[Openvpn-devel] [S] Change in openvpn[master]: ssl: Ignore hard reset packets with a non-zero packet id

--===============5207707838792160257==
Content-Transfer-Encoding: 8bit
Content-Disposition: inline
Content-Type: multipart/alternative; boundary="ldvqsmaGdPA="; charset=UTF-8

--ldvqsmaGdPA=
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

cron2 has uploaded a new patch set (#2) to the change originally created by=
 flichtenheld=2E ( http://gerrit=2Eopenvpn=2Enet/c/openvpn/+/1832?usp=3Dema=
il )

The following approvals got outdated and were removed:
Code-Review+2 =
by plaisthos


Change subject: ssl: Ignore hard reset packets with a non-ze=
ro packet id
=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=
=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=
=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=


ssl: Ignore hard reset packets with a non-zero packet id

A hard reset is=
 always the first packet of a session, so it always
carries reliable packet=
 id 0=2E tls_process_state() relies on that when it
treats a received reset=
 as the early negotiation packet only for packet
id 0, and the stateless th=
ree-way handshake relies on it as well (see
the comment in session_skip_to_=
pre_start())=2E

A reset claiming a different id is therefore bogus=2E

We =
had a bug that could cause hard reset replays with packet id 1 in
specific =
scenarios (P2P TCP)=2E In that case we accepted the packet id
at face value=
 and then ignored the control packet that actually had
id 1 as an replay=2E=
 This caused a difficult to diagnose dead connection
that was stuck just be=
fore TLS negotiation=2E The check added handles
this specific scenario well=
 in that we just ignore the bogus reset
but do not abort the connection att=
empt=2E Starting fresh might retrigger
the bug=2E If there would be a separ=
ate bug where the client only sends
hard resets with packet id 1 we will st=
ill get logging on the server
side now=2E

Change-Id: I3c7d1f9e5b2a4c6d8e1f=
3a5b7c9d2e4f6a8b1c3d
Signed-off-by: Frank Lichtenheld <frank@lichtenheld=2E=
com>
Acked-by: Arne Schwabe <arne-openvpn@rfc2549=2Eorg>
Gerrit URL: https:=
//gerrit=2Eopenvpn=2Enet/c/openvpn/+/1832
Message-Id: <20260731114605=2E115=
96-1-gert@greenie=2Emuc=2Ede>
URL: https://www=2Email-archive=2Ecom/openvpn=
-devel@lists=2Esourceforge=2Enet/msg38098=2Ehtml
Signed-off-by: Gert Doerin=
g <gert@greenie=2Emuc=2Ede>
---
M src/openvpn/ssl=2Ec
1 file changed, 15 in=
sertions(+), 1 deletion(-)


  git pull ssh://gerrit=2Eopenvpn=2Enet:29418/=
openvpn refs/changes/32/1832/2

diff --git a/src/openvpn/ssl=2Ec b/src/open=
vpn/ssl=2Ec
index 60df7ce=2E=2Eccd8264 100644
--- a/src/openvpn/ssl=2Ec
+++=
 b/src/openvpn/ssl=2Ec
@@ -3896,8 +3896,22 @@
         /* Extract the packe=
t ID from the packet */
         if (reliable_ack_read_packet_id(buf, &id))=

         {
+            /* A hard reset always is the first packet of a se=
ssion, so it
+             * always must use packet id 0=2E Ignore it if it=
 claims another id=2E
+             * In a specific existing bug these pack=
ets were replays of an
+             * already handled reset, so ignoring i=
t is better than aborting
+             * the connection attempt=2E
+      =
       */
+            if (is_hard_reset_method2(op) && id !=3D 0)
+       =
     {
+                msg(D_TLS_ERRORS,
+                    "TLS Error: =
received %s with packet id " packet_id_format
+                    " from %=
s -- 0 was expected, ignoring packet",
+                    packet_opcode_n=
ame(op), (packet_id_print_type)id,
+                    print_link_socket_a=
ctual(from, &gc));
+            }
             /* Avoid deadlock by rejecti=
ng packet that would de-sequentialize receive buffer */
-            if (re=
liable_wont_break_sequentiality(ks->rec_reliable, id))
+            else if=
 (reliable_wont_break_sequentiality(ks->rec_reliable, id))
             {
 =
                if (reliable_not_replay(ks->rec_reliable, id))
            =
     {

