openvpn-devel Mailing List for OpenVPN

Due to several requests, I've put together a set of isolated patches which fix the individual security issues addressed by OpenVPN 2.0.1, and which can be applied to any major version of OpenVPN going back to 1.3.2. Out of the 4 patches, only CAN-2005-2531 is relevant for the 1.x branch. These patches will individually apply the specific security fixes released in OpenVPN 2.0.1 to an OpenVPN 2.0 or 1.x tree. Patches are available in: http://openvpn.net/patch/2.0.1-security-patches/ ----------------------------------------- openvpn-2.0-sslerrqfix.patch openvpn-1.6.0-sslerrqfix.patch (also applicable to 1.5.0) openvpn-1.4.3-sslerrqfix.patch (also applicable to 1.3.2) * Security Fix -- DoS attack against server when run with "verb 0" and without "tls-auth". If a client connection to the server fails certificate verification, the OpenSSL error queue is not properly flushed, which can result in another unrelated client instance on the server seeing the error and responding to it, resulting in disconnection of the unrelated client (CAN-2005-2531). Affects OpenVPN 1.x and 2.0. ----------------------------------------- openvpn-2.0-sslerrqfix.patch * Security Fix -- DoS attack against server by authenticated client. This bug presents a potential DoS attack vector against the server which can only be initiated by a connected and authenticated client. If the client sends a packet which fails to decrypt on the server, the OpenSSL error queue is not properly flushed, which can result in another unrelated client instance on the server seeing the error and responding to it, resulting in disconnection of the unrelated client (CAN-2005-2532). Affects OpenVPN 2.0 only, 1.x is unaffected. ----------------------------------------- openvpn-2.0-iroutequota.patch * Security Fix -- DoS attack against server by authenticated client. A malicious client in "dev tap" ethernet bridging mode could theoretically flood the server with packets appearing to come from hundreds of thousands of different MAC addresses, causing the OpenVPN process to deplete system virtual memory as it expands its internal routing table. A --max-routes-per-client directive has been added (default=256) to limit the maximum number of routes in OpenVPN's internal routing table which can be associated with a given client (CAN-2005-2533). Affects OpenVPN 2.0 only, 1.x is unaffected. ----------------------------------------- openvpn-2.0-assert-mtcp411.patch * Security Fix -- DoS attack against server by authenticated client. If two or more client machines try to connect to the server at the same time via TCP, using the same client certificate, and when --duplicate-cn is not enabled on the server, a race condition can crash the server with "Assertion failed at mtcp.c:411" (CAN-2005-2534). Affects OpenVPN 2.0 only, 1.x is unaffected. ----------------------------------------- James 

