forked from pool/openvpn
774c998664
- Update to 2.4.3 (bsc#1045489)
- Ignore auth-nocache for auth-user-pass if auth-token is pushed
- crypto: Enable SHA256 fingerprint checking in --verify-hash
- copyright: Update GPLv2 license texts
- auth-token with auth-nocache fix broke --disable-crypto builds
- OpenSSL: don't use direct access to the internal of X509
- OpenSSL: don't use direct access to the internal of EVP_PKEY
- OpenSSL: don't use direct access to the internal of RSA
- OpenSSL: don't use direct access to the internal of DSA
- OpenSSL: force meth->name as non-const when we free() it
- OpenSSL: don't use direct access to the internal of EVP_MD_CTX
- OpenSSL: don't use direct access to the internal of EVP_CIPHER_CTX
- OpenSSL: don't use direct access to the internal of HMAC_CTX
- Fix NCP behaviour on TLS reconnect.
- Remove erroneous limitation on max number of args for --plugin
- Fix edge case with clients failing to set up cipher on empty PUSH_REPLY.
- Fix potential 1-byte overread in TCP option parsing.
- Fix remotely-triggerable ASSERT() on malformed IPv6 packet.
- Preparing for release v2.4.3 (ChangeLog, version.m4, Changes.rst)
- refactor my_strupr
- Fix 2 memory leaks in proxy authentication routine
- Fix memory leak in add_option() for option 'connection'
- Ensure option array p[] is always NULL-terminated
- Fix a null-pointer dereference in establish_http_proxy_passthru()
- Prevent two kinds of stack buffer OOB reads and a crash for invalid input data
- Fix an unaligned access on OpenBSD/sparc64
- Missing include for socket-flags TCP_NODELAY on OpenBSD
- Make openvpn-plugin.h self-contained again.
- Pass correct buffer size to GetModuleFileNameW()
- Log the negotiated (NCP) cipher
OBS-URL: https://build.opensuse.org/request/show/505857
OBS-URL: https://build.opensuse.org/package/show/network:vpn/openvpn?expand=0&rev=124
113 lines
4.0 KiB
Diff
113 lines
4.0 KiB
Diff
From a33c0d811ad976561e5cb5bfc8431c1a286e796b Mon Sep 17 00:00:00 2001
|
|
From: Nirmoy Das <ndas@suse.de>
|
|
Date: Fri, 23 Jun 2017 11:00:08 +0200
|
|
Subject: [PATCH] fips-140
|
|
|
|
Signed-off-by: Nirmoy Das <ndas@suse.de>
|
|
---
|
|
src/openvpn/crypto.c | 2 +-
|
|
src/openvpn/crypto_backend.h | 3 ++-
|
|
src/openvpn/crypto_openssl.c | 6 +++++-
|
|
src/openvpn/ntlm.c | 2 +-
|
|
src/openvpn/options.c | 4 ++++
|
|
src/openvpn/ssl.c | 4 ++--
|
|
6 files changed, 15 insertions(+), 6 deletions(-)
|
|
|
|
diff --git a/src/openvpn/crypto.c b/src/openvpn/crypto.c
|
|
index 5f482d0..ff0f9a7 100644
|
|
--- a/src/openvpn/crypto.c
|
|
+++ b/src/openvpn/crypto.c
|
|
@@ -876,7 +876,7 @@ init_key_ctx(struct key_ctx *ctx, struct key *key,
|
|
if (kt->digest && kt->hmac_length > 0)
|
|
{
|
|
ctx->hmac = hmac_ctx_new();
|
|
- hmac_ctx_init(ctx->hmac, key->hmac, kt->hmac_length, kt->digest);
|
|
+ hmac_ctx_init(ctx->hmac, key->hmac, kt->hmac_length, kt->digest, 0);
|
|
|
|
msg(D_HANDSHAKE,
|
|
"%s: Using %d bit message hash '%s' for HMAC authentication",
|
|
diff --git a/src/openvpn/crypto_backend.h b/src/openvpn/crypto_backend.h
|
|
index b7f519b..2911248 100644
|
|
--- a/src/openvpn/crypto_backend.h
|
|
+++ b/src/openvpn/crypto_backend.h
|
|
@@ -604,10 +604,11 @@ void hmac_ctx_free(hmac_ctx_t *ctx);
|
|
* @param key The key to use for the HMAC
|
|
* @param key_len The key length to use
|
|
* @param kt Static message digest parameters
|
|
+ * @param prf_use Intended use for PRF in TLS protocol
|
|
*
|
|
*/
|
|
void hmac_ctx_init(hmac_ctx_t *ctx, const uint8_t *key, int key_length,
|
|
- const md_kt_t *kt);
|
|
+ const md_kt_t *kt, bool prf_use);
|
|
|
|
/*
|
|
* Free the given HMAC context.
