aboutsummaryrefslogtreecommitdiff
path: root/src/openvpnserv
AgeCommit message (Collapse)Author
2024-03-26Fix snprintf/swnprintf related compiler warningsArne Schwabe
When openvpn_snprintf is replaced by snprintf the GCC/MSVC compiler will perform additional checks that the result is not truncated. This warning can be avoid by either explicitly checking the return value of snprintf (proxy) or ensuring that it is never truncated(tls crypt) Change-Id: If23988a05dd53a519c5e57f2aa3b2d10bd29df1d Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20240326104101.531291-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28475.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-03-19interactive.c: Fix potential stack overflow issueLev Stipakov
When reading message from the pipe, we first peek the pipe to get the size of the message waiting to be read and then read the message. A compromised OpenVPN process could send an excessively large message, which would result in a stack-allocated message buffer overflow. To address this, we terminate the misbehaving process if the peeked message size exceeds the maximum allowable size. CVE: 2024-27459 Microsoft case number: 85932 Reported-by: Vladimir Tokarev <vtokarev@microsoft.com> Change-Id: Ib5743cba0741ea11f9ee62c4978b2c6789b81ada Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Heiko Hund <heiko@openvpn.net> Message-Id: <20240319152803.1801-2-lev@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28420.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-03-19interactive.c: disable remote access to the service pipeLev Stipakov
Remote access to the service pipe is not needed and might be a potential attack vector. For example, if an attacker manages to get credentials for a user which is the member of "OpenVPN Administrators" group on a victim machine, an attacker might be able to communicate with the privileged interactive service on a victim machine and start openvpn processes remotely. CVE: 2024-24974 Microsoft case number: 85925 Reported-by: Vladimir Tokarev <vtokarev@microsoft.com> Change-Id: I8739c5f127e9ca0683fcdbd099dba9896ae46277 Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Heiko Hund <heiko@openvpn.net> Message-Id: <20240319151723.936-2-lev@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28419.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-03-18Update Copyright statements to 2024Frank Lichtenheld
Change-Id: Ic377958d303b1dcfa9d877d3a63ecf39bdff7aef Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20240315170054.2368254-1-frank@lichtenheld.com> URL: https://sourceforge.net/p/openvpn/mailman/message/58749316/ Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-03-08remove repetitive words in documentation and commentswellweek
github: OpenVPN/openvpn/pull/517 Change-Id: I4f349963b41ebe155d3866da8955f2d7245d0394 Signed-off-by: wellweek <xiezitai@outlook.com> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20240308140112.4015131-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28368.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-01-17cmake: symlink whole build dir not just .json fileHeiko Hund
It turned out that symlinking compile_commands.json from the top level source dir has some issues: * file is not created on Windows and symlinking may cause an error * some IDEs create their own json and error out b/c a file exists Since clangd also looks for the json in build/ directories by default, we now symlink the whole build directory instead, not just the json file. This approach requires for the existing build/ dir in the repo to vanish. Luckily it only contains one automake include file, which is moved to the top level source dir. Lastly, make this an opt-in feature, so that the default configuration of the buildsystem never causes a build failure because of this. Change-Id: Ib1a5c788269949d8de95d1da2cb0c32a65bf13f2 Signed-off-by: Heiko Hund <heiko@ist.eigentlich.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20240117134929.5317-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28061.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2023-12-02Remove compat versionhelpers.h and remove cmake/configure check for itArne Schwabe
The cmake file defined that file to be never present in contrast to the old msvc-config.h that always had it present. Remove also the compat implementation taken from mingw. All our current build environments already have that header in place. Change-Id: I9c85ccab6d51064ebff2c391740ba8c2d044ed1a Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Signed-off-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20231128103950.62407-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27573.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2023-08-11Set WINS servers via interactice serviceLev Stipakov
