Menu ▾ ▴
openvpn-devel — OpenVPN developers list
You can subscribe to this list here.
| 2002 | Jan | Feb | Mar | Apr (24) | May (14) | Jun (29) | Jul (33) | Aug (3) | Sep (8) | Oct (18) | Nov (1) | Dec (10) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2003 | Jan (3) | Feb (33) | Mar (7) | Apr (28) | May (30) | Jun (5) | Jul (10) | Aug (7) | Sep (32) | Oct (41) | Nov (20) | Dec (10) |
| 2004 | Jan (24) | Feb (18) | Mar (57) | Apr (40) | May (55) | Jun (48) | Jul (77) | Aug (15) | Sep (56) | Oct (80) | Nov (74) | Dec (52) |
| 2005 | Jan (38) | Feb (42) | Mar (39) | Apr (56) | May (79) | Jun (73) | Jul (16) | Aug (23) | Sep (68) | Oct (77) | Nov (52) | Dec (27) |
| 2006 | Jan (27) | Feb (18) | Mar (51) | Apr (62) | May (28) | Jun (50) | Jul (36) | Aug (33) | Sep (47) | Oct (50) | Nov (77) | Dec (13) |
| 2007 | Jan (15) | Feb (8) | Mar (14) | Apr (18) | May (25) | Jun (16) | Jul (16) | Aug (19) | Sep (32) | Oct (17) | Nov (5) | Dec (5) |
| 2008 | Jan (64) | Feb (25) | Mar (25) | Apr (6) | May (28) | Jun (20) | Jul (10) | Aug (27) | Sep (28) | Oct (59) | Nov (37) | Dec (43) |
| 2009 | Jan (40) | Feb (25) | Mar (12) | Apr (57) | May (46) | Jun (29) | Jul (39) | Aug (10) | Sep (20) | Oct (42) | Nov (50) | Dec (57) |
| 2010 | Jan (82) | Feb (165) | Mar (256) | Apr (260) | May (36) | Jun (87) | Jul (53) | Aug (89) | Sep (107) | Oct (51) | Nov (88) | Dec (117) |
| 2011 | Jan (69) | Feb (60) | Mar (113) | Apr (71) | May (67) | Jun (90) | Jul (88) | Aug (90) | Sep (48) | Oct (64) | Nov (69) | Dec (118) |
| 2012 | Jan (49) | Feb (528) | Mar (351) | Apr (190) | May (238) | Jun (193) | Jul (104) | Aug (100) | Sep (57) | Oct (41) | Nov (47) | Dec (51) |
| 2013 | Jan (94) | Feb (57) | Mar (96) | Apr (105) | May (77) | Jun (102) | Jul (27) | Aug (81) | Sep (32) | Oct (53) | Nov (127) | Dec (65) |
| 2014 | Jan (113) | Feb (59) | Mar (104) | Apr (259) | May (70) | Jun (70) | Jul (146) | Aug (45) | Sep (58) | Oct (149) | Nov (77) | Dec (83) |
| 2015 | Jan (53) | Feb (66) | Mar (86) | Apr (50) | May (135) | Jun (76) | Jul (151) | Aug (83) | Sep (97) | Oct (262) | Nov (245) | Dec (231) |
| 2016 | Jan (131) | Feb (233) | Mar (97) | Apr (138) | May (221) | Jun (254) | Jul (92) | Aug (248) | Sep (168) | Oct (275) | Nov (477) | Dec (445) |
| 2017 | Jan (218) | Feb (217) | Mar (146) | Apr (172) | May (216) | Jun (252) | Jul (164) | Aug (192) | Sep (190) | Oct (143) | Nov (255) | Dec (182) |
| 2018 | Jan (295) | Feb (164) | Mar (113) | Apr (147) | May (64) | Jun (262) | Jul (184) | Aug (90) | Sep (69) | Oct (364) | Nov (102) | Dec (101) |
| 2019 | Jan (119) | Feb (64) | Mar (64) | Apr (102) | May (57) | Jun (154) | Jul (84) | Aug (81) | Sep (76) | Oct (102) | Nov (233) | Dec (89) |
| 2020 | Jan (38) | Feb (170) | Mar (155) | Apr (172) | May (120) | Jun (223) | Jul (461) | Aug (227) | Sep (268) | Oct (113) | Nov (56) | Dec (124) |
| 2021 | Jan (121) | Feb (48) | Mar (334) | Apr (345) | May (207) | Jun (136) | Jul (71) | Aug (112) | Sep (122) | Oct (173) | Nov (184) | Dec (223) |
| 2022 | Jan (197) | Feb (206) | Mar (156) | Apr (212) | May (192) | Jun (170) | Jul (143) | Aug (380) | Sep (182) | Oct (148) | Nov (128) | Dec (269) |
| 2023 | Jan (248) | Feb (196) | Mar (264) | Apr (36) | May (123) | Jun (66) | Jul (120) | Aug (48) | Sep (157) | Oct (198) | Nov (300) | Dec (273) |
| 2024 | Jan (271) | Feb (147) | Mar (207) | Apr (78) | May (107) | Jun (168) | Jul (151) | Aug (51) | Sep (438) | Oct (221) | Nov (302) | Dec (357) |
| 2025 | Jan (451) | Feb (219) | Mar (326) | Apr (232) | May (306) | Jun (181) | Jul (452) | Aug (282) | Sep (620) | Oct (793) | Nov (682) | Dec |
| S | M | T | W | T | F | S |
|---|---|---|---|---|---|---|
| | | | | | | 1 |
| 2 | 3 (3) | 4 (1) | 5 (26) | 6 (34) | 7 (6) | 8 (17) |
