Menu ▾ ▴
openvpn-devel — OpenVPN developers list
You can subscribe to this list here.
| 2002 | Jan | Feb | Mar | Apr (24) | May (14) | Jun (29) | Jul (33) | Aug (3) | Sep (8) | Oct (18) | Nov (1) | Dec (10) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2003 | Jan (3) | Feb (33) | Mar (7) | Apr (28) | May (30) | Jun (5) | Jul (10) | Aug (7) | Sep (32) | Oct (41) | Nov (20) | Dec (10) |
| 2004 | Jan (24) | Feb (18) | Mar (57) | Apr (40) | May (55) | Jun (48) | Jul (77) | Aug (15) | Sep (56) | Oct (80) | Nov (74) | Dec (52) |
| 2005 | Jan (38) | Feb (42) | Mar (39) | Apr (56) | May (79) | Jun (73) | Jul (16) | Aug (23) | Sep (68) | Oct (77) | Nov (52) | Dec (27) |
| 2006 | Jan (27) | Feb (18) | Mar (51) | Apr (62) | May (28) | Jun (50) | Jul (36) | Aug (33) | Sep (47) | Oct (50) | Nov (77) | Dec (13) |
| 2007 | Jan (15) | Feb (8) | Mar (14) | Apr (18) | May (25) | Jun (16) | Jul (16) | Aug (19) | Sep (32) | Oct (17) | Nov (5) | Dec (5) |
| 2008 | Jan (64) | Feb (25) | Mar (25) | Apr (6) | May (28) | Jun (20) | Jul (10) | Aug (27) | Sep (28) | Oct (59) | Nov (37) | Dec (43) |
| 2009 | Jan (40) | Feb (25) | Mar (12) | Apr (57) | May (46) | Jun (29) | Jul (39) | Aug (10) | Sep (20) | Oct (42) | Nov (50) | Dec (57) |
| 2010 | Jan (82) | Feb (165) | Mar (256) | Apr (260) | May (36) | Jun (87) | Jul (53) | Aug (89) | Sep (107) | Oct (51) | Nov (88) | Dec (117) |
| 2011 | Jan (69) | Feb (60) | Mar (113) | Apr (71) | May (67) | Jun (90) | Jul (88) | Aug (90) | Sep (48) | Oct (64) | Nov (69) | Dec (118) |
| 2012 | Jan (49) | Feb (528) | Mar (351) | Apr (190) | May (238) | Jun (193) | Jul (104) | Aug (100) | Sep (57) | Oct (41) | Nov (47) | Dec (51) |
| 2013 | Jan (94) | Feb (57) | Mar (96) | Apr (105) | May (77) | Jun (102) | Jul (27) | Aug (81) | Sep (32) | Oct (53) | Nov (127) | Dec (65) |
| 2014 | Jan (113) | Feb (59) | Mar (104) | Apr (259) | May (70) | Jun (70) | Jul (146) | Aug (45) | Sep (58) | Oct (149) | Nov (77) | Dec (83) |
| 2015 | Jan (53) | Feb (66) | Mar (86) | Apr (50) | May (135) | Jun (76) | Jul (151) | Aug (83) | Sep (97) | Oct (262) | Nov (245) | Dec (231) |
| 2016 | Jan (131) | Feb (233) | Mar (97) | Apr (138) | May (221) | Jun (254) | Jul (92) | Aug (248) | Sep (168) | Oct (275) | Nov (477) | Dec (445) |
| 2017 | Jan (218) | Feb (217) | Mar (146) | Apr (172) | May (216) | Jun (252) | Jul (164) | Aug (192) | Sep (190) | Oct (143) | Nov (255) | Dec (182) |
| 2018 | Jan (295) | Feb (164) | Mar (113) | Apr (147) | May (64) | Jun (262) | Jul (184) | Aug (90) | Sep (69) | Oct (364) | Nov (102) | Dec (101) |
| 2019 | Jan (119) | Feb (64) | Mar (64) | Apr (102) | May (57) | Jun (154) | Jul (84) | Aug (81) | Sep (76) | Oct (102) | Nov (233) | Dec (89) |
| 2020 | Jan (38) | Feb (170) | Mar (155) | Apr (172) | May (120) | Jun (223) | Jul (461) | Aug (227) | Sep (268) | Oct (113) | Nov (56) | Dec (124) |
| 2021 | Jan (121) | Feb (48) | Mar (334) | Apr (345) | May (207) | Jun (136) | Jul (71) | Aug (112) | Sep (122) | Oct (173) | Nov (184) | Dec (223) |
| 2022 | Jan (197) | Feb (206) | Mar (156) | Apr (212) | May (192) | Jun (170) | Jul (143) | Aug (380) | Sep (182) | Oct (148) | Nov (128) | Dec (269) |
| 2023 | Jan (248) | Feb (196) | Mar (264) | Apr (36) | May (123) | Jun (66) | Jul (120) | Aug (48) | Sep (157) | Oct (198) | Nov (300) | Dec (273) |
| 2024 | Jan (271) | Feb (147) | Mar (207) | Apr (78) | May (107) | Jun (168) | Jul (151) | Aug (51) | Sep (438) | Oct (221) | Nov (302) | Dec (357) |
| 2025 | Jan (451) | Feb (219) | Mar (326) | Apr (232) | May (306) | Jun (181) | Jul (452) | Aug (282) | Sep (620) | Oct (793) | Nov (682) | Dec (2) |
| S | M | T | W | T | F | S |
|---|---|---|---|---|---|---|
| | | | | | | 1 |
| 2 | 3 (3) | 4 (1) | 5 (26) | 6 (34) | 7 (6) | 8 (17) |
| 9 (15) | 10 | 11 (8) | 12 (22) | 13 (3) | 14 (10) | 15 |
| 16 | 17 (4) | 18 (32) | 19 (18) | 20 (11) | 21 (5) | 22 |
| 23 (3) | 24 (35) | 25 (16) | 26 (14) | 27 (26) | 28 (7) | 29 (1) |
| 30 | 31 (9) | | | | | |
| From: flichtenheld (C. Review) <ge...@op...> - 2025-03-31 16:30:03 |
Attention is currently required from: cron2, d12fk, plaisthos. flichtenheld has posted comments on this change. ( http://gerrit.openvpn.net/c/openvpn/+/838?usp=email ) Change subject: dns: apply settings via script on unixoid systems ...................................................................... Patch Set 19: Code-Review+2 (1 comment) File configure.ac: http://gerrit.openvpn.net/c/openvpn/+/838/comment/52a50795_cfc20080 : PS16, Line 100: [AS_HELP_STRING([--disable-dns-updown], [disable the --dns-updown hook @<:@default=no@:>@])], > This is now inconsistent with how our options are described. `default=yes` would be consistent. Done -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/838?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: Ifbe4ffb44d3bfcaa50adb38cacb3436fcdc71b10 Gerrit-Change-Number: 838 Gerrit-PatchSet: 19 Gerrit-Owner: d12fk <he...@op...> Gerrit-Reviewer: cron2 <ge...@gr...> Gerrit-Reviewer: flichtenheld <fr...@li...> Gerrit-Reviewer: plaisthos <arn...@rf...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-Attention: plaisthos <arn...@rf...> Gerrit-Attention: cron2 <ge...@gr...> Gerrit-Attention: d12fk <he...@op...> Gerrit-Comment-Date: Mon, 31 Mar 2025 16:29:50 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes Comment-In-Reply-To: flichtenheld <fr...@li...> Gerrit-MessageType: comment |
| From: plaisthos (C. Review) <ge...@op...> - 2025-03-31 15:42:36 |
Attention is currently required from: flichtenheld. plaisthos has posted comments on this change. ( http://gerrit.openvpn.net/c/openvpn/+/926?usp=email ) Change subject: GHA: Dependency and Actions update April 2025 ...................................................................... Patch Set 1: (1 comment) File .github/workflows/build.yaml: http://gerrit.openvpn.net/c/openvpn/+/926/comment/bfccada6_757aa827 : PS1, Line 69: -DENABLE_PKCS11=false -DBUILD_TESTING=true -DENABLE_LZO=false -DUSE_WERROR=no you missed your opportunity to fix the yes vs true you complained about last time ;) -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/926?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: Ie9bffcc487f53a3a8ae6e59b79e654360d99902c Gerrit-Change-Number: 926 Gerrit-PatchSet: 1 Gerrit-Owner: flichtenheld <fr...@li...> Gerrit-Reviewer: plaisthos <arn...@rf...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-Attention: flichtenheld <fr...@li...> Gerrit-Comment-Date: Mon, 31 Mar 2025 15:42:21 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Gerrit-MessageType: comment |
| From: Frank L. <fr...@li...> - 2025-03-31 15:33:33 |
- Fix Android build with newer vcpkg Need to sync CMAKE_SYSTEM_VERSION with vcpkg. - Update mbedTLS v3 builds to latest release. Depends on commit 4897c522948c8cdb82c0325ee08f6907cfc16f57 - Update all actions to latest releases. Change-Id: Ie9bffcc487f53a3a8ae6e59b79e654360d99902c Signed-off-by: Frank Lichtenheld <fr...@li...> Acked-by: Arne Schwabe <arn...@rf...> --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/926 This mail reflects revision 1 of this Change. Acked-by according to Gerrit (reflected above): Arne Schwabe <arn...@rf...> diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index b1af7ec..3fc44f5 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -27,7 +27,7 @@ - name: Show changes on standard output run: git diff working-directory: openvpn - - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: uncrustify-changes.patch path: 'openvpn/uncrustify-changes.patch' @@ -57,11 +57,16 @@ - name: Install vcpkg uses: lukka/run-vcpkg@5e0cab206a5ea620130caf672fce3e4a6b5666a1 # v11.5 with: - vcpkgGitCommitId: 33e9c99208736b713cabe4490e15235f62f893d4 + vcpkgGitCommitId: acd5bba5aac8b6573b5f6f463dc0341ac0ee6fa4 - name: Install dependencies run: ${VCPKG_ROOT}/vcpkg install openssl lz4 cmocka - name: configure OpenVPN with cmake - run: cmake -S . -B openvpn-build -DUNSUPPORTED_BUILDS=yes -DCMAKE_SYSTEM_NAME=Android -DOPENSSL_ROOT_DIR=${VCPKG_INSTALLED_DIR}/${{ matrix.vcpkg_triplet }} -DENABLE_PKCS11=false -DBUILD_TESTING=true -DCMAKE_ANDROID_ARCH_ABI=${{ matrix.abi }} -DENABLE_LZO=false -DUSE_WERROR=no + run: | + cmake -S . -B openvpn-build -DUNSUPPORTED_BUILDS=yes \ + -DCMAKE_SYSTEM_NAME=Android -DCMAKE_SYSTEM_VERSION=28 \ + -DCMAKE_ANDROID_ARCH_ABI=${{ matrix.abi }} \ + -DOPENSSL_ROOT_DIR=${VCPKG_INSTALLED_DIR}/${{ matrix.vcpkg_triplet }} \ + -DENABLE_PKCS11=false -DBUILD_TESTING=true -DENABLE_LZO=false -DUSE_WERROR=no - name: Build OpenVPN Android binary with cmake run: cmake --build openvpn-build @@ -85,7 +90,7 @@ - name: Restore from cache and install vcpkg uses: lukka/run-vcpkg@5e0cab206a5ea620130caf672fce3e4a6b5666a1 # v11.5 with: - vcpkgGitCommitId: 33e9c99208736b713cabe4490e15235f62f893d4 + vcpkgGitCommitId: acd5bba5aac8b6573b5f6f463dc0341ac0ee6fa4 vcpkgJsonGlob: '**/mingw/vcpkg.json' - name: Run CMake with vcpkg.json manifest @@ -95,7 +100,7 @@ buildPreset: mingw-${{ matrix.arch }} buildPresetAdditionalArgs: "['--config Debug']" - - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: openvpn-mingw-${{ matrix.arch }} path: | @@ -103,7 +108,7 @@ ${{ github.workspace }}/out/build/mingw/${{ matrix.arch }}/Debug/*.dll !