At the moments WINS servers are set either: - via DHCP, which works only for tap-windows6 driver - via netsh when running without interactice service This means that in 2.6 default setup (interactive service and dco) WINS is silently ignored. Add WINS support for non-DHCP drivers (like dco) by passing WINS settings to interactive service and set them there with netsh call, similar approach as we use for setting DNS. Fixes https://github.com/OpenVPN/openvpn/issues/373 Change-Id: I47c22dcb728011dcedaae47cd03a57219e9c7607 Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20230728131246.694-1-lstipakov@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26903.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2023-06-27Remove all traces of the previous MSVC build systemFrank Lichtenheld
Completely replaced by the CMake build system now. v3: - rebase on top of my dist fixes Change-Id: I807cffa40f18faa1adec4e15e84c032877a2b92e Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Lev Stipakov <lstipakov@gmail.com> Message-Id: <20230620135310.94455-4-frank@lichtenheld.com> URL: https://www.mail-archive.com/search?l=mid&q=20230620135310.94455-4-frank@lichtenheld.com Signed-off-by: Gert Doering <gert@greenie.muc.de>
2023-06-27CMake: Add complete MinGW and MSVC buildFrank Lichtenheld
This is based on the initial CMake patch by Arne Schwabe, but extends that to provide a complete replacement for existing MinGW build (autotools based) and MSVC build (openvpn.sln). The following features are added while switching these builds to CMake: - vcpkg support for MinGW build, allowing for trivial cross-compilation on Linux - Add unittests to MSVC build - Rework MSVC config header generation, removing need for separate headers between autotools and MSVC The following advantages are reasons for switching to CMake over the existing MSVC build: - Easier to maintain CMake files without IDE than the sln and vcxproj files - Able to maintain MSVC and MinGW build side-by-side The plan is to completely remove the existing MSVC build system but leave the existing autotools builds in place as-is, including MinGW support. CMake is not the intended build system for Unix-like platforms and there are no current plans to switch to it. v2: - Reduce default warning level for MSVC to /W2. With /W3 the build is just much too noisy, making it difficult to spot new warnings. - Change MSVC CMake presets to have hardcoded build type. When using pkg_search_module MSVC Multi-Config builds do not work correctly at all since PkgConfig doesn't seem to be able to create multi-config libraries like find_package does. - Change minGW presets to be Multi-Config capable. - Remove OPENVPN_VERSION_MAJOR, OPENVPN_VERSION_MINOR, OPENVPN_VERSION_PATCH from config.h.cmake.in. They are not required and cause macro redefinition warnings in MSVC (with openvpn-plugin.h). gcc doesn't warn about this because the definitions are identical so no need to fix this in autoheader config.h.in. v3: - Apply fixes by Lev Stipakov to match MSVC compile options better to previous build. - Apply change by Lev Stipakov to enable generation of PDB files. - Move /Brepro to its own commit. This is a behavior change that should be more visible. - Rebase on top of my dist fixes. Change-Id: I237f28eca618d4fc476225b887c0be26cca362b1 Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Lev Stipakov <lstipakov@gmail.com> Message-Id: <20230620135310.94455-3-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26754.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2023-05-19Interactive service: do not force a target desktop for openvpn.exeSelva Nair
Setting the desktop as "winsta0\default" does not always work when run from a non-interactive session which may not have access to the the window station "Winsta0". Leave this as NULL to let the system automatically assign a window station and desktop. Test runs on Win10 confirm that "Winsta0\Default" still gets selected when run interactively (e.g., using the GUI or from task scheduler as an interactive job). This is the same behaviour as now. The change allows "interactive service" to be used for launching OpenVPN from non-interactive sessions. For example, when service client is a non-interactive task from the task scheduler, the default desktop in a custom window station gets assigned to openvpn.exe. Note that we already run openvpn.exe in a non-interactive window station when directly launched by "automatic service". Github: Fixes OpenVPN/openvpn-gui#626 Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20230518173345.2722530-1-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26705.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2023-03-22Make error in setting metric for IPv6 interface non-fatalSelva Nair
