Make --cipher/--auth none more explicit on the risks

PATCH In review David Sommerseth 4 participants 5 messages Apr 10, 2017 – Apr 11, 2017

Share & tools

David Sommerseth

author

2017-04-10 22:28 UTC #0 lore raw

PATCH 1/1 Make --cipher/--auth none more explicit on the risks

The warning provided to --cipher and --auth using the 'none' setting may not have been too clearly understandable to non-developers or people not fully understanding encryption and cryptography. This tries to improve that.

While at it, also break up the long source lines.

Signed-off-by David Sommerseth <[email protected]...>

---
 src/openvpn/crypto.c | 11 +++++++++--
 src/openvpn/init.c   |  5 ++++-
 2 files changed, 13 insertions(+), 3 deletions(-)

src/openvpn/crypto.c +9 -2

index 909f725..8a5c723 100644
@@ -784,7 +784,10 @@ init_key_type(struct key_type *kt, const char *ciphername,
     {
         if (warn)
         {
-            msg(M_WARN, "******* WARNING *******: null cipher specified, no encryption will be used");
+            msg(M_WARN, "******* WARNING *******: '--cipher none' was specified. "
+                "This means NO encryption will be performed and tunnelled "
+                "data WILL be transmitted in clear text over the network! "
+                "PLEASE DO RECONIDER THIS SETTING!");
         }
     }
     if (strcmp(authname, "none") != 0)

@@ -804,7 +807,11 @@ init_key_type(struct key_type *kt, const char *ciphername,
     {
         if (warn)
         {
-            msg(M_WARN, "******* WARNING *******: null MAC specified, no authentication will be used");
+            msg(M_WARN, "******* WARNING *******: '--auth none' was specified. "
+                "This means no authentication will be performed on received "
+                "packets, meaning you CANNOT trust that the data received by "
+                "the remote side have NOT been manipulated. "
+                "PLEASE DO RECONIDER THIS SETTING!");
         }
     }
 }

src/openvpn/init.c +4 -1

index 0b74f25..86882fe 100644
@@ -2745,7 +2745,10 @@ do_init_crypto_none(const struct context *c)
 {
     ASSERT(!c->options.test_crypto);
     msg(M_WARN,
-        "******* WARNING *******: all encryption and authentication features disabled -- all data will be tunnelled as cleartext");
+        "******* WARNING *******: All encryption and authentication features "
+        "disabled -- All data will be tunnelled as clear text and will not be "
+        "protected against man-in-the-middle changes. "
+        "PLEASE DO RECONIDER THIS CONFIGURATION!");
 }
 #endif /* ifdef ENABLE_CRYPTO */

Signature · 1 line

2.11.0

Simon Matter

2017-04-11 04:26 UTC #1 lore raw

Quoted 25 lines

The warning provided to --cipher and --auth using the 'none' setting may not have been too clearly understandable to non-developers or people not fully understanding encryption and cryptography. This tries to improve that.
While at it, also break up the long source lines.
Signed-off-by David Sommerseth <[email protected]...>
---
 src/openvpn/crypto.c | 11 +++++++++--
 src/openvpn/init.c   |  5 ++++-
 2 files changed, 13 insertions(+), 3 deletions(-)
src/openvpn/crypto.c +1 -1
index 909f725..8a5c723 100644
@@ -784,7 +784,10 @@ init_key_type(struct key_type *kt, const char
 *ciphername,
     {
         if (warn)
         {
-            msg(M_WARN, "******* WARNING *******: null cipher specified,
 no encryption will be used");
+            msg(M_WARN, "******* WARNING *******: '--cipher none' was

Quoted 6 lines

specified. "
+ "This means NO encryption will be performed and tunnelled
"
+ "data WILL be transmitted in clear text over the network!
"
+ "PLEASE DO RECONIDER THIS SETTING!");

Small typos, you may want to 's/RECONIDER/RECONSIDER/g' the patches.

Regards,
Simon

David Sommerseth

2017-04-11 08:55 UTC #2 lore raw

Quoted 34 lines · Simon Matter

Quoted 25 lines
The warning provided to --cipher and --auth using the 'none' setting may not have been too clearly understandable to non-developers or people not fully understanding encryption and cryptography. This tries to improve that.
While at it, also break up the long source lines.
Signed-off-by David Sommerseth <[email protected]...>
---
 src/openvpn/crypto.c | 11 +++++++++--
 src/openvpn/init.c   |  5 ++++-
 2 files changed, 13 insertions(+), 3 deletions(-)
src/openvpn/crypto.c +1 -1
index 909f725..8a5c723 100644
@@ -784,7 +784,10 @@ init_key_type(struct key_type *kt, const char
 *ciphername,
     {
         if (warn)
         {
-            msg(M_WARN, "******* WARNING *******: null cipher specified,
 no encryption will be used");
+            msg(M_WARN, "******* WARNING *******: '--cipher none' was
Quoted 6 lines
specified. "
+ "This means NO encryption will be performed and tunnelled
"
+ "data WILL be transmitted in clear text over the network!
"
+ "PLEASE DO RECONIDER THIS SETTING!");
Hi

Quoted 1 line

Small typos, you may want to 's/RECONIDER/RECONSIDER/g' the patches.