${{ github.workspace }}/out/build/mingw/${{ matrix.arch }}/Debug/test_*.exe - - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: openvpn-mingw-${{ matrix.arch }}-tests path: | @@ -124,7 +129,7 @@ - name: Checkout OpenVPN uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Retrieve mingw unittest - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8 + uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1 with: name: openvpn-mingw-${{ matrix.arch }}-tests path: unittests @@ -269,7 +274,7 @@ runs-on: windows-latest steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: lukka/get-cmake@5f6e04f5267c8133f1273bf2103583fc72c46b17 # v3.31.5 + - uses: lukka/get-cmake@56d043d188c3612951d8755da8f4b709ec951ad6 # v3.31.6 - name: Install rst2html run: python -m pip install --upgrade pip docutils @@ -277,7 +282,7 @@ - name: Restore artifacts, or setup vcpkg (do not install any package) uses: lukka/run-vcpkg@5e0cab206a5ea620130caf672fce3e4a6b5666a1 # v11.5 with: - vcpkgGitCommitId: 33e9c99208736b713cabe4490e15235f62f893d4 + vcpkgGitCommitId: acd5bba5aac8b6573b5f6f463dc0341ac0ee6fa4 vcpkgJsonGlob: '**/windows/vcpkg.json' - name: Run CMake with vcpkg.json manifest (NO TESTS) @@ -296,7 +301,7 @@ testPreset: win-${{ matrix.arch }}-release testPresetAdditionalArgs: "['--output-on-failure']" - - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: openvpn-msvc-${{ matrix.arch }} path: | @@ -406,7 +411,7 @@ submodules: true # versioning=semver-coerced repository: Mbed-TLS/mbedtls - ref: v3.6.2 + ref: v3.6.3 - name: "mbedtls: make no_test" run: make -j3 no_test SHARED=1 working-directory: mbedtls diff --git a/.github/workflows/coverity-scan.yml b/.github/workflows/coverity-scan.yml index 3381d8f..222c57e 100644 --- a/.github/workflows/coverity-scan.yml +++ b/.github/workflows/coverity-scan.yml @@ -13,7 +13,7 @@ steps: - name: Check submission cache id: check_submit - uses: actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0 + uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 with: path: | cov-int @@ -65,7 +65,7 @@ - name: Cache submission if: steps.check_submit.outputs.cache-hit != 'true' - uses: actions/cache/save@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0 + uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 with: path: | cov-int diff --git a/.github/workflows/doxygen.yml b/.github/workflows/doxygen.yml index f1ece70..ffd1b82 100644 --- a/.github/workflows/doxygen.yml +++ b/.github/workflows/doxygen.yml @@ -34,7 +34,7 @@ touch doc/doxygen/html/.nojekyll - name: Upload static files as artifact id: deployment - uses: actions/upload-pages-artifact@v3.0.1 + uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1 with: path: doxygen/doc/doxygen/html/ @@ -50,4 +50,4 @@ steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v4.0.5 + uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5 |
| From: plaisthos (C. Review) <ge...@op...> - 2025-03-31 14:18:01 |
Attention is currently required from: flichtenheld. plaisthos has posted comments on this change. ( http://gerrit.openvpn.net/c/openvpn/+/926?usp=email ) Change subject: GHA: Dependency and Actions update April 2025 ...................................................................... Patch Set 1: (1 comment) Patchset: PS1: It looks good but I am entirely sure that "GHA: Dependency and Actions update April 2025" is a good git commit subject -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/926?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: Ie9bffcc487f53a3a8ae6e59b79e654360d99902c Gerrit-Change-Number: 926 Gerrit-PatchSet: 1 Gerrit-Owner: flichtenheld <fr...@li...> Gerrit-Reviewer: plaisthos <arn...@rf...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-Attention: flichtenheld <fr...@li...> Gerrit-Comment-Date: Mon, 31 Mar 2025 14:17:46 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Gerrit-MessageType: comment |
| From: plaisthos (C. Review) <ge...@op...> - 2025-03-31 14:17:28 |
Attention is currently required from: flichtenheld. plaisthos has posted comments on this change. ( http://gerrit.openvpn.net/c/openvpn/+/926?usp=email ) Change subject: GHA: Dependency and Actions update April 2025 ...................................................................... Patch Set 1: Code-Review+2 -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/926?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: Ie9bffcc487f53a3a8ae6e59b79e654360d99902c Gerrit-Change-Number: 926 Gerrit-PatchSet: 1 Gerrit-Owner: flichtenheld <fr...@li...> Gerrit-Reviewer: plaisthos <arn...@rf...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-Attention: flichtenheld <fr...@li...> Gerrit-Comment-Date: Mon, 31 Mar 2025 14:17:14 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment |
| From: flichtenheld (C. Review) <ge...@op...> - 2025-03-31 12:14:40 |
Attention is currently required from: plaisthos. flichtenheld has posted comments on this change. ( http://gerrit.openvpn.net/c/openvpn/+/926?usp=email ) Change subject: GHA: Dependency and Actions update April 2025 ...................................................................... Patch Set 1: (1 comment) Patchset: PS1: See https://github.com/OpenVPN/openvpn/pull/711 for build verification. -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/926?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: Ie9bffcc487f53a3a8ae6e59b79e654360d99902c Gerrit-Change-Number: 926 Gerrit-PatchSet: 1 Gerrit-Owner: flichtenheld <fr...@li...> Gerrit-Reviewer: plaisthos <arn...@rf...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-Attention: plaisthos <arn...@rf...> Gerrit-Comment-Date: Mon, 31 Mar 2025 12:14:20 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Gerrit-MessageType: comment |
| From: flichtenheld (C. Review) <ge...@op...> - 2025-03-31 12:09:51 |
Attention is currently required from: plaisthos. Hello plaisthos, I'd like you to do a code review. Please visit http://gerrit.openvpn.net/c/openvpn/+/926?usp=email to review the following change. Change subject: GHA: Dependency and Actions update April 2025 ...................................................................... GHA: Dependency and Actions update April 2025 - Fix Android build with newer vcpkg Need to sync CMAKE_SYSTEM_VERSION with vcpkg. - Update mbedTLS v3 builds to latest release. Depends on commit 4897c522948c8cdb82c0325ee08f6907cfc16f57 - Update all actions to latest releases. Change-Id: Ie9bffcc487f53a3a8ae6e59b79e654360d99902c Signed-off-by: Frank Lichtenheld <fr...@li...> --- M .github/workflows/build.yaml M .github/workflows/coverity-scan.yml M .github/workflows/doxygen.yml 3 files changed, 20 insertions(+), 15 deletions(-) git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/26/926/1 diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index b1af7ec..3fc44f5 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -27,7 +27,7 @@ - name: Show changes on standard output run: git diff working-directory: openvpn - - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: uncrustify-changes.patch path: 'openvpn/uncrustify-changes.patch' @@ -57,11 +57,16 @@ - name: Install vcpkg uses: lukka/run-vcpkg@5e0cab206a5ea620130caf672fce3e4a6b5666a1 # v11.5 with: - vcpkgGitCommitId: 33e9c99208736b713cabe4490e15235f62f893d4 + vcpkgGitCommitId: acd5bba5aac8b6573b5f6f463dc0341ac0ee6fa4 - name: Install dependencies run: ${VCPKG_ROOT}/vcpkg install openssl lz4 cmocka - name: configure OpenVPN with cmake - run: cmake -S . -B openvpn-build -DUNSUPPORTED_BUILDS=yes -DCMAKE_SYSTEM_NAME=Android -DOPENSSL_ROOT_DIR=${VCPKG_INSTALLED_DIR}/${{ matrix.vcpkg_triplet }} -DENABLE_PKCS11=false -DBUILD_TESTING=true -DCMAKE_ANDROID_ARCH_ABI=${{ matrix.abi }} -DENABLE_LZO=false -DUSE_WERROR=no + run: | + cmake -S . -B openvpn-build -DUNSUPPORTED_BUILDS=yes \ + -DCMAKE_SYSTEM_NAME=Android -DCMAKE_SYSTEM_VERSION=28 \ + -DCMAKE_ANDROID_ARCH_ABI=${{ matrix.abi }} \ + -DOPENSSL_ROOT_DIR=${VCPKG_INSTALLED_DIR}/${{ matrix.vcpkg_triplet }} \ + -DENABLE_PKCS11=false -DBUILD_TESTING=true -DENABLE_LZO=false -DUSE_WERROR=no - name: Build OpenVPN Android binary with cmake run: cmake --build openvpn-build @@ -85,7 +90,7 @@ - name: Restore from cache and install vcpkg uses: lukka/run-vcpkg@5e0cab206a5ea620130caf672fce3e4a6b5666a1 # v11.5 with: - vcpkgGitCommitId: 33e9c99208736b713cabe4490e15235f62f893d4 + vcpkgGitCommitId: acd5bba5aac8b6573b5f6f463dc0341ac0ee6fa4 vcpkgJsonGlob: '**/mingw/vcpkg.json' - name: Run CMake with vcpkg.json manifest @@ -95,7 +100,7 @@ buildPreset: mingw-${{ matrix.arch }} buildPresetAdditionalArgs: "['--config Debug']" - - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: openvpn-mingw-${{ matrix.arch }} path: | @@ -103,7 +108,7 @@ ${{ github.workspace }}/out/build/mingw/${{ matrix.arch }}/Debug/*.dll !