auth-token verification logs erroneous password verification
Open
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 14.6k
- Forks
- 3.4k
- PR merge metrics
- No merged PRs in 30d
Description
A server using --auth-gen-token outputs an erroneous log message stating password verification, when ONLY an auth-token has been verified -- at renegotiation time --reneg-sec.
- OS: Linux
- OpenVPN version: master
https://community.openvpn.net/openvpn/ticket/840#comment:6
Log example:
CLIENT-01/10.1.101.21:64070 TLS: Username/auth-token authentication succeeded for username 'dan10'
CLIENT-01/10.1.101.21:64070 TLS: Username/Password authentication succeeded for username 'dan10'
CLIENT-01/10.1.101.21:64070 SENT CONTROL [CLIENT-01]: 'PUSH_REPLY, auth-tokenSESS_ID' (status=1)
password cannot be verified because password was not sent, the client uses --auth-nocache.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the renegotiation scenario with --auth-gen-token, --reneg-sec, and --auth-nocache, then trace the authentication logging path for auth-token verification. Done means the log identifies auth-token verification accurately and no longer reports password verification when no password was sent.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, linux
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100