crl-verify and client-config-dir paths are incorrectly checked in 2.3.*

[io7m]

The following config file works correctly with 2.2.1:

chroot /vpn/chroot
ca /vpn/ca.crt
cert /vpn/vpn.arc7.info.crt
client-config-dir /client-configs
crl-verify /crl.pem
dh /vpn/dh2048.pem
key /vpn/vpn.arc7.info.key
tls-auth /vpn/tls-auth.key 0

That is, there's a /vpn/chroot directory and inside that, a crl.pem file and
a client-configs directory. 2.2.1 would accept the config and work correctly,
loading client configs and revocations from inside the chroot. 2.3, however,
says:

Options error: --crl-verify fails with '/crl.pem': No such file or directory
Options error: --client-config-dir fails with '/client-configs': No such file or directory
Options error: Please correct these errors.

Specifying an absolute path for either of those simply fails when clients
connect instead.

[JoshC]

I've confirmed and been able to reproduce this issue and a fix in in the works.

In the meantime, a workaround exists if downgrading to <2.3 is undesirable; use --cd and point to the --chroot dir, then use relative file paths to specify the files with their path inside the chroot. A proper fix will be made available shortly.

The issue in the code is that additional access checks were added, but they don't account for file paths that differ once the chroot operation is performed.

[JoshC]

An initial patch I wrote that resolves this issue is being processed through our patch review system (see: ​http://permalink.gmane.org/gmane.network.openvpn.devel/7873 for details.)

Once a merge to source control takes place I'll update this ticket.

[Samuli Seppänen]

At the moment JoshC's patch is awaiting some modifications, but we should eventually get there. For details look into ​this email thread.

[Gert Döring]

commit b77bffe8186647c6fd1f2f76aac41fd45719edb8 (master)
commit c79fa3b0bb63bf7833f5a1c163bd30433c213b6a (release/2.3)

(Not actually JoshC's patch, but Dazo's, after long discussions in #openvpn-devel)

Please verify that it works for you, and we can close this :-)

[Gert Döring]

setting the milestone so it's clear where this fix went in, but since it already *is* in, I'm just waiting for a "yes, it works for me" confirmation from io7m.

If I don't hear by Jan 15, I'll close the ticket and assume everything is good.

[Gert Döring]

As announced :-) - reopen if needed.

[tct]

Re-opening..

Added here because of this comment: ​https://community.openvpn.net/openvpn/ticket/299#comment:1
Although, #299 seems to be more appropriate now.

If --client-config-dir is also defined then that is effected in the same way.

Config:

dev tun
topology subnet
server 10.16.0.0 255.255.255.0
keepalive 10 120
verb 4

chroot /tmp/easytls

dh none

<ca>
..
</ca>

<cert>
..
</cert>

<key>
..
</key>

<tls-crypt-v2>
..
</tls-crypt-v2>

Log:

Options error: Temporary directory (--tmp-dir) fails with 
'/tmp/easytls//tmp': No such file or directory (errno=2)
Options error: Please correct these errors.
Use --help for more information.

Version:

OpenVPN 2.6_git [git:master/2b9bbaadf44d4978] x86_64-pc-linux-gnu 
[SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on 
Aug 12 2021
library versions: OpenSSL 1.1.1f  31 Mar 2020, LZO 2.10
Originally developed by James Yonan
Copyright (C) 2002-2021 OpenVPN Inc <sales@openvpn.net>
Compile time defines: enable_async_push=no enable_comp_stub=no 
enable_crypto_ofb_cfb=yes enable_debug=yes enable_dlopen=unknown 
enable_dlopen_self=unknown enable_dlopen_self_static=unknown 
enable_fast_install=needless enable_fragment=yes 
enable_iproute2=yes enable_libtool_lock=yes enable_lz4=yes 
enable_lzo=yes enable_management=yes enable_pam_dlopen=no 
enable_pedantic=no enable_pf=yes enable_pkcs11=no 
enable_plugin_auth_pam=yes enable_plugin_down_root=yes 
enable_plugins=yes enable_port_share=yes enable_selinux=no 
enable_shared=yes enable_shared_with_static_runtimes=no 
enable_small=no enable_static=yes enable_strict=no 
enable_strict_options=no enable_systemd=yes enable_werror=no 
enable_win32_dll=yes enable_wolfssl_options_h=yes 
enable_x509_alt_username=no with_aix_soname=aix 
with_crypto_library=openssl with_gnu_ld=yes with_mem_check=no 
with_sysroot=no

[Gert Döring]

--tmp-dir defaults to /tmp if not specified. In combination with chroot, this requires $chrootdir/tmp to exists.

No bug here. Either create a /tmp in /tmp/easytls/ or specify a different --tmp-dir with a directory that exists in chroot.

[tct]

Replying to Gert Döring:

No bug here.

Indeed, my mistake.

And a word to the wise: Openvpn --up script cannot be used to create a chroot from scratch.