aboutsummaryrefslogtreecommitdiff
path: root/src
AgeCommit message (Collapse)Author
2024-03-26Add bracket in fingerprint message and do not warn about missing verificationArne Schwabe
Github: fixes OpenVPN/openvpn#516 Change-Id: Ia73d53002f4ba2658af18c17cce1b68f79de5781 Signed-off-by: Arne Schwabe <arne-openvpn@rfc2549.org> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20240326103853.494572-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28474.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-03-26Fix snprintf/swnprintf related compiler warningsArne Schwabe
When openvpn_snprintf is replaced by snprintf the GCC/MSVC compiler will perform additional checks that the result is not truncated. This warning can be avoid by either explicitly checking the return value of snprintf (proxy) or ensuring that it is never truncated(tls crypt) Change-Id: If23988a05dd53a519c5e57f2aa3b2d10bd29df1d Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20240326104101.531291-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28475.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-03-25phase2_tcp_server: fix Coverity issue 'Dereference after null check'Frank Lichtenheld
As Coverity says: Either the check against null is unnecessary, or there may be a null pointer dereference. In phase2_tcp_server: Pointer is checked against null but then dereferenced anyway There is only one caller (link_socket_init_phase2) and it already has an ASSERT(sig_info). So use that here was well. v2: - fix cleanly by actually asserting that sig_info is defined Change-Id: I8ef199463d46303129a3f563fd9eace780a58b8a Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Arne Schwabe <arne-openvpn@rfc2549.org> Message-Id: <20240325071448.12143-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28452.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-03-25Use snprintf instead of sprintf for get_ssl_library_versionArne Schwabe
This is avoid a warning/error (when using -Werror) under current macOS of sprintf: __deprecated_msg("This function is provided for compatibility reasons only. Due to security concerns inherent in the design of sprintf(3), it is highly recommended that you use snprintf(3) instead.") Change-Id: I3c6fd36eb9daee9244d6dc6d9f22de1c5cf9d039 Signed-off-by: Arne Schwabe <arne-openvpn@rfc2549.org> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20240325125052.14135-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28458.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-03-19Disable DCO if proxy is set via managementLev Stipakov
Commit 45a1cb2a ("Disable DCO if proxy is set via management") attempted to disable DCO when proxy is set via management interface. However, at least on Windows this doesn't work, since: - setting tuntap_options->disable_dco to true is not enough to disable DCO - at this point it is a bit too late, since we've already done DCO-specific adjustments Since proxy can be set via management only if --management-query-proxy is specified, the better way is to add a check to dco_check_startup_option(). Github: fixes OpenVPN/openvpn#522 Change-Id: I16d6a9fefa317d7d4a195e786618328445bdbca8 Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20240318181744.20625-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28415.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-03-19interactive.c: Fix potential stack overflow issueLev Stipakov
When reading message from the pipe, we first peek the pipe to get the size of the message waiting to be read and then read the message. A compromised OpenVPN process could send an excessively large message, which would result in a stack-allocated message buffer overflow. To address this, we terminate the misbehaving process if the peeked message size exceeds the maximum allowable size. CVE: 2024-27459 Microsoft case number: 85932 Reported-by: Vladimir Tokarev <vtokarev@microsoft.com> Change-Id: Ib5743cba0741ea11f9ee62c4978b2c6789b81ada Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Heiko Hund <heiko@openvpn.net> Message-Id: <20240319152803.1801-2-lev@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28420.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-03-19interactive.c: disable remote access to the service pipeLev Stipakov
Remote access to the service pipe is not needed and might be a potential attack vector. For example, if an attacker manages to get credentials for a user which is the member of "OpenVPN Administrators" group on a victim machine, an attacker might be able to communicate with the privileged interactive service on a victim machine and start openvpn processes remotely. CVE: 2024-24974 Microsoft case number: 85925 Reported-by: Vladimir Tokarev <vtokarev@microsoft.com> Change-Id: I8739c5f127e9ca0683fcdbd099dba9896ae46277 Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Heiko Hund <heiko@openvpn.net> Message-Id: <20240319151723.936-2-lev@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28419.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-03-19win32: Enforce loading of plugins from a trusted directoryLev Stipakov
