From a8fb9f6443cd4ce3b76b1a31738ede2db5bc45ea Mon Sep 17 00:00:00 2001 From: Selva Nair Date: Mon, 24 Nov 2025 19:38:34 +0100 Subject: [PATCH] Harden interactive service pipe - Append a version 4 uuid to ovpn_pipe_name to make it less predictable - Do not allow remote access to the pipe This greatly reduces the possibility of a rogue process racing to open the pipe before CreateFile() is called in the worker thread. Reported-by: Marc Heuse Change-Id: Ie66a142751354e421d48b273784fc79bcb9f7208 Signed-off-by: Selva Nair Acked-by: Gert Doering Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1401 Message-Id: <20251124183839.24803-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg34654.html Signed-off-by: Gert Doering --- src/openvpnserv/interactive.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/src/openvpnserv/interactive.c b/src/openvpnserv/interactive.c index c717e99c..2dc865e7 100644 --- a/src/openvpnserv/interactive.c +++ b/src/openvpnserv/interactive.c @@ -1955,11 +1955,30 @@ RunOpenvpn(LPVOID p) goto out; } + UUID pipe_uuid; + RPC_STATUS rpc_stat = UuidCreate(&pipe_uuid); + if (rpc_stat != RPC_S_OK) + { + ReturnError(pipe, rpc_stat, L"UuidCreate", 1, &exit_event); + goto out; + } + + RPC_WSTR pipe_uuid_str = NULL; + rpc_stat = UuidToStringW(&pipe_uuid, &pipe_uuid_str); + if (rpc_stat != RPC_S_OK) + { + ReturnError(pipe, rpc_stat, L"UuidToString", 1, &exit_event); + goto out; + } openvpn_swprintf(ovpn_pipe_name, _countof(ovpn_pipe_name), - TEXT("\\\\.\\pipe\\" PACKAGE "%ls\\service_%lu"), service_instance, GetCurrentThreadId()); + TEXT("\\\\.\\pipe\\" PACKAGE "%ls\\service_%lu_%ls"), service_instance, + GetCurrentThreadId(), pipe_uuid_str); + RpcStringFree(&pipe_uuid_str); + ovpn_pipe = CreateNamedPipe(ovpn_pipe_name, PIPE_ACCESS_DUPLEX | FILE_FLAG_FIRST_PIPE_INSTANCE | FILE_FLAG_OVERLAPPED, - PIPE_TYPE_MESSAGE | PIPE_READMODE_MESSAGE | PIPE_WAIT, 1, 128, 128, 0, NULL); + PIPE_TYPE_MESSAGE | PIPE_READMODE_MESSAGE | PIPE_WAIT | PIPE_REJECT_REMOTE_CLIENTS, + 1, 128, 128, 0, NULL); if (ovpn_pipe == INVALID_HANDLE_VALUE) { ReturnLastError(pipe, L"CreateNamedPipe");