-- 
To view, visit http://gerrit=2Eopenvpn=2Enet/c/openvpn/+/1832?u=
sp=3Demail
To unsubscribe, or for help writing mail filters, visit http://g=
errit=2Eopenvpn=2Enet/settings?usp=3Demail

Gerrit-MessageType: newpatchset=

Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: I3c7d1f9e5=
b2a4c6d8e1f3a5b7c9d2e4f6a8b1c3d
Gerrit-Change-Number: 1832
Gerrit-PatchSet:=
 2
Gerrit-Owner: flichtenheld <frank@lichtenheld=2Ecom>
Gerrit-Reviewer: pl=
aisthos <arne-openvpn@rfc2549=2Eorg>
Gerrit-CC: openvpn-devel <openvpn-deve=
l@lists=2Esourceforge=2Enet>

--ldvqsmaGdPA=
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html><html><head><style></style></head><body><p>cron2 <strong>upl=
oaded patch set #2</strong> to the change originally created by flichtenhel=
d=2E</p><p><a href=3D"http://gerrit=2Eopenvpn=2Enet/c/openvpn/+/1832?usp=3D=
email">View Change</a></p><p>The following approvals got outdated and were =
removed:
Code-Review+2 by plaisthos</p><pre class=3D"blocks" style=3D"font-=
family: monospace,monospace; white-space: pre-wrap;">ssl: Ignore hard reset=
 packets with a non-zero packet id<br><br>A hard reset is always the first =
packet of a session, so it always<br>carries reliable packet id 0=2E tls_pr=
ocess_state() relies on that when it<br>treats a received reset as the earl=
y negotiation packet only for packet<br>id 0, and the stateless three-way h=
andshake relies on it as well (see<br>the comment in session_skip_to_pre_st=
art())=2E<br><br>A reset claiming a different id is therefore bogus=2E<br><=
br>We had a bug that could cause hard reset replays with packet id 1 in<br>=
specific scenarios (P2P TCP)=2E In that case we accepted the packet id<br>a=
t face value and then ignored the control packet that actually had<br>id 1 =
as an replay=2E This caused a difficult to diagnose dead connection<br>that=
 was stuck just before TLS negotiation=2E The check added handles<br>this s=
pecific scenario well in that we just ignore the bogus reset<br>but do not =
abort the connection attempt=2E Starting fresh might retrigger<br>the bug=
=2E If there would be a separate bug where the client only sends<br>hard re=
sets with packet id 1 we will still get logging on the server<br>side now=
=2E<br><br>Change-Id: I3c7d1f9e5b2a4c6d8e1f3a5b7c9d2e4f6a8b1c3d<br>Signed-o=
ff-by: Frank Lichtenheld &lt;frank@lichtenheld=2Ecom&gt;<br>Acked-by: Arne =
Schwabe &lt;arne-openvpn@rfc2549=2Eorg&gt;<br>Gerrit URL: https://gerrit=2E=
openvpn=2Enet/c/openvpn/+/1832<br>Message-Id: &lt;20260731114605=2E11596-1-=
gert@greenie=2Emuc=2Ede&gt;<br>URL: https://www=2Email-archive=2Ecom/openvp=
n-devel@lists=2Esourceforge=2Enet/msg38098=2Ehtml<br>Signed-off-by: Gert Do=
ering &lt;gert@greenie=2Emuc=2Ede&gt;<br>---<br>M src/openvpn/ssl=2Ec<br>1 =
file changed, 15 insertions(+), 1 deletion(-)<br><br></pre><pre class=3D"bl=
ocks" style=3D"font-family: monospace,monospace; white-space: pre-wrap;">gi=
t pull ssh://gerrit=2Eopenvpn=2Enet:29418/openvpn refs/changes/32/1832/2</p=
re><pre style=3D"font-family: monospace,monospace; white-space: pre-wrap;">=
<span>diff --git a/src/openvpn/ssl=2Ec b/src/openvpn/ssl=2Ec</span><br><spa=
n>index 60df7ce=2E=2Eccd8264 100644</span><br><span>--- a/src/openvpn/ssl=
=2Ec</span><br><span>+++ b/src/openvpn/ssl=2Ec</span><br><span>@@ -3896,8 +=
3896,22 @@</span><br><span>         /* Extract the packet ID from the packe=
t */</span><br><span>         if (reliable_ack_read_packet_id(buf, &amp;id)=
)</span><br><span>         {</span><br><span style=3D"color: hsl(120, 100%,=
 40%);">+            /* A hard reset always is the first packet of a sessio=