| 9 (15) | 10 | 11 (8) | 12 (22) | 13 (3) | 14 (10) | 15 |
| 16 | 17 (4) | 18 (32) | 19 (18) | 20 (11) | 21 (5) | 22 |
| 23 (3) | 24 (35) | 25 (16) | 26 (14) | 27 (26) | 28 (7) | 29 (1) |
| 30 | 31 (9) | | | | | |
| From: flichtenheld (C. Review) <ge...@op...> - 2025-03-31 16:30:03 |
Attention is currently required from: cron2, d12fk, plaisthos. flichtenheld has posted comments on this change. ( http://gerrit.openvpn.net/c/openvpn/+/838?usp=email ) Change subject: dns: apply settings via script on unixoid systems ...................................................................... Patch Set 19: Code-Review+2 (1 comment) File configure.ac: http://gerrit.openvpn.net/c/openvpn/+/838/comment/52a50795_cfc20080 : PS16, Line 100: [AS_HELP_STRING([--disable-dns-updown], [disable the --dns-updown hook @<:@default=no@:>@])], > This is now inconsistent with how our options are described. `default=yes` would be consistent. Done -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/838?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: Ifbe4ffb44d3bfcaa50adb38cacb3436fcdc71b10 Gerrit-Change-Number: 838 Gerrit-PatchSet: 19 Gerrit-Owner: d12fk <he...@op...> Gerrit-Reviewer: cron2 <ge...@gr...> Gerrit-Reviewer: flichtenheld <fr...@li...> Gerrit-Reviewer: plaisthos <arn...@rf...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-Attention: plaisthos <arn...@rf...> Gerrit-Attention: cron2 <ge...@gr...> Gerrit-Attention: d12fk <he...@op...> Gerrit-Comment-Date: Mon, 31 Mar 2025 16:29:50 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes Comment-In-Reply-To: flichtenheld <fr...@li...> Gerrit-MessageType: comment |
| From: plaisthos (C. Review) <ge...@op...> - 2025-03-31 15:42:36 |
Attention is currently required from: flichtenheld. plaisthos has posted comments on this change. ( http://gerrit.openvpn.net/c/openvpn/+/926?usp=email ) Change subject: GHA: Dependency and Actions update April 2025 ...................................................................... Patch Set 1: (1 comment) File .github/workflows/build.yaml: http://gerrit.openvpn.net/c/openvpn/+/926/comment/bfccada6_757aa827 : PS1, Line 69: -DENABLE_PKCS11=false -DBUILD_TESTING=true -DENABLE_LZO=false -DUSE_WERROR=no you missed your opportunity to fix the yes vs true you complained about last time ;) -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/926?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: Ie9bffcc487f53a3a8ae6e59b79e654360d99902c Gerrit-Change-Number: 926 Gerrit-PatchSet: 1 Gerrit-Owner: flichtenheld <fr...@li...> Gerrit-Reviewer: plaisthos <arn...@rf...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-Attention: flichtenheld <fr...@li...> Gerrit-Comment-Date: Mon, 31 Mar 2025 15:42:21 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Gerrit-MessageType: comment |
| From: Frank L. <fr...@li...> - 2025-03-31 15:33:33 |
- Fix Android build with newer vcpkg Need to sync CMAKE_SYSTEM_VERSION with vcpkg. - Update mbedTLS v3 builds to latest release. Depends on commit 4897c522948c8cdb82c0325ee08f6907cfc16f57 - Update all actions to latest releases. Change-Id: Ie9bffcc487f53a3a8ae6e59b79e654360d99902c Signed-off-by: Frank Lichtenheld <fr...@li...> Acked-by: Arne Schwabe <arn...@rf...> --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/926 This mail reflects revision 1 of this Change. Acked-by according to Gerrit (reflected above): Arne Schwabe <arn...@rf...> diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index b1af7ec..3fc44f5 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -27,7 +27,7 @@ - name: Show changes on standard output run: git diff working-directory: openvpn - - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: uncrustify-changes.patch path: 'openvpn/uncrustify-changes.patch' @@ -57,11 +57,16 @@ - name: Install vcpkg uses: lukka/run-vcpkg@5e0cab206a5ea620130caf672fce3e4a6b5666a1 # v11.5 with: - vcpkgGitCommitId: 33e9c99208736b713cabe4490e15235f62f893d4 + vcpkgGitCommitId: acd5bba5aac8b6573b5f6f463dc0341ac0ee6fa4 - name: Install dependencies run: ${VCPKG_ROOT}/vcpkg install openssl lz4 cmocka - name: configure OpenVPN with cmake - run: cmake -S . -B openvpn-build -DUNSUPPORTED_BUILDS=yes -DCMAKE_SYSTEM_NAME=Android -DOPENSSL_ROOT_DIR=${VCPKG_INSTALLED_DIR}/${{ matrix.vcpkg_triplet }} -DENABLE_PKCS11=false -DBUILD_TESTING=true -DCMAKE_ANDROID_ARCH_ABI=${{ matrix.abi }} -DENABLE_LZO=false -DUSE_WERROR=no + run: | + cmake -S . -B openvpn-build -DUNSUPPORTED_BUILDS=yes \ + -DCMAKE_SYSTEM_NAME=Android -DCMAKE_SYSTEM_VERSION=28 \ + -DCMAKE_ANDROID_ARCH_ABI=${{ matrix.abi }} \ + -DOPENSSL_ROOT_DIR=${VCPKG_INSTALLED_DIR}/${{ matrix.vcpkg_triplet }} \ + -DENABLE_PKCS11=false -DBUILD_TESTING=true -DENABLE_LZO=false -DUSE_WERROR=no - name: Build OpenVPN Android binary with cmake run: cmake --build openvpn-build @@ -85,7 +90,7 @@ - name: Restore from cache and install vcpkg uses: lukka/run-vcpkg@5e0cab206a5ea620130caf672fce3e4a6b5666a1 # v11.5 with: - vcpkgGitCommitId: 33e9c99208736b713cabe4490e15235f62f893d4 + vcpkgGitCommitId: acd5bba5aac8b6573b5f6f463dc0341ac0ee6fa4 vcpkgJsonGlob: '**/mingw/vcpkg.json' - name: Run CMake with vcpkg.json manifest @@ -95,7 +100,7 @@ buildPreset: mingw-${{ matrix.arch }} buildPresetAdditionalArgs: "['--config Debug']" - - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: openvpn-mingw-${{ matrix.arch }} path: | @@ -103,7 +108,7 @@ ${{ github.workspace }}/out/build/mingw/${{ matrix.arch }}/Debug/*.dll !${{ github.workspace }}/out/build/mingw/${{ matrix.arch }}/Debug/test_*.exe - - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: openvpn-mingw-${{ matrix.arch }}-tests path: | @@ -124,7 +129,7 @@ - name: Checkout OpenVPN uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Retrieve mingw unittest - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8 + uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1 with: name: openvpn-mingw-${{ matrix.arch }}-tests path: unittests @@ -269,7 +274,7 @@ runs-on: windows-latest steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: lukka/get-cmake@5f6e04f5267c8133f1273bf2103583fc72c46b17 # v3.31.5 + - uses: lukka/get-cmake@56d043d188c3612951d8755da8f4b709ec951ad6 # v3.31.6 - name: Install rst2html run: python -m pip install --upgrade pip docutils @@ -277,7 +282,7 @@ - name: Restore artifacts, or setup vcpkg (do not install any package) uses: lukka/run-vcpkg@5e0cab206a5ea620130caf672fce3e4a6b5666a1 # v11.5 with: - vcpkgGitCommitId: 33e9c99208736b713cabe4490e15235f62f893d4 + vcpkgGitCommitId: acd5bba5aac8b6573b5f6f463dc0341ac0ee6fa4 vcpkgJsonGlob: '**/windows/vcpkg.json' - name: Run CMake with vcpkg.json manifest (NO TESTS) @@ -296,7 +301,7 @@ testPreset: win-${{ matrix.arch }}-release testPresetAdditionalArgs: "['--output-on-failure']" - - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: openvpn-msvc-${{ matrix.arch }} path: | @@ -406,7 +411,7 @@ submodules: true # versioning=semver-coerced repository: Mbed-TLS/mbedtls - ref: v3.6.2 + ref: v3.6.3 - name: "mbedtls: make no_test" run: make -j3 no_test SHARED=1 working-directory: mbedtls diff --git a/.github/workflows/coverity-scan.yml b/.github/workflows/coverity-scan.yml index 3381d8f..222c57e 100644 --- a/.github/workflows/coverity-scan.yml +++ b/.github/workflows/coverity-scan.yml @@ -13,7 +13,7 @@ steps: - name: Check submission cache id: check_submit - uses: actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0 + uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 