From: Antonio Quartulli Date: Tue, 15 Feb 2022 12:31:57 +0000 (+0100) Subject: auth_token/tls_crypt: fix usage of md_valid() X-Git-Tag: v2.6_beta1~271 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=af695b53e01035a9137bc78a868cd5410be817f4;p=thirdparty%2Fopenvpn.git auth_token/tls_crypt: fix usage of md_valid() With b39725cf ("Remove md_kt_t and change crypto API to use const char*") the logic for validating ciphers and md algorithms has been changed. We should now *always* use md_valid() when validating a digest alg. At the same time, add '!' (negation) when validating the digest algorithm in the tls-crypt code, in order to restore the proper logic. Cc: Arne Schwabe Fixes: b39725cf ("Remove md_kt_t and change crypto API to use const char*") Reported-by: Richard T Bonhomme Signed-off-by: Antonio Quartulli Acked-by: Arne Schwabe Message-Id: <20220215123157.10615-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23793.html Signed-off-by: Gert Doering --- diff --git a/src/openvpn/auth_token.c b/src/openvpn/auth_token.c index ceae68f69..10c9dde6c 100644 --- a/src/openvpn/auth_token.c +++ b/src/openvpn/auth_token.c @@ -38,7 +38,7 @@ auth_token_kt(void) kt.cipher = "none"; kt.digest = "SHA256"; - if (!kt.digest) + if (!md_valid(kt.digest)) { msg(M_WARN, "ERROR: --tls-crypt requires HMAC-SHA-256 support."); return (struct key_type) { 0 }; diff --git a/src/openvpn/crypto_backend.h b/src/openvpn/crypto_backend.h index abf1b876c..6d89b9e5a 100644 --- a/src/openvpn/crypto_backend.h +++ b/src/openvpn/crypto_backend.h @@ -520,8 +520,7 @@ static inline bool md_defined(const char* mdname) * * @param digest Name of the digest to verify, e.g. \c MD5). * - * @return A statically allocated structure containing parameters - * for the given message digest. + * @return Whether a digest of the given name is available */ bool md_valid(const char *digest); diff --git a/src/openvpn/tls_crypt.c b/src/openvpn/tls_crypt.c index 610168b0a..aae2a9170 100644 --- a/src/openvpn/tls_crypt.c +++ b/src/openvpn/tls_crypt.c @@ -59,7 +59,7 @@ tls_crypt_kt(void) msg(M_WARN, "ERROR: --tls-crypt requires AES-256-CTR support."); return (struct key_type) { 0 }; } - if (cipher_valid(kt.digest)) + if (!md_valid(kt.digest)) { msg(M_WARN, "ERROR: --tls-crypt requires HMAC-SHA-256 support."); return (struct key_type) { 0 };