search

schwabe / ics-openvpn

OpenVPN for Android
3.36k stars 1.2k forks source link

auth SHA512 not supported in version 0.7.32 #1437

Closed SilmorSenedlen closed 2 years ago

SilmorSenedlen commented 2 years ago

Good day, After upgrade app to 0.7.32 get fatal error when trying to connect. Downgrade app to 0.7.31 resolve this problem.

  1. Android Version: 10
  2. Android Vendor/Custom ROM: Samsung
  3. Device: Samsung Galaxy S9 (SM-G960F)
  4. Version of the app: 0.7.32 (From GitHub)
App Log ``` 2022-01-10 13:58:53 official build 0.7.32 running on samsung SM-G960F (exynos9810), Android 10 (QP1A.190711.020) API 29, ABI arm64-v8a, (samsung/starlteser/starlte:10/QP1A.190711.020/G960FXXSHFUJ2:user/release-keys) 2022-01-10 13:58:53 Building configuration… 2022-01-10 13:58:53 started Socket Thread 2022-01-10 13:58:53 Network Status: CONNECTED to WIFI 2022-01-10 13:58:53 Debug state info: CONNECTED to WIFI , pause: userPause, shouldbeconnected: true, network: SHOULDBECONNECTED 2022-01-10 13:58:53 Debug state info: CONNECTED to WIFI , pause: userPause, shouldbeconnected: true, network: SHOULDBECONNECTED 2022-01-10 13:58:53 P:WARNING: linker: Warning: "/data/app/de.blinkt.openvpn-vb5CBCNKyXiWSJQEka21vQ==/lib/arm64/libovpnexec.so" is not a directory (ignoring) 2022-01-10 13:58:53 NOTICE: --prng option ignored (SSL library PRNG is used) 2022-01-10 13:58:53 Current Parameter Settings: 2022-01-10 13:58:53 config = '/data/user/0/de.blinkt.openvpn/cache/android.conf' 2022-01-10 13:58:53 mode = 0 2022-01-10 13:58:53 show_ciphers = DISABLED 2022-01-10 13:58:53 show_digests = DISABLED 2022-01-10 13:58:53 show_engines = DISABLED 2022-01-10 13:58:53 genkey = DISABLED 2022-01-10 13:58:53 genkey_filename = '[UNDEF]' 2022-01-10 13:58:53 key_pass_file = '[UNDEF]' 2022-01-10 13:58:53 show_tls_ciphers = DISABLED 2022-01-10 13:58:53 connect_retry_max = 0 2022-01-10 13:58:53 Connection profiles [0]: 2022-01-10 13:58:53 proto = udp 2022-01-10 13:58:53 local = '[UNDEF]' 2022-01-10 13:58:53 local_port = '0' 2022-01-10 13:58:53 remote = '*redacted*' 2022-01-10 13:58:53 remote_port = '21194' 2022-01-10 13:58:53 remote_float = DISABLED 2022-01-10 13:58:53 bind_defined = DISABLED 2022-01-10 13:58:53 bind_local = ENABLED 2022-01-10 13:58:53 bind_ipv6_only = DISABLED 2022-01-10 13:58:53 connect_retry_seconds = 2 2022-01-10 13:58:53 connect_timeout = 120 2022-01-10 13:58:53 socks_proxy_server = '[UNDEF]' 2022-01-10 13:58:53 socks_proxy_port = '[UNDEF]' 2022-01-10 13:58:53 tun_mtu = 1500 2022-01-10 13:58:53 tun_mtu_defined = ENABLED 2022-01-10 13:58:53 link_mtu = 1500 2022-01-10 13:58:53 link_mtu_defined = DISABLED 2022-01-10 13:58:53 tun_mtu_extra = 0 2022-01-10 13:58:53 tun_mtu_extra_defined = DISABLED 2022-01-10 13:58:53 mtu_discover_type = -1 2022-01-10 13:58:53 fragment = 0 2022-01-10 13:58:53 mssfix = 1492 2022-01-10 13:58:53 mssfix_encap = ENABLED 2022-01-10 13:58:53 explicit_exit_notification = 1 2022-01-10 