with: path: | cov-int @@ -65,7 +65,7 @@ - name: Cache submission if: steps.check_submit.outputs.cache-hit != 'true' - uses: actions/cache/save@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0 + uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 with: path: | cov-int diff --git a/.github/workflows/doxygen.yml b/.github/workflows/doxygen.yml index f1ece70..ffd1b82 100644 --- a/.github/workflows/doxygen.yml +++ b/.github/workflows/doxygen.yml @@ -34,7 +34,7 @@ touch doc/doxygen/html/.nojekyll - name: Upload static files as artifact id: deployment - uses: actions/upload-pages-artifact@v3.0.1 + uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1 with: path: doxygen/doc/doxygen/html/ @@ -50,4 +50,4 @@ steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v4.0.5 + uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5 |
| From: plaisthos (C. Review) <ge...@op...> - 2025-03-31 14:18:01 |
Attention is currently required from: flichtenheld. plaisthos has posted comments on this change. ( http://gerrit.openvpn.net/c/openvpn/+/926?usp=email ) Change subject: GHA: Dependency and Actions update April 2025 ...................................................................... Patch Set 1: (1 comment) Patchset: PS1: It looks good but I am entirely sure that "GHA: Dependency and Actions update April 2025" is a good git commit subject -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/926?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: Ie9bffcc487f53a3a8ae6e59b79e654360d99902c Gerrit-Change-Number: 926 Gerrit-PatchSet: 1 Gerrit-Owner: flichtenheld <fr...@li...> Gerrit-Reviewer: plaisthos <arn...@rf...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-Attention: flichtenheld <fr...@li...> Gerrit-Comment-Date: Mon, 31 Mar 2025 14:17:46 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Gerrit-MessageType: comment |
| From: plaisthos (C. Review) <ge...@op...> - 2025-03-31 14:17:28 |
Attention is currently required from: flichtenheld. plaisthos has posted comments on this change. ( http://gerrit.openvpn.net/c/openvpn/+/926?usp=email ) Change subject: GHA: Dependency and Actions update April 2025 ...................................................................... Patch Set 1: Code-Review+2 -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/926?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: Ie9bffcc487f53a3a8ae6e59b79e654360d99902c Gerrit-Change-Number: 926 Gerrit-PatchSet: 1 Gerrit-Owner: flichtenheld <fr...@li...> Gerrit-Reviewer: plaisthos <arn...@rf...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-Attention: flichtenheld <fr...@li...> Gerrit-Comment-Date: Mon, 31 Mar 2025 14:17:14 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment |
| From: flichtenheld (C. Review) <ge...@op...> - 2025-03-31 12:14:40 |
Attention is currently required from: plaisthos. flichtenheld has posted comments on this change. ( http://gerrit.openvpn.net/c/openvpn/+/926?usp=email ) Change subject: GHA: Dependency and Actions update April 2025 ...................................................................... Patch Set 1: (1 comment) Patchset: PS1: See https://github.com/OpenVPN/openvpn/pull/711 for build verification. -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/926?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: Ie9bffcc487f53a3a8ae6e59b79e654360d99902c Gerrit-Change-Number: 926 Gerrit-PatchSet: 1 Gerrit-Owner: flichtenheld <fr...@li...> Gerrit-Reviewer: plaisthos <arn...@rf...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-Attention: plaisthos <arn...@rf...> Gerrit-Comment-Date: Mon, 31 Mar 2025 12:14:20 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Gerrit-MessageType: comment |
