Gert Doering has uploaded a new patch set (#3) to the change originally created by Arne Schwabe. ( https://gerrit.openvpn.net/c/openvpn/+/2169?usp=email )
The following approvals got outdated and were removed: Code-Review+2 by Antonio Quartulli Change subject: Extract tls_pre_decrypt_verify_opcode from tls_pre_decrypt ...................................................................... Extract tls_pre_decrypt_verify_opcode from tls_pre_decrypt This extracts the pre-check to verify allowed op codes into its own method to reduce the complexity. Change-Id: I86154e5c997b044f6913bddab58b43193ff539e1 Signed-off-by: Arne Schwabe <[email protected]> Acked-by: Antonio Quartulli <[email protected]> Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2169 Message-Id: <[email protected]> URL: https://www.mail-archive.com/[email protected]/msg41159.html Signed-off-by: Gert Doering <[email protected]> --- M src/openvpn/ssl.c 1 file changed, 41 insertions(+), 22 deletions(-) git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/69/2169/3 diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c index d13a0d3..f91f226 100644 --- a/src/openvpn/ssl.c +++ b/src/openvpn/ssl.c @@ -3725,6 +3725,46 @@ *opt = NULL; } +/** + * Does a very coarse check on the received opcode. It only checks if the + * opcode is an allowed op code for the peer to send at all, not if this + * opcode is valid for the current state. + */ +static bool +tls_pre_decrypt_verify_opcode(int op, bool server, const struct link_socket_actual *from) +{ + if (op < P_FIRST_OPCODE || op > P_LAST_OPCODE) + { + if (op == P_CONTROL_HARD_RESET_CLIENT_V1 || op == P_CONTROL_HARD_RESET_SERVER_V1) + { + msg(D_TLS_ERRORS, "Peer tried unsupported key-method 1"); + } + struct gc_arena gc = gc_new(); + msg(D_TLS_ERRORS, "TLS Error: unknown opcode received from %s op=%d", + print_link_socket_actual(from, &gc), op); + gc_free(&gc); + return false; + } + + /* hard reset ? */ + if (is_hard_reset_method2(op)) + { + /* verify client -> server or server -> client connection */ + if (((op == P_CONTROL_HARD_RESET_CLIENT_V2 || op == P_CONTROL_HARD_RESET_CLIENT_V3) + && !server) + || ((op == P_CONTROL_HARD_RESET_SERVER_V2) && server)) + { + struct gc_arena gc = gc_new(); + msg(D_TLS_ERRORS, + "TLS Error: client->client or server->server connection attempted from %s", + print_link_socket_actual(from, &gc)); + gc_free(&gc); + return false; + } + } + return true; +} + /* * * When we are in TLS mode, this is the first routine which sees @@ -3783,32 +3823,11 @@ struct session_id sid; /* remote session ID */ /* verify legal opcode */ - if (op < P_FIRST_OPCODE || op > P_LAST_OPCODE) + if (!tls_pre_decrypt_verify_opcode(op, multi->opt.server, from)) { - if (op == P_CONTROL_HARD_RESET_CLIENT_V1 || op == P_CONTROL_HARD_RESET_SERVER_V1) - { - msg(D_TLS_ERRORS, "Peer tried unsupported key-method 1"); - } - msg(D_TLS_ERRORS, "TLS Error: unknown opcode received from %s op=%d", - print_link_socket_actual(from, &gc), op); goto error; } - /* hard reset ? */ - if (is_hard_reset_method2(op)) - { - /* verify client -> server or server -> client connection */ - if (((op == P_CONTROL_HARD_RESET_CLIENT_V2 || op == P_CONTROL_HARD_RESET_CLIENT_V3) - && !multi->opt.server) - || ((op == P_CONTROL_HARD_RESET_SERVER_V2) && multi->opt.server)) - { - msg(D_TLS_ERRORS, - "TLS Error: client->client or server->server connection attempted from %s", - print_link_socket_actual(from, &gc)); - goto error; - } - } - /* * Authenticate Packet */ -- To view, visit https://gerrit.openvpn.net/c/openvpn/+/2169?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.openvpn.net/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I86154e5c997b044f6913bddab58b43193ff539e1 Gerrit-Change-Number: 2169 Gerrit-PatchSet: 3 Gerrit-Owner: Arne Schwabe <[email protected]> Gerrit-Reviewer: Antonio Quartulli <[email protected]> Gerrit-CC: openvpn-devel <[email protected]>
_______________________________________________ Openvpn-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-devel