${{ github.workspace }}/out/build/mingw/${{ matrix.arch }}/Debug/test_*.exe - - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: openvpn-mingw-${{ matrix.arch }}-tests path: | @@ -124,7 +129,7 @@ - name: Checkout OpenVPN uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Retrieve mingw unittest - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8 + uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1 with: name: openvpn-mingw-${{ matrix.arch }}-tests path: unittests @@ -269,7 +274,7 @@ runs-on: windows-latest steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: lukka/get-cmake@5f6e04f5267c8133f1273bf2103583fc72c46b17 # v3.31.5 + - uses: lukka/get-cmake@56d043d188c3612951d8755da8f4b709ec951ad6 # v3.31.6 - name: Install rst2html run: python -m pip install --upgrade pip docutils @@ -277,7 +282,7 @@ - name: Restore artifacts, or setup vcpkg (do not install any package) uses: lukka/run-vcpkg@5e0cab206a5ea620130caf672fce3e4a6b5666a1 # v11.5 with: - vcpkgGitCommitId: 33e9c99208736b713cabe4490e15235f62f893d4 + vcpkgGitCommitId: acd5bba5aac8b6573b5f6f463dc0341ac0ee6fa4 vcpkgJsonGlob: '**/windows/vcpkg.json' - name: Run CMake with vcpkg.json manifest (NO TESTS) @@ -296,7 +301,7 @@ testPreset: win-${{ matrix.arch }}-release testPresetAdditionalArgs: "['--output-on-failure']" - - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: openvpn-msvc-${{ matrix.arch }} path: | @@ -406,7 +411,7 @@ submodules: true # versioning=semver-coerced repository: Mbed-TLS/mbedtls - ref: v3.6.2 + ref: v3.6.3 - name: "mbedtls: make no_test" run: make -j3 no_test SHARED=1 working-directory: mbedtls diff --git a/.github/workflows/coverity-scan.yml b/.github/workflows/coverity-scan.yml index 3381d8f..222c57e 100644 --- a/.github/workflows/coverity-scan.yml +++ b/.github/workflows/coverity-scan.yml @@ -13,7 +13,7 @@ steps: - name: Check submission cache id: check_submit - uses: actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0 + uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 with: path: | cov-int @@ -65,7 +65,7 @@ - name: Cache submission if: steps.check_submit.outputs.cache-hit != 'true' - uses: actions/cache/save@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0 + uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 with: path: | cov-int diff --git a/.github/workflows/doxygen.yml b/.github/workflows/doxygen.yml index f1ece70..ffd1b82 100644 --- a/.github/workflows/doxygen.yml +++ b/.github/workflows/doxygen.yml @@ -34,7 +34,7 @@ touch doc/doxygen/html/.nojekyll - name: Upload static files as artifact id: deployment - uses: actions/upload-pages-artifact@v3.0.1 + uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1 with: path: doxygen/doc/doxygen/html/ @@ -50,4 +50,4 @@ steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v4.0.5 + uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5 -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/926?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: Ie9bffcc487f53a3a8ae6e59b79e654360d99902c Gerrit-Change-Number: 926 Gerrit-PatchSet: 1 Gerrit-Owner: flichtenheld <fr...@li...> Gerrit-Reviewer: plaisthos <arn...@rf...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-Attention: plaisthos <arn...@rf...> Gerrit-MessageType: newchange |
| From: d12fk (C. Review) <ge...@op...> - 2025-03-31 07:52:36 |
Attention is currently required from: cron2, d12fk, flichtenheld, plaisthos. Hello cron2, flichtenheld, plaisthos, I'd like you to reexamine a change. Please visit http://gerrit.openvpn.net/c/openvpn/+/838?usp=email to look at the new patch set (#19). The following approvals got outdated and were removed: Code-Review-1 by flichtenheld Change subject: dns: apply settings via script on unixoid systems ...................................................................... dns: apply settings via script on unixoid systems This introduces a new script hook, the dns-updown, and implements such a command script for a few popular systems (and a default for the not so popular ones). Like the name suggests this hook is soleley for dealing with modifying how names are resolved when the VPN pushes some --dns settings. The default dns updown command is part of the distribution and is installed with openvpn. You can change the path the command is located at as a compile time option, defaults to libexecdir. You can compile-time disable that the default dns-updown hook is run by passing --disable-dns-updown-by-default to configure or ccmake ENABLE_DNS_UPDOWN_BY_DEFAULT to OFF. There's also a new runtime option --dns-updown, which can run a custom command, force running the default when disabled or disable execution of the dns-updown altogether. Change-Id: Ifbe4ffb44d3bfcaa50adb38cacb3436fcdc71b10 Signed-off-by: Heiko Hund <he...@is...> --- M .gitignore M CMakeLists.txt M config.h.cmake.in M configure.ac M distro/Makefile.am A distro/dns-scripts/Makefile.am A distro/dns-scripts/haikuos_file-dns-updown.sh A distro/dns-scripts/openresolv-dns-updown.sh A distro/dns-scripts/resolvconf_file-dns-updown.sh A distro/dns-scripts/systemd-dns-updown.sh M doc/man-sections/script-options.rst M src/openvpn/Makefile.am M src/openvpn/dns.c M src/openvpn/dns.h M src/openvpn/options.c 15 files changed, 658 insertions(+), 10 deletions(-) git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/38/838/19 diff --git a/.gitignore b/.gitignore index db8bb73..04523af 100644 --- a/.gitignore +++ b/.gitignore @@ -49,6 +49,7 @@ /doc/doxygen/latex/ /doc/doxygen/openvpn.doxyfile distro/systemd/*.service +distro/dns-scripts/dns-updown sample/sample-keys/sample-ca/ vendor/cmocka_build vendor/dist diff --git a/CMakeLists.txt b/CMakeLists.txt index b04adce..ef4a0f2 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -41,7 +41,10 @@ option(USE_WERROR "Treat compiler warnings as errors (-Werror)" ON) option(FAKE_ANDROID "Target Android but do not use actual cross compile/Android cmake to build for simple compile checks on Linux") -set(PLUGIN_DIR /usr/local/lib/openvpn/plugins CACHE FILEPATH "Location of the plugin directory") +option(ENABLE_DNS_UPDOWN_BY_DEFAULT "Run --dns-updown hook by default" ON) +set(DNS_UPDOWN_PATH "${CMAKE_INSTALL_PREFIX}/libexec/openvpn/dns-updown" CACHE STRING "Default location for the DNS up/down script") + +set(PLUGIN_DIR "${CMAKE_INSTALL_PREFIX}/lib/openvpn/plugins" CACHE FILEPATH "Location of the plugin directory") # Create machine readable compile commands option(ENABLE_COMPILE_COMMANDS "Generate compile_commands.json and a symlink for clangd to find it" OFF) @@ -577,6 +580,8 @@ add_library_deps(openvpn) +target_compile_options(openvpn PRIVATE -DDEFAULT_DNS_UPDOWN=\"${DNS_UPDOWN_PATH}\") + if(MINGW) target_compile_options(openvpn PRIVATE -municode -UUNICODE) target_link_options(openvpn PRIVATE -municode) diff --git a/config.h.cmake.in b/config.h.cmake.in index 2f7b43d..5164ce3 100644 --- a/config.h.cmake.in +++ b/config.h.cmake.in @@ -35,6 +35,9 @@ /* Enable LZO compression library */ #cmakedefine ENABLE_LZO +/* Enable dns-updown script hook */ +#cmakedefine ENABLE_DNS_UPDOWN + /* Enable NTLMv2 proxy support */ #define ENABLE_NTLM 1 diff --git a/configure.ac b/configure.ac index 9777e36..75367e8 100644 --- a/configure.ac +++ b/configure.ac @@ -96,6 +96,13 @@ ) AC_ARG_ENABLE( + [dns-updown-by-default], + [AS_HELP_STRING([--disable-dns-updown-by-default], [disable running --dns-updown by default @<:@default=yes@:>@])], + , + [enable_dns_updown_by_default="yes"] +) + +AC_ARG_ENABLE( [ntlm], [AS_HELP_STRING([--disable-ntlm], [disable NTLMv2 proxy support @<:@default=yes@:>@])], , @@ -315,37 +322,50 @@ plugindir="\${libdir}/openvpn/plugins" fi +AC_ARG_VAR([SCRIPTDIR], [Path of script directory @<:@default=PKGLIBEXECDIR@:>@]) +if test -n "${SCRIPTDIR}"; then + scriptdir="${SCRIPTDIR}" +else + scriptdir="\${pkglibexecdir}" +fi + AC_DEFINE_UNQUOTED([TARGET_ALIAS], ["${host}"], [A string representing our host]) -AM_CONDITIONAL([TARGET_LINUX], [false]) +AM_CONDITIONAL([ENABLE_DNS_UPDOWN],[true]) case "$host" in *-*-linux*) AC_DEFINE([TARGET_LINUX], [1], [Are we running on Linux?]) - AM_CONDITIONAL([TARGET_LINUX], [true]) AC_DEFINE_UNQUOTED([TARGET_PREFIX], ["L"], [Target