Fix assertion error when using --cipher none

PATCH In review Steffan Karger 3 participants 4 messages Nov 6, 2014 – Nov 8, 2014

Share & tools

Steffan Karger

author

2014-11-06 22:26 UTC #0 lore raw

PATCH 1/1 Fix assertion error when using --cipher none

Some commits ago, the cipher mode checks were cleaned up to remove code duplication (and fix the issue in #471), but broke '--cipher none' (reported in #473). This commit fixes that.

Signed-off-by Steffan Karger <[email protected]...>

---
 src/openvpn/crypto_backend.h  | 8 ++++----
 src/openvpn/crypto_openssl.c  | 4 ++--
 src/openvpn/crypto_polarssl.c | 4 ++--
 3 files changed, 8 insertions(+), 8 deletions(-)

src/openvpn/crypto_backend.h +4 -4

index bc067a7..57830c2 100644
@@ -223,17 +223,17 @@ int cipher_kt_block_size (const cipher_kt_t *cipher_kt);
 /**
  * Returns the mode that the cipher runs in.
  *
- * @param cipher_kt 	Static cipher parameters
+ * @param cipher	Static cipher parameters. May not be NULL.
  *
  * @return 		Cipher mode, either \c OPENVPN_MODE_CBC, \c
  * 			OPENVPN_MODE_OFB or \c OPENVPN_MODE_CFB
  */
-int cipher_kt_mode (const cipher_kt_t *cipher_kt);
+int cipher_kt_mode (const cipher_kt_t *cipher);
 
 /**
  * Check if the supplied cipher is a supported CBC mode cipher.
  *
- * @param cipher	Static cipher parameters. May not be NULL.
+ * @param cipher	Static cipher parameters.
  *
  * @return		true iff the cipher is a CBC mode cipher.
  */

@@ -243,7 +243,7 @@ bool cipher_kt_mode_cbc(const cipher_kt_t *cipher)
 /**
  * Check if the supplied cipher is a supported OFB or CFB mode cipher.
  *
- * @param cipher	Static cipher parameters. May not be NULL.
+ * @param cipher	Static cipher parameters.
  *
  * @return		true iff the cipher is a OFB or CFB mode cipher.
  */

src/openvpn/crypto_openssl.c +2 -2

index cc00a7d..9d5fe7c 100644
@@ -519,7 +519,7 @@ cipher_kt_mode (const EVP_CIPHER *cipher_kt)
 bool
 cipher_kt_mode_cbc(const cipher_kt_t *cipher)
 {
-  return cipher_kt_mode(cipher) == OPENVPN_MODE_CBC
+  return cipher && cipher_kt_mode(cipher) == OPENVPN_MODE_CBC
 #ifdef EVP_CIPH_FLAG_AEAD_CIPHER
       /* Exclude AEAD cipher modes, they require a different API */
       && !(EVP_CIPHER_flags(cipher) & EVP_CIPH_FLAG_AEAD_CIPHER)

@@ -530,7 +530,7 @@ cipher_kt_mode_cbc(const cipher_kt_t *cipher)
 bool
 cipher_kt_mode_ofb_cfb(const cipher_kt_t *cipher)
 {
-  return (cipher_kt_mode(cipher) == OPENVPN_MODE_OFB ||
+  return cipher && (cipher_kt_mode(cipher) == OPENVPN_MODE_OFB ||
 	  cipher_kt_mode(cipher) == OPENVPN_MODE_CFB)
 #ifdef EVP_CIPH_FLAG_AEAD_CIPHER
       /* Exclude AEAD cipher modes, they require a different API */

src/openvpn/crypto_polarssl.c +2 -2

index 68e350d..c038f8e 100644
@@ -447,13 +447,13 @@ cipher_kt_mode (const cipher_info_t *cipher_kt)
 bool
 cipher_kt_mode_cbc(const cipher_kt_t *cipher)
 {
-  return cipher_kt_mode(cipher) == OPENVPN_MODE_CBC;
+  return cipher && cipher_kt_mode(cipher) == OPENVPN_MODE_CBC;
 }
 
 bool
 cipher_kt_mode_ofb_cfb(const cipher_kt_t *cipher)
 {
-  return (cipher_kt_mode(cipher) == OPENVPN_MODE_OFB ||
+  return cipher && (cipher_kt_mode(cipher) == OPENVPN_MODE_OFB ||
 	  cipher_kt_mode(cipher) == OPENVPN_MODE_CFB);
 }

Signature · 1 line

1.9.1

Steffan Karger

author

2014-11-08 10:15 UTC #1 lore raw

Quoted 3 lines · Steffan Karger

Some commits ago, the cipher mode checks were cleaned up to remove code duplication (and fix the issue in #471), but broke '--cipher none' (reported in #473). This commit fixes that.

Attached a v2 of this patch that removes the (inconsistent) renaming of the cipher_kt_mode() parameter. Otherwise this patch is the same.

-Steffan

From 1fed00bc54bb9b774bdd7d522a80d0ec83effdfd Mon Sep 17 00:00:00 2001
From: Steffan Karger <[email protected]...>
Date: Sat, 8 Nov 2014 11:03:52 +0100
Subject: [PATCH] Fix assertion error when using --cipher none

Some commits ago, the cipher mode checks were cleaned up to remove code duplication (and fix the issue in #471), but broke '--cipher none' (reported in #473). This commit fixes that.

