plaisthos has uploaded this change for review. ( http://gerrit.openvpn.net/c/openvpn/+/1766?usp=email )
Change subject: Backport stricter check for valid tokens ...................................................................... Backport stricter check for valid tokens This also improves is_auth_token to check for the correct length and adds a few unit tests. OpenVPN 2.5 does not have the logic to keep a session id for the auth token. So it does not suffer the same problem that 2.6 and 2.7 did (CVE 2026-13122). However the improvement that we are a lot stricter to check what might be an auth token is a good thing to backport as well to avoid any other potential issues that might be there. Partial cherry pick from ee119b24b3. Change-Id: I16187153e5b107eb08ccb7c9c9ed4acd6377af0c Signed-off-by: Arne Schwabe <[email protected]> --- M src/openvpn/auth_token.c M src/openvpn/auth_token.h 2 files changed, 28 insertions(+), 11 deletions(-) git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/66/1766/1 diff --git a/src/openvpn/auth_token.c b/src/openvpn/auth_token.c index 7c4d15d..5c299a2 100644 --- a/src/openvpn/auth_token.c +++ b/src/openvpn/auth_token.c @@ -21,12 +21,33 @@ const char *auth_token_pem_name = "OpenVPN auth-token server key"; #define AUTH_TOKEN_SESSION_ID_LEN 12 -#if AUTH_TOKEN_SESSION_ID_LEN % 3 -#error AUTH_TOKEN_SESSION_ID_LEN needs to be multiple a 3 -#endif +#define AUTH_TOKEN_SESSION_ID_BASE64_LEN (OPENVPN_BASE64_LENGTH(AUTH_TOKEN_SESSION_ID_LEN)) +/* We want our token to be a multiple of 3 bytes to avoid the base64 padding */ +static_assert(AUTH_TOKEN_SESSION_ID_LEN % 3 == 0, "AUTH_TOKEN_SESSION_ID_LEN needs to be multiple a 3"); + +#define AUTH_TOKEN_HMAC_LEN SHA256_DIGEST_LENGTH /* Size of the data of the token (not b64 encoded and without prefix) */ -#define TOKEN_DATA_LEN (2 * sizeof(int64_t) + AUTH_TOKEN_SESSION_ID_LEN + 32) +#define TOKEN_DATA_LEN (2 * sizeof(int64_t) + AUTH_TOKEN_SESSION_ID_LEN + AUTH_TOKEN_HMAC_LEN) +#define TOKEN_DATA_BASE64_LEN (OPENVPN_BASE64_LENGTH(TOKEN_DATA_LEN)) + + +#define TOTAL_SESSION_TOKEN_LEN (strlen(SESSION_ID_PREFIX) + TOKEN_DATA_BASE64_LEN) + +/* Ensure that TOKEN_DATA_LEN is a multiple of 3 so the we avoid the base64 + * padding */ +static_assert(TOKEN_DATA_LEN % 3 == 0, "TOKEN_DATA_BASE64_LEN is not a multiple of 3"); + +bool +is_auth_token(const char *password) +{ + if (strlen(password) != TOTAL_SESSION_TOKEN_LEN) + { + return false; + } + + return (memcmp_constant_time(SESSION_ID_PREFIX, password, strlen(SESSION_ID_PREFIX)) == 0); +} static struct key_type auth_token_kt(void) diff --git a/src/openvpn/auth_token.h b/src/openvpn/auth_token.h index 0fa4dba..85fb3c4 100644 --- a/src/openvpn/auth_token.h +++ b/src/openvpn/auth_token.h @@ -117,16 +117,12 @@ /** * Return if the password string has the format of a password. * - * This fuction will always read as many bytes as SESSION_ID_PREFIX is longer + * This function will always read as many bytes as SESSION_ID_PREFIX is longer * the caller needs ensure that password memory is at least that long (true for * calling with struct user_pass) * @param password * @return whether the password string starts with the session token prefix */ -static inline bool -is_auth_token(const char *password) -{ - return (memcmp_constant_time(SESSION_ID_PREFIX, password, - strlen(SESSION_ID_PREFIX)) == 0); -} +bool +is_auth_token(const char *password); #endif /* AUTH_TOKEN_H */ -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/1766?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: openvpn Gerrit-Branch: release/2.5 Gerrit-Change-Id: I16187153e5b107eb08ccb7c9c9ed4acd6377af0c Gerrit-Change-Number: 1766 Gerrit-PatchSet: 1 Gerrit-Owner: plaisthos <[email protected]> Gerrit-CC: openvpn-devel <[email protected]>
_______________________________________________ Openvpn-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-devel