| From: flichtenheld (C. Review) <ge...@op...> - 2025-03-31 12:09:51 |
Attention is currently required from: plaisthos. Hello plaisthos, I'd like you to do a code review. Please visit http://gerrit.openvpn.net/c/openvpn/+/926?usp=email to review the following change. Change subject: GHA: Dependency and Actions update April 2025 ...................................................................... GHA: Dependency and Actions update April 2025 - Fix Android build with newer vcpkg Need to sync CMAKE_SYSTEM_VERSION with vcpkg. - Update mbedTLS v3 builds to latest release. Depends on commit 4897c522948c8cdb82c0325ee08f6907cfc16f57 - Update all actions to latest releases. Change-Id: Ie9bffcc487f53a3a8ae6e59b79e654360d99902c Signed-off-by: Frank Lichtenheld <fr...@li...> --- M .github/workflows/build.yaml M .github/workflows/coverity-scan.yml M .github/workflows/doxygen.yml 3 files changed, 20 insertions(+), 15 deletions(-) git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/26/926/1 diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index b1af7ec..3fc44f5 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -27,7 +27,7 @@ - name: Show changes on standard output run: git diff working-directory: openvpn - - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: uncrustify-changes.patch path: 'openvpn/uncrustify-changes.patch' @@ -57,11 +57,16 @@ - name: Install vcpkg uses: lukka/run-vcpkg@5e0cab206a5ea620130caf672fce3e4a6b5666a1 # v11.5 with: - vcpkgGitCommitId: 33e9c99208736b713cabe4490e15235f62f893d4 + vcpkgGitCommitId: acd5bba5aac8b6573b5f6f463dc0341ac0ee6fa4 - name: Install dependencies run: ${VCPKG_ROOT}/vcpkg install openssl lz4 cmocka - name: configure OpenVPN with cmake - run: cmake -S . -B openvpn-build -DUNSUPPORTED_BUILDS=yes -DCMAKE_SYSTEM_NAME=Android -DOPENSSL_ROOT_DIR=${VCPKG_INSTALLED_DIR}/${{ matrix.vcpkg_triplet }} -DENABLE_PKCS11=false -DBUILD_TESTING=true -DCMAKE_ANDROID_ARCH_ABI=${{ matrix.abi }} -DENABLE_LZO=false -DUSE_WERROR=no + run: | + cmake -S . -B openvpn-build -DUNSUPPORTED_BUILDS=yes \ + -DCMAKE_SYSTEM_NAME=Android -DCMAKE_SYSTEM_VERSION=28 \ + -DCMAKE_ANDROID_ARCH_ABI=${{ matrix.abi }} \ + -DOPENSSL_ROOT_DIR=${VCPKG_INSTALLED_DIR}/${{ matrix.vcpkg_triplet }} \ + -DENABLE_PKCS11=false -DBUILD_TESTING=true -DENABLE_LZO=false -DUSE_WERROR=no - name: Build OpenVPN Android binary with cmake run: cmake --build openvpn-build @@ -85,7 +90,7 @@ - name: Restore from cache and install vcpkg uses: lukka/run-vcpkg@5e0cab206a5ea620130caf672fce3e4a6b5666a1 # v11.5 with: - vcpkgGitCommitId: 33e9c99208736b713cabe4490e15235f62f893d4 + vcpkgGitCommitId: acd5bba5aac8b6573b5f6f463dc0341ac0ee6fa4 vcpkgJsonGlob: '**/mingw/vcpkg.json' - name: Run CMake with vcpkg.json manifest @@ -95,7 +100,7 @@ buildPreset: mingw-${{ matrix.arch }} buildPresetAdditionalArgs: "['--config Debug']" - - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: openvpn-mingw-${{ matrix.arch }} path: | @@ -103,7 +108,7 @@ ${{ github.workspace }}/out/build/mingw/${{ matrix.arch }}/Debug/*.dll !${{ github.workspace }}/out/build/mingw/${{ matrix.arch }}/Debug/test_*.exe - - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: openvpn-mingw-${{ matrix.arch }}-tests path: | @@ -124,7 +129,7 @@ - name: Checkout OpenVPN uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Retrieve mingw unittest - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8 + uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1 with: name: openvpn-mingw-${{ matrix.arch }}-tests path: unittests @@ -269,7 +274,7 @@ runs-on: windows-latest steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: lukka/get-cmake@5f6e04f5267c8133f1273bf2103583fc72c46b17 # v3.31.5 + - uses: lukka/get-cmake@56d043d188c3612951d8755da8f4b709ec951ad6 # v3.31.6 - name: Install rst2html run: python -m pip install --upgrade pip docutils @@ -277,7 +282,7 @@ - name: Restore artifacts, or setup vcpkg (do not install any package) uses: lukka/run-vcpkg@5e0cab206a5ea620130caf672fce3e4a6b5666a1 # v11.5 with: - vcpkgGitCommitId: 33e9c99208736b713cabe4490e15235f62f893d4 + vcpkgGitCommitId: acd5bba5aac8b6573b5f6f463dc0341ac0ee6fa4 vcpkgJsonGlob: '**/windows/vcpkg.json' - name: Run CMake with vcpkg.json manifest (NO TESTS) @@ -296,7 +301,7 @@ testPreset: win-${{ matrix.arch }}-release testPresetAdditionalArgs: "['--output-on-failure']" - - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: openvpn-msvc-${{ matrix.arch }} path: | @@ -406,7 +411,7 @@ submodules: true # versioning=semver-coerced repository: Mbed-TLS/mbedtls - ref: v3.6.2 + ref: v3.6.3 - name: "mbedtls: make no_test" run: make -j3 no_test SHARED=1 working-directory: mbedtls diff --git a/.github/workflows/coverity-scan.yml b/.github/workflows/coverity-scan.yml index 3381d8f..222c57e 100644 --- a/.github/workflows/coverity-scan.yml +++ b/.github/workflows/coverity-scan.yml @@ -13,7 +13,7 @@ steps: - name: Check submission cache id: check_submit - uses: actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0 + uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 with: path: | cov-int @@ -65,7 +65,7 @@ - name: Cache submission if: steps.check_submit.outputs.cache-hit != 'true' - uses: actions/cache/save@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0 + uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 with: path: | cov-int diff --git a/.github/workflows/doxygen.yml b/.github/workflows/doxygen.yml index f1ece70..ffd1b82 100644 --- a/.github/workflows/doxygen.yml +++ b/.github/workflows/doxygen.yml @@ -34,7 +34,7 @@ touch doc/doxygen/html/.nojekyll - name: Upload static files as artifact id: deployment - uses: actions/upload-pages-artifact@v3.0.1 + uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1 with: path: doxygen/doc/doxygen/html/ @@ -50,4 +50,4 @@ steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v4.0.5 + uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5 -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/926?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: Ie9bffcc487f53a3a8ae6e59b79e654360d99902c Gerrit-Change-Number: 926 Gerrit-PatchSet: 1 Gerrit-Owner: flichtenheld <fr...@li...> Gerrit-Reviewer: plaisthos <arn...@rf...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-Attention: plaisthos <arn...@rf...> Gerrit-MessageType: newchange |
| From: d12fk (C. Review) <ge...@op...> - 2025-03-31 07:52:36 |
Attention is currently required from: cron2, d12fk, flichtenheld, plaisthos. Hello cron2, flichtenheld, plaisthos, I'd like you to reexamine a change. Please visit http://gerrit.openvpn.net/c/openvpn/+/838?usp=email to look at the new patch set (#19). The following approvals got outdated and were removed: Code-Review-1 by flichtenheld Change subject: dns: apply settings via script on unixoid systems ...................................................................... dns: apply settings via script on unixoid systems This introduces a new script hook, the dns-updown, and implements such a command script for a few popular systems (and a default for the not so popular ones). Like the name suggests this hook is soleley for dealing with modifying how names are resolved when the VPN pushes some --dns settings. The default dns updown command is part of the distribution and is installed with openvpn. You can change the path the command is located at as a compile time option, defaults to libexecdir. You can compile-time disable that the default dns-updown hook is run by passing --disable-dns-updown-by-default to configure or ccmake ENABLE_DNS_UPDOWN_BY_DEFAULT to OFF. There's also a new runtime option --dns-updown, which can run a custom command, force running the default when disabled or disable execution of the dns-updown altogether. Change-Id: Ifbe4ffb44d3bfcaa50adb38cacb3436fcdc71b10 Signed-off-by: Heiko Hund <he...