13:58:53 tls_auth_file = '[INLINE]' 2022-01-10 13:58:53 key_direction = 1 2022-01-10 13:58:53 tls_crypt_file = '[UNDEF]' 2022-01-10 13:58:53 tls_crypt_v2_file = '[UNDEF]' 2022-01-10 13:58:53 Connection profiles END 2022-01-10 13:58:53 remote_random = DISABLED 2022-01-10 13:58:53 ipchange = '[UNDEF]' 2022-01-10 13:58:53 Waiting 0s seconds between connection attempt 2022-01-10 13:58:53 dev = 'tun' 2022-01-10 13:58:53 dev_type = '[UNDEF]' 2022-01-10 13:58:53 dev_node = '[UNDEF]' 2022-01-10 13:58:53 lladdr = '[UNDEF]' 2022-01-10 13:58:53 topology = 1 2022-01-10 13:58:53 ifconfig_local = '[UNDEF]' 2022-01-10 13:58:53 ifconfig_remote_netmask = '[UNDEF]' 2022-01-10 13:58:53 ifconfig_noexec = DISABLED 2022-01-10 13:58:53 ifconfig_nowarn = ENABLED 2022-01-10 13:58:53 ifconfig_ipv6_local = '[UNDEF]' 2022-01-10 13:58:53 ifconfig_ipv6_netbits = 0 2022-01-10 13:58:53 ifconfig_ipv6_remote = '[UNDEF]' 2022-01-10 13:58:53 shaper = 0 2022-01-10 13:58:53 mtu_test = 0 2022-01-10 13:58:53 mlock = DISABLED 2022-01-10 13:58:53 keepalive_ping = 0 2022-01-10 13:58:53 keepalive_timeout = 0 2022-01-10 13:58:53 inactivity_timeout = 0 2022-01-10 13:58:53 ping_send_timeout = 0 2022-01-10 13:58:53 ping_rec_timeout = 0 2022-01-10 13:58:53 ping_rec_timeout_action = 0 2022-01-10 13:58:53 ping_timer_remote = DISABLED 2022-01-10 13:58:53 remap_sigusr1 = 0 2022-01-10 13:58:53 persist_tun = ENABLED 2022-01-10 13:58:53 persist_local_ip = DISABLED 2022-01-10 13:58:53 persist_remote_ip = DISABLED 2022-01-10 13:58:53 persist_key = DISABLED 2022-01-10 13:58:53 passtos = ENABLED 2022-01-10 13:58:53 resolve_retry_seconds = 1000000000 2022-01-10 13:58:53 resolve_in_advance = ENABLED 2022-01-10 13:58:53 username = '[UNDEF]' 2022-01-10 13:58:53 groupname = '[UNDEF]' 2022-01-10 13:58:53 chroot_dir = '[UNDEF]' 2022-01-10 13:58:53 cd_dir = '[UNDEF]' 2022-01-10 13:58:53 writepid = '[UNDEF]' 2022-01-10 13:58:53 up_script = '[UNDEF]' 2022-01-10 13:58:53 down_script = '[UNDEF]' 2022-01-10 13:58:53 down_pre = DISABLED 2022-01-10 13:58:53 up_restart = DISABLED 2022-01-10 13:58:53 up_delay = DISABLED 2022-01-10 13:58:53 daemon = DISABLED 2022-01-10 13:58:53 log = DISABLED 2022-01-10 13:58:53 suppress_timestamps = DISABLED 2022-01-10 13:58:53 machine_readable_output = ENABLED 2022-01-10 13:58:53 nice = 0 2022-01-10 13:58:53 verbosity = 4 2022-01-10 13:58:53 mute = 0 2022-01-10 13:58:53 gremlin = 0 2022-01-10 13:58:53 status_file = '[UNDEF]' 2022-01-10 13:58:53 status_file_version = 1 2022-01-10 13:58:53 status_file_update_freq = 60 2022-01-10 13:58:53 occ = ENABLED 2022-01-10 13:58:53 rcvbuf = 0 2022-01-10 13:58:53 sndbuf = 0 2022-01-10 13:58:53 sockflags = 0 2022-01-10 13:58:53 fast_io = DISABLED 2022-01-10 13:58:53 comp.alg = 0 2022-01-10 13:58:53 comp.flags = 0 2022-01-10 13:58:53 route_script = '[UNDEF]' 2022-01-10 13:58:53 route_default_gateway = '[UNDEF]' 2022-01-10 13:58:53 route_default_metric = 0 2022-01-10 13:58:53 route_noexec = DISABLED 2022-01-10 13:58:53 route_delay = 0 2022-01-10 13:58:53 route_delay_window = 30 2022-01-10 13:58:53 route_delay_defined = DISABLED 2022-01-10 13:58:53 route_nopull = DISABLED 2022-01-10 13:58:53 route_gateway_via_dhcp = DISABLED 2022-01-10 13:58:53 allow_pull_fqdn = DISABLED 2022-01-10 13:58:53 route 0.0.0.0/0.0.0.0/vpn_gateway/default (not set) 2022-01-10 13:58:53 management_addr = '/data/user/0/de.blinkt.openvpn/cache/mgmtsocket' 2022-01-10 13:58:53 management_port = 'unix' 2022-01-10 13:58:53 management_user_pass = '[UNDEF]' 2022-01-10 13:58:53 management_log_history_cache = 250 2022-01-10 13:58:53 management_echo_buffer_size = 100 2022-01-10 13:58:53 management_write_peer_info_file = '[UNDEF]' 2022-01-10 13:58:53 management_client_user = '[UNDEF]' 2022-01-10 13:58:53 management_client_group = '[UNDEF]' 2022-01-10 13:58:53 management_flags = 200486 2022-01-10 13:58:53 shared_secret_file = '[UNDEF]' 2022-01-10 13:58:53 key_direction = 1 2022-01-10 13:58:53 ciphername = 'AES-256-GCM' 2022-01-10 13:58:53 ncp_ciphers = 'AES-256-GCM:CHACHA20-POLY1305' 2022-01-10 13:58:53 authname = 'SHA512' 2022-01-10 13:58:53 engine = DISABLED 2022-01-10 13:58:53 replay = ENABLED 2022-01-10 13:58:53 mute_replay_warnings = DISABLED 2022-01-10 13:58:53 replay_window = 64 2022-01-10 13:58:53 replay_time = 15 2022-01-10 13:58:53 packet_id_file = '[UNDEF]' 2022-01-10 13:58:53 test_crypto = DISABLED 2022-01-10 13:58:53 tls_server = DISABLED 2022-01-10 13:58:53 tls_client = ENABLED 2022-01-10 13:58:53 ca_file = '[INLINE]' 2022-01-10 13:58:53 ca_path = '[UNDEF]' 2022-01-10 13:58:53 dh_file = '[UNDEF]' 2022-01-10 13:58:53 cert_file = '[INLINE]' 2022-01-10 13:58:53 extra_certs_file = '[INLINE]' 2022-01-10 13:58:53 "priv_key_file" = EXTERNAL_PRIVATE_KEY 2022-01-10 13:58:53 pkcs12_file = '[UNDEF]' 2022-01-10 13:58:53 cipher_list = '[UNDEF]' 2022-01-10 13:58:53 cipher_list_tls13 = 'TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384' 2022-01-10 13:58:53 tls_cert_profile = '[UNDEF]' 2022-01-10 13:58:53 tls_verify = '[UNDEF]' 2022-01-10 13:58:53 tls_export_cert = '[UNDEF]' 2022-01-10 13:58:53 verify_x509_type = 2 2022-01-10 13:58:53 verify_x509_name = '*redacted*' 2022-01-10 13:58:53 crl_file = '[UNDEF]' 2022-01-10 13:58:53 ns_cert_type = 0 2022-01-10 13:58:53 remote_cert_ku[i] = 65535 2022-01-10 13:58:53 remote_cert_ku[i] = 0 2022-01-10 13:58:53 remote_cert_ku[i] = 0 2022-01-10 13:58:53 remote_cert_ku[i] = 0 2022-01-10 13:58:53 remote_cert_ku[i] = 0 2022-01-10 13:58:53 remote_cert_ku[i] = 0 2022-01-10 13:58:53 remote_cert_ku[i] = 0 2022-01-10 13:58:53 remote_cert_ku[i] = 0 2022-01-10 13:58:53 remote_cert_ku[i] = 0 2022-01-10 13:58:53 remote_cert_ku[i] = 0 2022-01-10 13:58:53 remote_cert_ku[i] = 0 2022-01-10 13:58:53 remote_cert_ku[i] = 0 2022-01-10 13:58:53 remote_cert_ku[i] = 0 2022-01-10 13:58:53 remote_cert_ku[i] = 0 2022-01-10 13:58:53 remote_cert_ku[i] = 0 2022-01-10 13:58:53 remote_cert_ku[i] = 0 2022-01-10 13:58:53 remote_cert_eku = 'TLS Web Server Authentication' 2022-01-10 13:58:53 ssl_flags = 256 2022-01-10 13:58:53 tls_timeout = 2 2022-01-10 13:58:53 renegotiate_bytes = -1 2022-01-10 13:58:53 renegotiate_packets = 0 2022-01-10 13:58:53 renegotiate_seconds = 3600 2022-01-10 13:58:53 handshake_window = 60 2022-01-10 13:58:53 transition_window = 3600 2022-01-10 13:58:53 single_session = DISABLED 2022-01-10 13:58:53 push_peer_info = DISABLED 2022-01-10 13:58:53 tls_exit = DISABLED 2022-01-10 13:58:53 tls_crypt_v2_metadata = '[UNDEF]' 2022-01-10 13:58:53 server_network = 0.0.0.0 2022-01-10 13:58:53 server_netmask = 0.0.0.0 2022-01-10 13:58:53 server_network_ipv6 = :: 2022-01-10 13:58:53 server_netbits_ipv6 = 0 2022-01-10 13:58:53 server_bridge_ip = 0.0.0.0 2022-01-10 13:58:53 server_bridge_netmask = 0.0.0.0 2022-01-10 13:58:53 server_bridge_pool_start = 0.0.0.0 2022-01-10 13:58:53 server_bridge_pool_end = 0.0.0.0 2022-01-10 13:58:53 ifconfig_pool_defined = DISABLED 2022-01-10 13:58:53 ifconfig_pool_start = 0.0.0.0 2022-01-10 13:58:53 ifconfig_pool_end = 0.0.0.0 2022-01-10 13:58:53 ifconfig_pool_netmask = 0.0.0.0 2022-01-10 13:58:53 ifconfig_pool_persist_filename = '[UNDEF]' 2022-01-10 13:58:53 ifconfig_pool_persist_refresh_freq = 600 2022-01-10 13:58:53 ifconfig_ipv6_pool_defined = DISABLED 2022-01-10 13:58:53 ifconfig_ipv6_pool_base = :: 2022-01-10 13:58:53 ifconfig_ipv6_pool_netbits = 0 2022-01-10 13:58:53 n_bcast_buf = 256 2022-01-10 13:58:53 tcp_queue_limit = 64 2022-01-10 13:58:53 real_hash_size = 256 2022-01-10 13:58:53 virtual_hash_size = 256 2022-01-10 13:58:53 client_connect_script = '[UNDEF]' 2022-01-10 13:58:53 learn_address_script = '[UNDEF]' 2022-01-10 13:58:53 client_disconnect_script = '[UNDEF]' 2022-01-10 13:58:53 client_config_dir = '[UNDEF]' 2022-01-10 13:58:53 ccd_exclusive = DISABLED 2022-01-10 13:58:53 tmp_dir = '/data/data/de.blinkt.openvpn/cache' 2022-01-10 13:58:53 push_ifconfig_defined = DISABLED 2022-01-10 13:58:53 push_ifconfig_local = 0.0.0.0 2022-01-10 13:58:53 push_ifconfig_remote_netmask = 0.0.0.0 2022-01-10 13:58:53 push_ifconfig_ipv6_defined = DISABLED 2022-01-10 13:58:53 push_ifconfig_ipv6_local = ::/0 2022-01-10 13:58:53 push_ifconfig_ipv6_remote = :: 2022-01-10 13:58:53 enable_c2c = DISABLED 2022-01-10 13:58:53 duplicate_cn = DISABLED 2022-01-10 13:58:53 cf_max = 0 2022-01-10 13:58:53 cf_per = 0 2022-01-10 13:58:53 max_clients = 1024 2022-01-10 13:58:53 max_routes_per_client = 256 2022-01-10 13:58:53 auth_user_pass_verify_script = '[UNDEF]' 2022-01-10 13:58:53 auth_user_pass_verify_script_via_file = DISABLED 2022-01-10 13:58:53 auth_token_generate = DISABLED 2022-01-10 13:58:53 auth_token_lifetime = 0 2022-01-10 13:58:53 auth_token_secret_file = '[UNDEF]' 2022-01-10 13:58:53 port_share_host = '[UNDEF]' 2022-01-10 13:58:53 port_share_port = '[UNDEF]' 2022-01-10 13:58:53 vlan_tagging = DISABLED 2022-01-10 13:58:53 vlan_accept = all 2022-01-10 13:58:53 vlan_pvid = 1 2022-01-10 13:58:53 client = ENABLED 2022-01-10 13:58:53 pull = ENABLED 2022-01-10 13:58:53 auth_user_pass_file = '[UNDEF]' 2022-01-10 13:58:53 OpenVPN 2.6-icsopenvpn [git:icsopenvpn/v0.7.32-0-g0909f23c] arm64-v8a [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Jan 9 2022 2022-01-10 13:58:53 library versions: OpenSSL 3.0.1 14 Dec 2021, LZO 2.10 2022-01-10 13:58:53 MANAGEMENT: Connected to management server at /data/user/0/de.blinkt.openvpn/cache/mgmtsocket 2022-01-10 13:58:53 MANAGEMENT: CMD 'version 3' 2022-01-10 13:58:53 MANAGEMENT: CMD 'hold release' 2022-01-10 13:58:53 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA2-512' for HMAC authentication 2022-01-10 13:58:53 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA2-512' for HMAC authentication 2022-01-10 13:58:53 Control Channel MTU parms [ mss_fix:0 max_frag:0 tun_mtu:1250 headroom:85 payload:1335 tailroom:85 ET:0 ] 2022-01-10 13:58:53 Data Channel MTU parms [ mss_fix:1371 max_frag:0 tun_mtu:1500 headroom:136 payload:1736 tailroom:268 ET:0 ] 2022-01-10 13:58:53 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1549,tun-mtu 1500,proto UDPv4,keydir 1,cipher AES-256-GCM,auth [null-digest],keysize 256,tls-auth,key-method 2,tls-client' 2022-01-10 13:58:53 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1549,tun-mtu 1500,proto UDPv4,keydir 0,cipher AES-256-GCM,auth [null-digest],keysize 256,tls-auth,key-method 2,tls-server' 2022-01-10 13:58:53 TCP/UDP: Preserving recently used remote address: [AF_INET]*redacted*:21194 2022-01-10 13:58:53 Socket Buffers: R=[229376->229376] S=[229376->229376] 2022-01-10 13:58:53 MANAGEMENT: CMD 'bytecount 2' 2022-01-10 13:58:53 MANAGEMENT: CMD 'needok 'PROTECTFD' ok' 2022-01-10 13:58:53 UDP link local (bound): [AF_INET][undef]:0 2022-01-10 13:58:53 UDP link remote: [AF_INET]*redacted*:21194 2022-01-10 13:58:53 MANAGEMENT: Client disconnected 2022-01-10 13:58:53 Assertion failed at /Users/arne/software/icsopenvpn/main/src/main/cpp/openvpn/src/openvpn/crypto.c:260 (mac_out = buf_prepend(buf, hmac_ctx_size(ctx->hmac))) 2022-01-10 13:58:53 Exiting due to fatal error 2022-01-10 13:58:53 Process exited with exit value 1 2022-01-10 13:58:53 MGMT: Got unrecognized command>FATAL:Assertion failed at /Users/arne/software/icsopenvpn/main/src/main/cpp/openvpn/src/openvpn/crypto.c:260 (mac_out = buf_prepend(buf, hmac_ctx_size(ctx->hmac))) ```
schwabe commented 2 years ago

Can you give me a copy of your vpn config (with private information removed)?

schwabe commented 2 years ago

Nevermind. SHA512 is triggering. Will be fixed in the next release.

realbiz21 commented 2 years ago

I have also seen this after F-Droid has just pushed out 0.7.32; it is impossible to connect to my VPN, and SHA512 is used.

Is a workaround available to avoid downgrading?

schwabe commented 2 years ago

No, you will need to wait for an update. Note that 0.7.32 is a beta version, so bugs are expected.