- Unfortunately there are still users out there who disable IPv6 on tun/tap/dco interfaces or even system-wide. Github: fixes OpenVPN/openvpn#294 Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20230322151550.1596669-1-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26477.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2023-02-02block-dns using iservice: fix a potential double freeSelva Nair
- An item added to undo-list was not removed on error, causing attempt to free again in Undo(). Also fix a memory leak possibility in the same context. Github: fixes OpenVPN/openvpn#232 v2: Split add and delete functions and reuse the delete function for cleanup. Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Lev Stipakov <lstipakov@gmail.com> Message-Id: <20230201170735.2266851-1-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26130.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2023-01-10Update copyright year to 2023Frank Lichtenheld
Manually excluded ovpn_dco_win.h because it is an imported file. ovpn_dco_linux.h is already excluded because it still says 2021. Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20230110160531.81010-1-frank@lichtenheld.com> URL: https://patchwork.openvpn.net/project/openvpn2/patch/20230110160531.81010-1-frank@lichtenheld.com/ Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-12-31Cleanup: Close duplicated handles in interactive serviceSelva Nair
Several handles from openvpn.exe are duplicated in the service for registering ring buffer memory maps with the driver. These handles are not required after registration, as all access is through handles in openvpn.exe. Only the map base address (send_ring, rceive_ring) need be retained for later unmapping. Use local variables for duplicated handles and close them soon after use. The struct ring_buffer_handles_t is renamed to ring_buffer_maps_t as there are no handles in there any longer. Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Lev Stipakov <lstipakov@gmail.com> Message-Id: <20221229182739.1477336-2-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25863.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-12-31Use undo_lists for saving ring-buffer handles in interactive serviceSelva Nair
HandleRegisterRingBuffers() in interactive.c did not follow the the original API of HandleMessage(): a new argument was added to HandleMessage to pass-in prer-process ring-buffer handles. The existing undo lists argument is meant for such use. Rewrite following the original design. Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Lev Stipakov <lstipakov@gmail.com> Message-Id: <20221229182739.1477336-1-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25864.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-12-29Properly unmap ring buffer file-map in interactive serviceSelva Nair
The return value of MapViewOfFile must be passed to UnmapViewofFile, instead of the file handle. Github: Fixes OpenVPN/openvpn#206 v2: move *ring = NULL inside if {} Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Lev Stipakov <lstipakov@gmail.com> Message-Id: <20221229134729.1474034-1-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25859.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-12-22msvc: upgrade to Visual Studio 2022Lev Stipakov
Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20221214160940.153-1-lstipakov@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25697.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-09-09msvc: remove .filters filesLev Stipakov
Filters file defines custom logical folders in Solution Explorer. We don't use this functionality and it requires maintenance, so let's remove those. While on it, remove dco linux files from VS project. Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20220905115639.379-1-lstipakov@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25149.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-04-21The Great Reformatting of 2022David Sommerseth
It was agreed it was time to do a full reformat fix-up of the whole source tree again. Over time (since late 2016) small changes has not adhered to our uncrustify defined coding style. This realigns to our current standards. Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20220420143050.52790-1-openvpn@sf.lists.topphemmelig.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24123.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-03-17msvc: adjust build options to harden binariesLev Stipakov
- enable hardware-enforced stack protection on compatible hardware/software (/CETCOMPAT linker option) - hash object files with SHA256 (/ZH:SHA_256 compiler option) - enable SDL. The required to add _CRT_NONSTDC_NO_DEPRECATE _CRT_SECURE_NO_WARNINGS _WINSOCK_DEPRECATED_NO_WARNINGS preprocessor definitions. I don't feel like replacing strdup (which is correct POSIX function) and inet_ntoa (we always pass IPv4 address to it, inet_ntop will make code more complex) Above issues were discovered by bitskim. Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20220218235004.269-1-lstipakov@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23851.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-01-26update copyright year to 2022Antonio Quartulli
