Merge ~j-latten/ubuntu/+source/openvpn:xenial-openvpn-fips-crash-1807439 into ubuntu/+source/openvpn:ubuntu/xenial-devel

[Joy Latten]

openvpn segfaults when linked with fips-mode openssl because of MD5 algo.

openvpn version 2.3.x uses MD5 for (1). hashing its internal state and (2) tls connection TLS PRF(pseudorandom function).

FIPS 140-2 does not permit MD5 except for PRF. fips mode openssl checks a flag value to permit this.

Upstream, openvpn 2.4.x internal hash algo was changed to SHA256, thus fixing (1) in 2.4.x. Thus this fix for version 2.3.x changes algo to SHA256.

For (2), openvpn needs to set a context flag-value that FIPS-mode libcrypto.so checks to indicate permit MD5. FIPS-mode libcrypto.so will grant the request instead of entering an error state. In non-FIPS libcrypto.so this check does not exist since it always permits MD5. However, the particular flag value is defined in both fips and non-fips openssl code.

Note: Upstream has not fixed (2).

[Seth Arnold (seth-arnold)]

Looks good to me, thanks.

review: Approve

[Andreas Hasenack (ahasenack)]

Thanks, sponsoring.

[Andreas Hasenack (ahasenack)]

Tagged and uploaded.

[Andreas Hasenack (ahasenack)]

and my +1

review: Approve

diff --git a/debian/changelog b/debian/changelog
index 0bfc355..5ae9970 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+openvpn (2.3.10-1ubuntu2.2) xenial; urgency=medium
+
+  * d/p/openvpn-fips140-2.3.2.patch: Replace MD5 internal hash
+    with SHA256 and allow MD5 for PRF. (LP: #1807439)
+
+ -- Joy Latten <[e-mail]>  Wed, 09 Jan 2019 16:31:45 -0600
+
 openvpn (2.3.10-1ubuntu2.1) xenial-security; urgency=medium
 