SGkNCg0KCUkgYnVpbGQgdGhlIHNvdXJjZSBjb2RlcyBvZiBPcGVuVlBOIG9uIFdpbmRvdyBYUCwg dGhlIGx6byBpcyBpbiBIOlx2cG4tYnVpbGRcbHpvLTEuMDguIFRoZSBpbmNsdWRlIGRpcmVjdG9y eSB1bmRlciBsem8tMS4wOCBjb250YWlucyBsem8uaCxsem9jb25mLmgsbHpvdXRpbC5oIGx6bzEu aCwgLi4uIFRoZSBsaWIgZGlyZWN0b3J5IHVuZGVyIGx6by0xLjA4IGNvbnRhaW5zIGxpYmx6by5h IGFuZCBsaWJsaXoubGEuIChwbGVhc2Ugc2VlIHRoZSBhdHRhY2htZW50KQ0KDQoJU28gSSBzZXQg IkxaTyA9IC9oL3Zwbi1idWlsZC9sem8tMS4wOCIsIkxJQl9ESVJTID0gLUwke09QRU5TU0x9L2xp Yi9NaW5HVyAgLUwke0xaT30vbGliIiwiSU5DTFVERV9ESVJTID0gLUkke09QRU5TU0x9L2luY2x1 ZGUgLUkke0xaT30vaW5jbHVkZSIgaW4gdGhlIG1ha2VmaWxlLnczMi4gTm90ZSB0aGUgb3BlbnNz bCBpcyBvayB3aGVuIGJ1aWxkaW5nLg0KCXdoZW4gSSBidWlsZCB0aGUgY29kZXMgd2l0aCAnbWFr ZSAtZiBtYWtlZmlsZS53MzInLCBJIGZhY2UgdGhlIGZvbGxvd2luZyBlcnJvcnM6DQoNCg0KLyot LS0tLS0tLS0tLS0tLS0tLS0tIHRoZSBtYWtpbmcgcHJvY2Vzc2VzIGFuZCB0aGUgZXJyb3MtLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSovDQpIOlx2cG5cc291cmNlY29kZVx3aW5kb3dzXG9w ZW52cG4tMi4wPm1ha2UgLWYgbWFrZWZpbGUudzMyICAgICAgICAgICAgICAgICAgICAgIA0KZ2Nj IC1nIC1PMiAtV2FsbCAtV25vLXVudXNlZC1mdW5jdGlvbiAtV25vLXVudXNlZC12YXJpYWJsZSAt bW5vLWN5Z3dpbiAtbyBvcGVudnBuLmV4ZSBiYXNlNjQubyAgYnVmZmVyLm8gY3J5cHRvLm8gY3J5 cHRvYXBpLm8gZXJyb3IubyBldmVudC5vIGZkbWlzYy5vIGZvcndhcmQubyBmcmFnbWVudC5vIGdy ZW1saW4ubyBoZWxwZXIubyBpbml0Lm8gaW50ZXJ2YWwubyBsaXN0Lm8gbHpvLm8gbWFuYWdlLm8g bWJ1Zi5vIG1pc2MubyBtcm91dGUubyBtc3MubyBtdGNwLm8gbXR1Lm8gbXVkcC5vIG11bHRpLm8g bnRsbS5vIG9jYy5vIG9wZW52cG4ubyBvcHRpb25zLm8gb3RpbWUubyBwYWNrZXRfaWQubyBwZXJm Lm8gcGluZy5vIHBsdWdpbi5vIHBvb2wubyBwcm90by5vIHByb3h5Lm8gcHVzaC5vIHJlbGlhYmxl Lm8gcm91dGUubyBzY2hlZHVsZS5vIHNlc3Npb25faWQubyBzaGFwZXIubyBzaWcubyBzb2NrZXQu byBzb2Nrcy5vIHNzbC5vIHN0YXR1cy5vIHRocmVhZC5vIHR1bi5vIHdpbjMyLm8gLUwvaC92cG4t YnVpbGQvT3BlblNTTC9saWIvTWluR1cgLUwvaC92cG4tYnVpbGQvbHpvLTEuMDgvbGliIC1sc3Ns MzIgLWxlYXkzMiAtbGx6byAtbGNyeXB0MzIgLWx3czJfMzIgLWxnZGkzMiAtbGlwaGxwYXBpIC1s d2lubW0gICAgICANCmx6by5vKC50ZXh0KzB4YmQpOiBJbiBmdW5jdGlvbiBgbHpvX2NvbXByZXNz X2luaXQnOiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSDovdnBuL3NvdXJjZWNvZGUvd2lu ZG93cy9vcGVudnBuLTIuMC9sem8uYzoxMTI6IHVuZGVmaW5lZCByZWZlcmVuY2UgdG8gYF9fbHpv X2luaXQyJyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIGx6by5vKC50ZXh0KzB4Y2MpOkg6L3Zwbi9zb3VyY2Vj b2RlL3dpbmRvd3Mvb3BlbnZwbi0yLjAvbHpvLmM6MTE0OiB1bmRlZmluZWQgcmVmZXJlbmNlIHRv IGBsem9fbWFsbG9jJw0KbHpvLm8oLnRleHQrMHgxNjQpOiBJbiBmdW5jdGlvbiBgbHpvX2NvbXBy ZXNzX3VuaW5pdCc6ICAgICAgICAgICAgICAgICAgICAgICAgICAgSDovdnBuL3NvdXJjZWNvZGUv d2luZG93cy9vcGVudnBuLTIuMC9sem8uYzoxMjQ6IHVuZGVmaW5lZCByZWZlcmVuY2UgdG8gYGx6 b19mcmVlJyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIGx6by5vKC50ZXh0KzB4MmJjKTogSW4gZnVuY3Rp b24gYGx6b19jb21wcmVzcyc6ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSDovdnBu L3NvdXJjZWNvZGUvd2luZG93cy9vcGVudnBuLTIuMC9sem8uYzoxNTU6IHVuZGVmaW5lZCByZWZl cmVuY2UgdG8gYGx6bzF4XzFfMTVfY29tcHJlc3MnICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGx6by5vKC50ZXh0KzB4Njlh KTogSW4gZnVuY3Rpb24gYGx6b19kZWNvbXByZXNzJzogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgSDovdnBuL3NvdXJjZWNvZGUvd2luZG93cy9vcGVudnBuLTIuMC9sem8uYzoyMDk6IHVu ZGVmaW5lZCByZWZlcmVuY2UgdG8gYGx6bzF4X2RlY29tcHJlc3Nfc2FmZScgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIA0KY29sbGVjdDI6IGxkIHJldHVybmVkIDEgZXhpdCBzdGF0dXMN Cm1ha2U6ICoqKiBbZHluYW1pY10gRXJyb3IgMSAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICANCi8qLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tIHRoZSBtYWtp bmcgcHJvY2Vzc2VzIGVuZC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSovDQoNCg0K SGFzIEFueW9uZSAgZmFjZWQgdGhlc2UgcHJvYmxlbXMgd2l0aCBNaW5HVy9NU1lTIGluIHdpbmRv d3MgcGxhdGZvcm0sIG9yIElmIGFueW9uZSBoYXMgdGhlIGx6byBsaWIgdGhhdCBjYW4gbWFrZSBz dWNjZXNzZnVsbHkgaW4gd2luZG93cyBwbGF0Zm9ybSwgcGxlYXNlIHNlbmQgaXQgdG8gbWUoZGVo dWE5OTlAc2p0dS5lZHUuY24pLCB0aGFua3MgYSBsb3QhDQqhoaGhoaGhoaGhoaGhoaGhDQqhoaGh oaGhoaGhoaGhoaGhICAgICAgICAgICAgICAgICAgIGRld2FyZA0KDQoNCg== 

 On Wed, 17 Aug 2005, Johnny C. Lam wrote: > On Wed, Aug 17, 2005 at 06:52:50AM -0600, James Yonan wrote: > > On Tue, 16 Aug 2005, Johnny Lam wrote: > > > > > James Yonan wrote: > > > > > > > > * Added easy-rsa 2.0 scripts to the tarball in easy-rsa/2.0 > > > > > > I am maintaining OpenVPN in the NetBSD Packages Collection and was in > > > the process of updating our package to 2.0.1 when I noticed that the > > > pkitool script uses bash. If I provide them, will patches be accepted > > > into the OpenVPN sources to use Bourne shell syntax instead so as to > > > relax the requirement on bash? > > > > Yes, that's probably okay. Hopefully we can get bash/sh portability > > without complexifying the code too much. > > I've attached a patch that does the following things: > > (1) Bourne shell fix: function foo {...} -> foo() {...} > > (2) Bourne shell fix: avoid use of bash's substring selection >	${foo:M:N} by replacing with an equivalent options-processing >	loop. > > (3) Solaris /bin/sh fix: don't set and export in one command; >	rather, export all the variables after setting them. > > (4) Solaris /bin/sh fix: "if ! cmd ; then ... fi" isn't understood, >	so change it to "if cmd; then :; else ... fi". > > (5) Don't require GNU grep -- -E isn't needed since we're matching >	a basic RE, and -q can be avoided by attaching stdout to >	/dev/null. > > (6) Use GREP and OPENSSL variables instead of "grep" and "openssl" >	so that it's easier to hard-code the full paths to the two >	utilities in the pkitool script by setting them at the top of >	the script. > > I've tested this script on both NetBSD 2.0.2 and Solaris 8. Thanks, I've merged your patch with 2.0.2-rc1. James