aboutsummaryrefslogtreecommitdiff
path: root/tests
AgeCommit message (Collapse)Author
2022-01-21unit-test: fix test_crypto when USE_COMP is not definedAntonio Quartulli
This unit-test did not consider the case when USE_COMP is not defined, thus generating a compiler error. Adapt the test to the case when no compression is available. Cc: Arne Schwabe <arne@rfc2549.org> Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20220121144313.24961-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23628.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-01-20Add a unit test for external key providerSelva Nair
Tests: - Check SIGNATURE and KEYMGMT methods can be fetched from the provider - Load sample RSA and EC keys as management-external-key and check that their sign callbacks are correctly exercised: with and without digest support mocked in the client capability flag. -Test generic key load and signature v4: 16/18 and 17/18 of v3 squashed into one patch Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20220120161616.13447-1-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23608.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-12-31Rework occ link-mtu calculationArne Schwabe
Use the functions that directly compute the link mtu instead relying on the frame logic. Patch V2: rebase on master Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20211230172136.2017215-1-arne@rfc2549.org> URL: https://www.mail-archive.com/search?l=mid&q=20211230172136.2017215-1-arne@rfc2549.org Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-12-13Remove md_kt_t and change crypto API to use const char*Arne Schwabe
As with the removal of cipher_kt_t, this is allows better support of OpenSSL 3.0 and mbed TLS 3.0 Patch v2: rebase Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20211213150654.3993358-2-arne@rfc2549.org> URL: https://www.mail-archive.com/search?l=mid&q=20211213150654.3993358-2-arne@rfc2549.org Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-12-13Remove cipher_kt_t and change type to const char* in APIArne Schwabe
Make the external crypto consumer oblivious to the internal cipher type that both mbed TLS and OpenSSL use. This change is mainly done so the cipher type that is used can be stay a const type but instead of an SSL library type, we now use a simple string to identify a cipher. This has the disadvantages that we do a cipher lookup every time a function is called that needs to query properties of a cipher. But none of these queries are in a critical path. This patch also fixes the memory leaks introduced by the EVP_fetch_cipher commit by always freeing the EVP_CIPHER. This also changes kt->cipher to be always defined with the name of the cipher. This only affects the "none" cipher cipher which was previously represented by kt->cipher to be NULL. Patch v2: rebase on master Patch v3: fix errors with mbed TLS without having md_kt to const char * patch also applied, fix logic inversion in tls_crypt_tk Patch v4: fix issue if cipher does not get changed by NCP that null cipher is then used Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20211213150654.3993358-1-arne@rfc2549.org> URL: https://www.mail-archive.com/search?l=mid&q=20211213150654.3993358-1-arne@rfc2549.org Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-12-10add test case(s) to notice 'openvpn --show-cipher' crashingGert Doering
Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20211210165543.77587-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23381.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-12-09Add argv_insert_head__empty_argv__head_only to argv testsArne Schwabe
The unit test argv_insert_head__empty_argv__head_only was defined but never used. Add it to the array of unit tests. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20211208170614.3404821-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23359.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-12-08Don't use BF-CBC in unit tests if we don't have itMax Fillinger
Signed-off-by: Max Fillinger <maximilian.fillinger@foxcrypto.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20211208134655.28905-1-maximilian.fillinger@foxcrypto.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23354.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-12-07Remove max_size from buffer_list_newArne Schwabe
This argument is never used apart from a unit test. Remove this argument as a small cleanup. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20211207170211.3275837-2-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23329.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-12-06Fix handling an optional invalid cipher at the end of data-ciphersArne Schwabe
If an optional cipher was found at the end of --data-cipher that was not available, it would reset the error and allow non optional ciphers to be ignored. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20211206150852.3142891-1-arne@rfc2549.org> URL: https://www.mail-archive.com/search?l=mid&q=20211206150852.3142891-1-arne@rfc2549.org Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-12-06Remove key_type->hmac_lengthArne Schwabe
This field is only set once with md_kt_size and then only read. Remove this field and replace the read accesses with md_kt_size. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20211201180727.2496903-6-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23274.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-12-05Implement optional cipher in --data-ciphers prefixed with ?Arne Schwabe
This allows to use the same configuration multiple platforms/ssl libraries and include optional algorithms that are not available on all platforms For example "AES-256-GCM:AES-128-GCM:?CHACHA20-POLY1305" can be used to emulate the default behaviour of OpenVPN 2.6. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20211201180727.2496903-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23279.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-11-05Implement DES ECB encrypt via EVP_CIPHER apiArne Schwabe
Even though DES is super outdated and also NTLM is super outdated, eliminating the warnings for OpenSSL 3.0 is still a step in the right direction and using the correct APIs. We cheat a bit by using 3DES instead of DES to avoid needing legacy provider for DES encryption for now. Patch v4: add unit test, use 3DES to avoid legacy provider for now Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Max Fillinger <maximilian.fillinger@foxcrypto.com> Message-Id: <20211029111109.2003101-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23078.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-11-01Remove dependency on BF-CBC existance from test_ncpArne Schwabe
The test_check_ncp_ciphers_list test assumed that BF-CBC is always available, which is no longer the case with OpenSSL 3.0. Rewrite the test to not rely on BF-CBC to be available. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Max Fillinger <maximilian.fillinger@foxcrypto.com> Message-Id: <20211019183127.614175-14-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23003.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-10-21Add small unit test for testing HMACArne Schwabe
This just adds a very simple unit test to check that the HMAC implementation produces a well known hash. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20211019183127.614175-18-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23012.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-08-02Remove unistd.h from unit testArne Schwabe
the unit tests do not compile under Windows since Windows does not provide a unistd.h header. The header is still included on Unix platforms via syshead.h Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20210802100740.694474-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22685.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-08-02Support NCP in pure P2P VPN setupsArne Schwabe
Currently P2P mode of OpenVPN is on of the few places that cannot negotiate modern OpenVPN features. This becomes more and more problematic since P2P and P2MP code diverge more and more and also the lack of switching to more advanced features like Data v2 currently blocks P2P mode from working together with the upcoming ovpn-dco support. This NCP support is a lot simpler and works in the following way: - P2P peer announce an extremely limited IV_ variable set (IV_PROTO and IV_CIPHERS) - Both peers check if the IV_PROTO_NCP_P2P bit is present in IV_PROTO - if yes both sides deterministically determine according to IV_PROTO and IV_CIPHER what options can be used and start using these There are no poor man's NCP or other compatibility workaround like in the normal NCP, making this NCP leaner and more deterministic. Patch v2: remove empty lines, add doxygen comment to push_peer_info, fix push_peer_info >= 2 that should be > 2 Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <20210728123050.564595-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22671.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-07-28Cleanup handling of initial auth tokenArne Schwabe
This changes that auth_token_initial is set when the token is initially generated instead when pushing the token. Even I do not know anymore why I did it in this way in the first place. Also use multi->auth_token_initial as source for the sesssion ID since it should now always be available. Also set auth_token_initial directly to up->password once we verified that we have gotten a valid token from a client. This cleans ups the logic in generating the environment and makes the code flow clearer. Since the change makes auth_token_initial always available we need to add a check to only send a PUSH reply to update the token on renegotiations. The old code relied on multi->auth_token not being set in this case. This commit also removes the workaround for old OpenVPN clients. These were only available as commercial OpenVPN Connect client and not in use anymore. Furthermore, introduce a check if the session ID has changed during a session. Even though this is still a valid authentication changing to a different auth token mid session is highly irregular and should never occur naturally. Patch V2: rebase. Patch V3: fix formatting, clarifying commit message, remove initial token workaround for old v3. Patch v4: move sending the auth-token for renegotiations to a sane place and trigger it when the TLS session reaches its fully authenticated state. Patch v5: Move also setting auth_token_inital from up->password to a more logical place, general cleanups, add session id mismatch check Patch v6: Rework some comments and general cleanup of small things Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <20210719133132.128783-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22645.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-07-02Update Fox e-mail address in copyright noticesMax Fillinger