Signed-off-by Steffan Karger <[email protected]...>

---
 src/openvpn/crypto_backend.h  | 6 +++---
 src/openvpn/crypto_openssl.c  | 4 ++--
 src/openvpn/crypto_polarssl.c | 4 ++--
 3 files changed, 7 insertions(+), 7 deletions(-)

src/openvpn/crypto_backend.h +3 -3

index bc067a7..8749878 100644
@@ -223,7 +223,7 @@ int cipher_kt_block_size (const cipher_kt_t *cipher_kt);
 /**
  * Returns the mode that the cipher runs in.
  *
- * @param cipher_kt 	Static cipher parameters
+ * @param cipher_kt	Static cipher parameters. May not be NULL.
  *
  * @return 		Cipher mode, either \c OPENVPN_MODE_CBC, \c
  * 			OPENVPN_MODE_OFB or \c OPENVPN_MODE_CFB

@@ -233,7 +233,7 @@ int cipher_kt_mode (const cipher_kt_t *cipher_kt);
 /**
  * Check if the supplied cipher is a supported CBC mode cipher.
  *
- * @param cipher	Static cipher parameters. May not be NULL.
+ * @param cipher	Static cipher parameters.
  *
  * @return		true iff the cipher is a CBC mode cipher.
  */

@@ -243,7 +243,7 @@ bool cipher_kt_mode_cbc(const cipher_kt_t *cipher)
 /**
  * Check if the supplied cipher is a supported OFB or CFB mode cipher.
  *
- * @param cipher	Static cipher parameters. May not be NULL.
+ * @param cipher	Static cipher parameters.
  *
  * @return		true iff the cipher is a OFB or CFB mode cipher.
  */

src/openvpn/crypto_openssl.c +2 -2

index cc00a7d..9d5fe7c 100644
@@ -519,7 +519,7 @@ cipher_kt_mode (const EVP_CIPHER *cipher_kt)
 bool
 cipher_kt_mode_cbc(const cipher_kt_t *cipher)
 {
-  return cipher_kt_mode(cipher) == OPENVPN_MODE_CBC
+  return cipher && cipher_kt_mode(cipher) == OPENVPN_MODE_CBC
 #ifdef EVP_CIPH_FLAG_AEAD_CIPHER
       /* Exclude AEAD cipher modes, they require a different API */
       && !(EVP_CIPHER_flags(cipher) & EVP_CIPH_FLAG_AEAD_CIPHER)

@@ -530,7 +530,7 @@ cipher_kt_mode_cbc(const cipher_kt_t *cipher)
 bool
 cipher_kt_mode_ofb_cfb(const cipher_kt_t *cipher)
 {
-  return (cipher_kt_mode(cipher) == OPENVPN_MODE_OFB ||
+  return cipher && (cipher_kt_mode(cipher) == OPENVPN_MODE_OFB ||
 	  cipher_kt_mode(cipher) == OPENVPN_MODE_CFB)
 #ifdef EVP_CIPH_FLAG_AEAD_CIPHER
       /* Exclude AEAD cipher modes, they require a different API */

src/openvpn/crypto_polarssl.c +2 -2

index 68e350d..c038f8e 100644
@@ -447,13 +447,13 @@ cipher_kt_mode (const cipher_info_t *cipher_kt)
 bool
 cipher_kt_mode_cbc(const cipher_kt_t *cipher)
 {
-  return cipher_kt_mode(cipher) == OPENVPN_MODE_CBC;
+  return cipher && cipher_kt_mode(cipher) == OPENVPN_MODE_CBC;
 }
 
 bool
 cipher_kt_mode_ofb_cfb(const cipher_kt_t *cipher)
 {
-  return (cipher_kt_mode(cipher) == OPENVPN_MODE_OFB ||
+  return cipher && (cipher_kt_mode(cipher) == OPENVPN_MODE_OFB ||
 	  cipher_kt_mode(cipher) == OPENVPN_MODE_CFB);
 }

Signature · 1 line

1.9.1

Arne Schwabe

2014-11-08 14:22 UTC #2 lore raw

Quoted 8 lines · Steffan Karger

Quoted 3 lines · Steffan Karger
Some commits ago, the cipher mode checks were cleaned up to remove code duplication (and fix the issue in #471), but broke '--cipher none' (reported in #473). This commit fixes that.
Attached a v2 of this patch that removes the (inconsistent) renaming of the cipher_kt_mode() parameter. Otherwise this patch is the same.

ACK

Arne

Gert Doering

2014-11-08 17:31 UTC #3 lore raw

In reply to Steffan Karger

Your patch has been applied to the master and release/2.3 branches.

commit 4e93e6dc88f4d904a4f2eb90140472a8d8fd68d0 (master) commit 44294568a113a7c54ce7fca86b4014c9d1168888 (release/2.3)

Author: Steffan Karger
Date:   Sat Nov 8 11:15:08 2014 +0100

     Fix assertion error when using --cipher none

     Signed-off-by: Steffan Karger <[email protected]...>
     Acked-by: Arne Schwabe <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/9217
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering