]> git.ipfire.org Git - thirdparty/openvpn.git/commit
Fix broken async push with NCP is used
authorLev Stipakov <lev@openvpn.net>
Fri, 13 Mar 2020 16:59:13 +0000 (18:59 +0200)
committerGert Doering <gert@greenie.muc.de>
Thu, 16 Apr 2020 07:01:07 +0000 (09:01 +0200)
commit3b06b57d9f1d972ec16f0893d06697439c1bb1fe
treeab05f3116ece20ffa0d899e274e68a994fc83337
parentd8ac887c6b1b57a1953ab62058b4aed5d8c11f65
Fix broken async push with NCP is used

With NCP and deferred auth, we perform cipher negotiation and generate
data channel keys on incoming push request, assuming that auth succeeded.

With async push, when auth succeeds in between push requests, we send
push reply immediately.

The code which generates data channel keys is only called on handling
incoming push requests (incoming_push_message). It might not be called
with NCP, deferred auth and async push, because on incoming push request,
auth might not be complete yet. When auth is complete in between push
requests, push reply is sent and it is assumed that connection is
established. However, since data channel keys are not generated on the
server side, connection doesn't work.

Fix by adding a call to generate data channel keys when async push is
triggered.

Also, all the "session->key[KS_PRIMARY].crypto_options.key_ctx_bi.initialized"
checks have been moved into tls_session_update_crypto_params(), which
is just reducing duplicate code, no actual code change (*all* callers
had this pre-check).

Trac: #1259

Reported-by: smaxfield@duosecurity.com
Signed-off-by: Lev Stipakov <lev@openvpn.net>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20200313165913.12682-1-lstipakov@gmail.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19553.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>
src/openvpn/init.c
src/openvpn/multi.c
src/openvpn/push.c
src/openvpn/ssl.c
src/openvpn/ssl.h