|
|
diff --git a/src/openvpn/crypto_openssl.c b/src/openvpn/crypto_openssl.c
|
|
index a55e65c..79f5530 100644
|
|
--- a/src/openvpn/crypto_openssl.c
|
|
+++ b/src/openvpn/crypto_openssl.c
|
|
@@ -926,11 +926,15 @@ hmac_ctx_free(HMAC_CTX *ctx)
|
|
|
|
void
|
|
hmac_ctx_init(HMAC_CTX *ctx, const uint8_t *key, int key_len,
|
|
- const EVP_MD *kt)
|
|
+ const EVP_MD *kt, bool prf_use)
|
|
{
|
|
ASSERT(NULL != kt && NULL != ctx);
|
|
|
|
HMAC_CTX_init(ctx);
|
|
+ /* FIPS 140-2 explicitly allows MD5 for the use in PRF although it is not
|
|
+ * * to be used anywhere else */
|
|
+ if(kt == EVP_md5() && prf_use)
|
|
+ HMAC_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
|
|
HMAC_Init_ex(ctx, key, key_len, kt, NULL);
|
|
|
|
/* make sure we used a big enough key */
|
|
diff --git a/src/openvpn/ntlm.c b/src/openvpn/ntlm.c
|
|
index 0b1163e..93283bc 100644
|
|
--- a/src/openvpn/ntlm.c
|
|
+++ b/src/openvpn/ntlm.c
|
|
@@ -87,7 +87,7 @@ gen_hmac_md5(const char *data, int data_len, const char *key, int key_len,char *
|
|
const md_kt_t *md5_kt = md_kt_get("MD5");
|
|
hmac_ctx_t *hmac_ctx = hmac_ctx_new();
|
|
|
|
- hmac_ctx_init(hmac_ctx, key, key_len, md5_kt);
|
|
+ hmac_ctx_init(hmac_ctx, key, key_len, md5_kt, 0);
|
|
hmac_ctx_update(hmac_ctx, (const unsigned char *)data, data_len);
|
|
hmac_ctx_final(hmac_ctx, (unsigned char *)result);
|
|
hmac_ctx_cleanup(hmac_ctx);
|
|
diff --git a/src/openvpn/options.c b/src/openvpn/options.c
|
|
index fef5e90..33b6976 100644
|
|
--- a/src/openvpn/options.c
|
|
+++ b/src/openvpn/options.c
|
|
@@ -850,6 +850,10 @@ init_options(struct options *o, const bool init_gc)
|
|
#endif
|
|
#ifdef ENABLE_CRYPTO
|
|
o->ciphername = "BF-CBC";
|
|
+#ifdef OPENSSL_FIPS
|
|
+ if(FIPS_mode())
|
|
+ o->ciphername = "AES-256-CBC";
|
|
+#endif
|
|
#ifdef HAVE_AEAD_CIPHER_MODES /* IV_NCP=2 requires GCM support */
|
|
o->ncp_enabled = true;
|
|
#else
|
|
diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c
|
|
index 15cd94a..21f50f1 100644
|
|
--- a/src/openvpn/ssl.c
|
|
+++ b/src/openvpn/ssl.c
|
|
@@ -1635,8 +1635,8 @@ tls1_P_hash(const md_kt_t *md_kt,
|
|
chunk = md_kt_size(md_kt);
|
|
A1_len = md_kt_size(md_kt);
|
|
|
|
- hmac_ctx_init(ctx, sec, sec_len, md_kt);
|
|
- hmac_ctx_init(ctx_tmp, sec, sec_len, md_kt);
|
|
+ hmac_ctx_init(ctx, sec, sec_len, md_kt, 1);
|
|
+ hmac_ctx_init(ctx_tmp, sec, sec_len, md_kt, 1);
|
|
|
|
hmac_ctx_update(ctx,seed,seed_len);
|
|
hmac_ctx_final(ctx, A1);
|
|
--
|
|
2.13.1
|
|
|