mirror of
https://github.com/OpenVPN/openvpn.git
synced 2026-02-03 20:39:40 -05:00
OpenVPN
aab1f862f4
Additional context from PR on Github about changes in ssl_openssl.c around line 1900: This change addresses a subtle behavioral difference between AWS-LC and OpenSSL regarding object ownership semantics in SSL_CTX_set_client_CA_list(ctx->ctx, cert_names). OpenSSL Behavior: Stores a reference to the provided cert_names stack cert_names remains valid after SSL_CTX_set_client_CA_list AWS-LC Behavior: Creates a copy of the parameter cert_names (which is a stack of type X509_NAME) and converts it to a stack of CRYPTO_BUFFER (how we internally represent X509_NAME, it's an opaque byte string). Then frees the original passed in cert_names. After SSL_CTX_set_client_CA_list, cert_names no longer points to valid memory. The proposed changes reorder operations to getting the size of the stack before the set operation as opposed to after the set operation. No operations between the setter and stack size check modify cert_names. Therefore, the logical outcome should remain the same - and this would also handle the subtle behavioral difference in AWS-LC. Github: closes OpenVPN/openvpn#672 Signed-off-by: Shubham Mittal <smittals@amazon.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20250128220932.2113-1-smittals@amazon.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg30682.html Signed-off-by: Gert Doering <gert@greenie.muc.de> |
||
|---|---|---|
| .github | ||
| contrib | ||
| debug | ||
| dev-tools | ||
| distro | ||
| doc | ||
| include | ||
| m4 | ||
| sample | ||
| src | ||
| tests | ||
| .git-blame-ignore-revs | ||
| .gitattributes | ||
| .gitignore | ||
| .mailmap | ||
| .svncommitters | ||
| AUTHORS | ||
| ChangeLog | ||
| Changes.rst | ||
| CMakeLists.txt | ||
| CMakePresets.json | ||
| compat.m4 | ||
| config.h.cmake.in | ||
| configure.ac | ||
| CONTRIBUTING.rst | ||
| COPYING | ||
| COPYRIGHT.GPL | ||
| forked-test-driver | ||
| INSTALL | ||
| ltrc.inc | ||
| Makefile.am | ||
| NEWS | ||
| PORTS | ||
| README | ||
| README.awslc | ||
| README.cmake.md | ||
| README.dco.md | ||
| README.ec | ||
| README.mbedtls | ||
| README.wolfssl | ||
| renovate.json | ||
| version.m4 | ||
OpenVPN -- A Secure tunneling daemon Copyright (C) 2002-2022 OpenVPN Inc. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License version 2 as published by the Free Software Foundation. ************************************************************************* To get the latest release of OpenVPN, go to: https://openvpn.net/community-downloads/ To Build and Install, tar -zxf openvpn-<version>.tar.gz cd openvpn-<version> ./configure make make install or see the file INSTALL for more info. For information on how to build OpenVPN on/for Windows with MinGW or MSVC see README.cmake.md. ************************************************************************* For detailed information on OpenVPN, including examples, see the man page http://openvpn.net/man.html For a sample VPN configuration, see http://openvpn.net/howto.html To report an issue, see https://github.com/OpenVPN/openvpn/issues/new (Note: We recently switched to GitHub for reporting new issues, old issues can be found at: https://community.openvpn.net/openvpn/report) For a description of OpenVPN's underlying protocol, see the file ssl.h included in the source distribution. ************************************************************************* Other Files & Directories: * configure.ac -- script to rebuild our configure script and makefile. * sample/sample-scripts/verify-cn A sample perl script which can be used with OpenVPN's --tls-verify option to provide a customized authentication test on embedded X509 certificate fields. * sample/sample-keys/ Sample RSA keys and certificates. DON'T USE THESE FILES FOR ANYTHING OTHER THAN TESTING BECAUSE THEY ARE TOTALLY INSECURE. * sample/sample-config-files/ A collection of OpenVPN config files and scripts from the HOWTO at http://openvpn.net/howto.html ************************************************************************* Note that easy-rsa and tap-windows are now maintained in their own subprojects. Their source code is available here: https://github.com/OpenVPN/easy-rsa https://github.com/OpenVPN/tap-windows6 Community-provided Windows installers (MSI) and Debian packages are built from https://github.com/OpenVPN/openvpn-build See the INSTALL file for usage information.