aboutsummaryrefslogtreecommitdiff
path: root/src
AgeCommit message (Collapse)Author
2023-04-11Support of DNS domain for DHCP-less driversLev Stipakov
We set DNS domain either via interactve service or DHCP. When interactive service is not used, for example, when profiles are started by OpenVPNService, this option is not working for DCO and wintun. This implements setting DNS domain via WMIC command, similar to implementation in interactive service. This is done when: - interactive service is not used - DHCP is not used (ip-win32 is either NETSH or IPAPI, or IPv4 address is not pushed) Github: fixes OpenVPN/openvpn#306 Change-Id: Ic72a4ecd0414c0d7bf013415f52640fd122cb739 Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Selva Nair <selva.nair@gmail.com> Message-Id: <20230406071546.1056-1-lstipakov@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26582.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 6cf7ce4eb33626b861031f965b35c3107d75e843)
2023-03-30vcpkg: request "tools" feature of openssl for MSVC buildFrank Lichtenheld
We need this for the MSI build. Previously this was enabled by default. Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Lev Stipakov <lstipakov@gmail.com> Message-Id: <20230330101536.533080-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26561.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit b1fc3f25bc27462100bf96d9b677d6a3c31d3303)
2023-03-28Bug-fix: segfault in dco_get_peer_stats()Selva Nair
We persist peer-stats when restarting, but an early restart before open_tun results in a segfault in dco_get_peer_stats(). To reproduce, trigger a TLS handshake error due to lack of common protocols, for example. Fix by checking that tuntap is defined before dereferencing it. Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Antonio Quartulli <a@unstable.cc> Message-Id: <20230327171236.51771-1-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26530.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 10c3f25a26bce480f80624c5ef4cb6774a31c305)
2023-03-24Don't overwrite socket flags when using DCO on WindowsLev Stipakov
Socket flags can be pushed, in which case they overwrite existing value. We use socket flags to distingust between DCO handle and socket on Windows. If server pushes --socket-flags, we treat DCO handle as socket and everything explodes. Fix by making link_socket_update_flags() update flags (like name suggests) instead of overwriting them. Also do not set TCP_NODELAY on DCO handle on Windows because it doesn't make sense. Change-Id: Ia34d73ca49041cb0ce22b84751cdbff57de96048 Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20230324121818.2358-1-lstipakov@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26513.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 82e7d5cfd81f03f045ace2bf1d3590b79441ea17)
2023-03-24Parse compression options and bail out when compression is disabledArne Schwabe
This change keeps the option parsing of compression options even when compression is disabled. This allows OpenVPN to also refuse/reject connections that try to use compression when compression is completely disabled. Patch v4: fix one missing USE_COMP Change-Id: I9d7afd8f1d67d2455b4ec6bc12f4dcde80140c4f Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20230324121050.1350913-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26512.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit a8170dd0e76a7440f3291ad26d78f8ca247a191b)
2023-03-24Add 'allow-compression stub-only' internally for DCOArne Schwabe
This changes the "no" setting of allow-compression to also refuse framing if DCO is active. This is important for our DCO implementations as these do not implement framing. This behaviour surfaced when a commercial VPN provider was pushing "comp-lzo no" to a client with DCO. While we are technically at fault here for announcing comp-lzo no support by announcing IV_LZO_STUB=1, the VPN provider continues to push "comp-lzo no" even in absense of that flag. As the new default we default to 'allow-compression no' if DCO is enabled and to 'allow-compression stub' otherwise. This will now also bail out if the server pushes a compression setting that we do not support as mismatching compression is almost never a working connection. In the case of lz4-v2 and lzo-v2 you might have a connection that works mostly but some packets will be dropped since they compressed which is not desirable either since it becomes very hard to debug. Patch v2: bail out if server pushes an unsupported method. Also include this bail out logic when OpenVPN is compiled without compression support. Patch v3: always parse all compression option and move logic to check method Patch v4: fix for not setting correct default for non-dco Change-Id: Ibd0c77af24e2214b3055d585dc23a4b06dccd414 Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20230324100640.1340535-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26509.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 4117d950788eebfaf6c9b5dde278e3a81b9e805d)