n, so it</span><br><span style=3D"color: hsl(120, 100%, 40%);">+           =
  * always must use packet id 0=2E Ignore it if it claims another id=2E</sp=
an><br><span style=3D"color: hsl(120, 100%, 40%);">+             * In a spe=
cific existing bug these packets were replays of an</span><br><span style=
=3D"color: hsl(120, 100%, 40%);">+             * already handled reset, so =
ignoring it is better than aborting</span><br><span style=3D"color: hsl(120=
, 100%, 40%);">+             * the connection attempt=2E</span><br><span st=
yle=3D"color: hsl(120, 100%, 40%);">+             */</span><br><span style=
=3D"color: hsl(120, 100%, 40%);">+            if (is_hard_reset_method2(op)=
 &amp;&amp; id !=3D 0)</span><br><span style=3D"color: hsl(120, 100%, 40%);=
">+            {</span><br><span style=3D"color: hsl(120, 100%, 40%);">+   =
             msg(D_TLS_ERRORS,</span><br><span style=3D"color: hsl(120, 100=
%, 40%);">+                    &quot;TLS Error: received %s with packet id =
&quot; packet_id_format</span><br><span style=3D"color: hsl(120, 100%, 40%)=
;">+                    &quot; from %s -- 0 was expected, ignoring packet&q=
uot;,</span><br><span style=3D"color: hsl(120, 100%, 40%);">+              =
      packet_opcode_name(op), (packet_id_print_type)id,</span><br><span sty=
le=3D"color: hsl(120, 100%, 40%);">+                    print_link_socket_a=
ctual(from, &amp;gc));</span><br><span style=3D"color: hsl(120, 100%, 40%);=
">+            }</span><br><span>             /* Avoid deadlock by rejectin=
g packet that would de-sequentialize receive buffer */</span><br><span styl=
e=3D"color: hsl(0, 100%, 40%);">-            if (reliable_wont_break_sequen=
tiality(ks-&gt;rec_reliable, id))</span><br><span style=3D"color: hsl(120, =
100%, 40%);">+            else if (reliable_wont_break_sequentiality(ks-&gt=
;rec_reliable, id))</span><br><span>             {</span><br><span>        =
         if (reliable_not_replay(ks-&gt;rec_reliable, id))</span><br><span>=
                 {</span><br><span></span><br></pre><p>To view, visit <a hr=
ef=3D"http://gerrit=2Eopenvpn=2Enet/c/openvpn/+/1832?usp=3Demail">change 18=
32</a>=2E To unsubscribe, or for help writing mail filters, visit <a href=
=3D"http://gerrit=2Eopenvpn=2Enet/settings?usp=3Demail">settings</a>=2E</p>=
<div itemscope itemtype=3D"http://schema=2Eorg/EmailMessage"><div itemscope=
 itemprop=3D"action" itemtype=3D"http://schema=2Eorg/ViewAction"><link item=
prop=3D"url" href=3D"http://gerrit=2Eopenvpn=2Enet/c/openvpn/+/1832?usp=3De=
mail"/><meta itemprop=3D"name" content=3D"View Change"/></div></div>

<div =
style=3D"display:none"> Gerrit-MessageType: newpatchset </div>
<div style=
=3D"display:none"> Gerrit-Project: openvpn </div>
<div style=3D"display:non=
e"> Gerrit-Branch: master </div>
<div style=3D"display:none"> Gerrit-Change=
-Id: I3c7d1f9e5b2a4c6d8e1f3a5b7c9d2e4f6a8b1c3d </div>
<div style=3D"display=
:none"> Gerrit-Change-Number: 1832 </div>
<div style=3D"display:none"> Gerr=
it-PatchSet: 2 </div>
<div style=3D"display:none"> Gerrit-Owner: flichtenhe=
ld &lt;frank@lichtenheld=2Ecom&gt; </div>
<div style=3D"display:none"> Gerr=
it-Reviewer: plaisthos &lt;arne-openvpn@rfc2549=2Eorg&gt; </div>
<div style=
=3D"display:none"> Gerrit-CC: openvpn-devel &lt;openvpn-devel@lists=2Esourc=
eforge=2Enet&gt; </div>

</body></html>
--ldvqsmaGdPA=--


--===============5207707838792160257==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============5207707838792160257==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

--===============5207707838792160257==--