From: Arne Schwabe <[email protected]> The username environment variable is already set by the set_verify_user_pass_env function before the verify_user_pass_script function is called, so this call is not doing anything but might erroneously made people think that this needs to be cleaned up.
Also ensure that the password is clean from the env even in an error case. Reported-by: Joshua Rogers <[email protected]> Found-by: ZeroPath (https://zeropath.com/) Change-Id: I6c502508026c6b85bb092ada4d16d985b20dd41f Signed-off-by: Arne Schwabe <[email protected]> Acked-by: Gert Doering <[email protected]> Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1326 Message-Id: <[email protected]> URL: https://www.mail-archive.com/[email protected]/msg34069.html Signed-off-by: Gert Doering <[email protected]> Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1326 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1326 This mail reflects revision 2 of this Change. Acked-by according to Gerrit (reflected above): diff --git a/src/openvpn/ssl_verify.c b/src/openvpn/ssl_verify.c index 04ef27e..993d22c 100644 --- a/src/openvpn/ssl_verify.c +++ b/src/openvpn/ssl_verify.c @@ -1329,7 +1329,7 @@ } else { - setenv_str(session->opt->es, "username", up->username); + /* username env is already set by set_verify_user_pass_env */ setenv_str(session->opt->es, "password", up->password); } @@ -1377,10 +1377,6 @@ /* purge auth control filename (and file itself) for non-deferred returns */ key_state_rm_auth_control_files(&ks->script_auth); } - if (!session->opt->auth_user_pass_verify_script_via_file) - { - setenv_del(session->opt->es, "password"); - } done: if (tmp_file && strlen(tmp_file) > 0) @@ -1389,6 +1385,11 @@ } error: + if (!session->opt->auth_user_pass_verify_script_via_file) + { + setenv_del(session->opt->es, "password"); + } + argv_free(&argv); gc_free(&gc); return retval; _______________________________________________ Openvpn-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-devel
