6186fe732b
Fixes two related security vulnerabilities (CVE-2020-15078) which under very specific circumstances allow tricking a server using delayed authentication (plugin or management) into returning a PUSH_REPLY before the AUTH_FAILED message, which can possibly be used to gather information about a VPN setup. In combination with "--auth-gen-token" or a user-specific token auth solution it can be possible to get access to a VPN with an otherwise-invalid account. OpenVPN 2.5.2 also includes other bug fixes and improvements. Add CI build test script. Signed-off-by: Magnus Kroken <mkroken@gmail.com>
42 lines
2 KiB
Diff
42 lines
2 KiB
Diff
From e4bd17c86e01aaf6f809d9ea355419c86c4defdc Mon Sep 17 00:00:00 2001
|
|
From: Max Fillinger <maximilian.fillinger@foxcrypto.com>
|
|
Date: Mon, 12 Apr 2021 19:46:17 +0200
|
|
Subject: [PATCH] Fix build with mbedtls w/o SSL renegotiation support
|
|
|
|
In mbedtls, support for SSL renegotiation can be disabled at
|
|
compile-time. However, OpenVPN cannot be built with such a library
|
|
because it calls mbedtls_ssl_conf_renegotiation() to disable this
|
|
feature at runtime. This function doesn't exist when mbedtls was built
|
|
without support for SSL renegotiation.
|
|
|
|
This commit fixes the build by ifdef'ing out the function call when
|
|
mbedtls was built without support for SSL renegotiation.
|
|
|
|
Signed-off-by: Max Fillinger <maximilian.fillinger@foxcrypto.com>
|
|
Acked-by: Antonio Quartulli <antonio@openvpn.net>
|
|
Message-Id: <E1lW0eX-00012w-9n@sfs-ml-1.v29.lw.sourceforge.com>
|
|
URL: https://www.mail-archive.com/search?l=mid&q=E1lW0eX-00012w-9n@sfs-ml-1.v29.lw.sourceforge.com
|
|
Signed-off-by: Gert Doering <gert@greenie.muc.de>
|
|
---
|
|
src/openvpn/ssl_mbedtls.c | 9 ++++++---
|
|
1 file changed, 6 insertions(+), 3 deletions(-)
|
|
|
|
--- a/src/openvpn/ssl_mbedtls.c
|
|
+++ b/src/openvpn/ssl_mbedtls.c
|
|
@@ -1098,10 +1098,13 @@ key_state_ssl_init(struct key_state_ssl
|
|
{
|
|
mbedtls_ssl_conf_curves(ks_ssl->ssl_config, ssl_ctx->groups);
|
|
}
|
|
- /* Disable TLS renegotiations. OpenVPN's renegotiation creates new SSL
|
|
- * session and does not depend on this feature. And TLS renegotiations have
|
|
- * been problematic in the past */
|
|
+
|
|
+ /* Disable TLS renegotiations if the mbedtls library supports that feature.
|
|
+ * OpenVPN's renegotiation creates new SSL sessions and does not depend on
|
|
+ * this feature and TLS renegotiations have been problematic in the past. */
|
|
+#if defined(MBEDTLS_SSL_RENEGOTIATION)
|
|
mbedtls_ssl_conf_renegotiation(ks_ssl->ssl_config, MBEDTLS_SSL_RENEGOTIATION_DISABLED);
|
|
+#endif /* MBEDTLS_SSL_RENEGOTIATION */
|
|
|
|
/* Disable record splitting (for now). OpenVPN assumes records are sent
|
|
* unfragmented, and changing that will require thorough review and
|