upstream/openvpn
1
0
Fork 0
mirror of https://github.com/OpenVPN/openvpn.git synced 2026-05-28 04:03:29 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Improve data channel crypto error messages

Browse source 
* Make decryption error messages better understandable.
 * Increase verbosity level for authentication errors, because those can
   be expected on bad connections.

Change-Id: I0fd48191babe4fe5c56f10eb3ba88182ffb075d1
Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: MaxF <max@max-fillinger.net>
Message-Id: <20241017064955.23959-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg29569.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>
This commit is contained in:
Steffan Karger 2024-10-17 08:49:55 +02:00 committed by Gert Doering
parent 33a700d61e
commit bacdbbee7e
2 changed files with 12 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
src/openvpn/crypto.c
View file

@ -459,14 +459,14 @@ openvpn_decrypt_aead(struct buffer *buf, struct buffer work,
if (!cipher_ctx_update(ctx->cipher, BPTR(&work), &outlen, BPTR(buf),
data_len))
{
CRYPT_ERROR("cipher update failed");
CRYPT_ERROR("packet decryption failed");
}
ASSERT(buf_inc_len(&work, outlen));
if (!cipher_ctx_final_check_tag(ctx->cipher, BPTR(&work) + outlen,
&outlen, tag_ptr, tag_size))
{
CRYPT_ERROR("cipher final failed");
CRYPT_DROP("packet tag authentication failed");
}
ASSERT(buf_inc_len(&work, outlen));
@ -538,7 +538,7 @@ openvpn_decrypt_v1(struct buffer *buf, struct buffer work,
/* Compare locally computed HMAC with packet HMAC */
if (memcmp_constant_time(local_hmac, BPTR(buf), hmac_len))
{
CRYPT_ERROR("packet HMAC authentication failed");
CRYPT_DROP("packet HMAC authentication failed");
}
ASSERT(buf_advance(buf, hmac_len));
@ -572,26 +572,26 @@ openvpn_decrypt_v1(struct buffer *buf, struct buffer work,
/* ctx->cipher was already initialized with key & keylen */
if (!cipher_ctx_reset(ctx->cipher, iv_buf))
{
CRYPT_ERROR("cipher init failed");
CRYPT_ERROR("decrypt initialization failed");
}
/* Buffer overflow check (should never happen) */
if (!buf_safe(&work, buf->len + cipher_ctx_block_size(ctx->cipher)))
{
CRYPT_ERROR("potential buffer overflow");
CRYPT_ERROR("packet too big to decrypt");
}
/* Decrypt packet ID, payload */
if (!cipher_ctx_update(ctx->cipher, BPTR(&work), &outlen, BPTR(buf), BLEN(buf)))
{
CRYPT_ERROR("cipher update failed");
CRYPT_ERROR("packet decryption failed");
}
ASSERT(buf_inc_len(&work, outlen));
/* Flush the decryption buffer */
if (!cipher_ctx_final(ctx->cipher, BPTR(&work) + outlen, &outlen))
{
CRYPT_ERROR("cipher final failed");
CRYPT_DROP("packet authentication failed, dropping.");
}
ASSERT(buf_inc_len(&work, outlen));

7
src/openvpn/crypto.h
View file

@ -288,8 +288,11 @@ struct crypto_options
* security operation functions. */
};
#define CRYPT_ERROR(format) \
do { msg(D_CRYPT_ERRORS, "%s: " format, error_prefix); goto error_exit; } while (false)
#define CRYPT_ERROR_EXIT(flags, format) \
do { msg(flags, "%s: " format, error_prefix); goto error_exit; } while (false)
#define CRYPT_ERROR(format) CRYPT_ERROR_EXIT(D_CRYPT_ERRORS, format)
#define CRYPT_DROP(format) CRYPT_ERROR_EXIT(D_MULTI_DROPPED, format)
/**
* Minimal IV length for AEAD mode ciphers (in bytes):