2023-03-23Refuse connection if server pushes an option contradicting allow-compressArne Schwabe
This removes also the checks in options.c itself as they we now bail out later and no longer need to ignore them during parsing. Change-Id: I872c06f402c35112194ba77c3d6aee78e22547cb Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20230323170601.1256132-2-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26503.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit e86bc8b2967484afdb1e96efddb8d91185c4cc2c)
2023-03-23Simplify --compress parsing in options.cArne Schwabe
This removes a level of identation and make the "stub" condition easier to see. Change-Id: Iae47b191f522625f81eedd3a237b272cb7374d90 Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20230323170601.1256132-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26501.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit bfc00a01c10bbdd9683aab5db2c2e7dcbb2f7378)
2023-03-23dco-linux: implement dco_get_peer_stats{, multi} APIAntonio Quartulli
With this API it is possible to retrieve the stats for a specific peer or for all peers and then update the userspace counters with the value reported by DCO. Change-Id: Ia3990b86b1be7ca844fb1674b39ce0d60528ccff Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20230322192757.20767-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26481.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 5a8fb55ac8cf4019afee884d3be545ddf87435a4)
2023-03-23Print DCO client stats on SIGUSR2Lev Stipakov
Change-Id: I465febdf7ee5fe573e88255844f718efb60f8e8a Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20230322113249.2039-1-lstipakov@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26471.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit d5238627e4fab93a6c09816c60eb90e237b626c3)
2023-03-23dco-freebsd: use m->instances[] instead of m->hashAntonio Quartulli
When retrieving the multi_instance of a specific peer, there is no need to peform a linear search across the whole m->hash list. We can directly access the needed object via m->instances[peer-id] in constant time (and just one line of code). Adapt the dco-freebsd code to do so. v4: use "peerid" everywhere as that's what FreeBSD does, change message text Cc: Kristof Provost <kp@FreeBSD.org> Change-Id: I8d8af6f872146604a9710edf443db65df48ac3cb Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Kristof Provost <kp@freebsd.org> Message-Id: <20230323080341.51624-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/search?l=mid&q=20230323080341.51624-1-gert@greenie.muc.de Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 03145f223236df90b35d1db444319fd3f785792b)
2023-03-22Make error in setting metric for IPv6 interface non-fatalSelva Nair
- Unfortunately there are still users out there who disable IPv6 on tun/tap/dco interfaces or even system-wide. Github: fixes OpenVPN/openvpn#294 Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20230322151550.1596669-1-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26477.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit b8ee8c43fd81988a58343da466999d2e30ae6221)
2023-03-22Fix '--inactive <time> 0' behavior for DCOLev Stipakov
Make sure we exit if <bytes> is 0 (not set) and no traffic was produced. According to man page and non-DCO --inactive implementation, we exit if amount of bytes produced is less than <bytes> specified. DCO implementation will do off-by-ones, but we consider it as okay since we don't want to complicate code to handle both bytes=0 and >0 cases. Change-Id: I4c089e486728a43bfe42596787c00355838311da Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20230322113408.2057-1-lstipakov@gmail.com> URL: https://www.mail-archive.com/search?l=mid&q=20230322113408.2057-1-lstipakov@gmail.com Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 6c64b46b15476351ca19f9a8f3cb8185aa2c7e07)
2023-03-21dns option: allow up to eight addresses per serverHeiko Hund
This change allows configuration of more than one address per family for a DNS server. This way you can specify backup addresses in case a server is not reachable. During closer inspection of the various DNS backend in supported operation systems it turned out that our previous idea to have more than one DNS server applied in order of priority does not work in most cases. Thus it became important to be able to specify backup addresses. So instead of doing dns server 1 address 1.2.3.4 2001::1 dns server 2 address 5.6.7.8 2001::2 to specify a backup addresses, this is now done like so: dns server 1 address 1.2.3.4 2001::1 dns server 1 address 5.6.7.8 2001::2 or you can have all the addresses on one line if you like: dns server 1 address 1.2.3.4 2001::1 2001::2 5.6.7.8 This also saves some repeated options when (backup) servers share the same settings like "resolve-domains" compared to the originally intended way. The order in which addresses are given is retained for backends that support this sort of cross address family ordering. Change-Id: I9bd3d6d05da4e61a5fa05c0e455fc770b1fe186a Signed-off-by: Heiko Hund <heiko@ist.eigentlich.net> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20230310050814.67246-1-heiko@ist.eigentlich.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26386.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 424ae5906388af8769ae448080fa3b7ec266e8d8)
