralf Lici <[email protected]> Acked-by: Arne Schwabe <[email protected]> Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1478 Message-Id: <[email protected]> URL: https://www.mail-archive.com/[email protected]/msg41068.html Signed-off-by: Gert Doering <[email protected]> --- M src/openvpn/ssl.c 1 file changed, 15 insertions(+), 0 deletions(-) diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c index cdb94ed..d13a0d3 100644 --- a/src/openvpn/ssl.c +++ b/src/openvpn/ssl.c @@ -3946,6 +3946,21 @@ goto error; } + /* + * Do not allow incoming renegotiation unless our primary key is + * fully authenticated and past the deferred-auth/transition gate. + */ + time_t auth_deferred_left = ks->auth_deferred_expire - now; + if (ks->authenticated != KS_AUTH_TRUE || auth_deferred_left > 0) + { + msg(D_TLS_ERRORS, + "TLS: refusing premature incoming renegotiation request for key-id %d: " + "auth=%s, auth_deferred_expire in %d seconds", + ks->key_id, ks_auth_name(ks->authenticated), + auth_deferred_left > 0 ? (int)auth_deferred_left : 0); + goto done; + } + key_state_soft_reset(session, NULL); dmsg(D_TLS_DEBUG, "TLS: received P_CONTROL_SOFT_RESET_V1 s=%d sid=%s", i, -- To view, visit https://gerrit.openvpn.net/c/openvpn/+/1478?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.openvpn.net/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I704c560fa23c03237d0f8adc30908a617265a5a1 Gerrit-Change-Number: 1478 Gerrit-PatchSet: 7 Gerrit-Owner: Ralf Lici <[email protected]> Gerrit-Reviewer: Arne Schwabe <[email protected]> Gerrit-CC: Antonio Quartulli <[email protected]> Gerrit-CC: openvpn-devel <[email protected]>
_______________________________________________ Openvpn-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-devel