prefix]) + AC_SUBST([DNS_UPDOWN_TYPE], ["systemd"]) have_sitnl="yes" pkg_config_required="yes" ;; *-*-solaris*) AC_DEFINE([TARGET_SOLARIS], [1], [Are we running on Solaris?]) AC_DEFINE_UNQUOTED([TARGET_PREFIX], ["S"], [Target prefix]) + AC_SUBST([DNS_UPDOWN_TYPE], ["resolvconf_file"]) CPPFLAGS="$CPPFLAGS -D_XPG4_2" test -x /bin/bash && SHELL="/bin/bash" ;; *-*-openbsd*) AC_DEFINE([TARGET_OPENBSD], [1], [Are we running on OpenBSD?]) AC_DEFINE_UNQUOTED([TARGET_PREFIX], ["O"], [Target prefix]) + AC_SUBST([DNS_UPDOWN_TYPE], ["resolvconf_file"]) ;; *-*-freebsd*) AC_DEFINE([TARGET_FREEBSD], [1], [Are we running on FreeBSD?]) AC_DEFINE_UNQUOTED([TARGET_PREFIX], ["F"], [Target prefix]) + AC_SUBST([DNS_UPDOWN_TYPE], ["openresolv"]) ;; *-*-netbsd*) AC_DEFINE([TARGET_NETBSD], [1], [Are we running NetBSD?]) AC_DEFINE_UNQUOTED([TARGET_PREFIX], ["N"], [Target prefix]) + AC_SUBST([DNS_UPDOWN_TYPE], ["openresolv"]) ;; *-*-darwin*) AC_DEFINE([TARGET_DARWIN], [1], [Are we running on Mac OS X?]) AC_DEFINE_UNQUOTED([TARGET_PREFIX], ["M"], [Target prefix]) + AM_CONDITIONAL([ENABLE_DNS_UPDOWN], [false]) + AC_SUBST([DNS_UPDOWN_TYPE], ["resolvconf_file"]) have_tap_header="yes" ac_cv_type_struct_in_pktinfo=no ;; @@ -353,6 +373,8 @@ AC_DEFINE([TARGET_WIN32], [1], [Are we running WIN32?]) AC_DEFINE([ENABLE_DCO], [1], [DCO is always enabled on Windows]) AC_DEFINE_UNQUOTED([TARGET_PREFIX], ["W"], [Target prefix]) + AM_CONDITIONAL([ENABLE_DNS_UPDOWN], [false]) + AC_SUBST([DNS_UPDOWN_TYPE], ["windows"]) CPPFLAGS="${CPPFLAGS} -DWIN32_LEAN_AND_MEAN" CPPFLAGS="${CPPFLAGS} -DNTDDI_VERSION=NTDDI_VISTA -D_WIN32_WINNT=_WIN32_WINNT_VISTA" WIN32=yes @@ -360,10 +382,12 @@ *-*-dragonfly*) AC_DEFINE([TARGET_DRAGONFLY], [1], [Are we running on DragonFlyBSD?]) AC_DEFINE_UNQUOTED([TARGET_PREFIX], ["D"], [Target prefix]) + AC_SUBST([DNS_UPDOWN_TYPE], ["openresolv"]) ;; *-aix*) AC_DEFINE([TARGET_AIX], [1], [Are we running AIX?]) AC_DEFINE_UNQUOTED([TARGET_PREFIX], ["A"], [Target prefix]) + AC_SUBST([DNS_UPDOWN_TYPE], ["resolvconf_file"]) ROUTE="/usr/sbin/route" have_tap_header="yes" ac_cv_header_net_if_h="no" # exists, but breaks things @@ -371,10 +395,12 @@ *-*-haiku*) AC_DEFINE([TARGET_HAIKU], [1], [Are we running Haiku?]) AC_DEFINE_UNQUOTED([TARGET_PREFIX], ["H"], [Target prefix]) + AC_SUBST([DNS_UPDOWN_TYPE], ["haikuos_file"]) LIBS="${LIBS} -lnetwork" ;; *) AC_DEFINE_UNQUOTED([TARGET_PREFIX], ["X"], [Target prefix]) + AC_SUBST([DNS_UPDOWN_TYPE], ["resolvconf_file"]) have_tap_header="yes" ;; esac @@ -1317,7 +1343,7 @@ test "${enable_small}" = "yes" && AC_DEFINE([ENABLE_SMALL], [1], [Enable smaller executable size]) test "${enable_fragment}" = "yes" && AC_DEFINE([ENABLE_FRAGMENT], [1], [Enable internal fragmentation support]) test "${enable_port_share}" = "yes" && AC_DEFINE([ENABLE_PORT_SHARE], [1], [Enable TCP Server port sharing]) - +test "${enable_dns_updown_by_default}" = "yes" && AC_DEFINE([ENABLE_DNS_UPDOWN_BY_DEFAULT], [1], [Enable dns-updown hook by default]) test "${enable_ntlm}" = "yes" && AC_DEFINE([ENABLE_NTLM], [1], [Enable NTLMv2 proxy support]) test "${enable_crypto_ofb_cfb}" = "yes" && AC_DEFINE([ENABLE_OFB_CFB_MODE], [1], [Enable OFB and CFB cipher modes]) if test "${have_export_keying_material}" = "yes"; then @@ -1505,6 +1531,7 @@ sampledir="\$(docdir)/sample" AC_SUBST([plugindir]) +AC_SUBST([scriptdir]) AC_SUBST([sampledir]) AC_SUBST([systemdunitdir]) @@ -1541,6 +1568,7 @@ Makefile distro/Makefile distro/systemd/Makefile + distro/dns-scripts/Makefile doc/Makefile doc/doxygen/Makefile doc/doxygen/openvpn.doxyfile diff --git a/distro/Makefile.am b/distro/Makefile.am index 7a588da..26f577b 100644 --- a/distro/Makefile.am +++ b/distro/Makefile.am @@ -13,3 +13,7 @@ $(srcdir)/Makefile.in SUBDIRS = systemd + +if ENABLE_DNS_UPDOWN +SUBDIRS += dns-scripts +endif diff --git a/distro/dns-scripts/Makefile.am b/distro/dns-scripts/Makefile.am new file mode 100644 index 0000000..ec7bfde --- /dev/null +++ b/distro/dns-scripts/Makefile.am @@ -0,0 +1,28 @@ +# +# OpenVPN -- An application to securely tunnel IP networks +# over a single UDP port, with support for SSL/TLS-based +# session authentication and key exchange, +# packet encryption, packet authentication, and +# packet compression. +# +# Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> +# + +MAINTAINERCLEANFILES = \ + $(srcdir)/Makefile.in + +EXTRA_DIST = \ + systemd-dns-updown.sh \ + openresolv-dns-updown.sh \ + haikuos_file-dns-updown.sh \ + resolvconf_file-dns-updown.sh + +script_SCRIPTS = \ + dns-updown + +CLEANFILES = $(script_SCRIPTS) + +dns-updown: @DNS...@-d... + cp ${srcdir}/@DNS...@-d... $@ + +all: $(script_SCRIPTS) diff --git a/distro/dns-scripts/haikuos_file-dns-updown.sh b/distro/dns-scripts/haikuos_file-dns-updown.sh new file mode 100644 index 0000000..1b03e9c --- /dev/null +++ b/distro/dns-scripts/haikuos_file-dns-updown.sh @@ -0,0 +1,84 @@ +#!/bin/sh +# +# Simple OpenVPN up/down script for modifying Haiku OS resolv.conf +# (C) Copyright 2024 OpenVPN Inc <sa...@op...> +# +# SPDX-License-Identifier: BSD-2-Clause +# +# Example env from openvpn (most are not applied): +# +# dev tun0 +# script-type dns-up +# dns_search_domain_1 mycorp.in +# dns_search_domain_2 eu.mycorp.com +# dns_server_1_address_1 192.168.99.254 +# dns_server_1_address_2 fd00::99:53 +# dns_server_1_port_1 53 +# dns_server_1_port_2 53 +# dns_server_1_resolve_domain_1 mycorp.in +# dns_server_1_resolve_domain_2 eu.mycorp.com +# dns_server_1_dnssec true +# dns_server_1_transport DoH +# dns_server_1_sni dns.mycorp.in +# + +set -e +u + +conly_standard_server_ports() { + i=1 + while true; do + eval addr=\"\$dns_server_${n}_address_${i}\" + [ -n "$addr" ] || return 0 + + eval port=\"\$dns_server_${n}_port_${i}\" + [ -z "$port" -o "$port" = "53" ] || return 1 + + i=$(expr $i + 1) + done +} + +onf=/boot/system/settings/network/resolv.conf +test -e "$conf" || exit 1 +case "${script_type}" in +dns-up) + n=1 + while :; do + eval addr=\"\$dns_server_${n}_address_1\" + [ -n "$addr" ] || { + echo "setting DNS failed, no compatible server profile" + exit 1 + } + + # Skip server profiles which require DNSSEC, + # secure transport or use a custom port + eval dnssec=\"\$dns_server_${n}_dnssec\" + eval transport=\"\$dns_server_${n}_transport\" + [ -z "$transport" -o "$transport" = "plain" ] \ + && [ -z "$dnssec" -o "$dnssec" = "no" ] \ + && only_standard_server_ports && break + + n=$(expr $n + 1) + done + + eval addr1=\"\$dns_server_${n}_address_1\" + eval addr2=\"\$dns_server_${n}_address_2\" + eval addr3=\"\$dns_server_${n}_address_3\" + text="### openvpn ${dev} begin ###\n" + text="${text}nameserver $addr1\n" + test -z "$addr2" || text="${text}nameserver $addr2\n" + test -z "$addr3" || text="${text}nameserver $addr3\n" + + test -z "$dns_search_domain_1" || { + for i in $(seq 1 6); do + eval domains=\"$domains\$dns_search_domain_${i} \" || break + done + text="${text}search $domains\n" + } + text="${text}### openvpn ${dev} end ###" + + sed -i "1i${text}" "$conf" + ;; +dns-down) + sed -i "/### openvpn ${dev} begin ###/,/### openvpn ${dev} end ###/d" "$conf" + ;; +esac diff --git a/distro/dns-scripts/openresolv-dns-updown.sh b/distro/dns-scripts/openresolv-dns-updown.sh new file mode 100644 index 0000000..1b218f5 --- /dev/null +++ b/distro/dns-scripts/openresolv-dns-updown.sh @@ -0,0 +1,89 @@ +#!/bin/sh +# +# Simple OpenVPN up/down script for openresolv integration +# (C) Copyright 2016 Baptiste Daroussin +# 2024 OpenVPN Inc <sa...@op...> +# +# SPDX-License-Identifier: BSD-2-Clause +# +# Example env from openvpn (most are not applied): +# +# dev tun0 +# script-type dns-up +# dns_search_domain_1 mycorp.in +# dns_search_domain_2 eu.mycorp.com +# dns_server_1_address_1 192.168.99.254 +# dns_server_1_address_2 fd00::99:53 +# dns_server_1_port_1 53 +# dns_server_1_port_2 53 +# dns_server_1_resolve_domain_1 mycorp.in +# dns_server_1_resolve_domain_2 eu.mycorp.com +# dns_server_1_dnssec true +# dns_server_1_transport DoH +# dns_server_1_sni dns.mycorp.in +# + +set -e +u + +only_standard_server_ports() { + i=1 + while true; do + eval addr=\"\$dns_server_${n}_address_${i}\" + [ -n "$addr" ] || return 0 + + eval port=\"\$dns_server_${n}_port_${i}\" + [ -z "$port" -o "$port" = "53" ] || return 1 + + i=$(expr $i + 1) + done +} + +: ${script_type:=dns-down} +case "${script_type}" in +dns-up) + n=1 + while :; do + eval addr=\"\$dns_server_${n}_address_1\" + [ -n "$addr" ] || { + echo "setting DNS failed, no compatible server profile" + exit 1 + } + + # Skip server profiles which require DNSSEC, + # secure transport or use a custom port + eval dnssec=\"\$dns_server_${n}_dnssec\" + eval transport=\"\$dns_server_${n}_transport\" + [ -z "$transport" -o "$transport" = "plain" ] \ + && [ -z "$dnssec" -o "$dnssec" = "no" ] \ + && only_standard_server_ports && break + + n=$(expr $n + 1) + done + + { + i=1 + maxns=3 + while :; do + maxns=$((maxns - 1)) + [ $maxns -gt 0 ] || break + eval option=\"\$dns_server_${n}_address_${i}\" || break + [ "${option}" ] || break + i=$((i + 1)) + echo "nameserver ${option}" + done + i=1 + maxdom=6 + while :; do + maxdom=$((maxdom - 1)) + [ $maxdom -gt 0 ] || break + eval option=\"\$dns_search_domain_${i}\" || break + [ "${option}" ] || break + i=$((i + 1)) + echo "search ${option}" + done + } | /sbin/resolvconf -a "${dev}" + ;; +dns-down) + /sbin/resolvconf -d "${dev}" -f + ;; +esac diff --git a/distro/dns-scripts/resolvconf_file-dns-updown.sh b/distro/dns-scripts/resolvconf_file-dns-updown.sh new file mode 100644 index 0000000..c469490 --- /dev/null +++ b/distro/dns-scripts/resolvconf_file-dns-updown.sh @@ -0,0 +1,84 @@ +#!