2023-03-21multi: don't call DCO APIs if DCO is disabledAntonio Quartulli
The agreement with the DCO submodule is that no API should be called if DCO is actually disabled. For this reason, every invocation must happen only after having checked that dco_enabled() returns true. Add missing checks before invoking dco_get_peer_stats_multi() Reported-by: Lev Stipakov <lev@openvpn.net> Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Lev Stipakov <lstipakov@gmail.com> Message-Id: <20230321102842.10780-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26458.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 891c71db5e26291b19885b9a5ae5c72011b86658)
2023-03-21dco-linux: remove M_ERRNO flag when printing netlink error messageAntonio Quartulli
Netlink has its own error space and reports errors via the return value of its functions. For this reason remove the M_ERRNO flag when printing its errors. At the moment we get something like this: netlink reports error (-7): Invalid input data or parameter: Interrupted system call (errno=4) where the errno=4 (and its human readable representation) is a leftover from the previous recv() interrupted by a signal and it is totally unrelated to this netlink failure. Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20230320195820.6675-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26452.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 23903fd579353c9892415a750f17a9832a79cced)
2023-03-20Improve error message on short read from socks proxySelva Nair
Change-Id: Id00006bf8ea705d02eff2cbfba7d841e1cdb6ae1 Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20230318141330.1315235-1-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26437.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 172640189277c940439d24fd31a59b8faffd0b3e)
2023-03-20Only update frame calculation if we have a valid link socketsArne Schwabe
Without this, we will caculate a pointer to the linksocket relative to a null pointer in get_link_socket_info(), which itself does not crash and the pointer seems not to be accessed later, so we do not get a crash here. This is still not the correct behaviour and the undefined behaviour sanitiser from llvm/clang finds this. Change-Id: I82a20ac72f60f8770ea1b4ab0c8cdea31868abe7 Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20230301134455.2810114-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26318.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 2d17869f8d9d8e27f64f1a7cd1514fbbb768807b)
2023-03-20Make sending plain text control message session awareArne Schwabe
The control messages coming from auth pending should always be on the session that triggered them (i.e. INITIAL or ACTIVE) and not always on the active session. Rework the code path that trigger those messsages from management and plugin/script to specify the TLS session. We only support the two TLS sessions that are supposed to be active. TLS sessions in any lame slot (TM_LAME or KS_LAME) are not considered to be candidates for sending messages as these slots only serve to keep key material around. Unfortunately, this fix requires the management interface to be changed to allow including the specific session the messages should to go to. As there are very few users of this interface with auth-pending, I made this a hard change instead of adding hacky workaround code that is not always working correctly anyway. send_control_channel_string() will continue to only use the primary session and key but the current users of that (push replys and exit notification) already require the established session to be the active one, so there no changes needed at the moment. Github: fixes OpenVPN/openvpn#256 Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20230301135353.2811069-2-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26320.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit a261e173341f8e68505a6ab5a413d09b0797a459)
2023-03-20Use key_state instead of multi for tls_send_payload parameterArne Schwabe
Currently, this function and other parts of OpenVPN assume that multi->session[TM_ACTIVE].key[KS_PRIMARY] is always the right session to send control message. This assumption was only achieve through complicated session moving and shuffling in our state machine in the past. The old logic basically also always assumed that control messages are always for fully authenticated clients. This assumption was never really true (see AUTH_FAILED message) but has been broken even more by auth-pending. Cleaning up the state machine transitions in 7dcde87b7a broke this assumption even more. This change now allows to specify the key_state/TLS session that is used to send the control message. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20230301135353.2811069-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26319.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 06af538eb7bde36feb20ef63febb171c9607a5e6)