   * SECURITY UPDATE: birthday attack when using 64-bit block cipher
diff --git a/debian/patches/openvpn-fips140-2.3.2.patch b/debian/patches/openvpn-fips140-2.3.2.patch
new file mode 100644
index 0000000..c40484d
--- /dev/null
+++ b/debian/patches/openvpn-fips140-2.3.2.patch
@@ -0,0 +1,343 @@
+Description: Use FIPS algos in openvpn
+ OpenVPN sends openssl requests to perform MD5 hash for (1) internal
+ configuration status verification and (2) TLS PRF. FIPS 140-2 does
+ not allow MD5 except for PRF. OpenVPN needs to use SHA for internal
+ verification and send EVP_MD_CTX_FLAG_NON_FIPS_ALLOW flag to
+ indicate PRF exception.
+ Upstream has changed internal hash to SHA256 in more recent
+ versions, but has delayed additional FIPS improvements.
+Bug: https://community.openvpn.net/openvpn/ticket/725
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1807439
+Author: Stephan Mueller <[e-mail]>
+
+diff --git a/src/openvpn/crypto.c b/src/openvpn/crypto.c
+index 7d9736b..f89b9aa 100644
+--- a/src/openvpn/crypto.c
++++ b/src/openvpn/crypto.c
+@@ -506,7 +506,7 @@ init_key_ctx (struct key_ctx *ctx, struct key *key,
+   if (kt->digest && kt->hmac_length > 0)
+     {
+       ALLOC_OBJ(ctx->hmac, hmac_ctx_t);
+-      hmac_ctx_init (ctx->hmac, key->hmac, kt->hmac_length, kt->digest);
++      hmac_ctx_init (ctx->hmac, key->hmac, kt->hmac_length, kt->digest, 0);
+ 
+       msg (D_HANDSHAKE,
+       "%s: Using %d bit message hash '%s' for HMAC authentication",
+@@ -1422,61 +1422,62 @@ free_ssl_lib (void)
+ #endif /* ENABLE_SSL */
+ 
+ /*
+- * md5 functions
++ * sha256 functions
+  */
+ 
+ const char *
+-md5sum (uint8_t *buf, int len, int n_print_chars, struct gc_arena *gc)
++sha256sum (uint8_t *buf, int len, int n_print_chars, struct gc_arena *gc)
+ {
+-  uint8_t digest[MD5_DIGEST_LENGTH];
+-  const md_kt_t *md5_kt = md_kt_get("MD5");
++  uint8_t digest[SHA256_DIGEST_LENGTH];
++  const md_kt_t *sha256_kt = md_kt_get("SHA256");
+ 
+-  md_full(md5_kt, buf, len, digest);
++  md_full(sha256_kt, buf, len, digest);
+ 
+-  return format_hex (digest, MD5_DIGEST_LENGTH, n_print_chars, gc);
++  return format_hex (digest, SHA256_DIGEST_LENGTH, n_print_chars, gc);
+ }
+ 
+ void
+-md5_state_init (struct md5_state *s)
++sha256_state_init (struct sha256_state *s)
+ {
+-  const md_kt_t *md5_kt = md_kt_get("MD5");
++  const md_kt_t *sha256_kt = md_kt_get("SHA256");
+ 
+-  md_ctx_init(&s->ctx, md5_kt);
++  md_ctx_init(&s->ctx, sha256_kt);
+ }
+ 
+ void
+-md5_state_update (struct md5_state *s, void *data, size_t len)
++sha256_state_update (struct sha256_state *s, void *data, size_t len)
+ {
+   md_ctx_update(&s->ctx, data, len);
+ }
+ 
+ void
+-md5_state_final (struct md5_state *s, struct md5_digest *out)
++sha256_state_final (struct sha256_state *s, struct sha256_digest *out)
+ {
+   md_ctx_final(&s->ctx, out->digest);
+   md_ctx_cleanup(&s->ctx);
+ }
+ 
+ void
+-md5_digest_clear (struct md5_digest *digest)
++sha256_digest_clear (struct sha256_digest *digest)
+ {
+   CLEAR (*digest);
+ }
+ 
+ bool
+-md5_digest_defined (const struct md5_digest *digest)
++sha256_digest_defined (const struct sha256_digest *digest)
+ {
+   int i;
+-  for (i = 0; i < MD5_DIGEST_LENGTH; ++i)
++  for (i = 0; i < SHA256_DIGEST_LENGTH; ++i)
+     if (digest->digest[i])
+       return true;
+   return false;
+ }
+ 
+ bool
+-md5_digest_equal (const struct md5_digest *d1, const struct md5_digest *d2)