Replace openvpn@fox-it.com with openvpn@foxcrypto.com. Signed-off-by: Max Fillinger <maximilian.fillinger@foxcrypto.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20210701171458.8897-1-maximilian.fillinger@foxcrypto.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22608.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-06-18Move auth_token_state from multi to key_stateArne Schwabe
The auth-token check is tied to the username/password that is coming via a specific SSL session, so keep the state also in the key_state structure. This also ensures the auth_token_state is always set to 0 on a new session since we clear the key_state object at the start of a new SSL session. This is a prerequisite patch to fix 2020-15078 in the following two commits. This also applies the changes to the auth_token_test.c. The change of tls_session to a pointer is necessary since before that we had tls_session not tied to the multi and had two tls_session used in the test. One implicitly in tls_multi and one explicit one. Merge these to one. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <20210520151148.2565578-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22415.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-06-15Update copyrightsDavid Sommerseth
- Update the update-copyright script to include more contributors as well as correcting a few typos - Correct a copyright address in the source code to now used address (dazo) - Update copyright year to 2021 Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20210609213231.22576-1-openvpn@sf.lists.topphemmelig.net> URL: https://www.mail-archive.com/search?l=mid&q=20210609213231.22576-1-openvpn@sf.lists.topphemmelig.net URL: https://sourceforge.net/p/openvpn/mailman/message/37299719/ Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-06-09Add github actionsArne Schwabe
dummy0 gives strange errors on the Ubuntu 16 runner on github actions because dummy already exist, so use a more unique ovpn-dummy0 name instead. Github actions are a good alternative to travis-ci, which futrure is questionable at the moment without payment. The github actions also allows building on macOS and Windows (not included in this commit). The matrix is a bit different than Coverity and uses different Ubuntu version with their native OpenSSL (1.0.2, 1.1.1)/mbed TLS instead of manually compiling different OpenSSL versions on just Ubuntu 20.04. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Lev Stipakov <lstipakov@gmail.com> Message-Id: <20210608152434.1403999-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22511.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-05-03Fix memory leak in misc unit testArne Schwabe
Detected-by: clang -fsanitize=address Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20210503114043.3909319-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22292.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-05-03Avoid failing_test unused warning in example_testArne Schwabe
This warnings makes make check fail if Werror is exmaple on LLVM/Clang on macOS for me. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20210422152939.2134046-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22205.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-04-02Implement '--compress migrate' to migrate to non-compression setupArne Schwabe
This option allow migration to a non compression server config while still retraining compatibility with client that have a compression setting in their config. For existing setups that used to have comp-lzo no or another compression setting in their configs it is a difficult to migrate to a setup without compression without replacing all client configs at once especially if OpenVPN 2.3 or earlier clients are in the mix that do not support pushing stub-v2. Even with OpenVPN 2.4 and later clients that support pushing this is not a satisfying solution as the clients log occ mismatches and the "push stub-v2" needs to be in the server config "forever". If the new migrate option to compress is set and a client is detected that indicates that compression is used (via OCC), the server will automatically add ``--push compress stub-v2`` to the client specific configuration if stub-v2 is supported by the client and otherwise switch to ``comp-lzo no`` and add ``--push comp-lzo`` to the client specific configuration. Patch v2: better commit message/man page, add USE_COMP ifdefs, various style fixes Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <20210324220853.31246-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg21801.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-03-10Refactor extract_var_peer_info into standalone function and add ssl_util.cArne Schwabe
