upstream/openvpn
1
0
Fork 0
mirror of https://github.com/OpenVPN/openvpn.git synced 2026-07-16 04:13:47 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 4
openvpn/doc
History
Arne Schwabe ee119b24b3 Ensure we only get the session from valid tokens for external-auth 
This also improves is_auth_token to check for the correct length and
adds a few unit tests.

This fixes an assertion when a user would send auth token with the
right prefix but overall too short length.

Reported-By: Haiyang Huang <huanghaiyang83@gmail.com>
CVE: 2026-13122
Github: OpenVPN/openvpn-private-issues#118
Github: OpenVPN/openvpn-private-issues#128 (2.7+master)
Github: OpenVPN/openvpn-private-issues#141 (2.6)

Acked-by: MaxF <max@max-fillinger.net>
Acked-by: Gert Doering <gert@greenie.muc.de>

cherry picked from master commit. Adjusted for formatting
differences in 2.6 and kept spelling mistake (old_tsamp instead
of old_stamp) to keep avoid more changes.

Change-Id: I053cca5f42e3841cef8934c2114a8a159fbc0c29
2026-06-30 12:24:28 +02:00
..
doxygen doc: HTTPS upgrades and URL fixes throughout the tree 2025-10-13 17:41:41 +02:00
man-sections Ensure we only get the session from valid tokens for external-auth 2026-06-30 12:24:28 +02:00
tests Remove use of 'dh dh2048.pem' from sample configs, remove 'dh2048.pem' file 2025-08-20 23:11:53 +02:00
android.txt doc: HTTPS upgrades and URL fixes throughout the tree 2025-10-13 17:41:41 +02:00
CMakeLists.txt CMake: backport CMake buildsystem from master to release/2.6 2023-09-26 17:39:51 +02:00
gui-notes.txt Document common uses of 'echo' directive, re-enable logging for 'echo'. 2021-01-20 20:18:07 +01:00
interactive-service-notes.rst Add Interactive Service developer documentation 2018-06-09 20:14:26 +02:00
keying-material-exporter.txt doc: HTTPS upgrades and URL fixes throughout the tree 2025-10-13 17:41:41 +02:00
Makefile.am Update Copyright statements to 2024 2024-03-18 18:49:36 +01:00
management-notes.txt Make sending plain text control message session aware 2023-03-20 17:25:37 +01:00
openvpn-examples.5.rst Add detailed man page section to setup a OpenVPN setup with peer-fingerprint 2021-08-01 19:47:44 +02:00
openvpn.8.rst doc: Fix hyperlinks in openvpn(8) 2025-10-13 17:37:01 +02:00
README.man doc/man: convert openvpn.8 to split-up .rst files 2020-07-17 11:23:18 +02:00
README.plugins build: integrate plugins build into core build 2012-06-26 11:29:02 +02:00
tls-crypt-v2.txt Implement HMAC based session id for tls-crypt v2 2022-05-06 14:16:05 +02:00

README.plugins 

OpenVPN Plugins
---------------

Starting with OpenVPN 2.0-beta17, compiled plugin modules are
supported on any *nix OS which includes libdl or on Windows.
One or more modules may be loaded into OpenVPN using
the --plugin directive, and each plugin module is capable of
intercepting any of the script callbacks which OpenVPN supports:

(1) up
(2) down
(3) route-up
(4) ipchange
(5) tls-verify
(6) auth-user-pass-verify
(7) client-connect
(8) client-disconnect
(9) learn-address

See the openvpn-plugin.h file in the top-level directory of the
OpenVPN source distribution for more detailed information
on the plugin interface.

Included Plugins
----------------

auth-pam -- Authenticate using PAM and a split privilege
            execution model which functions even if
            root privileges or the execution environment
            have been altered with --user/--group/--chroot.
            Tested on Linux only.

down-root -- Enable the running of down scripts with root privileges
             even if --user/--group/--chroot have been used
             to drop root privileges or change the execution
             environment.  Not applicable on Windows.

examples -- A simple example that demonstrates a portable
            plugin, i.e. one which can be built for *nix
            or Windows from the same source.

Building Plugins
----------------

cd to the top-level directory of a plugin, and use the
"make" command to build it.  The examples plugin is
built using a build script, not a makefile.