Currently, there's a risk associated with allowing plugins to be loaded from any location. This update ensures plugins are only loaded from a trusted directory, which is either: - HKLM\SOFTWARE\OpenVPN\plugin_dir (or if the key is missing, then HKLM\SOFTWARE\OpenVPN, which is installation directory) - System directory Loading from UNC paths is disallowed. Note: This change affects only Windows environments. CVE: 2024-27903 Change-Id: I154a4aaad9242c9253a64312a14c5fd2ea95f40d Reported-by: Vladimir Tokarev <vtokarev@microsoft.com> Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Selva Nair <selva.nair@gmail.com> Message-Id: <20240319135355.1279-2-lev@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28416.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-03-18Update Copyright statements to 2024Frank Lichtenheld
Change-Id: Ic377958d303b1dcfa9d877d3a63ecf39bdff7aef Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20240315170054.2368254-1-frank@lichtenheld.com> URL: https://sourceforge.net/p/openvpn/mailman/message/58749316/ Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-03-08remove repetitive words in documentation and commentswellweek
github: OpenVPN/openvpn/pull/517 Change-Id: I4f349963b41ebe155d3866da8955f2d7245d0394 Signed-off-by: wellweek <xiezitai@outlook.com> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20240308140112.4015131-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28368.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-03-08t_client.sh: Allow to skip testsFrank Lichtenheld
Individual tests can define a script to run to test whether they should be skipped. Included in this commit is an example check which checks whether we can do NTLM checks. This fails e.g. on recent versions of Fedora with mbedTLS (tested with Fedora 39) or when NTLM support is not compiled in. v2: - ntlm_support: - support OpenSSL 3 - allow to build without cmocka v3: - add example to t_client.rc-sample - t_client.sh code style - use syshead.h in error.h v5: - rename SKIP_x to CHECK_SKIP_x Change-Id: I13ea6752c8d102eabcc579e391828c05d5322899 Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20240308102818.9249-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/search?l=mid&q=20240308102818.9249-1-gert@greenie.muc.de Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-03-08check_compression_settings_valid: Do not test for LZ4 in LZO checkFrank Lichtenheld
Probably introduced by copy & paste since there is no COMP_ALGV2_LZO. Github: #500 Change-Id: Id6b038c1c0095b2f22033e9dc7090e2507a373ab Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Arne Schwabe <arne-openvpn@rfc2549.org> Message-Id: <20240216123037.3670448-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28251.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-03-08Minor fix to process_ip_headerGianmarco De Gregori
Removed if-guard checking if any feature is enabled before performing per-feature check. It doesn't save us much but instead introduces uneeded complexity. While at it, fixed a typo IMCP -> ICMP for defined PIPV6_ICMP_NOHOST_CLIENT and PIPV6_ICMP_NOHOST_SERVER macros. Fixes: Trac https://community.openvpn.net/openvpn/ticket/269 Change-Id: I4b5e8357d872c920efdb64632e9bce72cebee202 Signed-off-by: Gianmarco De Gregori <gianmarco@mandelbit.com> Acked-by: Arne Schwabe <arne-openvpn@rfc2549.org> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20240307124616.16358-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28345.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-03-07Persist-key: enable persist-key option by defaultGianmarco De Gregori
Change the default behavior of the OpenVPN configuration by enabling the persist-key option by default. This means that all the keys will be kept in memory across restart. Trac: #1405 Change-Id: I57f1c2ed42bd9dfd43577238749a9b7f4c1419ff Signed-off-by: Gianmarco De Gregori <gianmarco@mandelbit.com> Message-Id: <20240307140355.32644-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28347.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-03-05Fix typo --data-cipher-fallbackFrank Lichtenheld
Change-Id: I38e70cb74c10848ab2981efc4c4c8863c5c8785d Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Arne Schwabe <arne-openvpn@rfc2549.org> Message-Id: <20240305082236.17566-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28321.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-02-10Turn dead list test code into unit testArne Schwabe
Change-Id: I7511bc43cd6a0bcb89476f27d5822ab4a78d0d21 Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20240209105902.14506-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28201.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-02-09Implement generating TLS 1.0 PRF using new OpenSSL 3.0 APIsArne Schwabe
OpenSSL 3.0 introduced a new API for doing key derivation. So this leaves us now with three different implementation for 1.0.2, 1.1.x and 3.x. This was initially done to maybe still have a working TLS 1.0 PRF when using OpenSSL 3.0 in FIPS but it gives the same error as with the older API. But since moving to a new API is always good, we use the new API when using OpenSSL 3.0. We also print the internal OpenSSL error message when the KDF fails. This also allows us now to compile an OpenSSL build that has been built with OPENSSL_NO_MD5. Which is not yet common but might be in the future. Change-Id: Ic74195a4ed340547c5e862dc2438f95be318c286 Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20240209110629.15364-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28203.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-02-09Print SSL peer signature information in handshake debug detailsArne Schwabe