@is...> --- M .gitignore M CMakeLists.txt M config.h.cmake.in M configure.ac M distro/Makefile.am A distro/dns-scripts/Makefile.am A distro/dns-scripts/haikuos_file-dns-updown.sh A distro/dns-scripts/openresolv-dns-updown.sh A distro/dns-scripts/resolvconf_file-dns-updown.sh A distro/dns-scripts/systemd-dns-updown.sh M doc/man-sections/script-options.rst M src/openvpn/Makefile.am M src/openvpn/dns.c M src/openvpn/dns.h M src/openvpn/options.c 15 files changed, 658 insertions(+), 10 deletions(-) git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/38/838/19 diff --git a/.gitignore b/.gitignore index db8bb73..04523af 100644 --- a/.gitignore +++ b/.gitignore @@ -49,6 +49,7 @@ /doc/doxygen/latex/ /doc/doxygen/openvpn.doxyfile distro/systemd/*.service +distro/dns-scripts/dns-updown sample/sample-keys/sample-ca/ vendor/cmocka_build vendor/dist diff --git a/CMakeLists.txt b/CMakeLists.txt index b04adce..ef4a0f2 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -41,7 +41,10 @@ option(USE_WERROR "Treat compiler warnings as errors (-Werror)" ON) option(FAKE_ANDROID "Target Android but do not use actual cross compile/Android cmake to build for simple compile checks on Linux") -set(PLUGIN_DIR /usr/local/lib/openvpn/plugins CACHE FILEPATH "Location of the plugin directory") +option(ENABLE_DNS_UPDOWN_BY_DEFAULT "Run --dns-updown hook by default" ON) +set(DNS_UPDOWN_PATH "${CMAKE_INSTALL_PREFIX}/libexec/openvpn/dns-updown" CACHE STRING "Default location for the DNS up/down script") + +set(PLUGIN_DIR "${CMAKE_INSTALL_PREFIX}/lib/openvpn/plugins" CACHE FILEPATH "Location of the plugin directory") # Create machine readable compile commands option(ENABLE_COMPILE_COMMANDS "Generate compile_commands.json and a symlink for clangd to find it" OFF) @@ -577,6 +580,8 @@ add_library_deps(openvpn) +target_compile_options(openvpn PRIVATE -DDEFAULT_DNS_UPDOWN=\"${DNS_UPDOWN_PATH}\") + if(MINGW) target_compile_options(openvpn PRIVATE -municode -UUNICODE) target_link_options(openvpn PRIVATE -municode) diff --git a/config.h.cmake.in b/config.h.cmake.in index 2f7b43d..5164ce3 100644 --- a/config.h.cmake.in +++ b/config.h.cmake.in @@ -35,6 +35,9 @@ /* Enable LZO compression library */ #cmakedefine ENABLE_LZO +/* Enable dns-updown script hook */ +#cmakedefine ENABLE_DNS_UPDOWN + /* Enable NTLMv2 proxy support */ #define ENABLE_NTLM 1 diff --git a/configure.ac b/configure.ac index 9777e36..75367e8 100644 --- a/configure.ac +++ b/configure.ac @@ -96,6 +96,13 @@ ) AC_ARG_ENABLE( + [dns-updown-by-default], + [AS_HELP_STRING([--disable-dns-updown-by-default], [disable running --dns-updown by default @<:@default=yes@:>@])], + , + [enable_dns_updown_by_default="yes"] +) + +AC_ARG_ENABLE( [ntlm], [AS_HELP_STRING([--disable-ntlm], [disable NTLMv2 proxy support @<:@default=yes@:>@])], , @@ -315,37 +322,50 @@ plugindir="\${libdir}/openvpn/plugins" fi +AC_ARG_VAR([SCRIPTDIR], [Path of script directory @<:@default=PKGLIBEXECDIR@:>@]) +if test -n "${SCRIPTDIR}"; then + scriptdir="${SCRIPTDIR}" +else + scriptdir="\${pkglibexecdir}" +fi + AC_DEFINE_UNQUOTED([TARGET_ALIAS], ["${host}"], [A string representing our host]) -AM_CONDITIONAL([TARGET_LINUX], [false]) +AM_CONDITIONAL([ENABLE_DNS_UPDOWN],[true]) case "$host" in *-*-linux*) AC_DEFINE([TARGET_LINUX], [1], [Are we running on Linux?]) - AM_CONDITIONAL([TARGET_LINUX], [true]) AC_DEFINE_UNQUOTED([TARGET_PREFIX], ["L"], [Target