Meh, yeah, sorry about that. That need to be fixed, but also something I can fix on-the-fly at commit time; that's an uncritical last minute change. Just need an ACK first ;-)

Signature · 4 lines

kind regards,

David Sommerseth
OpenVPN Technologies, Inc

Steffan Karger

2017-04-11 11:30 UTC #3 lore raw

Quoted 35 lines · David Sommerseth

Quoted 34 lines · Simon Matter
Quoted 25 lines
The warning provided to --cipher and --auth using the 'none' setting may not have been too clearly understandable to non-developers or people not fully understanding encryption and cryptography. This tries to improve that.
While at it, also break up the long source lines.
Signed-off-by David Sommerseth <[email protected]...>
---
 src/openvpn/crypto.c | 11 +++++++++--
 src/openvpn/init.c   |  5 ++++-
 2 files changed, 13 insertions(+), 3 deletions(-)
src/openvpn/crypto.c +1 -1
index 909f725..8a5c723 100644
@@ -784,7 +784,10 @@ init_key_type(struct key_type *kt, const char
 *ciphername,
     {
         if (warn)
         {
-            msg(M_WARN, "******* WARNING *******: null cipher specified,
 no encryption will be used");
+            msg(M_WARN, "******* WARNING *******: '--cipher none' was
Quoted 6 lines
specified. "
+ "This means NO encryption will be performed and tunnelled
"
+ "data WILL be transmitted in clear text over the network!
"
+ "PLEASE DO RECONIDER THIS SETTING!");
Hi

Quoted 5 lines

Quoted 1 line
Small typos, you may want to 's/RECONIDER/RECONSIDER/g' the patches.
Meh, yeah, sorry about that. That need to be fixed, but also something I can fix on-the-fly at commit time; that's an uncritical last minute change. Just need an ACK first ;-)

ACK if you fix the typos :)

-Steffan

David Sommerseth

author

2017-04-11 14:59 UTC #4 lore raw

In reply to David Sommerseth

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Just a commit time correction added, fixing wrong spelling of RECONSIDER.

Patch has been applied to the following branches

commit 7a1b6a0dd706a81897457b0456a951c0b30bbcfb  (master)
commit 1935729fe6d6badd978e9dfdd3402857b3d000a0  (release/2.4)
commit 32b5cb60e354f486c98408e6870af3a9c03ff865  (release/2.3)

Author: David Sommerseth
Date:   Tue Apr 11 00:28:28 2017 +0200

     Make --cipher/--auth none more explicit on the risks

     Signed-off-by: David Sommerseth <[email protected]...>
     Acked-by: Steffan Karger <[email protected]...>
     Message-Id: <[email protected]...>
     URL: https://www.mail-archive.com/[email protected]/msg14436.html
     Signed-off-by: David Sommerseth <[email protected]...>

- --
kind regards,

David Sommerseth

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)

iQIcBAEBCAAGBQJY7O9WAAoJEIbPlEyWcf3yQ08P/3/bWCmGRHPXMwMDdcs4mmyf Hna9ObtuAMqT4wYUAIGAXpzmpaVJtxteIGV7ahWLZVxiYrjeKSHrICRhZJOQ7ji6 RKbmPlZ9VeICUwY59d/I37q6d69gCsFpz9D8KSb4XyklJ+/UUILvEimbJAvFpu8C +l0mFOinQxPkRJMKvU54Ry+yrgHRBvEPUI8X3ni8g97ZRVu1VQe81Kfc5y94WB6v RGQ/9YS4jeE0LgMI7PinMdD5esfcJQ9opTZaiXtApxz+YLTTyLFSrCiTX/gE3xUb vUCcTxfM8iPAYqCVWiX/ep7Z+npPugmzpDWq+gbxPvGPtbCluuw3lXdzT3Wq6EJw wfFT2GFoY4CtK7ynEt6ibjDuBzeSBXyqOHd0wlpU272H99P4li8DtBn6N6XzBCr8 zfxPt00AUgo+eSYSVFdF3dZqjTFSWEO2SlS+L6zAekJOCSibIRFYU/BFC67hpvoO 50Qp66EK1PDtcW3oMQBwUfV2TcFDrflBL99nk34P2+YyIiscvj2DoaT+PTkwNLz7 Opy+16q7TIg2VhRgqi5gx03Ji0k/nAF01qjJOyyqBLFK7SKD85zCCIsV9TZMK09f TqPsQwtLeb/pNaZYIE2SVnExgYOpAJxLkPwkN93v7WvzBvFsCWxRbJjiN8Zjvu0G j47g3fFaHNuN4UYWYmT7
=C6Nl
-----END PGP SIGNATURE-----