This is more SSL debug information that most people do not really need or care about. OpenSSL's own s_client also logs them: Peer signing digest: SHA256 Peer signature type: ECDSA The complete message looks like this: Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 2048 bits RSA, signature: RSA-SHA256, server temp key: 253 bits X25519, peer signing digest/type: SHA256 RSASSA-PSS or when forcing a specific group via tls-groups X448 with a ECDSA server: Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 384 bits ECsecp384r1, signature: ecdsa-with-SHA256, server temp key: 448 bits X448, peer signing digest/type: SHA384 ECDSA Change-Id: Ib5fc0c4b8f164596681ac5ad73002068ec6de1e5 Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20240209111000.16258-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28206.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-02-07dco-freebsd: dynamically re-allocate buffer if it's too smallKristof Provost
It's possible for the buffer we provide for OVPN_GET_PEER_STATS to be too small. Handle the error, re-allocate a larger buffer and try again rather than failing. Signed-off-by: Kristof Provost <kprovost@netgate.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20240124152739.28248-1-kprovost@netgate.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28128.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-01-29test_user_pass: new UT for get_user_passFrank Lichtenheld
UTs for basic functionality, without management functions. v2: - add CMake support - add GHA support for both MSVC and mingw v3: - fix distcheck by adding input/ directory to dist Change-Id: I193aef06912f01426dd4ac298aadfab97dd75a35 Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Arne Schwabe <arne-openvpn@rfc2549.org> Message-Id: <20240127200716.10255-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28138.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-01-22--http-proxy-user-pass: allow to specify in either order with --http-proxyFrank Lichtenheld
Previously, when using a third argument to --http-proxy other than auto/auto-nct, order did matter between --http-proxy and --http-proxy-user-pass. Always prefer --http-proxy-user-pass when given. Change-Id: I6f402db2fb73f1206fbc1139c47d2bf4378376fa Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20240122092122.8591-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28099.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-01-19buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'Frank Lichtenheld
As Coverity says: An unsigned value can never be negative, so this test will always evaluate the same way. Was changed from int to size_t in commit 7fc608da4ec388c9209bd009cd5053ac0ff7df38 which triggered warning, but the check did not make sense before, either. Change-Id: I64f094eeb0ca8c3953a94d742adf468faf27dab3 Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Arne Schwabe <arne-openvpn@rfc2549.org> Message-Id: <20240119120341.22933-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28093.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-01-18NTLM: when NTLMv1 is requested, try NTLMv2 insteadFrank Lichtenheld
Commit 21910ebc2ee8a6138eb2af8d38056d2b94e59f9c removed support for NTLMv1 authentication. This adjusts the behavior for existing configurations that specify "ntlm" keyword. Do not error out hard, instead just try to upgrade. This should work fine in many cases and will avoid breaking user configs unnecessarily on upgrade. In addition it fixes an issue with the mentioned patch where "auto" wasn't working correctly for NTLM anymore. Change-Id: Iec74e88f86cd15328f993b6cdd0317ebda81563c Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Arne Schwabe <arne-openvpn@rfc2549.org> Message-Id: <20240118151242.12169-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/search?l=mid&q=20240118151242.12169-1-gert@greenie.muc.de Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-01-17Fix various 'Uninitialized scalar variable' warnings from CoverityFrank Lichtenheld
These are all not actually problems, since the uninitialized parts are either .unused members of the struct (mroute_addr) or only written to (buflen), but still doesn't hurt to explicitely initialize them. Change-Id: I45cd0917d24570ae9e9db7eb6c370756e4595842 Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Arne Schwabe <arne-openvpn@rfc2549.org> Message-Id: <20231008103641.19864-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27157.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-01-17cmake: symlink whole build dir not just .json fileHeiko Hund
It turned out that symlinking compile_commands.json from the top level source dir has some issues: * file is not created on Windows and symlinking may cause an error * some IDEs create their own json and error out b/c a file exists Since clangd also looks for the json in build/ directories by default, we now symlink the whole build directory instead, not just the json file. This approach requires for the existing build/ dir in the repo to vanish. Luckily it only contains one automake include file, which is moved to the top level source dir. Lastly, make this an opt-in feature, so that the default configuration of the buildsystem never causes a build failure because of this. Change-Id: Ib1a5c788269949d8de95d1da2cb0c32a65bf13f2 Signed-off-by: Heiko Hund <heiko@ist.eigentlich.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20240117134929.5317-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28061.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-01-17NTLM: increase size of phase 2 response we can handleFrank Lichtenheld
