[S] Change in openvpn[release/2.5]: Backport stricter check for valid tokens

plaisthos has uploaded this change for review. ( http://gerrit.openvpn.net/c/openvpn/+/1766?usp=email )


Change subject: Backport stricter check for valid tokens
......................................................................

Backport stricter check for valid tokens

This also improves is_auth_token to check for the correct length and
adds a few unit tests.

OpenVPN 2.5 does not have the logic to keep a session id for the auth
token. So it does not suffer the same problem that 2.6 and 2.7 did
(CVE 2026-13122).

However the improvement that we are a lot stricter to check what might
be an auth token is a good thing to backport as well to avoid any other
potential issues that might be there.

Partial cherry pick from ee119b24b3.

Change-Id: I16187153e5b107eb08ccb7c9c9ed4acd6377af0c
Signed-off-by: Arne Schwabe <[email protected]>
---
M src/openvpn/auth_token.c
M src/openvpn/auth_token.h
2 files changed, 28 insertions(+), 11 deletions(-)



  git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/66/1766/1

diff --git a/src/openvpn/auth_token.c b/src/openvpn/auth_token.c
index 7c4d15d..5c299a2 100644
--- a/src/openvpn/auth_token.c
+++ b/src/openvpn/auth_token.c
@@ -21,12 +21,33 @@
 const char *auth_token_pem_name = "OpenVPN auth-token server key";
 
 #define AUTH_TOKEN_SESSION_ID_LEN 12
-#if AUTH_TOKEN_SESSION_ID_LEN % 3
-#error AUTH_TOKEN_SESSION_ID_LEN needs to be multiple a 3
-#endif
+#define AUTH_TOKEN_SESSION_ID_BASE64_LEN (OPENVPN_BASE64_LENGTH(AUTH_TOKEN_SESSION_ID_LEN))
 
+/* We want our token to be a multiple of 3 bytes to avoid the base64 padding */
+static_assert(AUTH_TOKEN_SESSION_ID_LEN % 3 == 0, "AUTH_TOKEN_SESSION_ID_LEN needs to be multiple a 3");
+
+#define AUTH_TOKEN_HMAC_LEN   SHA256_DIGEST_LENGTH
 /* Size of the data of the token (not b64 encoded and without prefix) */
-#define TOKEN_DATA_LEN (2 * sizeof(int64_t) + AUTH_TOKEN_SESSION_ID_LEN + 32)
+#define TOKEN_DATA_LEN        (2 * sizeof(int64_t) + AUTH_TOKEN_SESSION_ID_LEN + AUTH_TOKEN_HMAC_LEN)
+#define TOKEN_DATA_BASE64_LEN (OPENVPN_BASE64_LENGTH(TOKEN_DATA_LEN))
+
+
+#define TOTAL_SESSION_TOKEN_LEN (strlen(SESSION_ID_PREFIX) + TOKEN_DATA_BASE64_LEN)
+
+/* Ensure that TOKEN_DATA_LEN is a multiple of 3 so the we avoid the base64
+ * padding */
+static_assert(TOKEN_DATA_LEN % 3 == 0, "TOKEN_DATA_BASE64_LEN is not a multiple of 3");
+
+bool
+is_auth_token(const char *password)
+{
+    if (strlen(password) != TOTAL_SESSION_TOKEN_LEN)
+    {
+        return false;
+    }
+
+    return (memcmp_constant_time(SESSION_ID_PREFIX, password, strlen(SESSION_ID_PREFIX)) == 0);
+}
 
 static struct key_type
 auth_token_kt(void)
diff --git a/src/openvpn/auth_token.h b/src/openvpn/auth_token.h
index 0fa4dba..85fb3c4 100644
--- a/src/openvpn/auth_token.h
+++ b/src/openvpn/auth_token.h
@@ -117,16 +117,12 @@
 /**
  * Return if the password string has the format of a password.
  *
- * This fuction will always read as many bytes as SESSION_ID_PREFIX is longer
+ * This function will always read as many bytes as SESSION_ID_PREFIX is longer
  * the caller needs ensure that password memory is at least that long (true for
  * calling with struct user_pass)
  * @param password
  * @return whether the password string starts with the session token prefix
  */
-static inline bool
-is_auth_token(const char *password)
-{
-    return (memcmp_constant_time(SESSION_ID_PREFIX, password,
-                                 strlen(SESSION_ID_PREFIX)) == 0);
-}
+bool
+is_auth_token(const char *password);
 #endif /* AUTH_TOKEN_H */

-- 
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1766?usp=email
To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: newchange
Gerrit-Project: openvpn
Gerrit-Branch: release/2.5
Gerrit-Change-Id: I16187153e5b107eb08ccb7c9c9ed4acd6377af0c
Gerrit-Change-Number: 1766
Gerrit-PatchSet: 1
Gerrit-Owner: plaisthos <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>

_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel