[PR #1346] [MERGED] Implement client identity verification [SECURITY VULNERABILITIES CVE-2021-42072, CVE-2021-42073] #1785

New issue

Closed

opened 2026-05-05 08:01:53 -06:00 by gitea-mirror · 0 comments

gitea-mirror commented

2026-05-05 08:01:53 -06:00

Owner

📋 Pull Request Information

Original PR: https://github.com/debauchee/barrier/pull/1346
Author: @p12tic
Created: 11/1/2021
Status: ✅ Merged
Merged: 11/1/2021
Merged by: @p12tic

Base: master ← Head: client-identity-verification

📝 Commits (10+)

c0ce893 lib/net: Load client SSL certificates when connecting
92ba6f6 gui: Move SSL fingerprint labels out of server frame
4d73ed9 lib/net: Present client certificate when connecting to server
ed32e2e gui: Expand checkboxes in settings dialog through both grid columns
8bc280e gui: Add configuration for requiring client certificates
133e447 lib/net: Don't hardcode fingerprint DB path in verify_cert_fingerprint()
82b8fa9 lib/net: Improve name of showCertificate() to reflect what it does
5c7d719 lib/net: Use enum for connection security level instead of boolean
57769cf lib/net: Pass connection security level to within socket classes
e79bdf3 gui: Fix fingerprint database being not populated due to missing dirs

📊 Changes

31 files changed (+680 additions, -255 deletions)

View changed files

➕ doc/newsfragments/client-certificate-checking.bugfix (+7 -0)
➕ doc/newsfragments/client-send-certificate.feature (+1 -0)
📝 src/gui/CMakeLists.txt (+2 -0)
📝 src/gui/src/AppConfig.cpp (+7 -0)
📝 src/gui/src/AppConfig.h (+4 -0)
➕ src/gui/src/FingerprintAcceptDialog.cpp (+65 -0)
➕ src/gui/src/FingerprintAcceptDialog.h (+45 -0)
➕ src/gui/src/FingerprintAcceptDialog.ui (+174 -0)
📝 src/gui/src/MainWindow.cpp (+33 -31)
📝 src/gui/src/MainWindow.h (+3 -7)
📝 src/gui/src/MainWindowBase.ui (+101 -101)
📝 src/gui/src/SettingsDialog.cpp (+2 -0)
📝 src/gui/src/SettingsDialogBase.ui (+42 -35)
📝 src/gui/src/SslCertificate.cpp (+5 -0)
📝 src/gui/src/ZeroconfService.cpp (+1 -1)
📝 src/lib/barrier/ArgParser.cpp (+3 -1)
➕ src/lib/barrier/BarrierType.h (+26 -0)
📝 src/lib/barrier/ServerApp.cpp (+13 -3)
📝 src/lib/barrier/ServerArgs.h (+1 -0)
📝 src/lib/client/Client.cpp (+8 -3)

...and 11 more files

📄 Description

This PR implements client identity verification. Essentially server gets the same process of accepting and rejecting clients like the clients can accept or reject the server. This is important because even though the client can't move the mouse on the server, it can still receive input and potentially set the clipboard.

This PR fixes the following security vulnerabilities:

CVE-2021-42072 server does not verify client identity (certificate fingerprint)
CVE-2021-42073 By guessing/listening in on valid client names server clipboard content can be manipulated.

The issues have been reported by Matthias Gerstner mgerstner@suse.de @mgerstner. Matthias also provided insights into how best to fix the issues, precise reproduction steps and any used tools and made the maintainer's life as pleasant as possible. Thank you!

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/debauchee/barrier/pull/1346 **Author:** [@p12tic](https://github.com/p12tic) **Created:** 11/1/2021 **Status:** ✅ Merged **Merged:** 11/1/2021 **Merged by:** [@p12tic](https://github.com/p12tic) **Base:** `master` ← **Head:** `client-identity-verification` --- ### 📝 Commits (10+) - [`c0ce893`](https://github.com/debauchee/barrier/commit/c0ce893711eb5e504e3bf6b376c84b4616d4241e) lib/net: Load client SSL certificates when connecting - [`92ba6f6`](https://github.com/debauchee/barrier/commit/92ba6f61e69dcc88ef7cea4ed74bc42883f263ed) gui: Move SSL fingerprint labels out of server frame - [`4d73ed9`](https://github.com/debauchee/barrier/commit/4d73ed9fddedba63b91935799c6f7ae22d9ea989) lib/net: Present client certificate when connecting to server - [`ed32e2e`](https://github.com/debauchee/barrier/commit/ed32e2e326fa6a28129a597b6cdc7d0b01122562) gui: Expand checkboxes in settings dialog through both grid columns - [`8bc280e`](https://github.com/debauchee/barrier/commit/8bc280e0dd6dd95952cecb4b810b9f034de53927) gui: Add configuration for requiring client certificates - [`133e447`](https://github.com/debauchee/barrier/commit/133e447fb67d558d52309da80bfa1b0d10e6173b) lib/net: Don't hardcode fingerprint DB path in verify_cert_fingerprint() - [`82b8fa9`](https://github.com/debauchee/barrier/commit/82b8fa905eb31b0291bfe2ca4adffaa764292c4e) lib/net: Improve name of showCertificate() to reflect what it does - [`5c7d719`](https://github.com/debauchee/barrier/commit/5c7d7194d5cb8589b2d12a89fa0c678887da51d4) lib/net: Use enum for connection security level instead of boolean - [`57769cf`](https://github.com/debauchee/barrier/commit/57769cffdae571298671f828ee681c153f098d4d) lib/net: Pass connection security level to within socket classes - [`e79bdf3`](https://github.com/debauchee/barrier/commit/e79bdf333c47952b9f18972f782bc3b4b75ad204) gui: Fix fingerprint database being not populated due to missing dirs ### 📊 Changes **31 files changed** (+680 additions, -255 deletions) <details> <summary>View changed files</summary> ➕ `doc/newsfragments/client-certificate-checking.bugfix` (+7 -0) ➕ `doc/newsfragments/client-send-certificate.feature` (+1 -0) 📝 `src/gui/CMakeLists.txt` (+2 -0) 📝 `src/gui/src/AppConfig.cpp` (+7 -0) 📝 `src/gui/src/AppConfig.h` (+4 -0) ➕ `src/gui/src/FingerprintAcceptDialog.cpp` (+65 -0) ➕ `src/gui/src/FingerprintAcceptDialog.h` (+45 -0) ➕ `src/gui/src/FingerprintAcceptDialog.ui` (+174 -0) 📝 `src/gui/src/MainWindow.cpp` (+33 -31) 📝 `src/gui/src/MainWindow.h` (+3 -7) 📝 `src/gui/src/MainWindowBase.ui` (+101 -101) 📝 `src/gui/src/SettingsDialog.cpp` (+2 -0) 📝 `src/gui/src/SettingsDialogBase.ui` (+42 -35) 📝 `src/gui/src/SslCertificate.cpp` (+5 -0) 📝 `src/gui/src/ZeroconfService.cpp` (+1 -1) 📝 `src/lib/barrier/ArgParser.cpp` (+3 -1) ➕ `src/lib/barrier/BarrierType.h` (+26 -0) 📝 `src/lib/barrier/ServerApp.cpp` (+13 -3) 📝 `src/lib/barrier/ServerArgs.h` (+1 -0) 📝 `src/lib/client/Client.cpp` (+8 -3) _...and 11 more files_ </details> ### 📄 Description This PR implements client identity verification. Essentially server gets the same process of accepting and rejecting clients like the clients can accept or reject the server. This is important because even though the client can't move the mouse on the server, it can still receive input and potentially set the clipboard. This PR fixes the following security vulnerabilities: - CVE-2021-42072 server does not verify client identity (certificate fingerprint) - CVE-2021-42073 By guessing/listening in on valid client names server clipboard content can be manipulated. The issues have been reported by Matthias Gerstner <mgerstner@suse.de> @mgerstner. Matthias also provided insights into how best to fix the issues, precise reproduction steps and any used tools and made the maintainer's life as pleasant as possible. Thank you! --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>