/bin/sh +# +# Simple OpenVPN up/down script for modifying /etc/resolv.conf +# (C) Copyright 2024 OpenVPN Inc <sa...@op...> +# +# SPDX-License-Identifier: BSD-2-Clause +# +# Example env from openvpn (most are not applied): +# +# dev tun0 +# script-type dns-up +# dns_search_domain_1 mycorp.in +# dns_search_domain_2 eu.mycorp.com +# dns_server_1_address_1 192.168.99.254 +# dns_server_1_address_2 fd00::99:53 +# dns_server_1_port_1 53 +# dns_server_1_port_2 53 +# dns_server_1_resolve_domain_1 mycorp.in +# dns_server_1_resolve_domain_2 eu.mycorp.com +# dns_server_1_dnssec true +# dns_server_1_transport DoH +# dns_server_1_sni dns.mycorp.in +# + +set -e +u + +only_standard_server_ports() { + i=1 + while true; do + eval addr=\"\$dns_server_${n}_address_${i}\" + [ -n "$addr" ] || return 0 + + eval port=\"\$dns_server_${n}_port_${i}\" + [ -z "$port" -o "$port" = "53" ] || return 1 + + i=$(expr $i + 1) + done +} + +conf=/etc/resolv.conf +test -e "$conf" || exit 1 +case "${script_type}" in +dns-up) + n=1 + while :; do + eval addr=\"\$dns_server_${n}_address_1\" + [ -n "$addr" ] || { + echo "setting DNS failed, no compatible server profile" + exit 1 + } + + # Skip server profiles which require DNSSEC, + # secure transport or use a custom port + eval dnssec=\"\$dns_server_${n}_dnssec\" + eval transport=\"\$dns_server_${n}_transport\" + [ -z "$transport" -o "$transport" = "plain" ] \ + && [ -z "$dnssec" -o "$dnssec" = "no" ] \ + && only_standard_server_ports && break + + n=$(expr $n + 1) + done + + eval addr1=\"\$dns_server_${n}_address_1\" + eval addr2=\"\$dns_server_${n}_address_2\" + eval addr3=\"\$dns_server_${n}_address_3\" + text="### openvpn ${dev} begin ###\n" + text="${text}nameserver $addr1\n" + test -z "$addr2" || text="${text}nameserver $addr2\n" + test -z "$addr3" || text="${text}nameserver $addr3\n" + + test -z "$dns_search_domain_1" || { + for i in $(seq 1 6); do + eval domains=\"$domains\$dns_search_domain_${i} \" || break + done + text="${text}search $domains\n" + } + text="${text}### openvpn ${dev} end ###" + + sed -i "1i${text}" "$conf" + ;; +dns-down) + sed -i "/### openvpn ${dev} begin ###/,/### openvpn ${dev} end ###/d" "$conf" + ;; +esac diff --git a/distro/dns-scripts/systemd-dns-updown.sh b/distro/dns-scripts/systemd-dns-updown.sh new file mode 100644 index 0000000..69bbebf --- /dev/null +++ b/distro/dns-scripts/systemd-dns-updown.sh @@ -0,0 +1,194 @@ +#!/bin/bash +# +# dns-updown - add/remove openvpn provided DNS information +# +# Copyright (C) 2024 OpenVPN Inc <sa...@op...> +# +# SPDX-License-Identifier: GPL-2.0 +# +# Add/remove openvpn DNS settings from the env into/from +# the system. Supported backends in this order: +# +# * systemd-resolved +# * resolvconf +# +# Example env from openvpn (not all are always applied): +# +# dev tun0 +# script-type dns-up +# dns_search_domain_1 mycorp.in +# dns_search_domain_2 eu.mycorp.com +# dns_server_1_address_1 192.168.99.254 +# dns_server_1_address_2 fd00::99:53 +# dns_server_1_port_1 53 +# dns_server_1_port_2 53 +# dns_server_1_resolve_domain_1 mycorp.in +# dns_server_1_resolve_domain_2 eu.mycorp.com +# dns_server_1_dnssec true +# dns_server_1_transport DoH +# dns_server_1_sni dns.mycorp.in +# + +function do_resolved_servers { + local sni="" + local transport_var=dns_server_${n}_transport + local sni_var=dns_server_${n}_sni + [ "${!transport_var}" = "DoT" ] && sni="#${!sni_var}" + + local i=1 + local addrs="" + while :; do + local addr_var=dns_server_${n}_address_${i} + local addr="${!addr_var}" + [ -n "$addr" ] || break + + local port_var=dns_server_${n}_port_${i} + if [ -n "${!port_var}" ]; then + if [[ "$addr" =~ : ]]; then + addr="[$addr]" + fi + addrs+="${addr}:${!port_var}${sni} " + else + addrs+="${addr}${sni} " + fi + i=$((i+1)) + done + + resolvectl dns "$dev" $addrs +} + +function do_resolved_domains { + local list="" + for domain_var in ${!dns_search_domain_*}; do + list+="${!domain_var} " + done + local domain_var=dns_server_${n}_resolve_domain_1 + if [ -z "${!domain_var}" ]; then + resolvectl default-route "$dev" true + list+="~." + else + resolvectl default-route "$dev" false + local i=1 + while :; do + domain_var=dns_server_${n}_resolve_domain_${i} + [ -n "${!domain_var}" ] || break + # Add as split domain (~ prefix), if it doesn't already exist + [[ "$list" =~ (^| )"${!domain_var}"( |$) ]] \ + || list+="~${!domain_var} " + i=$((i+1)) + done + fi + + resolvectl domain "$dev" $list +} + +function do_resolved_dnssec { + local dnssec_var=dns_server_${n}_dnssec + if [ "${!dnssec_var}" = "optional" ]; then + resolvectl dnssec "$dev" allow-downgrade + elif [ "${!dnssec_var}" = "yes" ]; then + resolvectl dnssec "$dev" true + else + resolvectl dnssec "$dev" false + fi +} + +function do_resolved_dnsovertls { + local transport_var=dns_server_${n}_transport + if [ "${!transport_var}" = "DoT" ]; then + resolvectl dnsovertls "$dev" true + else + resolvectl dnsovertls "$dev" false + fi +} + +function do_resolved { + [[ "$(readlink /etc/resolv.conf)" =~ systemd ]] || return 1 + + n=1 + while :; do + local addr_var=dns_server_${n}_address_1 + [ -n "${!addr_var}" ] || { + echo "setting DNS failed, no compatible server profile" + return 1 + } + + # Skip server profiles which require DNS-over-HTTPS + local transport_var=dns_server_${n}_transport + [ -n "${!transport_var}" -a "${!transport_var}" = "DoH" ] || break + + n=$((n+1)) + done + + if [ "$script_type" = "dns-up" ]; then + echo "setting DNS using resolvectl" + do_resolved_servers + do_resolved_domains + do_resolved_dnssec + do_resolved_dnsovertls + else + echo "unsetting DNS using resolvectl" + resolvectl revert "$dev" + fi + + return 0 +} + +function only_standard_server_ports { + local i=1 + while :; do + local addr_var=dns_server_${n}_address_${i} + [ -n "${!addr_var}" ] || return 0 + + local port_var=dns_server_${n}_port_${i} + [ -z "${!port_var}" -o "${!port_var}" = "53" ] || return 1 + + i=$((i+1)) + done +} + +function do_resolvconf { + [ -x /sbin/resolvconf ] || return 1 + + n=1 + while :; do + local server_addr_var=dns_server_${n}_address_1 + [ -n "${!server_addr_var}" ] || { + echo "setting DNS failed, no compatible server profile" + return 1 + } + + # Skip server profiles which require DNSSEC, + # secure transport or use a custom port + local dnssec_var=dns_server_${n}_dnssec + local transport_var=dns_server_${n}_transport + [ -z "${!transport_var}" -o "${!transport_var}" = "plain" ] \ + && [ -z "${!dnssec_var}" -o "${!dnssec_var}" = "no" ] \ + && only_standard_server_ports && break + + n=$((n+1)) + done + + if [ "$script_type" = "dns-up" ]; then + echo "setting DNS using resolvconf" + local domains="" + for domain_var in ${!dns_search_domain_*}; do + domains+="${!domain_var} " + done + { + local maxns=3 + for addr_var in ${!dns_server_1_address_*}; do + [ $((maxns--)) -gt 0 ] || break + echo "nameserver ${!addr_var}" + done + [ -z "$domains" ] || echo "search $domains" + } | /sbin/resolvconf -a "$dev" + else + echo "unsetting DNS using resolvconf" + /sbin/resolvconf -d "$dev" + fi + + return 0 +} + +do_resolved || do_resolvconf diff --git a/doc/man-sections/script-options.rst b/doc/man-sections/script-options.rst index 0d1f9ae..de3842b 100644 --- a/doc/man-sections/script-options.rst +++ b/doc/man-sections/script-options.rst @@ -8,9 +8,13 @@ Script Order of Execution ------------------------- +#. ``--dns-updown`` + + Executed after TCP/UDP socket bind and TUN/TAP open, before ``--up``. + #. ``--up`` - Executed after TCP/UDP socket bind and TUN/TAP open. + Executed after TCP/UDP socket bind and TUN/TAP open, after ``--dns-updown``. #. ``--tls-verify`` @@ -38,9 +42,13 @@ Executed in ``--mode server`` mode on client instance shutdown. +#. ``--dns-updown`` + + Executed before TCP/UDP and TUN/TAP close, before ``--down``. + #. ``--down`` - Executed after TCP/UDP