diff options
| author | David Sommerseth | 2022-03-13 20:31:53 +0100 |
|---|---|---|
| committer | Gert Doering | 2022-03-15 17:51:48 +0100 |
| commit | 282ddbac54f8d4923844f69983b38dd2b813a00a (patch) | |
| tree | c26a1996a75bba6d61d9dd225b226e71f87c1eae /doc | |
| parent | d816207bc2fe1ee5a04c394b215d50123cb25aad (diff) | |
| download | openvpn-282ddbac54f8d4923844f69983b38dd2b813a00a.zip openvpn-282ddbac54f8d4923844f69983b38dd2b813a00a.tar.gz | |
plug-ins: Disallow multiple deferred authentication plug-ins
The plug-in API in OpenVPN 2.x is not designed for running multiple
deferred authentication processes in parallel. The authentication
results of such configurations are not to be trusted. For now we bail
out when this is discovered with an error in the log.
CVE: 2022-0547
Signed-off-by: David Sommerseth <davids@openvpn.net>
Acked-by: Antonio Quartulli <antonio@openvpn.net>
Message-Id: <20220313193154.9350-3-openvpn@sf.lists.topphemmelig.net>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23931.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/man-sections/plugin-options.rst | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/doc/man-sections/plugin-options.rst b/doc/man-sections/plugin-options.rst index 51c574f..9266429 100644 --- a/doc/man-sections/plugin-options.rst +++ b/doc/man-sections/plugin-options.rst @@ -55,3 +55,12 @@ plug-ins must be prebuilt and adhere to the OpenVPN Plug-In API. (such as tls-verify, auth-user-pass-verify, or client-connect), then every module and script must return success (:code:`0`) in order for the connection to be authenticated. + + **WARNING**: + Plug-ins may do deferred execution, meaning the plug-in will + return the control back to the main OpenVPN process and provide + the plug-in result later on via a different thread or process. + OpenVPN does **NOT** support multiple authentication plug-ins + **where more than one plugin** tries to do deferred authentication. + If this behaviour is detected, OpenVPN will shut down upon first + authentication. |