Skip to contentSkip to conversation

Always use default keysize for NCP'd ciphers

PATCH Superseded Steffan Karger 3 participants 4 messages Jul 1, 2017 – Aug 14, 2017 1 message not in the archive

lore
Share & tools
lore

A message that is not in the archive (sent off-list or not yet received): [email protected]...

Steffan Karger

author
#1 lore raw

PATCH 1/1 Always use default keysize for NCP'd ciphers

If a peer has set --keysize, and NCP negotiates a cipher with a different key size (e.g. --keysize 128 + AES-256-GCM), that peer will exit with a "invalid key size" error. To prevent that, always set keysize=0 for NCP'd ciphers.

Signed-off-by Steffan Karger <[email protected]...>
---
 src/openvpn/ssl.c | 1 +
 1 file changed, 1 insertion(+)
src/openvpn/ssl.c +1 -0
index f868457e..a8418d37 100644
@@ -1976,6 +1976,7 @@ tls_session_update_crypto_params(struct tls_session *session,
     {
         msg(D_HANDSHAKE, "Data Channel: using negotiated cipher '%s'",
             options->ciphername);
+        options->keysize = 0; /* Always use default key size for NCP */
     }
 
     init_key_type(&session->opt->key_type, options->ciphername,
Signature · 1 line
2.11.0
#2 lore raw
Quoted 15 lines · Steffan Karger

If a peer has set --keysize, and NCP negotiates a cipher with a different key size (e.g. --keysize 128 + AES-256-GCM), that peer will exit with a "invalid key size" error. To prevent that, always set keysize=0 for NCP'd ciphers.

Signed-off-by Steffan Karger <[email protected]...>
---
 src/openvpn/ssl.c | 1 +
 1 file changed, 1 insertion(+)
src/openvpn/ssl.c +0 -0
index f868457e..a8418d37 100644

src/openvpn/ssl.c tls_session_update_crypto_params(struct tls_session *session, · line 1979

Quoted 4 lines
src/openvpn/ssl.c +1 -0
@@ -1976,6 +1976,7 @@ tls_session_update_crypto_params(struct tls_session *session,
     {
         msg(D_HANDSHAKE, "Data Channel: using negotiated cipher '%s'",
             options->ciphername);
+        options->keysize = 0; /* Always use default key size for NCP */

How about printing a message to inform the user that if any keysize was set it is now getting cleared up?

Cheers,

Signature · 1 line
Antonio Quartulli
author
#3 lore raw

PATCH v2 1/1 Always use default keysize for NCP'd ciphers

If a peer has set --keysize, and NCP negotiates a cipher with a different key size (e.g. --keysize 128 + AES-256-GCM), that peer will exit with a "invalid key size" error. To prevent that, always set keysize=0 for NCP'd ciphers.

Signed-off-by Steffan Karger <[email protected]...>

---
v2 - print log message when we override the user-set keysize

 src/openvpn/ssl.c | 5 +++++
 1 file changed, 5 insertions(+)
src/openvpn/ssl.c +5 -0
index b1c26b3..8440f27 100644
@@ -1976,6 +1976,11 @@ tls_session_update_crypto_params(struct tls_session *session,
     {
         msg(D_HANDSHAKE, "Data Channel: using negotiated cipher '%s'",
             options->ciphername);
+        if (options->keysize)
+        {
+            msg(D_HANDSHAKE, "NCP: overriding user-set keysize with default");
+            options->keysize = 0;
+        }
     }
 
     init_key_type(&session->opt->key_type, options->ciphername,
Signature · 1 line
2.7.4
#4 lore raw

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

ACK. Checked code and ran a few quick local tests where it was observed that --keysize was reset to 0 when NCP was active.

Your patch has been applied to the following branches

commit 956bb1c32fa40ee184919b3ce569c90643a01b5b (master) commit 6f616aa6b7570db965b8eee1d8b8d182af4bb05f (release/2.4)

Author: Steffan Karger
Date:   Thu Jul 20 19:55:57 2017 +0200
     Always use default keysize for NCP'd ciphers

     Signed-off-by: Steffan Karger <[email protected]...>
     Acked-by: David Sommerseth <[email protected]...>
     Message-Id: <[email protected]...>
     URL: https://www.mail-archive.com/[email protected]/msg15110.html
     Signed-off-by: David Sommerseth <[email protected]...>

- --
kind regards,

David Sommerseth

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)

iQIcBAEBCgAGBQJZkaszAAoJEIbPlEyWcf3yRloP/0fYFXg2FbBw1wC7kr45K9DK aOWseSiHZy20TcrPxUJySy8prN6LopyDf1HNsWkPmOWA7duZwZLio1n4Hmh393ew ooXHH/iNkp4CWWppAf7Z+nzN0Wn1pH2yHchbtZoT+rLqLQP5Rgt1y94yb6gx1FC5 JfBw99weWvVfvrvFDXdJlrnDJYoJtoyfd6Z+gJL2n+DBkoHPTaxN6yU28raIzksC gvs2j98WAThiIfTMbstDiR2Qxz7/puIR0xDZkzQkgLnq8jV5uoH4jvnHJFbQO3Wa cPuBHQguTsKe/q2si9y0qhLQ8zURdVy+yTOgzPDHueVuRJs7deeXbDClf1Wfn+dd RPdH4DQoCjsjDZ+AFyPCEn1hora1ulFpnVE97pWnFUIlTeRVIJ9P4r9/z4iABGmp TVfvapucdED0VKxeYqyZYlEXHK3Vxg7eruS9f2X7gPwTYJbQ8DvKqigZIuBjMEcE tGkzt4A3XNSbtHHcgdssI2WVInhRPQG1Y0YFSxPNLw5SYlkY2zlUlVCHROoOZfBT AilgH3kygPgymf+k+OLxVCCm8HL8TC8DD/YxczV8i6kKkvMbIQfR+wM1i592eKSQ Ryi4md7F+FJUfnDUB0JT07FK95jFF7ANStq+vhj9TyzyV3v6ktQVF3t+pgv6djyF YLY70Eu/WV15iXBZnddU
=582X
-----END PGP SIGNATURE-----