2023-03-20using OpenSSL3 API for EVP PKEY type name reportingMichael Baentsch
Signed-off-by: Michael Baentsch <info@baentsch.ch> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20230319075441.13021-1-info@baentsch.ch> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26439.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 6c111be9b109a6dbcd39cac7821ea3dd78ff6adf)
2023-03-17Support --inactive option for DCOLev Stipakov
When DCO is in use, userland doesn't see any traffic which breaks --inactive option. Fix by adding inactivity check to inactivity timeout callback. Get the cumulative tun bytes count (ping packets are excluded) from DCO and compare it to the previous value stored in c2.inactivity_bytes. Reset inactivity timer and update c2.inactivity_bytes if amount of new bytes exceeds inactivity_minimum_bytes, otherwise terminate session due to inactivity. Github: Fixes OpenVPN/openvpn#228 Currently works only on Windows, since we don't yet have single peer stats implementation for Linux and FreeBSD. Change-Id: Ib417b965bc4a2c17b51935b43c9627b106716526 Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Heiko Hund <heiko@ist.eigentlich.net> Message-Id: <20230315133808.1550-1-lstipakov@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26421.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 514eefb14ace41a5790e59b81654d1d5eed60670)
2023-03-16Refactor SSL_CTX_use_CryptoAPI_certificate()Selva Nair
- Loading the certificate and key into the provider is split out of setting up the SSL context. This allows testing of signing by cryptoapi-provider interface without dependence on SSL context or link-time wrapping. Change-Id: I269b94589636425e1ba9bf953047d238fa830376 Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20230315013516.1256700-4-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26414.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 0ad5f4d6c44daedca00dc399a5f914ac5850caa0)
2023-03-15Fix memory leaks in HMAC initial packet generationArne Schwabe
The HMAC leaks are just forgotten frees/deinitialisations. tls_wrap_control() will sometimes return the original buffer (non tls-crypt) and sometimes tls_wrap.work, so handling this buffer lifetime is a bit more complicated. Instead of further complicating that code just give our work buffer the same lifetime as the other one inside tls_wrap.work (put it into per-session gc_arena) as that is also more consistent. Second, packet_id_init() allocates a buffer with malloc and not using a gc_arena, so we need to also manually free it. Patch v2: add missing deallocations in unit tests of the new workbuf Patch v3: remove useless allocation of 0 size buffer in tls_auth_standalone_init Found-By: clang with asan Change-Id: I0cff44f79ee7e3bcf7b5981fc94f469c15f21af3 Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20230315195512.323070-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/ Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit e8ecaadd2ac38f2c2d4bcd40eeaea7401aa737a1)
2023-03-15Bugfix: Convert ECDSA signature form pkcs11-helper to DER encoded formSelva Nair
With OpenSSL 3.0 and xkey-provider, we use pkcs11h_certificate_signAny_ex() which returns EC signature as raw r|s concatenated. But OpenSSL expects a DER encoded ASN.1 structure. Do this conversion as done in cryptoapi.c. For code re-use, ecdsa_bin2sig() is consolidated with sig to DER conversion as ecdsa_bin2der() and moved to xkey_helper.c In the past when we used OpenSSL hooks installed by pkcs11-helper, such a conversion was not required as it was internally handled by the library. Reported by: Tom <openvpn@sup-logistik.de> Also see: https://bugzilla.redhat.com/show_bug.cgi?id=2177834 Tested-by: Florian Apolloner <florian@apolloner.eu> Change-Id: Ie20cf81edd643ab8ef3c41321353d11fd66c188c Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20230314122134.1248576-1-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26406.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit b7cf18f750f2a020032e09b6c4184579896876ee)
2023-03-14Fix memory leaks in open_tun_dco()Arne Schwabe
open_tun_dco_generic() already allocates the tt->actual_name string, which shadows the allocation in the FreeBSD/Linux specific methods. Found-By: clang with asan Change-Id: I51f5fcfff4e5f8203fdb9aec0245cfccd17043cc Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20230314144854.182110-2-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26411.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 021952705ba4b77a1d94bec85f6f02e6c612a37e)
2023-03-13dco: print FreeBSD versionKristof Provost
Implement dco_version_string() for FreeBSD. Unlike Linux and Windows the DCO driver is built into the operating system itself, so we log the OS version as a proxy for the DCO version. Signed-off-by: Kristof Provost <kp@FreeBSD.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20230309122332.92490-1-kprovost@netgate.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26367.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit fe0853d2e72dd3a639a95e420ad7eeed6b49e81b)
2023-03-13dco: print version to log if availableAntonio Quartulli
In order to provide better support in case of troubleshooting issues, it's important to know what exact DCO version is loaded on the user system. Therefore print the DCO version during bootup. For Windows and FreeBSD we currently implement a placeholder printing 'v0'. This should be improved with a follow-up patch. For Linux we directly fetch the module version from /sys and print something like: DCO version: 0.1.20230206-15-g580608ec7c59 Change-Id: Ie1f6fa5d12a473d353d84fd119c2430b638e8bcd Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20230309131419.29157-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26370.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 3da238e677b7801607e6777d9d23eb61e38034c2)
2023-03-13dco: don't use NetLink to exchange control packetsAntonio Quartulli
Using NetLink for control messages did not work out as it did lead to kernel side buffer congestion during heavy client activity. With this patch DCO will redirect control packets directly to the transport socket without altering them, so that userspace can happily process them as usual. NOTE: this is an API breaking change. Up to this commit, the userland requests a kernel module called "ovpn-dco" which does control messages via netlink. From this commit on, OpenVPN requests a kernel module named "ovpn-dco-v2" which brings the kernel change corresponding to this commit. If the system only has "the wrong module" available (either way), OpenVPN will log ... Kernel support for ovpn-dco missing, disabling data channel offload. and proceed without kernel support. Change-Id: Ia1297c3ae9a28b188ed21ad21ae96fff3d02ee4d [lev@openvpn.net: ensure win_dco flag is still exposed] Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20230309210344.5763-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26384.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit ac1d24286ad4788415ce6f56e97c18562d1cadbd)
2023-03-09Ensure n = 2 is set in key2 struct in tls_crypt_v2_unwrap_client_keyArne Schwabe
The ASSERT in xor_key2 assumes that all methods that load a key2 struct correctly set n=2. However, tls_crypt_v2_unwrap_client_key loads a key without setting n = 2, triggering the assert. Github: Closes and reported in OpenVPN/openvpn#272 Change-Id: Iaeb163d83b95818e0b26faf9d25e7737dc8ecb23 Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Antonio Quartulli <a@unstable.cc> Message-Id: <20230309120031.3780130-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26363.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 85832307fcb41c229ccb7ba83984726757eb32f7)
2023-03-09Set netlink socket to be non-blockingArne Schwabe
Even though we use select/poll to explicitly query when the netlink socket is ready for read, sometimes we end up reading from the socket when it is not ready to read and then the process hangs for several seconds (20-30s). Avoid this situation by setting the socket to be non-blocking, so we get a status in this case that allows us to continue. Change-Id: I35447c23a9350176007df5455bf9451021e9856d Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Antonio Quartulli <a@unstable.cc> Message-Id: <20230308151945.3670151-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26353.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 7aa3520768a68fb6a73ab64569c7be5d571f86fc)
2023-03-08Avoid warning about missing braces when initialising key structAntonio Quartulli
This avoids the warning from gcc about initialising the key2 struct. Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20230308133743.5059-1-a@unstable.cc> URL: https://www.mail-archive.com/search?l=mid&q=20230308133743.5059-1-a@unstable.cc Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 5a14a5ea572ec88e2a9e7bfdad9d5fe31025c021)
2023-03-08FreeBSD 12.x workaround for IPv6 ifconfig is needed on 12.4 as wellGert Doering
Commit 16d7f2cd4d90 tried to remove an FreeBSD 12.x ifconfig inet6 workaround based on the understanding that the upstream fix for bug 248172 went into 12.4, but that was a misread of the code - 12.4 needs the workaround as well, fixed in 13.0. Also extend comment to point to /etc/network.subr, which is the real source of the problematic code if checkyesno ipv6_activate_all_interfaces; then _ipv6_opts="-ifdisabled" elif [ "$1" != "lo0" ]; then <<<< _ipv6_opts="ifdisabled" <<<< fi Trac: 1226 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20230306080744.66069-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26335.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 549fbd83f9d445863cc62b3a658a406afacdaeac)
2023-03-07Dynamic tls-crypt for secure soft_reset/session renegotiationArne Schwabe
Currently we have only one slot for renegotiation of the session/keys. If a replayed/faked packet is inserted by a malicous attacker, the legimate peer cannot renegotiate anymore. This commit introduces dynamic tls-crypt. When both peer support this feature, both peer create a dynamic tls-crypt key using TLS EKM (export key material) and will enforce using that key and tls-crypt for all renegotiations. This also add an additional protection layer for renegotiations to be taken over by an illegimate client, binding the renegotiations tightly to the original session. Especially when 2FA, webauth or similar authentication is used, many third party setup ignore the need to secure renegotiation with an auth-token. Since one of tls-crypt/tls-crypt-v2 purposes is to provide poor man's post quantum crypto guarantees, we have to ensure that the dynamic key tls-crypt key that replace the original tls-crypt key is as strong as the orginal key to avoid problems if there is a weak RNG or TLS EKM produces weak keys. We ensure this but XORing the original key with the key from TLS EKM. If tls-crypt/tls-cryptv2 is not active, we use just the key generated by TLS EKM. We also do not use hashing or anything else on the original key before XOR to avoid any potential of a structure in the key or something else that might weaken post-quantum use cases. OpenVPN 2.x reserves the TM_ACTIVE session for renegotiations. When a SOFT_RESET_V1 packet is received, the active TLS session is moved from KS_PRIMARY to KS_SECONDARY. Here an attacker could theorectically send a faked/replayed SOFT_RESET_V1 and first packet containing the TLS client hello. If this happens, the session is blocked until the TLS renegotiation attempt times out, blocking the legimitate client. Using a dynamic tls-crypt key here blocks any SOFT_RESET_V1 (and following packets) as replay and fake packets will not have a matching authentication/encryption and will be discarded. HARD_RESET packets that are from a reconnecting peer are instead put in the TM_UNTRUSTED/KS_PRIMARY slot until they are sufficiently verified, so the dynamic tls-crypt key is not used here. Replay/fake packets also do not block the legimitate client. This commit delays the purging of the original tls-crypt key data from directly after passing it to crypto library to tls_wrap_free. We do this to allow us mixing the new exported key with the original key. To be able to generate the dynamic tls-cryptn key, we need the original key, so deleting the key is not an option if we need it later again to generate another key. Even when the client does not support secure renegotiation, deleting the key is not an option since when the reconnecting client or (especially in p2p mode with float) another client does the reconnect, we might need to generate a dynamic tls-crypt key again. Delaying the deletion of the key has also little effect as the key is still present in the OpenSSL/mbed TLS structures in the tls_wrap structure, so only the number of times the keys is in memory would be reduced. Patch v2: fix spellings of reneg and renegotiations. Patch v3: expand comment to original_tlscrypt_keydata and commit message, add Changes.rst Patch v4: improve commit message, Changes.rst Patch v5: fix spelling/grammar mistakes. Add more comments. Patch v6: consistently calld this feature dynamic tls-crypt crypt. Note this changes the export label and makes it incompatible with previous patches. Patch v7: also xor tls-auth key data into the dynamic tls-crypt key like tls-crypt key data Patch v8: Avoid triggering ASSERT added in v7 by properly setting keys.n = 2 when loading tls crypt v2 client keys. Add dyn-tls-crypt to protocol options printout. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Heiko Hund <heiko@ist.eigentlich.net> Message-Id: <20230307150233.3551436-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26341.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 6a05768a71ede7a8654fc6f3104f7449509efee0)
2023-03-06Do not save pointer to 'struct passwd' returned by getpwnam etc.Selva Nair
- This pointer is to a static area which can change on further calls to getpwnam, getpwuid etc. Same with struct group returned by getgrnam. As the only field later referred to is uid or gid, fix by saving them instead. Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20230306053346.796992-1-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26332.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 62024046dffd6ff10309b791cd6600fe80bc46e3)
2023-03-03Reduce initialisation spam from verb <= 3 and print summary insteadArne Schwabe
The messages about cipher initialisation are currently very noisy, especially if tls-auth/tls-crypt is in use. Typically messages like this is display for AES-256-CBC with SHA256: Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key Outgoing Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key Incoming Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication in addition to the tls-crypt/tls-auth messages that has the amount of messages. These message are not that helpful. The only meaningful information is better suited in compat messages. This commit moves the spammy messages to verb 4 and consistently prints out the cipher/auth used in the data channel instead on verb 2: Data Channel: cipher 'AES-256-CBC' auth 'SHA256' This patches also summarises other aspects of the imported options for VPN connection and prints them (even if not coming from pulled options): Data Channel: cipher 'AES-256-GCM' Timers: ping 8, ping-restart 40 Protocol options: explicit-exit-notify 1, protocol-flags tls-ekm And move the OPTIONS IMPORT: xx modified that are included in the new messages to D_PUSH_DEBUG (verb 7) since they do not add any useful information anymore. Patch v2: also compile with compression disabled Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20230214112044.1021962-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26249.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit c333a0c05f9d454efb38fc04c1dca1413bfc48ff)
2023-03-03dco: define OVPN_DEL_PEER_REASON_TRANSPORT_DISCONNECT on FreeBSDKristof Provost
FreeBSD's if_ovpn will never emit this as a peer deletion reason (because it doesn't support TCP), but this allows us to align the defines between Linux and FreeBSD, and remove a Linux-specific case from process_incoming_del_peer(). Signed-off-by: Kristof Provost <kprovost@netgate.com> Acked-by: Antonio Quartulli <a@unstable.cc> Message-Id: <20230303110511.9569-1-kprovost@netgate.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26324.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 155cf11531e619cf24b2aa9d0acb4ff834b2e8fa)
2023-03-02options.c: enforce a minimal fragment sizeKristof Provost
Very low values for 'fragment' can result in a division by zero in optimal_fragment_size() (because it rounds max_frag_size down with FRAG_SIZE_ROUND_MASK). Enforce a minimal fragment size of 68 bytes, based on RFC 791 ("Every internet module must be able to forward a datagram of 68 octets without further fragmentation.") Signed-off-by: Kristof Provost <kprovost@netgate.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20230301091851.82243-1-kprovost@netgate.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26313.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 78e504210add19343e65f5c5b80be9ea6e9e95ab)
2023-03-01Use proper print format/casting when converting msg_channel handleArne Schwabe
The current casting triggers a warning on 32bit: init.c:1842:66: error: cast from pointer to integer of different size [-Werror=pointer-to-int-cast] Use the proper printf format specifier for printing a pointer avoiding the cast alltogether. In options.c use a cast to intptr_t before converting to a handle to avoid having to ifdef atoll/atol for 32/64 bit. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Lev Stipakov <lstipakov@gmail.com> Message-Id: <20230214134323.1033590-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26255.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 9c52e0c610ef1229561c2d038ca41fe2cbefe8da)
2023-02-27Avoid management log loop with verb >= 6Lev Stipakov
This log message is printed within check_tls(), which is called by pre_select(), which is called on every iteration of event loop. When management is attached (and doesn't use own event loop), this message sets management state to "wait write", which arms event loop. When on the next iteration iowait returns with "management write event is set", we call pre_select() and print that message again, causing the loop. Fix by simply removing this log message. Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Antonio Quartulli <a@unstable.cc> Message-Id: <20230217122156.541-1-lstipakov@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26284.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit b8eddda8524bf6f164361667bfce6bbb3fac846b)
2023-02-25Windows: fix signedness errors with recv/sendFrank Lichtenheld
On Linux those functions actually take void pointer, so no behavior change there. On Windows, we avoid warnings about unsigned char vs char. Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20230203191440.136050-6-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26144.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 7acd93a6bef2dd9b660571c29b5f41c8ca351161)
2023-02-25Add logging for windows driver selection processLev Stipakov
Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20230216160129.994-1-lstipakov@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26281.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 5b748ad099ed69b893124e2805b5ddeb6b0ec8fc)
2023-02-21Disable DCO if proxy is set via managementLev Stipakov