++sha256_digest_equal (const struct sha256_digest *d1,
++                     const struct sha256_digest *d2)
+ {
+-  return memcmp(d1->digest, d2->digest, MD5_DIGEST_LENGTH) == 0;
++  return memcmp(d1->digest, d2->digest, SHA256_DIGEST_LENGTH) == 0;
+ }
+ 
+ #endif /* ENABLE_CRYPTO */
+diff --git a/src/openvpn/crypto.h b/src/openvpn/crypto.h
+index e489827..9f991cc 100644
+--- a/src/openvpn/crypto.h
++++ b/src/openvpn/crypto.h
+@@ -430,24 +430,24 @@ void free_ssl_lib (void);
+ #endif /* ENABLE_SSL */
+ 
+ /*
+- * md5 functions
++ * sha256 functions
+  */
+ 
+-struct md5_state {
++struct sha256_state {
+   md_ctx_t ctx;
+ };
+ 
+-struct md5_digest {
+-  uint8_t digest [MD5_DIGEST_LENGTH];
++struct sha256_digest {
++  uint8_t digest [SHA256_DIGEST_LENGTH];
+ };
+ 
+-const char *md5sum(uint8_t *buf, int len, int n_print_chars, struct gc_arena *gc);
+-void md5_state_init (struct md5_state *s);
+-void md5_state_update (struct md5_state *s, void *data, size_t len);
+-void md5_state_final (struct md5_state *s, struct md5_digest *out);
+-void md5_digest_clear (struct md5_digest *digest);
+-bool md5_digest_defined (const struct md5_digest *digest);
+-bool md5_digest_equal (const struct md5_digest *d1, const struct md5_digest *d2);
++const char *sha256sum(uint8_t *buf, int len, int n_print_chars, struct gc_arena *gc);
++void sha256_state_init (struct sha256_state *s);
++void sha256_state_update (struct sha256_state *s, void *data, size_t len);
++void sha256_state_final (struct sha256_state *s, struct sha256_digest *out);
++void sha256_digest_clear (struct sha256_digest *digest);
++bool sha256_digest_defined (const struct sha256_digest *digest);
++bool sha256_digest_equal (const struct sha256_digest *d1, const struct sha256_digest *d2);
+ 
+ /*
+  * Inline functions
+diff --git a/src/openvpn/crypto_backend.h b/src/openvpn/crypto_backend.h
+index 4c1ce9f..bd2a387 100644
+--- a/src/openvpn/crypto_backend.h
++++ b/src/openvpn/crypto_backend.h
+@@ -480,10 +480,11 @@ void md_ctx_final (md_ctx_t *ctx, uint8_t *dst);
+  * @param key		The key to use for the HMAC
+  * @param key_len	The key length to use
+  * @param kt 		Static message digest parameters
++ * @param prf_use	Intended use for PRF in TLS protocol
+  *
+  */
+ void hmac_ctx_init (hmac_ctx_t *ctx, const uint8_t *key, int key_length,
+-    const md_kt_t *kt);
++    const md_kt_t *kt, bool prf_use);
+ 
+ /*
+  * Free the given HMAC context.
+diff --git a/src/openvpn/crypto_openssl.c b/src/openvpn/crypto_openssl.c
+index 229401d..ba59e04 100644
+--- a/src/openvpn/crypto_openssl.c
++++ b/src/openvpn/crypto_openssl.c
+@@ -812,13 +812,17 @@ md_ctx_final (EVP_MD_CTX *ctx, uint8_t *dst)
+ 
+ void
+ hmac_ctx_init (HMAC_CTX *ctx, const uint8_t *key, int key_len,
+-    const EVP_MD *kt)
++    const EVP_MD *kt, bool prf_use)
+ {
+   ASSERT(NULL != kt && NULL != ctx);
+ 
+   CLEAR(*ctx);
+ 
+   HMAC_CTX_init (ctx);
++  /* FIPS 140-2 explicitly allows MD5 for the use in PRF although it is not
++   * to be used anywhere else */
++  if(kt == EVP_md5() && prf_use)
++    HMAC_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
+   HMAC_Init_ex (ctx, key, key_len, kt, NULL);
+ 
+   /* make sure we used a big enough key */
+diff --git a/src/openvpn/crypto_openssl.h b/src/openvpn/crypto_openssl.h
+index f883c2a..37b9d75 100644
+--- a/src/openvpn/crypto_openssl.h
++++ b/src/openvpn/crypto_openssl.h
+@@ -33,6 +33,7 @@
+ #include <openssl/evp.h>
+ #include <openssl/hmac.h>
+ #include <openssl/md5.h>
++#include <openssl/sha.h>
+ 
+ /** Generic cipher key type %context. */
+ typedef EVP_CIPHER cipher_kt_t;
+diff --git a/src/openvpn/crypto_polarssl.c b/src/openvpn/crypto_polarssl.c
+index 67f3c5f..0f7d8f9 100644
+--- a/src/openvpn/crypto_polarssl.c
++++ b/src/openvpn/crypto_polarssl.c
+@@ -665,7 +665,7 @@ md_ctx_final (md_context_t *ctx, uint8_t *dst)
+  * TODO: re-enable dmsg for crypto debug
+  */
+ void
+-hmac_ctx_init (md_context_t *ctx, const uint8_t *key, int key_len, const md_info_t *kt)
++hmac_ctx_init (md_context_t *ctx, const uint8_t *key, int key_len, const md_info_t *kt, bool prf_use)
+ {
+   ASSERT(NULL != kt && NULL != ctx);
+ 
+diff --git a/src/openvpn/init.c b/src/openvpn/init.c
+index 2148777..7a9b266 100644
+--- a/src/openvpn/init.c
++++ b/src/openvpn/init.c
+@@ -1360,12 +1360,12 @@ do_route (const struct options *options,
+  */
+ #if P2MP
+ static void
+-save_pulled_options_digest (struct context *c, const struct md5_digest *newdigest)
++save_pulled_options_digest (struct context *c, const struct sha256_digest *newdigest)
+ {
+   if (newdigest)
+     c->c1.pulled_options_digest_save = *newdigest;
+   else
+-    md5_digest_clear (&c->c1.pulled_options_digest_save);
++    sha256_digest_clear (&c->c1.pulled_options_digest_save);
+ }
+ #endif
+ 
+@@ -1695,8 +1695,8 @@ do_up (struct context *c, bool pulled_options, unsigned int option_types_found)
+ 	  if (!c->c2.did_open_tun
+ 	      && PULL_DEFINED (&c->options)
+ 	      && c->c1.tuntap
+-	      && (!md5_digest_defined (&c->c1.pulled_options_digest_save) || !md5_digest_defined (&c->c2.pulled_options_digest)
+-		  || !md5_digest_equal (&c->c1.pulled_options_digest_save, &c->c2.pulled_options_digest)))
++	      && (!sha256_digest_defined (&c->c1.pulled_options_digest_save) || !sha256_digest_defined (&c->c2.pulled_options_digest)
++		  || !sha256_digest_equal (&c->c1.pulled_options_digest_save, &c->c2.pulled_options_digest)))
+ 	    {
+ 	      /* if so, close tun, delete routes, then reinitialize tun and add routes */
+ 	      msg (M_INFO, "NOTE: Pulled options changed on restart, will need to close and reopen TUN/TAP device.");
+@@ -2774,11 +2774,11 @@ do_compute_occ_strings (struct context *c)
+ #ifdef ENABLE_CRYPTO
+   msg (D_SHOW_OCC_HASH, "Local Options hash (VER=%s): '%s'",
+        options_string_version (c->c2.options_string_local, &gc),
+-       md5sum ((uint8_t*)c->c2.options_string_local,
++       sha256sum ((uint8_t*)c->c2.options_string_local,
+ 	       strlen (c->c2.options_string_local), 9, &gc));
+   msg (D_SHOW_OCC_HASH, "Expected Remote Options hash (VER=%s): '%s'",
+        options_string_version (c->c2.options_string_remote, &gc),
+-       md5sum ((uint8_t*)c->c2.options_string_remote,
++       sha256sum ((uint8_t*)c->c2.options_string_remote,
+ 	       strlen (c->c2.options_string_remote), 9, &gc));
+ #endif
+ 
+diff --git a/src/openvpn/ntlm.c b/src/openvpn/ntlm.c
+index 13bbc16..87b4037 100644
+--- a/src/openvpn/ntlm.c
++++ b/src/openvpn/ntlm.c
+@@ -90,7 +90,7 @@ gen_hmac_md5 (const char* data, int data_len, const char* key, int key_len,char
+ 	hmac_ctx_t hmac_ctx;
+ 	CLEAR(hmac_ctx);
+ 
+-	hmac_ctx_init(&hmac_ctx, key, key_len, md5_kt);
++	hmac_ctx_init(&hmac_ctx, key, key_len, md5_kt, 0);
+ 	hmac_ctx_update(&hmac_ctx, (const unsigned char *)data, data_len);
+ 	hmac_ctx_final(&hmac_ctx, (unsigned char *)result);