Our "natural" place for this function would be ssl.c but ssl.c has a lot of dependencies on all kinds of other compilation units so including ssl.c into unit tests is near impossible currently. Instead create a new file ssl_util.c that holds small utility functions like this one. Patch v2: add newline add the end of sll_util.h and ssl_util.c Patch v3: Refactor/clean up the function even more as suggested by Gert. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Lev Stipakov <lstipakov@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20210226111012.21269-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg21585.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-03-08Prefer TLS libraries TLS PRF function, fix OpenVPN in FIPS modeArne Schwabe
This moves from using our own copy of the TLS1 PRF function to using TLS library provided function where possible. This includes currently OpenSSL 1.1.0+ and mbed TLS 2.18+. For the libraries where it is not possible to use the library's own function, we still use our own implementation. mbed TLS will continue to use our own old PRF function while for OpenSSL we will use a adapted version from OpenSSL 1.0.2t code. The version allows to be used in a FIPS enabled environment. The old OpenSSL and mbed TLS implementation could have shared some more code but as we will eventually drop support for older TLS libraries, the separation makes it easier it remove that code invdidually. In FIPS mode MD5 is normally forbidden, the TLS1 PRF1 function we use, makes uses of MD5, which in the past has caused OpenVPN to segfault. The new implementation for OpenSSL version of our custom implementation has added the special flags that tell OpenSSL that this specific use of MD5 is allowed in FIPS mode. No FIPS conformitiy testing etc has been done, this is only about allowing OpenVPN on a system where FIPS mode has been enabled system wide (e.g. on RHEL derivates). Patch v4: Handle the unlikely case that PRF generation fails. More formatting fixes. Patch v5: v4 with the formatting fixes actually commited. sigh. Patch v6: More formatting fixes, make OpenSSL fucntion return bool instead of int. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <20210305141352.21847-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg21612.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-10-08Allow 'none' cipher being specified in --data-ciphersArne Schwabe
Although we want to get rid of none as cipher, we still have not deprecated it. In order to use it currently you need --ncp-disable together with --cipher none to use the none cipher otherwise OpenVPN will spit out an error about an unrecognised cipher in --data-ciphers. In our current situation allowing none to be specified in data-ciphers is the lesser evil. This commit also fixes that we use '[null-cipher]' instead 'none' when setting remote_cipher. Note that negotiating to cipher 'none' can the same the same problems with frame size calculation as any other non AEAD cipher. If --cipher none is also specified in the configuration, the workaround of commit e539c95dc will also apply to cipher none. Patch V2: Also work correctly if remote_cipher is NULL. Patch V3: fix unit tests, add note about corner case Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20201008115959.21151-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg21181.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-09-11Replace 'echo -n' with 'printf' in tests/t_lpback.shGert Doering
"echo -n" is inherently less portable than printf, so the tests look ugly on (at least) OpenSolaris/Illumos on AIX. Add a blank at the end of the tls-crypt-v2 messages, so it has the same look as the cipher messages ("... OK"). Reported-by: mnowak on Trac Trac: #1196 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Antonio Quartulli <a@unstable.cc> Message-Id: <20200909130024.24264-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg20930.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-08-10Rework NCP compability logic and drop BF-CBC support by defaultArne Schwabe
This reworks the NCP logic to be more strict about what is considered an acceptable result of an NCP negotiation. It also allows us to finally drop support for BF-CBC as default cipher. All new behaviour is currently limited to server/client mode with pull enabled. P2p mode without pull does not change. New Server behaviour: - when a client announces its supported ciphers through either OCC or IV_CIPHER/IV_NCP we reject the client with a AUTH_FAILED message if we have no common cipher. - When a client does not announce any cipher in either OCC or NCP we reject it unless data-ciphers-fallback is specified in either ccd/ or config. New client behaviour: - When no cipher is pushed (or a cipher we refused to support) and we also cannot support the server's cipher announced in OCC we fail the connection and log why - If there is no cipher in OCC but data-ciphers-fallback is specified we will use the fallback cipher instead of failing the connection