Update performed by means of: dev-tools/update-copyright.sh Cc: David Sommerseth <davids@openvpn.net> Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <20220125142456.18176-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23650.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-09-27BUILD: enable CFG and Spectre mitigation for MSVCIlya Shipitsin
found by BinSkim Signed-off-by: Ilya Shipitsin <chipitsine@gmail.com> Acked-by: Lev Stipakov <lstipakov@gmail.com> Message-Id: <20210922095756.1929-1-chipitsine@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22870.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-06-15msvc: standalone buildingLev Stipakov
This finally enables standalone MSVC building, without dependency on openvpn-build/msvc. This makes MSVC build process much simpler. Dependencies are managed by vcpkg. To install dependencies, run: > vcpkg --overlay-ports=<openvpn>\contrib\vcpkg-ports --overlay-triplets=<openvpn>\contrib\vcpkg-triplets install lz4:x64-windows-ovpn lzo:x64-windows-ovpn openssl-windows:x64-windows-ovpn pkcs11-helper:x64-windows-ovpn tap-windows6:x64-windows-ovpn To build for other arch, use x86-windows-ovpn or arm64-windows-ovpn. Custom triplets are defines so that lz4 is linked statically and other libraries dynamically. Since we don't have CMake support yet, we cannot use vcpkg manifest mode, since it doesn't work with overlay ports (https://github.com/microsoft/vcpkg/issues/12289), therefore this one-time manual dependency installation is required. While on it, bump msvc-generate project target version to VS2019 and cleanup leftovers from compat.vcxproj.filters. Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20210514045704.686-1-lstipakov@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22389.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-06-15Update copyrightsDavid Sommerseth
- Update the update-copyright script to include more contributors as well as correcting a few typos - Correct a copyright address in the source code to now used address (dazo) - Update copyright year to 2021 Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20210609213231.22576-1-openvpn@sf.lists.topphemmelig.net> URL: https://www.mail-archive.com/search?l=mid&q=20210609213231.22576-1-openvpn@sf.lists.topphemmelig.net URL: https://sourceforge.net/p/openvpn/mailman/message/37299719/ Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-05-25Use C standard compliant format specs in wprintf functionsSelva Nair
- Use %ls for wchar_t * and %hs for char * variables This makes it possible to build correctly with or without __USE_MINGW_ANIS_STDIO defined. When this define is not used all printf/scanf family functions are resolved from the windows runtime MSVCRT. Newer (since version 8) mingw-w64 versions have started automatically enabling this macro under some feature sets such as _GNU_SOURCE and C99. The changes should not affect MSVC builds as Windows support these format specifications. Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Lev Stipakov <lstipakov@gmail.com> Message-Id: <20210522033232.20548-2-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22436.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-05-25Make it explicit that WIndows build requires UNICODE supportSelva Nair
The interactive service code implicitly treats TCHAR == WCHAR in several places with the assumption that we build only with UNICODE defined. Make this explicit and remove some redundant code. Also replace openvpn_sntprintf(), _tprintf() and similar with explicit wide string functions. This adds some definiteness as to which stdio functions are used, and helps the next commit that makes those calls C-standard compliant. Also, replace direct swprintf calls with openvpn_swprintf. Note: we need UNICODE defined mainly because of the use of TEXT("..") throughout the code. If those are replaced by L"..", we could build with just -municode as done for OpenVPN core. Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Lev Stipakov <lstipakov@gmail.com> Message-Id: <20210522033232.20548-1-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22437.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-05-10msvc: add ARM64 configurationLev Stipakov
While on it, bump msvc solution version. Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20210507145644.195-1-lstipakov@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22325.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-05-02windows: list all enum values in switch blockAntonio Quartulli