With NTLMv2 the target information buffer can be rather large even with normal domain setups. In my test setup it was 152 bytes starting at offset 71. Overall the base64 encode phase 2 response was 300 byte long. The linked documentation has 98 bytes at offset 60. 128 byte is clearly too low. While here improve the error messaging, so that if the buffer is too small at least one can determine that in the log. Change-Id: Iefa4930cb1e8c4135056a17ceb4283fc13cc75c8 Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20240117090840.32621-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28040.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-01-17NTLM: add length check to add_security_bufferFrank Lichtenheld
Especially ntlmv2_response can be very big, so make sure we not do exceed the size of the phase3 buffer. Change-Id: Icea931d29e3e504e23e045539b21013b42172664 Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20240117085951.27414-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28037.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-01-16Implement the --tls-export-cert featureArne Schwabe
This is a re-implementation of the --tls-export-cert feature. This was necessary to due to missing approval to re-license the old (now removed) code. The re-implementation is based on the following description of the feature provided by David: Add an option to export certificate in PEM format of the remote peer to a given directory. For example: --tls-export-cert /var/tmp This option should use a randomised filename, which is provided via a "peer_cert" environment variable for the --tls-verify script or the OPENVPN_PLUGIN_TLS_VERIFY plug-in hook. Once the script or plugin call has completed, OpenVPN should delete this file. Change-Id: Ia9b3f1813d2d0d492d17c87348b4cebd0bf19ce2 Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20240116101556.2257-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28014.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-01-08Move get_tmp_dir to win32-util.c and error out on failureArne Schwabe
Currently we only warn in get_tmp_dir fails and set o->tmp_dir to a null pointer. This will not be caught by check_file_access_chroot either since that ignores NULL pointers but other parts of OpenVPN will assume that tmp_dir is set to a non-NULL string. Also move get_tmp_dir to win32-util.c to use it in unit tests. Change-Id: I525ccf7872880367b248ebebb0ddc83551498042 Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20240108171349.15871-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27964.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-01-05Fix IPv6 route add/delete message log levelSteffan Karger
We have D_ROUTE for route addition/deletion messages, which prints at loglevel 3. Use that for IPv6, like we do for IPv4 to reduce terminal spam for non-legacy-networking setups. Prvious code would print the messages at --verb 1. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20240105135742.21174-1-steffan@karger.me> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27954.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-01-04Check PRF availability on initialisation and add --force-tls-key-material-exportArne Schwabe
We now warn a user if the TLS 1.0 PRF is not supported by the cryptographic library of the system. Also add the option --force-tls-key-material-export that automatically rejects clients that do not support TLS Keying Material Export and automatically enable it when TLS 1.0 PRF support is not available. Change-Id: I04f8c7c413e7cb62c726262feee6ca89c7e86c70 Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20240104140214.32196-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27924.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-01-01get_default_gateway() HWADDR overhaulGert Doering
commit f13331005d5a7 (gerrit/454) most painfully works around the limitations of the SIOCGIFCONF API, with struct member access on an unaligned buffer, possibly overrunning sockaddr structures, etc. - and the result still did not work on OpenSolaris and OpenBSD (no AF_LINK in the returned elements). Reading through OpenBSD "ifconfig" source, I found getifaddrs(3), which is exactly what we want here - it works on FreeBSD, NetBSD, OpenBSD and MacOS, and all returned pointers are properly aligned, so the code gets shorter, easier to read, and UBSAN is still happy. OpenSolaris does have getifaddrs(3), but (surprise) it does not work, as in "it does not return AF_LINK addresses". It does have SIOCGIFHWADDR, instead, and "man if_tcp" claims "should behave in a manner compatible with Linux" - so TARGET_SOLARIS gets a copy of the Linux code now (works). Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20240101092714.18992-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27891.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-01-01OpenBSD: repair --show-gatewayGert Doering