Both client and server behaviour: - We only announce --cipher xyz in occ if we are willing to support that cipher (always announce the cipher if NCP is disabled or not in --client mode) It means that we only announce the fallback-cipher if it is also contained in --data-ciphers Compatibility behaviour: In 2.5 both client and server will use a --cipher xyz present in the config to automatically set --data-ciphers-fallback xyz and also append this cipher to the end of data-ciphers. We log a warning about this and point to --data-ciphers and --data-ciphers-fallback This also happens if the configuration contains an explicit --cipher BF-CBC. If --cipher is not set, we only warn that previous versions allowed BF-CBC and point out how to re-enable BF-CBC. This will break configs where someone connects a 2.3 client (or older) to a 2.5 server AND has no explicit --cipher setting in the server config. We still do it, because at some point we need to drop the BF-CBC default - and affected users already had the scary SWEET32 warning in their logs for a long time. In short: If --cipher is explicitly set then 2.5 will work the same as 2.4 did. When --cipher is not set, BF-CBC support is dropped and we warn about it. Examples how breaking the default BF-CBC will be logged: Client side: - Client connecting to server that does not push cipher but has --cipher in OCC OPTIONS ERROR: failed to negotiate cipher with server. Add the server's cipher ('BF-CBC') to --data-ciphers (currently 'AES-256-GCM:AES-128-CBC') if you want to connect to this server. - Client connecting to a server that does not support OCC: OPTIONS ERROR: failed to negotiate cipher with server. Configure --data-ciphers-fallback if you want connect to this server. Server Side: - Server has a client only supporting BF-CBC connecting: styx/IP PUSH: No common cipher between server and client. Server data-ciphers: 'CHACHA20-POLY1305:AES-128-GCM:AES-256-GCM:AES-256-CBC:AES-128-CBC', client supports cipher 'BF-CBC'. - Client without OCC: styx/IP PUSH:No NCP or OCC cipher data received from peer. styx/IP Use --data-ciphers-fallback with the cipher the client is using if you want to allow the client to connect In all cases the client is rejected with this message: AUTH: Received control message: AUTH_FAILED,Data channel cipher negotiation failed (no shared cipher) Signed-off-by: Arne Schwabe <arne@rfc2549.org> Patch V2: rename fallback-cipher to data-ciphers-fallback add all corrections from Steffan Ignore occ cipher for clients sending IV_CIPHERS move client side ncp in its own function do not print INSECURE cipher warning if BF-CBC is not allowed Patch V3: fix minor style, add null check when client sends no peerinfo at all Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20200809141922.7853-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg20656.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-07-22t_net.sh: drop hard dependency on t_client.rcAntonio Quartulli
Right now t_net.sh depends on t_client.rc in order to source the RUN_SUDO variable only. However, t_client.rc is something that a few people only have configured and thus this would result in t_net.sh almost never executed even if it just could. Drop dependency on t_client.rc by falling back to RUN_SUDO=sudo when the file is missing and no RUN_SUDO is passed via env. While at it, reword the error message to better match the current logic flow. Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20200721195518.14358-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg20533.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-07-03t_client.sh: correctly report all failed instances in summaryGert Doering
t_client.sh reports a summary at the end: Test sets succeeded: none. Test sets failed: 1 2 3 4 5. for tests that are skipped due to the pre-test ping check ("vpn target IP must not ping before VPN ist started") the script forgot to add the instance number to the summary line. Fixed. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <20200626082743.15397-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg20130.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-07-01Fix 'engine' unit test on FreeBSD (specifically 'not GNU make')Gert Doering
The rules to generate $(builddir)/openssl.cnf from $(srcdir)/openssl.cnf.in only worked for GNU Make. BSD make needs the rules more explicit, and the target must not have a directory specification (fixes commit 542c69c37). Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: James Bottomley <James.Bottomley@HansenPartnership.com> Message-Id: <20200629175109.94276-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg20159.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-06-26Reformat files using uncrustifyArne Schwabe
Some of the commits, especially engine have not strictly used uncrustify clean code. Rerun uncrustify to make them compliant again. Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20200626125332.15385-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg20142.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-06-24engine-key tests: make check_engine_keys.sh work with --enable-smallJames Bottomley