+ 	hmac_ctx_cleanup(&hmac_ctx);
+diff --git a/src/openvpn/openvpn.h b/src/openvpn/openvpn.h
+index 36c3100..6400a05 100644
+--- a/src/openvpn/openvpn.h
++++ b/src/openvpn/openvpn.h
+@@ -205,7 +205,7 @@ struct context_1
+ #endif
+ 
+   /* if client mode, hash of option strings we pulled from server */
+-  struct md5_digest pulled_options_digest_save;
++  struct sha256_digest pulled_options_digest_save;
+                                 /**< Hash of option strings received from the
+                                  *   remote OpenVPN server.  Only used in
+                                  *   client-mode. */
+@@ -473,9 +473,9 @@ struct context_2
+   bool did_pre_pull_restore;
+ 
+   /* hash of pulled options, so we can compare when options change */
+-  bool pulled_options_md5_init_done;
+-  struct md5_state pulled_options_state;
+-  struct md5_digest pulled_options_digest;
++  bool pulled_options_sha256_init_done;
++  struct sha256_state pulled_options_state;
++  struct sha256_digest pulled_options_digest;
+ 
+   struct event_timeout server_poll_interval;
+ 
+diff --git a/src/openvpn/push.c b/src/openvpn/push.c
+index e4f3984..b903586 100644
+--- a/src/openvpn/push.c
++++ b/src/openvpn/push.c
+@@ -455,10 +455,10 @@ process_incoming_push_msg (struct context *c,
+       if (ch == ',')
+ 	{
+ 	  struct buffer buf_orig = buf;
+-	  if (!c->c2.pulled_options_md5_init_done)
++	  if (!c->c2.pulled_options_sha256_init_done)
+ 	    {
+-	      md5_state_init (&c->c2.pulled_options_state);
+-	      c->c2.pulled_options_md5_init_done = true;
++	      sha256_state_init (&c->c2.pulled_options_state);
++	      c->c2.pulled_options_sha256_init_done = true;
+ 	    }
+ 	  if (!c->c2.did_pre_pull_restore)
+ 	    {
+@@ -474,13 +474,13 @@ process_incoming_push_msg (struct context *c,
+ 	      {
+ 	      case 0:
+ 	      case 1:
+-		md5_state_update (&c->c2.pulled_options_state, BPTR(&buf_orig), BLEN(&buf_orig));
+-		md5_state_final (&c->c2.pulled_options_state, &c->c2.pulled_options_digest);
+-	        c->c2.pulled_options_md5_init_done = false;
++		sha256_state_update (&c->c2.pulled_options_state, BPTR(&buf_orig), BLEN(&buf_orig));
++		sha256_state_final (&c->c2.pulled_options_state, &c->c2.pulled_options_digest);
++	        c->c2.pulled_options_sha256_init_done = false;
+ 		ret = PUSH_MSG_REPLY;
+ 		break;
+ 	      case 2:
+-		md5_state_update (&c->c2.pulled_options_state, BPTR(&buf_orig), BLEN(&buf_orig));
++		sha256_state_update (&c->c2.pulled_options_state, BPTR(&buf_orig), BLEN(&buf_orig));
+ 		ret = PUSH_MSG_CONTINUATION;
+ 		break;
+ 	      }
+diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c
+index 0679890..47fc702 100644
+--- a/src/openvpn/ssl.c
++++ b/src/openvpn/ssl.c
+@@ -1375,8 +1375,8 @@ tls1_P_hash(const md_kt_t *md_kt,
+   chunk = md_kt_size(md_kt);
+   A1_len = md_kt_size(md_kt);
+ 
+-  hmac_ctx_init(&ctx, sec, sec_len, md_kt);
+-  hmac_ctx_init(&ctx_tmp, sec, sec_len, md_kt);
++  hmac_ctx_init(&ctx, sec, sec_len, md_kt, 1);
++  hmac_ctx_init(&ctx_tmp, sec, sec_len, md_kt, 1);
+ 
+   hmac_ctx_update(&ctx,seed,seed_len);
+   hmac_ctx_final(&ctx, A1);
diff --git a/debian/patches/series b/debian/patches/series
index 9ccb035..b538685 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -14,3 +14,4 @@ CVE-2017-7512.patch
 CVE-2017-7520.patch
 CVE-2017-7521.patch
 establish_http_proxy_passthru_dos.patch
+openvpn-fips140-2.3.2.patch