A switch block in interactive.c is missing the _undo_type_max value of the neum set, thus triggering a compiler warning. Due to the logic, this value cannot really be assigned to the variable being examinated, however, add the missing enum value to silence the warning. Fixes: interactive.c: In function ‘Undo’: interactive.c:1561:13: warning: enumeration value ‘_undo_type_max’ not handled in switch [-Wswitch] 1561 | switch (type) | ^~~~~~ Signed-off-by: Antonio Quartulli <antonio@openvpn.net> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20210501130640.9330-4-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22267.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-03-31Remove automatic serviceSelva Nair
This has been replaced by openvpnserv2 since 2.4.0 and we have stopped setting up this service in the installer since 2.5.0. Get rid of the unused code. The mechanics of supporting multiple services with the same executable is retained for possible future use. For backwards compatibility, the command line option -instance is unchanged as "-instance <name> id" although <name>="interactive" is the only supported value now. Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Lev Stipakov <lstipakov@gmail.com> Message-Id: <1616991798-7179-1-git-send-email-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg21890.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-03-22openvpnserv: Cache last error before it is overriddenSimon Rozman
FormatMessage() sets the last error according to its own success. This looses the original error code leading to mismatched error message and error number when sprintfted together resulting in confusing event log message. Signed-off-by: Simon Rozman <simon@rozman.si> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20210322103957.1234-1-simon@rozman.si> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg21789.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-03-21iservice: Resolve MSVC C4996 warningsSimon Rozman
Lots of string functions were declared unsafe in favor of ..._s() counterparts. However, the code already is careful about the buffer size. Code analysis is just not smart enough (yet) to detect this. The code was refactored to use ..._s() variants MSVC is considering as "safe". Signed-off-by: Simon Rozman <simon@rozman.si> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20210321144627.1621-5-simon@rozman.si> URL: https://www.mail-archive.com/search?l=mid&q=20210321144627.1621-5-simon@rozman.si Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-03-21interactive.c: Resolve MSVC C4996 warningSimon Rozman via Openvpn-devel
It's about using a standard recommended alias for the wcsdup(): > warning C4996: 'wcsdup': The POSIX name for this item is deprecated. > Instead, use the ISO C and C++ conformant name: _wcsdup. See online > help for details. And the documentation says: > The Microsoft-implemented POSIX function names strdup and wcsdup are > deprecated aliases for the _strdup and _wcsdup functions. By default, > they generate Compiler warning (level 3) C4996. The names are > deprecated because they don't follow the Standard C rules for > implementation-specific names. However, the functions are still > supported. > > We recommend you use _strdup and _wcsdup instead. Or, you can continue > to use these function names, and disable the warning. For more > information, see Turn off the warning and POSIX function names. Reference: https://docs.microsoft.com/en-us/cpp/c-runtime-library/reference/strdup-wcs dup Signed-off-by: Simon Rozman <simon@rozman.si> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20210321144627.1621-3-simon@rozman.si> URL: https://www.mail-archive.com/search?l=mid&q=20210321144627.1621-3-simon@rozman.si Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-02-24Quote the domain name argument passed to the wmic commandSelva Nair
It appears wmic needs domain names containing hyphens to be quoted. Trac #1375 Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1613520275-28637-1-git-send-email-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg21570.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-09-28Set DNS Domain using iserviceSelva Nair
Use wmic instead of directly editing the registry as the former does not take full effect unless the dns client service is restarted. Editing the registry appears to work erratically depending on whether its followed with a dchp renew or ipconfig /registerdns etc. DOMAIN-SEARCH is not handled here as wmic only supports setting the global search list which will over-ride all interface specific values. Editing the registry directly combined with a wmic command to reset the global SearchList is an option that could be considered in a separate patch. Trac # 1209, 1331 v2 changes - Separate DNS domain setting from DNS server setting and call only once either during IPv4 processing or IPv6 processing if the former is not active. (file changed: tun.c) - Null terminate domain and interface_name received from the client. (file changed: interactive.c) Its done using a const cast-away of msg in a limited scope. Not pretty, but alternatives are no better. Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Lev Stipakov <lstipakov@gmail.com> Message-Id: <1601085886-10351-1-git-send-email-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg21097.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-07-25wintun: remove SYSTEM elevation hackLev Stipakov