and TUN/TAP close. + Executed after TCP/UDP and TUN/TAP close, after ``--dns-updown``. #. ``--learn-address`` @@ -173,7 +181,7 @@ client-crresponse cmd OpenVPN will write the response of the client into a temporary file. - The filename will be passed as an argument to ``cmd``, and the file will be + The filename will be passed as an argument to ``cmd``, and the file will automatically deleted by OpenVPN after the script returns. The response is passed as is from the client. The script needs to check @@ -235,6 +243,31 @@ The ``--client-disconnect`` command is not passed any extra arguments (only those arguments specified in cmd, if any). +--dns-updown cmd + Run command ``cmd``, instead of the default DNS up/down command that comes + with openvpn. If ``cmd`` is ``disable`` the ``--dns-updown`` command is not run. + + If you write your own command, please make sure to ignore ``--dns`` + server profiles that cannot be applied. Port, DNSSEC and secure transport + settings need to be adhered to. If split DNS is not possible a full redirect + can be used as a fallback. If not all of the server addresses or search domains + can be configured, apply them in the order they are listed in. + + Note that ``--dns-updown`` is not supported on all platforms. On Windows DNS + will always be set by the service. On Android DNS will be passed via management + interface. + + Note that DNS-related ``--dhcp-option``\ s might be converted so that they are + available to this hook if no ``--dns`` options exist. If any ``--dns server`` + option is present, DNS-related ``--dhcp-option``\ s will always be ignored. + If an ``--up`` script is defined, foreign_option env vars will be generated + from ``--dns`` options and passed to the script. The default ``--dns-updown`` + command is not run if an ``--up`` script is defined. Both is done for backward + compatibility. In case you want to run the ``--dns-updown`` command even if + there is an ``--up`` defined, you can define a custom command or use ``force`` + as ``cmd`` to run the default command. No DNS env vars will be passed to ``--up`` + in this case. + --down cmd Run command ``cmd`` after TUN/TAP device close (post ``--user`` UID change and/or ``--chroot`` ). ``cmd`` consists of a path to script (or @@ -661,7 +694,7 @@ names). Set prior to ``--up`` or ``--down`` script execution. :code:`dns_*` - The ``--dns`` configuration options will be made available to script + The ``--dns`` configuration options will be made available to ``--dns-updown`` execution through this set of environment variables. Variables appear only if the corresponding option has a value assigned. For the semantics of each individual variable, please refer to the documentation for ``--dns``. diff --git a/src/openvpn/Makefile.am b/src/openvpn/Makefile.am index 37af683..2e93ebb 100644 --- a/src/openvpn/Makefile.am +++ b/src/openvpn/Makefile.am @@ -30,7 +30,8 @@ $(OPTIONAL_LZ4_CFLAGS) \ $(OPTIONAL_PKCS11_HELPER_CFLAGS) \ $(OPTIONAL_INOTIFY_CFLAGS) \ - -DPLUGIN_LIBDIR=\"${plugindir}\" + -DPLUGIN_LIBDIR=\"${plugindir}\" \ + -DDEFAULT_DNS_UPDOWN=\"${scriptdir}/dns-updown\" if WIN32 # we want unicode entry point but not the macro diff --git a/src/openvpn/dns.c b/src/openvpn/dns.c index b6e524f..4da0747 100644 --- a/src/openvpn/dns.c +++ b/src/openvpn/dns.c @@ -30,6 +30,7 @@ #include "dns.h" #include "socket.h" #include "options.h" +#include "run_command.h" #ifdef _WIN32 #include "win32.h" @@ -262,6 +263,8 @@ clone.search_domains = clone_dns_domains(o->search_domains, gc); clone.servers = clone_dns_servers(o->servers, gc); clone.servers_prepull = clone_dns_servers(o->servers_prepull, gc); + clone.updown = o->updown; + clone.user_set_updown = o->user_set_updown; return clone; } @@ -548,6 +551,54 @@ send_msg_iservice(o->msg_channel, &nrpt, sizeof(nrpt), &ack, "DNS"); } +#else /* ifdef _WIN32 */ + +static void +updown_env_set(bool up, const struct dns_options *o, const struct tuntap *tt, struct env_set *es) +{ + setenv_str(es, "dev", tt->actual_name); + setenv_str(es, "script_type", up ? "dns-up" : "dns-down"); + setenv_dns_options(o, es); +} + +static int +do_run_up_down_command(bool up, const struct dns_options *o, const struct tuntap *tt) +{ + struct gc_arena gc = gc_new(); + struct argv argv = argv_new(); + struct env_set *es = env_set_create(&gc); + + updown_env_set(up, o, tt, es); + + argv_printf(&argv, "%s", o->updown); + argv_msg(M_INFO, &argv); + int res; + if (o->user_set_updown) + { + res = openvpn_run_script(&argv, es, S_EXITCODE, "dns updown"); + } + else + { + res = openvpn_execve_check(&argv, es, S_EXITCODE, "WARNING: Failed running dns updown"); + } + argv_free(&argv); + gc_free(&gc); + return res; +} + +static void +run_up_down_command(bool up, struct options *o, const struct tuntap *tt) +{ + if (!o->dns_options.updown) + { + return; + } + + int status; + status = do_run_up_down_command(up, &o->dns_options, tt); + msg(M_INFO, "dns %s command exited with status %d", up ? "up" : "down", status); +} + #endif /* _WIN32 */ void @@ -666,5 +717,7 @@ #ifdef _WIN32 run_up_down_service(up, o, tt); +#else + run_up_down_command(up, o, tt); #endif /* ifdef _WIN32 */ } diff --git a/src/openvpn/dns.h b/src/openvpn/dns.h index f24e30b..c4d19ff 100644 --- a/src/openvpn/dns.h +++ b/src/openvpn/dns.h @@ -73,6 +73,8 @@ struct dns_server *servers_prepull; struct dns_server *servers; struct gc_arena gc; + const char *updown; + bool user_set_updown; }; /** diff --git a/src/openvpn/options.c b/src/openvpn/options.c index 99dd60a..b116740 100644 --- a/src/openvpn/options.c +++ b/src/openvpn/options.c @@ -526,10 +526,12 @@ " address <addr[:port]> [addr[:port] ...] : server addresses 4/6\n" " resolve-domains <domain> [domain ...] : split domains\n" " dnssec <yes|no|optional> : option to use DNSSEC\n" - " type <DoH|DoT> : query server over HTTPS / TLS\n" + " transport <DoH|DoT> : query server over HTTPS / TLS\n" " sni <domain> : DNS server name indication\n" "--dns search-domains <domain> [domain ...]:\n" " Add domains to DNS domain search list\n" + "--dns-updown cmd|force|disable : Run cmd as user defined dns config command,\n" + " force running the default script or disable running it.\n" "--auth-retry t : How to handle auth failures. Set t to\n" " none (default), interact, or nointeract.\n" "--static-challenge t e [<scrv1|concat>]: Enable static challenge/response protocol using\n" @@ -921,6 +923,10 @@ #ifndef ENABLE_DCO o->disable_dco = true; #endif /* ENABLE_DCO */ + +#ifdef ENABLE_DNS_UPDOWN_BY_DEFAULT + o->dns_options.updown = DEFAULT_DNS_UPDOWN; +#endif /* ENABLE_DNS_UPDOWN_BY_DEFAULT */ } void @@ -8087,6 +8093,39 @@ to->ip_win32_defined = true; } #endif /* ifdef _WIN32 */ + else if (streq(p[0], "dns-updown") && p[1]) + { + VERIFY_PERMISSION(OPT_P_SCRIPT); + if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT)) + { + goto err; + } + struct dns_options *dns = &options->dns_options; + if (streq(p[1], "disable")) + { + dns->updown = NULL; + dns->user_set_updown = false; + } + else if (streq(p[1], "force")) + { + /* force dns-updown run, even if a --up script is defined */ + if (dns->user_set_updown == false) + { + dns->updown = DEFAULT_DNS_UPDOWN; + dns->user_set_updown = true; + } + } + else + { + if (streq(dns->updown, DEFAULT_DNS_UPDOWN)) + { + /* Unset the default command to prevent warnings */ + dns->updown = NULL; + } + set_user_script(options, &dns->updown, p[1], p[0], false); + dns->user_set_updown = true; + } + } else if (streq(p[0], "dns") && p[1]) { VERIFY_PERMISSION(OPT_P_DHCPDNS); -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/838?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: Ifbe4ffb44d3bfcaa50adb38cacb3436fcdc71b10 Gerrit-Change-Number: 838 Gerrit-PatchSet: 19 Gerrit-Owner: d12fk <he...@op...> Gerrit-Reviewer: cron2 <ge...@gr...> Gerrit-Reviewer: flichtenheld <fr...@li...> Gerrit-Reviewer: plaisthos <arn...@rf...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-Attention: plaisthos <arn...@rf...> Gerrit-Attention: cron2 <ge...@gr...> Gerrit-Attention: flichtenheld <fr...@li...> Gerrit-Attention: d12fk <he...@op...> Gerrit-MessageType: newpatchset |
| From: d12fk (C. Review) <ge...@op...> - 2025-03-31 07:52:34 |