--enable-small eliminates one of the openssl errors the test is looking for, so alter the grep also to account for the message in this version. Additionally output log.txt on failure so any test platform gives an easy clue about what went wrong. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1592953354.2103.3.camel@HansenPartnership.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg20102.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-06-23Fix make distcheck for new engine key unit testJames Bottomley
Add config precursor and script to extra dist and make sure built and test leftover files are cleaned up afterwards. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1592917531.4768.4.camel@HansenPartnership.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg20088.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-06-23Add unit tests for engine keysJames Bottomley
Testing engines is problematic, so one of the prerequisites built for the tests is a simple openssl engine that reads a non-standard PEM guarded key. The test is simply can we run a client/server configuration with the usual sample key replaced by an engine key. The trivial engine prints out some operations and we check for these in the log to make sure the engine was used to load the key and that it correctly got the password. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20200622232319.8143-2-James.Bottomley@HansenPartnership.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg20075.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-06-21Add unit test for cipher name translationsArne Schwabe
The unit test duplicates some part of the test for the ncp-cipher list but that is not a bad thing. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20200605112519.22714-3-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19968.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-05-15Do not write extra 0 byte for --gen-key with auth-token/tls-crypt-v2Arne Schwabe
Change crypto_pem_encode to not put a nul-terminated terminated string into the buffer. This was useful for printf but should not be written into the file. Instead do not assume that the buffer is null terminated and print only the number of bytes in the buffer. Also fix a similar case in printing static key where the 0 byte was never added to the buffer Patch V2: make pem_encode behave more like other similar functions in OpenVPN and do not null terminate. Patch V3: also make the mbed TLS variant of pem_decode behave like other similar functions in OpeNVPN and accept a not null-terminated buffer. Patch V4: The newly introduced unit test test_tls_crypt_v2_write_client_key_file_metadata was added after the V3 version of the patch and now misses the strlen with memcmp replacment that were added to test_tls_crypt_v2_write_client_key_file. Also add the modifictions to this function. Unconditionally allocate buffer in mbed TLS path as requested by Steffan. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Steffan Karger <steffan.karger@foxcrypto.com> Message-Id: <20200507132534.6380-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19852.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-05-07convert *_inline attributes to boolAntonio Quartulli
Carrying around the INLINE_TAG is not really efficient, because it requires a strcmp() to be performed every time we want to understand if the data is stored inline or not. Convert all the *_inline attributes to bool to make the logic easier and checks more efficient. Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20200507135909.21227-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19854.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-05-07t_net.sh: assign MAC address directly during interface creationAntonio Quartulli
Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20200428131700.9123-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19832.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-04-27Uncrustify the tests/unit_tests/ part of our tree.Gert Doering
Apply uncrustify 0.70.1 (FreeBSD port) with our rules to that part of the tree, which followed a more compact coding style so far. Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20200426095402.65047-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19823.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-04-26Add tls-crypt-v2 test writing metadataArne Schwabe
Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20200420104435.7082-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19798.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-04-19t_net.sh: use dummy interface instead of tunAntonio Quartulli
The tun interface has proved to be a bit fragile for basic netlink tests as it may introduce delays in switching state, depending on the system the test is ran on. For this reason, switch to dummy interface type and at the same type set its oper-state to up right after creation to avoid hitting the no-carrier state later. No-carrier has been problematic in pasts tests as it sometimes persists long enough to create a discrepancy between the various tests snapshots thus causing a test failure. Setting a static MAC addressis also re-enabled to avoid it being different and thus causing a test failure when comparing snapshots. Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20200416134925.8848-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19751.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-03-27Normalise ncp-ciphers option and restrict it to 127 bytesArne Schwabe