As discussed a while ago on the mailing list and community meetings, having SYSTEM elevation hack inside openvpn code considered harmful. Since interactive service is the recommended way of using openvpn on Windows, limiting wintun usage to interactive service should not be an issue. Remove elevation hack code and provide an error message telling user to use interactive service or do SYSTEM elevation himself via psexec. Move implementation of register_ring_buffers() to header amd delete ring_buffer.c. Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20200724104841.89-1-lstipakov@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg20567.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-06-10Set the correct mtu on windows based systemsChristopher Schenk
Signed-off-by: Christopher Schenk <cschenk@mail.uni-paderborn.de> Acked-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20200421154612.14140-1-cschenk@mail.uni-paderborn.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19803.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-03-10wintun: upgrade error message in case of ring registration failureSimon Rozman
Rather than have the Interactive Service return a custom 0x20000004 (ERROR_REGISTER_RING_BUFFERS) error, return the true GetLastError() code that the TUN_IOCTL_REGISTER_RINGS provides. Signed-off-by: Simon Rozman <simon@rozman.si> Acked-by: Lev Stipakov <lstipakov@gmail.com> Message-Id: <20200205183841.1118-1-simon@rozman.si> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19367.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-03-08interactive.c: remove unused functionLev Stipakov
Function ReturnOpenvpnOutput was used to read openvpn process output and write it to openvpn-gui. Commit 852f1e4 has directed stdout/stderr streams of openvpn process to NUL, after which ReturnOpenvpnOutput() has become unused. Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: <selva.nair@gmail.com> Acked-by: Selva Nair <selva.nair@gmail.com> Message-Id: <20200229123515.9745-1-lstipakov@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19508.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-02-20Fix possible access of uninitialized pipe handlesSelva Nair
Compile time warning for openvpnserv.exe interactive.c: In function ‘RunOpenvpn’: interactive.c:160:27: warning: ‘svc_pipe’ may be used uninitialized in this function [-Wmaybe-uninitialized] When RunOpenvpn exits early due to errors, uninitialized svc_pipe and ovpn_pipe vars could get passed to CloseHandleEx(). Fix by initializing to NULL. Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Lev Stipakov <lstipakov@gmail.com> Message-Id: <1582163803-3342-1-git-send-email-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19480.html Signed-off-by: David Sommerseth <davids@openvpn.net>
2020-02-20Fix possibly uninitialized return value in GetOpenvpnSettings()Selva Nair
Compile time warning for openvpnserv.exe common.c:90:11: warning: ‘error’ may be used uninitialized in this function [-Wmaybe-uninitialized]; Uninitialized value gets returned if install-path is not found in the registry. Fix by setting it to the return value of GetRegString(). Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Lev Stipakov <lstipakov@gmail.com> Message-Id: <1582159777-2437-1-git-send-email-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19479.html Signed-off-by: David Sommerseth <davids@openvpn.net>
2020-02-10Swap the order of checks for validating interactive service userSelva Nair
Check the config file location and command line options first and membership in OpenVPNAdministrators group after that as the latter could be a slow process for active directory users. When connection to domain controllers is poor or unavailable, checking the group membership is slow and causes timeouts in the GUI (Trac 1051). However, in cases where the config is in the global directory, no group membership check should be required. The re-ordering here avoids the redundant check in such cases. In addition to this, its also proposed to improve the timeout handling in the GUI, but this change is still useful as it should completely eliminate the timeout issue for many users. v3: Do not send error message to the client pipe from ValidateOptions(). Instead save the error and send it on only if user authorization also fails. The error buffer size is increased to 512 wide chars as these messages could get long in some cases and may get truncated otherwise. Also see: https://github.com/OpenVPN/openvpn-gui/issues/332 Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Lev Stipakov <lstipakov@gmail.com> Message-Id: <1581309200-27870-1-git-send-email-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19388.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-12-17wintun: interactive service supportLev Stipakov