Attention is currently required from: flichtenheld, plaisthos. Hello flichtenheld, plaisthos, I'd like you to reexamine a change. Please visit http://gerrit.openvpn.net/c/openvpn/+/904?usp=email to look at the new patch set (#12). Change subject: dns: deal with --dhcp-options when --dns is active ...................................................................... dns: deal with --dhcp-options when --dns is active Since --dns settings overrule DNS related --dhcp-options, remove the latter when values were defined via --dns. To stay as backward compatible as possible, we add foreign_options to the script hook environment from the --dns values when a --up script is defined. In that case the default --dns-updown is not run, even when --dns values are present, to prevent double DNS configuration. This way an existing --up script that deals with DNS can run, without the immediate need to change after an openvpn upgrade and a server pushing --dns options. If you specify a custom --dns-updown, or force running the default dns-updown that comes with openvpn, those compat env vars are not set for --up scripts and the dns-updown command is run, even when there's an --up script present. Since Android uses the DNS values from tuntap_options, we always override those with --dns stuff unconditionally. Also on Windows when --ip-win32 is dynamic or adaptive, since DHCP relies on these as well. Change-Id: I635c4018fb43b5976a39b6a90cb2e9cb2570cd6a Signed-off-by: Heiko Hund <he...@is...> --- M src/openvpn/dns.c M src/openvpn/dns.h M src/openvpn/options.c 3 files changed, 311 insertions(+), 186 deletions(-) git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/04/904/12 diff --git a/src/openvpn/dns.c b/src/openvpn/dns.c index 221e9a9..9927961 100644 --- a/src/openvpn/dns.c +++ b/src/openvpn/dns.c @@ -703,7 +703,8 @@ static void run_up_down_command(bool up, struct options *o, const struct tuntap *tt, struct dns_updown_runner_info *updown_runner) { - if (!o->dns_options.updown) + struct dns_options *dns = &o->dns_options; + if (!dns->updown || (o->up_script && !dns->user_set_updown)) { return; } @@ -713,7 +714,7 @@ if (!updown_runner->required) { /* Run dns updown directly */ - status = do_run_up_down_command(up, NULL, &o->dns_options, tt); + status = do_run_up_down_command(up, NULL, dns, tt); } else { diff --git a/src/openvpn/dns.h b/src/openvpn/dns.h index c56d603..8e3556d 100644 --- a/src/openvpn/dns.h +++ b/src/openvpn/dns.h @@ -76,7 +76,28 @@ #endif }; +#ifndef N_DHCP_ADDR +#define N_DHCP_ADDR 4 +#endif + +#ifndef N_SEARCH_LIST_LEN +#define N_SEARCH_LIST_LEN 10 +#endif + +struct dhcp_options { + in_addr_t dns[N_DHCP_ADDR]; + int dns_len; + + struct in6_addr dns6[N_DHCP_ADDR]; + int dns6_len; + + const char *domain; + const char *domain_search_list[N_SEARCH_LIST_LEN]; + int domain_search_list_len; +}; + struct dns_options { + struct dhcp_options from_dhcp; struct dns_domain *search_domains; struct dns_server *servers_prepull; struct dns_server *servers; diff --git a/src/openvpn/options.c b/src/openvpn/options.c index e2e4835..0131ef4 100644 --- a/src/openvpn/options.c +++ b/src/openvpn/options.c @@ -1333,7 +1333,6 @@ #endif /* ifndef ENABLE_SMALL */ #endif /* ifdef _WIN32 */ -#if defined(_WIN32) || defined(TARGET_ANDROID) static void dhcp_option_dns6_parse(const char *parm, struct in6_addr *dns6_list, int *len, int msglevel) { @@ -1376,150 +1375,6 @@ } } -/* - * If DNS options are set use these for TUN/TAP options as well. - * Applies to DNS, DNS6 and DOMAIN-SEARCH. - * Existing options will be discarded. - */ -static void -tuntap_options_copy_dns(struct options *o) -{ - struct tuntap_options *tt = &o->tuntap_options; - struct dns_options *dns = &o->dns_options; - - if (dns->search_domains) - { - tt->domain_search_list_len = 0; - const struct dns_domain *domain = dns->search_domains; - while (domain && tt->domain_search_list_len < N_SEARCH_LIST_LEN) - { - tt->domain_search_list[tt->domain_search_list_len++] = domain->name; - domain = domain->next; - } - if (domain) - { - msg(M_WARN, "WARNING: couldn't copy all --dns search-domains to --dhcp-option"); - } - tt->dhcp_options |= DHCP_OPTIONS_DHCP_REQUIRED; - } - - if (dns->servers) - { - tt->dns_len = 0; - tt->dns6_len = 0; - bool overflow = false; - const struct dns_server *server = dns->servers; - while (server) - { - for (int i = 0; i < server->addr_count; ++i) - { - if (server->addr[i].family == AF_INET) - { - if (tt->dns_len >= N_DHCP_ADDR) - { - overflow = true; - continue; - } - tt->dns[tt->dns_len++] = ntohl(server->addr[i].in.a4.s_addr); - } - else - { - if (tt->dns6_len >= N_DHCP_ADDR) - { - overflow = true; - continue; - } - tt->dns6[tt->dns6_len++] = server->addr[i].in.a6; - } - } - server = server->next; - } - if (overflow) - { - msg(M_WARN, "WARNING: couldn't copy all --dns server addresses to --dhcp-option"); - } - tt->dhcp_options |= DHCP_OPTIONS_DHCP_OPTIONAL; - } -} -#else /* if defined(_WIN32) || defined(TARGET_ANDROID) */ -static void -foreign_options_copy_dns(struct options *o, struct env_set *es) -{ - const struct dns_domain *domain = o->dns_options.search_domains; - const struct dns_server *server = o->dns_options.servers; - if (!domain && !server) - { - return; - } - - /* reset the index since we're starting all over again */ - int opt_max = o->foreign_option_index; - o->foreign_option_index = 0; - - for (int i = 1; i <= opt_max; ++i) - { - char name[32]; - snprintf(name, sizeof(name), "foreign_option_%d", i); - - const char *env_str = env_set_get(es, name); - const char *value = strchr(env_str, '=') + 1; - if ((domain && strstr(value, "dhcp-option DOMAIN-SEARCH") == value) - || (server && strstr(value, "dhcp-option DNS") == value)) - { - setenv_del(es, name); - } - else - { - setenv_foreign_option(o, &value, 1, es); - } - } - - struct gc_arena gc = gc_new(); - - while (server) - { - for (size_t i = 0; i < server->addr_count; ++i) - { - if (server->addr[i].family == AF_INET) - { - const char *argv[] = { - "dhcp-option", - "DNS", - print_in_addr_t(server->addr[i].in.a4.s_addr, 0, &gc) - }; - setenv_foreign_option(o, argv, 3, es); - } - else - { - const char *argv[] = { - "dhcp-option", - "DNS6", - print_in6_addr(server->addr[i].in.a6, 0, &gc) - }; - setenv_foreign_option(o, argv, 3, es); - } - } - server = server->next; - } - while (domain) - { - const char *argv[] = { "dhcp-option", "DOMAIN-SEARCH", domain->name }; - setenv_foreign_option(o, argv, 3, es); - domain = domain->next; - } - - gc_free(&gc); - - /* remove old leftover entries */ - while (o->foreign_option_index < opt_max) - { - char name[32]; - snprintf(name, sizeof(name), "foreign_option_%d", opt_max--); - setenv_del(es, name); - } -} -#endif /* if defined(_WIN32) || defined(TARGET_ANDROID) */ - #ifndef ENABLE_SMALL static const char * print_vlan_accept(enum vlan_acceptable_frames mode) @@ -3617,6 +3472,256 @@ } } +#if defined(_WIN32) || defined(TARGET_ANDROID) +/** + * @brief Postprocess DNS related settings + * + * Set TUN/TAP DNS options with values from either --dns + * or --dhcp-option. + * + * @param o pointer to the options struct + */ +static void +tuntap_options_postprocess_dns(struct options *o) +{ + struct dns_options *dns = &o->dns_options; + struct tuntap_options *tt = &o->tuntap_options; + if (!dns->servers) + { + /* Copy --dhcp-options to tuntap_options */ + struct dhcp_options *dhcp = &dns->from_dhcp; + assert(sizeof(dhcp->dns) == sizeof(tt->dns)); + assert(sizeof(dhcp->dns6) == sizeof(tt->dns6)); + assert(sizeof(dhcp->domain_search_list) == sizeof(tt->domain_search_list)); + + tt->domain = dhcp->domain; + tt->dns_len = dhcp->dns_len; + tt->dns6_len = dhcp->dns6_len; + tt->domain_search_list_len = dhcp->domain_search_list_len; + + memcpy(tt->dns, dhcp->dns, sizeof(tt->dns)); + memcpy(tt->dns6, dhcp->dns6, sizeof(tt->dns6)); + memcpy(tt->domain_search_list, dhcp->domain_search_list, sizeof(tt->domain_search_list)); + + return; + } + +#if defined(_WIN32) + if (tt->ip_win32_type != IPW32_SET_DHCP_MASQ && tt->ip_win32_type != IPW32_SET_ADAPTIVE) + { + return; /* Not in DHCP mode */ + } +#endif /* if defined(_WIN32) */ + + /* Copy --dns options to tuntap_options */ + const struct dns_domain *d = dns->search_domains; + while (d && tt->domain_search_list_len + 1 < N_SEARCH_LIST_LEN) + { + tt->domain_search_list[tt->domain_search_list_len++] = d->name; + d = d->next; + } + if (d) + { + msg(M_WARN, "WARNING: couldn't copy all --dns search-domains to TUN/TAP"); + } + + const struct dns_server *s = dns->servers; + while (s) + { + bool non_standard_server_port = false; + for (int i = 0; i < s->addr_count; ++i) + { + if (s->addr[i].port && s->addr[i].port != 53) + { + non_standard_server_port = true; + break; + } + } + if ((s->transport && s->transport != DNS_TRANSPORT_PLAIN) + || (s->dnssec && s->dnssec != DNS_SECURITY_NO) + || non_standard_server_port) + { + /* Skip servers requiring unsupported config to be set */ + s = s->next; + } + else + { + bool overflow = false; + for (int i = 0; i < s->addr_count; ++i) + { + if (s->addr[i].family == AF_INET && tt->dns_len + 1 < N_DHCP_ADDR) + { + tt->dns[tt->dns_len++] = s->addr[i].in.a4.s_addr; + } + else if (tt->dns6_len + 1 < N_DHCP_ADDR) + { + tt->dns6[tt->dns6_len] = s->addr[i].in.a6; + } + else + { + overflow = true; + } + } + if (overflow) + { + msg(M_WARN, "WARNING: couldn't copy all --dns server addresses to TUN/TAP"); + } + return; + } + } +} + +#else /* if defined(_WIN32) || defined(TARGET_ANDROID) */ + +/** + * @brief Postprocess DNS related settings + * + * Discard existing --dhcp-options from the env if needed and possibly + * replace them with values from --dns. If no --dns servers are set copy + * the --dhcp-option values over for --dns-updown runs. + * + * @param o pointer to the options struct + * @param es env set to modify potentially + */ +static void +dhcp_options_postprocess_dns(struct options *o, struct env_set *es) +{ + struct gc_arena gc = gc_new(); + struct dns_options *dns = &o->dns_options; + + if (dns->servers || dns->user_set_updown) + { + /* Clean up env from --dhcp-option DNS config */ + struct buffer name = alloc_buf_gc(OPTION_PARM_SIZE, &gc); + struct buffer value = alloc_buf_gc(OPTION_PARM_SIZE, &gc); + + const int fo_count = o->foreign_option_index; + o->foreign_option_index = 0; + + for (int i = 1; i <= fo_count; ++i) + { + buf_clear(&name); + buf_printf(&name, "foreign_option_%d", i); + const char *env_str = env_set_get(es, BSTR(&name)); + const char *item_val = strchr(env_str, '=') + 1; + buf_clear(&value); + buf_printf(&value, "%s", item_val); + + /* Remove foreign option item from env set */ + env_set_del(es, BSTR(&name)); + + item_val = BSTR(&value); + if (strncmp(item_val, "dhcp-option ", 12) != 0 + || (strncmp(item_val + 12, "ADAPTER-DOMAIN-SUFFIX ", 22) != 0 + && strncmp(item_val + 12, "DOMAIN-SEARCH ", 14) != 0 + && strncmp(item_val + 12, "DOMAIN ", 7) != 0 + && strncmp(item_val + 12, "DNS6 ", 5) != 0 + && strncmp(item_val + 12, "DNS ", 4) != 0)) + { + /* Re-set the item with potentially updated name */ + buf_clear(&name); + buf_printf(&name, "foreign_option_%d", ++o->foreign_option_index); + setenv_str(es, BSTR(&name), BSTR(&value)); + } + } + } + + if (!dns->servers) + { + /* Copy --dhcp-options to dns_options */ + struct dhcp_options *dhcp = &dns->from_dhcp; + + if (dhcp->dns_len || dhcp->dns6_len) + { + struct dns_domain **entry = &dns->search_domains; + ALLOC_OBJ_CLEAR_GC(*entry, struct dns_domain, &dns->gc); + struct dns_domain *new = *entry; + new->name = dhcp->domain; + entry = &new->next; + + for (size_t i = 0; i < dhcp->domain_search_list_len; ++i) + { + ALLOC_OBJ_CLEAR_GC(*entry, struct dns_domain, &dns->gc); + struct dns_domain *new = *entry; + new->name = dhcp->domain_search_list[i]; + entry = &new->next; + } + + struct dns_server *server = dns_server_get(&dns->servers, 0, &dns->gc); + const size_t max_addrs = SIZE(server->addr); + for (size_t i = 0; i < dhcp->dns_len && server->addr_count < max_addrs; ++i) + { + server->addr[server->addr_count].in.a4.s_addr = htonl(dhcp->dns[i]); + server->addr[server->addr_count].family = AF_INET; + server->addr_count += 1; + } + for (size_t i = 0; i < dhcp->dns6_len && server->addr_count < max_addrs; ++i) + { + server->addr[server->addr_count].in.a6 = dhcp->dns6[i]; + server->addr[server->addr_count].family = AF_INET6; + server->addr_count += 1; + } + } + } + else if (o->up_script && !dns->user_set_updown) + { + /* Set foreign option env vars from --dns config */ + const char *p[] = { "dhcp-option", NULL, NULL }; + size_t p_len = sizeof(p) / sizeof(p[0]); + + p[1] = "DOMAIN"; + const struct dns_domain *d = dns->search_domains; + while (d) + { + p[2] = d->name; + setenv_foreign_option(o, (const char **)p, p_len, es); + d = d->next; + } + + const struct dns_server *s = dns->servers; + while (s) + { + bool non_standard_server_port = false; + for (int i = 0; i < s->addr_count; ++i) + { + if (s->addr[i].port && s->addr[i].port != 53) + { + non_standard_server_port = true; + break; + } + } + if ((s->transport && s->transport != DNS_TRANSPORT_PLAIN) + || (s->dnssec && s->dnssec != DNS_SECURITY_NO) + || non_standard_server_port) + { + /* Skip servers requiring unsupported config to be set */ + s = s->next; + } + else + { + for (int i = 0; i < s->addr_count; ++i) + { + if (s->addr[i].family == AF_INET) + { + p[1] = "DNS"; + p[2] = print_in_addr_t(s->addr[i].in.a4.s_addr, IA_NET_ORDER, &gc); + } + else + { + p[1] = "DNS6"; + p[2] = print_in6_addr(s->addr[i].in.a6, 0, &gc); + } + setenv_foreign_option(o, (const char **)p, p_len, es); + } + break; + } + } + } + + gc_free(&gc); +} +#endif /* if defined(_WIN32) || defined(TARGET_ANDROID) */ + static void options_postprocess_mutate(struct options *o, struct env_set *es) { @@ -3802,9 +3907,9 @@ else { #if defined(_WIN32) || defined(TARGET_ANDROID) - tuntap_options_copy_dns(o); + tuntap_options_postprocess_dns(o); #else - foreign_options_copy_dns(o, es); + dhcp_options_postprocess_dns(o, es); #endif } if (o->auth_token_generate && !o->auth_token_renewal) @@ -4187,9 +4292,9 @@ { dns_options_postprocess_pull(&o->dns_options); #if defined(_WIN32) || defined(TARGET_ANDROID) - tuntap_options_copy_dns(o); + tuntap_options_postprocess_dns(o); #else - foreign_options_copy_dns(o, es); + dhcp_options_postprocess_dns(o, es); #endif } return success; @@ -8210,19 +8315,42 @@ goto err; } } -#if defined(_WIN32) || defined(TARGET_ANDROID) else if (streq(p[0], "dhcp-option") && p[1]) { - struct tuntap_options *o = &options->tuntap_options; + struct dhcp_options *dhcp = &options->dns_options.from_dhcp; VERIFY_PERMISSION(OPT_P_DHCPDNS); - if ((streq(p[1], "DOMAIN") || streq(p[1], "ADAPTER_DOMAIN_SUFFIX")) - && p[2] && !p[3]) + if ((streq(p[1], "DOMAIN") || streq(p[1], "ADAPTER_DOMAIN_SUFFIX")) && p[2] && !p[3]) { - o->domain = p[2]; - o->dhcp_options |= DHCP_OPTIONS_DHCP_OPTIONAL; + dhcp->domain = p[2]; } - else if (streq(p[1], "NBS") && p[2] && !p[3]) + else if (streq(p[1], "DOMAIN-SEARCH") && p[2] && !p[3]) + { + if (dhcp->domain_search_list_len < N_SEARCH_LIST_LEN) + { + dhcp->domain_search_list[dhcp->domain_search_list_len++] = p[2]; + } + else + { + msg(msglevel, "--dhcp-option %s: maximum of %d search entries can be specified", + p[1], N_SEARCH_LIST_LEN); + } + } + else if ((streq(p[1], "DNS") || streq(p[1], "DNS6")) && p[2] && !p[3] + && (!strstr(p[2], ":") || ipv6_addr_safe(p[2]))) + { + if (strstr(p[2], ":")) + { + dhcp_option_dns6_parse(p[2], dhcp->dns6, &dhcp->dns6_len, msglevel); + } + else + { + dhcp_option_address_parse("DNS", p[2], dhcp->dns, &dhcp->dns_len, msglevel); + } + } +#if defined(_WIN32) || defined(TARGET_ANDROID) + struct tuntap_options *o = &options->tuntap_options; + if (streq(p[1], "NBS") && p[2] && !p[3]) { o->netbios_scope = p[2]; o->dhcp_options |= DHCP_OPTIONS_DHCP_REQUIRED; @@ -8239,23 +8367,9 @@ o->netbios_node_type = t; o->dhcp_options |= DHCP_OPTIONS_DHCP_REQUIRED; } - else if ((streq(p[1], "DNS") || streq(p[1], "DNS6")) && p[2] && !p[3] - && (!strstr(p[2], ":") || ipv6_addr_safe(p[2]))) - { - if (strstr(p[2], ":")) - { - dhcp_option_dns6_parse(p[2], o->dns6, &o->dns6_len, msglevel); - } - else - { - dhcp_option_address_parse("DNS", p[2], o->dns, &o->dns_len, msglevel); - o->dhcp_options |= DHCP_OPTIONS_DHCP_OPTIONAL; - } - } else if (streq(p[1], "WINS") && p[2] && !p[3]) { dhcp_option_address_parse("WINS", p[2], o->wins, &o->wins_len, msglevel); - o->dhcp_options |= DHCP_OPTIONS_DHCP_OPTIONAL; } else if (streq(p[1], "NTP") && p[2] && !p[3]) { @@ -8267,19 +8381,6 @@ dhcp_option_address_parse("NBDD", p[2], o->nbdd, &o->nbdd_len, msglevel); o->dhcp_options |= DHCP_OPTIONS_DHCP_REQUIRED; } - else if (streq(p[1], "DOMAIN-SEARCH") && p[2] && !p[3]) - { - if (o->domain_search_list_len < N_SEARCH_LIST_LEN) - { - o->domain_search_list[o->domain_search_list_len++] = p[2]; - } - else - { - msg(msglevel, "--dhcp-option %s: maximum of %d search entries can be specified", - p[1], N_SEARCH_LIST_LEN); - } - o->dhcp_options |= DHCP_OPTIONS_DHCP_OPTIONAL; - } else if (streq(p[1], "DISABLE-NBT") && !p[2]) { o->disable_nbt = 1; @@ -8297,8 +8398,10 @@ msg(msglevel, "--dhcp-option: unknown option type '%s' or missing or unknown parameter", p[1]); goto err; } - } +#else /* if defined(_WIN32) || defined(TARGET_ANDROID) */ + setenv_foreign_option(options, (const char **)p, 3, es); #endif /* if defined(_WIN32) || defined(TARGET_ANDROID) */ + } #ifdef _WIN32 else if (streq(p[0], "show-adapters") && !p[1]) { -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/904?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I635c4018fb43b5976a39b6a90cb2e9cb2570cd6a Gerrit-Change-Number: 904 Gerrit-PatchSet: 12 Gerrit-Owner: d12fk <he...@op...> Gerrit-Reviewer: flichtenheld <fr...@li...> Gerrit-Reviewer: plaisthos <arn...@rf...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-Attention: plaisthos <arn...@rf...> Gerrit-Attention: flichtenheld <fr...@li...> Gerrit-MessageType: newpatchset |