In scenarios of mbed TLS vs OpenSSL we already normalise the ciphers that are send via the wire protocol via OCC to not have a mismatch warning between server and client. This is done by translate_cipher_name_from_openvpn. The same applies also to the ncp-ciphers list. Specifying non normalised names in ncp-ciphers will cause negotation not to succeed if ciphers are not in the same form. Therefore we will normalise the ciphers in options_postmutate. The alternative and a lot less user friendly alternative would be to bail if on of the ciphers in ncp-ciphers is not in its normalised form. Also restrict the ncp-ciphers list to 127. This is somewhat arbitrary but should prevent too large IV_CIPHER messages and problems sending those. The server will accept also large IV_CIPHER values from clients. Patch V2: Correct comment about normalising ciphers Patch V3: Correct #ifdef statement Patch V5: Fix tests with OpenSSL 1.0.2 and libraries missing Chacha Patch V6: Fix unit tests for mbed tls, which recognises ChaCha20-Poly1305 only when used with all uppercase, fix missing space in message Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <20200312113654.16184-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19546.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-03-09Move NCP related function into a seperate file and add unit testsArne Schwabe
This allows unit test the NCP functions. The ssl.c file has too many dependencies to make unit testing of it viable. Patch V2: Removing the include "ssl_ncp.h" from options.c for V2 of implement dynamic NCP forces a new version of this patch to add the #include in this patch. Merge VS studio file changes for ssl_ncp.[ch] into this patch Patch V3: Regenerate for changes in earlier patches, apply Lev's changes to Visual Studio project file Patch V4: Regenerate to also have the changes of earlier patches. Patch V5: Fix unit tests for crypto library missing chacha20-poly1305 Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Lev Stipakov <lstipakov@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20200221100746.7065-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19499.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-02-20Add gc_arena to struct argv to save allocationsHeiko Hund
With the private gc_arena we do not have to allocate the strings found during parsing again, since we know the arena they are allocated in is valid as long as the argv vector is. Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20200206132103.15977-4-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19376.html
2020-02-20argv: do fewer memory re-allocationsHeiko Hund
Prevent the re-allocations of memory when the internal argv grows beyond 2 and 4 arguments by initially allocating argv to hold up to 7 (+ trailing NULL) pointers. While at it rename argv_reset to argv_free to actually express what's going on. Redo the argv_reset functionality so that it can be used to actually reset the argv without re-allocation. Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20200206132103.15977-3-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19378.html
2020-02-20re-implement argv_printf_*()Heiko Hund
The previous implementation had the problem that it was not fully compatible with printf() and could only detect % format directives following a space character (0x20). It modifies the format string and inserts marks to separate groups before passing it to the regular printf in libc. The marks are later used to separate the output string into individual command line arguments. The choice of 0x1D as the argument delimiter is based on the assumption that no "regular" string passed to argv_printf_*() will ever have to contain that byte (and the fact that it actually is the ASCII "group separator" control character, which fits its purpose). This commit has been updated by David Sommerseth based on Arne Schwabe and his own feedback on the mailing list. Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20200206132103.15977-2-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19380.html
2019-11-10get rid of 'broadcast' argument when configuring the tun deviceAntonio Quartulli
The broadcast argument is actually useless as every platform will figure it out and configure it on its own. We even realized that on linux, if you configure it wrong, nothing wrong will happen. At this point, let's make the code cleaner and let's get rid of this useless argument at all. This patch just removed any occurrence of 'broadcast'. Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20191110124407.8734-1-a@unstable.cc> URL: https://www.mail-archive.com/search?l=mid&q=20191110124407.8734-1-a@unstable.cc Signed-off-by: Gert Doering <gert@greenie.muc.de>
generated by cgit v1.1 at 2024-10-06 20:31:44 +0000