Wintun requires ring buffers registration to be performed by privileged process. In order to use openvpn with wintun by non-Administrator, we need to use interactive service and shared memory to register buffers. Openvpn process creates memory mapping object and event for send and receive ring and passes handles to interactive service. There handles are duplicated and memory mapped object is mapped into the address space of service process. Then address of mapped view and event handle is passed to wintun kernel driver. After interactive service preformed registration, openvpn process maps memory mapped object into own address space. Thus mapped views in openvpn and service process represent the same memory region. Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Simon Rozman <simon@rozman.si> Message-Id: <20191217125041.207-1-lstipakov@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19244.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-11-09Visual Studio: upgrade project files to VS2019Lev Stipakov
Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Simon Rozman <simon@rozman.si> Message-Id: <1573148729-27339-2-git-send-email-lstipakov@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19027.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-07-28Wrong FILETYPE in .rc filesGisle Vanem
I noticed the .rc-files for programs uses 'FILETYPE 0x2L'. The 0x2L' is for a .DLL (VFT_DLL). Ref: Win-Kit's 'um/verrsrc.h': #define VFT_DLL 0x00000002L Hence these '0x2L' should be replaced with 'VFT_APP': Acked-by: Lev Stipakov <lstipakov@gmail.com> Message-Id: <aa4f4026-a684-f96d-c8cb-d4f8a3468c4c@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg18644.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-01-22White-list pull-filter and script-security in interactive serviceSelva Nair
This allows the Windows GUI to use these options on the command line without triggering user authorization errors. Useful for (i) ignoring certain pushed options such as "route-method" which could otherwise bypass the interactive service (ii) enforcing a safer script-security setting from the GUI See also: https://github.com/OpenVPN/openvpn-gui/issues/235#issuecomment-456142928 Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1548172232-11268-1-git-send-email-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg18154.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2018-12-12uncrustify openvpnserv/ sourcesGert Doering
this is really just whitespace changes, but will make running uncrustify as pre-commit-check easier if the "base sources" won't see changes Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <20181130135641.11533-2-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg17971.html Signed-off-by: David Sommerseth <davids@openvpn.net>
2018-10-22Introduce openvpn_swprintf() with nul termination guaranteeLev Stipakov
Every call to swprintf is followed by line which adds nul terminator. This patch introduces openvpn_swprintf() which guarantees nul termination for size > 0. Same approach as for snprintf / openvpn_snprintf. Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Selva Nair <selva.nair@gmail.com> Message-Id: <1540203571-17646-1-git-send-email-lstipakov@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg17786.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2018-10-10interactive.c: fix usage of potentially uninitialized variableLev Stipakov
In function netsh_dns_cmd() it is possible to jump on a label and call free() on uninitialized pointer. Move pointer initialization above jump. To fix a few warnings which are treated as errors with SDL enabled, initialize pointers with NULL. Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Selva Nair <selva.nair@gmail.com> Message-Id: <1539022378-24485-1-git-send-email-lstipakov@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg17663.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2018-10-08msvc: Unify Unicode/MultiByte string setting across all cfg|platSimon Rozman
The openvpnserv.vcxproj source code is Windows API Unicode compliant with only Debug|x64 set to Unicode, while other cfg|plat pairs were set to MultiByte. Acked-by: Lev Stipakov <lstipakov@gmail.com> Message-Id: <20181008094600.10164-1-simon@rozman.si> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg17633.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
generated by cgit v1.1 at 2024-10-06 12:27:16 +0000