OpenBSD route sockets do not want to be passed RTA_IFP on RTM_GET - if we do this, we get back EINVAL. On other platforms, if we do not request RTA_IFP, we will not get back interface information for queried routes - on OpenBSD, RTA_IFP comes back always... So we need to #ifdef this, RTA_IFP on all platforms except OpenBSD. (Found this fix in OpenBSD's ports tree, in their patches for OpenVPN 2.6.8 - but they just remove RTA_IFP, no #ifdef, so we can't just apply their patch) While at it, add M_ERRNO to the "write to routing socket" error message. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20240101094054.38869-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27892.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2023-12-31Fix unaligned access in macOS, FreeBSD, Solaris hwaddrArne Schwabe
The undefined behaviour USAN clang checker found this. This fix is a bit messy but so are the original structures. Since the API on Solaris/Illuminos does not return the AF_LINK sockaddr type we are interested in, there is little value in fixing the code on that platform to iterate through a list that does not contain the element we are looking for. Add includes stddef.h for offsetof and integer.h for max_int. Change-Id: Ia797c8801fa9a9bc10b6674efde5fdbd7132e4a8 Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20231231173431.31356-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27885.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2023-12-30Remove support for NTLM v1 proxy authenticationFrank Lichtenheld
Due to the limitation of the protocol it is not considered secure. Better to use basic auth instead of a false sense of security. NTLM v2 remains supported for now. Change-Id: I0dcb2dac4136f194da7050a8ea8495e9faba9dd9 Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Arne Schwabe <arne-openvpn@rfc2549.org> Message-Id: <20231230143733.4426-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27862.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2023-12-30misc: make get_auth_challenge staticFrank Lichtenheld
Not used outside of misc.c. Rename to parse_auth_challenge since it really just parses the string that you put in into the struct. Add doxygen documentation. v2: - change if(auth_challenge) to ASSERT(auth_challenge) Change-Id: I0abeec9f862aea1f6a8fdf350fa0008cf2e5d613 Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20231230143248.1625-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27864.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2023-12-30configure: allow to disable NTLMFrank Lichtenheld
Since we want to get rid of it, might be useful to allow users to remove the support completely. Change-Id: I199f83e2db5fc7c48a0ac9280cdbf9fa45f42300 Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Arne Schwabe <arne-openvpn@rfc2549.org> Message-Id: <20231230143817.4880-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27863.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2023-12-26fix(ssl): init peer_id when init tls_multiyatta
When openvpn run in UDP server mode, if ssl connections reach the max clients, the next connection would be failed in `multi_create_instance` and the half connection will be close in `multi_close_instance`, which may lead array `m->instances[0]` covered unexpectedly and make the first connection interrupt, this patch fix this problem by init `peer_id` with `MAX_PEER_ID` in `tils_multi_init`. Signed-off-by: yatta <ytzhang01@foxmail.com Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <tencent_C49D67EAA5678D180C293706A9469EFE8307@qq.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27260.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2023-12-26Extend the error message when TLS 1.0 PRF failsArne Schwabe
This error will probably become more and more common in the future when more and more systems will drop TLS 1.0 PRF support. We are already seeing people stumbling upon this (see GitHub issue #460) The current error messages TLS Error: PRF calcuation failed TLS Error: generate_key_expansion failed are not very helpful for people that do not have deep understanding of TLS or the OpenVPN protocol. Improve this message to give a normal user a chance to understand that the peer needs to be OpenVPN 2.6.x or newer. Change-Id: Ib3b64b52beed69dc7740f191b0e9a9dc9af5b7f3 Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20231213105308.121460-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27796.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2023-12-21tun.c: don't attempt to delete DNS and WINS servers if they're not setLev Stipakov
Commits 1c4a47f7 ("wintun: set adapter properties via interactive service") 18826de5 ("Set WINS servers via interactice service") added functionality of add/remove DNS/WINS via interactive service, which is used mostly by dco-win and wintun (tap-windows6 normally uses DHCP). There is a check in code - if DNS/WINS addresses are not pushed, nothing is added. However, due to bug we always attempted to remove DNS/WINS, even if nothing was added. Removing WINS, for example, could take up to 3 seconds. This change fixes this by improving check "has DNS/WINS been pushed?". While on it, convert do_XXX_service() functions to "void" from "bool", since we never check their return values. Change-Id: I21a36d24f8e213c780f55acbe3e4df555c93542a Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20231220133637.60996-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27843.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2023-12-12Fix building mbed TLS with CMake and allow specifying custom directoriesArne Schwabe