DCO doesn't support proxy and we already disable DCO is proxy is set in profile. Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Antonio Quartulli <a@unstable.cc> Message-Id: <20230220090601.983-1-lstipakov@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26287.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 45a1cb2ad85a50feded10dad706132bd8a7f6133)
2023-02-20Exit if a proper message instead of segfault on Android without managementArne Schwabe
The Android implementation is relying on the management interface to be always available. Trying to run the Android binary without the mangament interface outside the app leads to a segfault. Exit with a FATAL error instead. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20230220131424.1749736-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26288.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 3132bead497deca24dc638e151bf7194df6f4884)
2023-02-14Option --cryptoapicert: support issuer name as a selectorSelva Nair
- Certificate selection string can now specify a partial issuer name string as "--cryptoapicert ISSUER:<string>" where <string> is matched as a substring of the issuer (CA) name in the certificate. Partial case-insensitive matching against the "issuer name" is used. Here "issuer name" is a text representation of the RDN's separated by commas. E.g., "CA, Ontario, Toronto, Acme Inc., IT, Acme Root CA". See MSDN docs on CertFindCertificateInStore() with CERT_FIND_ISSUER_STR as "FindType" for more details. As the order of RDN's is not well-defined[*] and type names like "OU" or "CN" are not included, its best to match against a single attribute like the CN of the issuer: E.g., --cryptoapicert "ISSUER:Acme Root" [*] Windows appears to order RDN's in the reverse order to which its written in the certificate but do not rely on this. Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20230128223421.2207802-2-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26092.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit b9e0e4060798ed88d2170702f2935754616b1200)
2023-02-14cryptoapi.c: simplify parsing of thumbprint hex stringSelva Nair
v2: Moved the "parse_hexstring" chunk to a function for clarity and to permit unit-testing. A test is submitted as a follow up patch. Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20230204004322.250210-1-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26146.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 94bbe98b2b135b2da74b694358e6c94c1defbffd)
2023-02-14cryptoapi.c: remove pre OpenSSL-3.01 supportSelva Nair
- Require xkey-provider (thus OpenSSL 3.01+) for --cryptoapicert Note: Ideally we should also make ENABLE_CRYPTOAPI conditional on HAVE_XKEY_PROVIDER but that looks hard unless we can agree to move HAVE_XKEY_PROVIDER to configure/config.h. v2: use "binary" instead of "version" in the error message Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20230201230340.2268781-1-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26131.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 4b28831e07a357476cb31a6f439becff3dc8c842)
2023-02-14cyryptapi.c: log the selected certificate's nameSelva Nair
- With various ways of specifying the selector-string to the "--cryptoapicert" option, its not immediately obvious which certificate gets selected from the store. Log it. The "name" logged is a friendly name (if present), or a representative element of the subject (usually the common-name). Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20230128223421.2207802-3-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26093.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit ddffcea2922905ec13e0e39239d106e0edbea5de)
2023-02-14Improve format specifier for socket handle in WindowsLev Stipakov
Socket is a handle on Windows, which is usually logged in hex. Also an interesting value is INVALID_SOCKET, which is ~0. PRIuPTR prints decimals, and for INVALID_SOCKET it prints something like 2023-02-10 14:45:21 us=906000 write to TUN/TAP : Jrjestelmkutsulle annettu data-alue on liian pieni. (fd=18446744073709551615,code=122) PRIxPTR prints hex, and INVALID_SOCKET looks a bit nicer: 2023-02-10 15:17:11 us=828000 write to TUN/TAP : Jrjestelmkutsulle annettu data-alue on liian pieni. (fd=ffffffffffffffff,code=122) Reported-by: Selva Nair <selva.nair@gmail.com> Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <20230210133159.1336-1-lstipakov@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26220.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 6731314a82d1a3c76b5497749985ee20c0c7d8eb)
2023-02-14Combine extra_tun/frame parameter of frame_calculate_payload_overheadArne Schwabe
Instead of passing a value and a bool just pass the value and 0 if the caller does not want the value to be added. This also allows the function to be used by a function without a frame struct. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20230210142712.572303-3-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26223.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit e759c0ea6fe8679edf4d5208f2f0dc8cee5e948c)
generated by cgit v1.1 at 2024-10-06 22:49:46 +0000