Re: [Openvpn-devel] use of --cipher with no arguments?
Hi,
On Tue, Jul 26, 2016 at 04:09:16AM +0200, Jan Just Keijser wrote:
> > Anyone having a good argument against it? JJK, do you happen to know
> > what this is about?
>
> this is from even before my time ;)
Fun :-)
> I didn't even know that you could specify cipher without an argument -
> let's disable this (and I assume the same is true for --auth ?)
Indeed, the same is true, and it would lead to the same crash
(--auth none --auth)
else if (streq (p[0], "auth") && p[1] && !p[2])
{
VERIFY_PERMISSION (OPT_P_GENERAL);
options->authname_defined = true;
options->authname = p[1];
if (streq (options->authname, "none"))
{
options->authname_defined = false;
options->authname = NULL;
}
}
else if (streq (p[0], "auth") && !p[1])
{
VERIFY_PERMISSION (OPT_P_GENERAL);
options->authname_defined = true;
}
I think Steffan's patch (that he sent in parallel to my mail) takes care
of this as well...
gert
--
USENET is *not* the non-clickable part of WWW!
//www.muc.de/~gert/
Gert Doering - Munich, Germany g...@greenie.muc.de
fax: +49-89-35655025g...@net.informatik.tu-muenchen.de
signature.asc
Description: PGP signature
Re: [Openvpn-devel] use of --cipher with no arguments?
Hi Gert, On 25/07/16 22:04, Gert Doering wrote: Hi, has anyone ever used "--cipher" without an argument? If yes, what is the intended usage? It sort of "tells openvpn we want crypto!" but does not go into detail about it... Normally, this would just be a random weird option, but I ran across --cipher none --cipher which first tells openvpn "nah, we do not want anything!" and sets a pointer to NULL, and then tells openvpn "but please *do* use the ciphers already setup!", which core dumps. This is not remotely exploitable, so not a *security* issue, but a bit stupid nonetheless - so I propose we just throw out "--cipher" with no arguments (--cipher none, or --cipher bf-cbc would, of course, continue to work). Anyone having a good argument against it? JJK, do you happen to know what this is about? this is from even before my time ;) I didn't even know that you could specify cipher without an argument - let's disable this (and I assume the same is true for --auth ?) JJK
Re: [Openvpn-devel] use of --cipher with no arguments?
Hi, On Mon, Jul 25, 2016 at 10:04 PM, Gert Doering wrote: > has anyone ever used "--cipher" without an argument? If yes, what is the > intended usage? It sort of "tells openvpn we want crypto!" but does not > go into detail about it... > > Normally, this would just be a random weird option, but I ran across > > --cipher none --cipher > > which first tells openvpn "nah, we do not want anything!" and sets > a pointer to NULL, and then tells openvpn "but please *do* use the > ciphers already setup!", which core dumps. > > This is not remotely exploitable, so not a *security* issue, but a bit > stupid nonetheless - so I propose we just throw out "--cipher" with > no arguments (--cipher none, or --cipher bf-cbc would, of course, > continue to work). > > Anyone having a good argument against it? JJK, do you happen to know > what this is about? As the patch I just sent suggests, I don't believe this can be useful at all. Using just --cipher is a no-op if anything but '--cipher none' is used (o->ciphername_defined is already set to true), and crashes OpenVPN otherwise. Probably just a leftover 'from the old days'. -Steffan
[Openvpn-devel] use of --cipher with no arguments?
Hi, has anyone ever used "--cipher" without an argument? If yes, what is the intended usage? It sort of "tells openvpn we want crypto!" but does not go into detail about it... Normally, this would just be a random weird option, but I ran across --cipher none --cipher which first tells openvpn "nah, we do not want anything!" and sets a pointer to NULL, and then tells openvpn "but please *do* use the ciphers already setup!", which core dumps. This is not remotely exploitable, so not a *security* issue, but a bit stupid nonetheless - so I propose we just throw out "--cipher" with no arguments (--cipher none, or --cipher bf-cbc would, of course, continue to work). Anyone having a good argument against it? JJK, do you happen to know what this is about? gert -- USENET is *not* the non-clickable part of WWW! //www.muc.de/~gert/ Gert Doering - Munich, Germany g...@greenie.muc.de fax: +49-89-35655025g...@net.informatik.tu-muenchen.de signature.asc Description: PGP signature