When installing mbed TLS 2.x and 3.x in parallel, it is useful to point cmake to the version that should be used. This fixes also building mbed TLS versions with cmake. Change-Id: I7fd9e730e87210d2b7d090c8f9c7c6734bd7374e Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20231211170549.85749-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27763.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2023-12-12buffer: add documentation for string_mod and extend related UTFrank Lichtenheld
Since I was confused what exactly string_mod does, I added documentation and additional UTs to make it clearer. Change-Id: I911fb5c5fa4b41f1fc1a30c6bf8b314245f64a6e Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Arne Schwabe <arne-openvpn@rfc2549.org> Message-Id: <20231211170214.85417-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27761.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2023-12-09Move tls_get_cipher_name_pair and get_num_elements to ssl_utils.cArne Schwabe
This allow these functions to be defined without having to include ssl.c/misc.c which pulls in a lot of more dependencies. Change-Id: I605394d4f3872a168d05bbbe52d90f6d48935865 Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20231208173346.94820-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27726.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2023-12-06Remove superfluous x509_write_pem()David Sommerseth
After removing --tls-export-cert, this function was left in the code base with no other users. This was an oversight in the previous change. Removing it to avoid leaving dead code behind. Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20231122190057.120384-1-dazo+openvpn@eurephia.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27561.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2023-12-06Remove --tls-export-certDavid Sommerseth
As OpenVPN 2.6+ is doing some adoptions to the license text, all prior contributors need to accept this new text. Unfortunately, Mathieu Giannecchini who implemented the --tls-export-cert feature did not respond at all. Without an explicit acceptance we need to remove this feature to avoid potential legal complications. If this is still a wanted feature, it will need to be re-implemented from scratch. Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20231122143101.58483-1-dazo+openvpn@eurephia.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27557.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2023-12-02Rename state_change to continue_tls_processArne Schwabe
The name state_change is more confusing than helpful as it not really indicates if there was a state change but rather if processing should be continued. There even some states that are definitively state changes (setting to_link buffer) that require continue_tls_process to be set to false. Change-Id: Ib6d713f2eb08a4c39d97de3e1a4a832cedc09585 Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Signed-off-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20231128103704.61046-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27571.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2023-12-02Remove compat versionhelpers.h and remove cmake/configure check for itArne Schwabe
The cmake file defined that file to be never present in contrast to the old msvc-config.h that always had it present. Remove also the compat implementation taken from mingw. All our current build environments already have that header in place. Change-Id: I9c85ccab6d51064ebff2c391740ba8c2d044ed1a Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Signed-off-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20231128103950.62407-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27573.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2023-12-02Minimal Solaris/OpenIndiana support to Cmake and clean up -WerrorArne Schwabe
Change-Id: I66e3dd7b7166459526824fe5ae81a449b375b8db Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20231128111447.64445-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27581.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2023-12-02Add missing check for nl_socket_alloc failureArne Schwabe
This can happen if the memory alloc fails. Patch V2: add goto error Patch V3: return -ENOMEM instead of going to error Change-Id: Iee66caa794d267ac5f8bee584633352893047171 Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <20231121170603.886801-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27541.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2023-12-02Fix check_session_buf_not_used using wrong indexArne Schwabe
The inner loop used i instead of j when iterating through the buffers. Since i is always between 0 and 2 and ks->send_reliable->size is (when it is defined) always 6 (TLS_RELIABLE_N_SEND_BUFFERS) this does not cause an index of out bounds. So while the check was not doing anything really useful with i instead of j, at least it was not crashing or anything similar. Noticed-By: Jon Williams (braindead-bf) on Github issue #449 Change-Id: Ia3d5b4946138df322ebcd9e9e77d04328dacbc5d Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20231128104359.62967-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27576.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
generated by cgit v1.1 at 2024-10-06 12:37:19 +0000