prefix]) + AC_SUBST([DNS_UPDOWN_TYPE], ["systemd"]) have_sitnl="yes" pkg_config_required="yes" ;; *-*-solaris*) AC_DEFINE([TARGET_SOLARIS], [1], [Are we running on Solaris?]) AC_DEFINE_UNQUOTED([TARGET_PREFIX], ["S"], [Target prefix]) + AC_SUBST([DNS_UPDOWN_TYPE], ["resolvconf_file"]) CPPFLAGS="$CPPFLAGS -D_XPG4_2" test -x /bin/bash && SHELL="/bin/bash" ;; *-*-openbsd*) AC_DEFINE([TARGET_OPENBSD], [1], [Are we running on OpenBSD?]) AC_DEFINE_UNQUOTED([TARGET_PREFIX], ["O"], [Target prefix]) + AC_SUBST([DNS_UPDOWN_TYPE], ["resolvconf_file"]) ;; *-*-freebsd*) AC_DEFINE([TARGET_FREEBSD], [1], [Are we running on FreeBSD?]) AC_DEFINE_UNQUOTED([TARGET_PREFIX], ["F"], [Target prefix]) + AC_SUBST([DNS_UPDOWN_TYPE], ["openresolv"]) ;; *-*-netbsd*) AC_DEFINE([TARGET_NETBSD], [1], [Are we running NetBSD?]) AC_DEFINE_UNQUOTED([TARGET_PREFIX], ["N"], [Target prefix]) + AC_SUBST([DNS_UPDOWN_TYPE], ["openresolv"]) ;; *-*-darwin*) AC_DEFINE([TARGET_DARWIN], [1], [Are we running on Mac OS X?]) AC_DEFINE_UNQUOTED([TARGET_PREFIX], ["M"], [Target prefix]) + AM_CONDITIONAL([ENABLE_DNS_UPDOWN], [false]) + AC_SUBST([DNS_UPDOWN_TYPE], ["resolvconf_file"]) have_tap_header="yes" ac_cv_type_struct_in_pktinfo=no ;; @@ -353,6 +373,8 @@ AC_DEFINE([TARGET_WIN32], [1], [Are we running WIN32?]) AC_DEFINE([ENABLE_DCO], [1], [DCO is always enabled on Windows]) AC_DEFINE_UNQUOTED([TARGET_PREFIX], ["W"], [Target prefix]) + AM_CONDITIONAL([ENABLE_DNS_UPDOWN], [false]) + AC_SUBST([DNS_UPDOWN_TYPE], ["windows"]) CPPFLAGS="${CPPFLAGS} -DWIN32_LEAN_AND_MEAN" CPPFLAGS="${CPPFLAGS} -DNTDDI_VERSION=NTDDI_VISTA -D_WIN32_WINNT=_WIN32_WINNT_VISTA" WIN32=yes @@ -360,10 +382,12 @@ *-*-dragonfly*) AC_DEFINE([TARGET_DRAGONFLY], [1], [Are we running on DragonFlyBSD?]) AC_DEFINE_UNQUOTED([TARGET_PREFIX], ["D"], [Target prefix]) + AC_SUBST([DNS_UPDOWN_TYPE], ["openresolv"]) ;; *-aix*) AC_DEFINE([TARGET_AIX], [1], [Are we running AIX?]) AC_DEFINE_UNQUOTED([TARGET_PREFIX], ["A"], [Target prefix]) + AC_SUBST([DNS_UPDOWN_TYPE], ["resolvconf_file"]) ROUTE="/usr/sbin/route" have_tap_header="yes" ac_cv_header_net_if_h="no" # exists, but breaks things @@ -371,10 +395,12 @@ *-*-haiku*) AC_DEFINE([TARGET_HAIKU], [1], [Are we running Haiku?]) AC_DEFINE_UNQUOTED([TARGET_PREFIX], ["H"], [Target prefix]) + AC_SUBST([DNS_UPDOWN_TYPE], ["haikuos_file"]) LIBS="${LIBS} -lnetwork" ;; *) AC_DEFINE_UNQUOTED([TARGET_PREFIX], ["X"], [Target prefix]) + AC_SUBST([DNS_UPDOWN_TYPE], ["resolvconf_file"]) have_tap_header="yes" ;; esac @@ -1317,7 +1343,7 @@ test "${enable_small}" = "yes" && AC_DEFINE([ENABLE_SMALL], [1], [Enable smaller executable size]) test "${enable_fragment}" = "yes" && AC_DEFINE([ENABLE_FRAGMENT], [1], [Enable internal fragmentation support]) test "${enable_port_share}" = "yes" && AC_DEFINE([ENABLE_PORT_SHARE], [1], [Enable TCP Server port sharing]) - +test "${enable_dns_updown_by_default}" = "yes" && AC_DEFINE([ENABLE_DNS_UPDOWN_BY_DEFAULT], [1], [Enable dns-updown hook by default]) test "${enable_ntlm}" = "yes" && AC_DEFINE([ENABLE_NTLM], [1], [Enable NTLMv2 proxy support]) test "${enable_crypto_ofb_cfb}" = "yes" && AC_DEFINE([ENABLE_OFB_CFB_MODE], [1], [Enable OFB and CFB cipher modes]) if test "${have_export_keying_material}" = "yes"; then @@ -1505,6 +1531,7 @@ sampledir="\$(docdir)/sample" AC_SUBST([plugindir]) +AC_SUBST([scriptdir]) AC_SUBST([sampledir]) AC_SUBST([systemdunitdir]) @@ -1541,6 +1568,7 @@ Makefile distro/Makefile distro/systemd/Makefile + distro/dns-scripts/Makefile doc/Makefile doc/doxygen/Makefile doc/doxygen/openvpn.doxyfile diff --git a/distro/Makefile.am b/distro/Makefile.am index 7a588da..26f577b 100644 --- a/distro/Makefile.am +++ b/distro/Makefile.am @@ -13,3 +13,7 @@ $(srcdir)/Makefile.in SUBDIRS = systemd + +if ENABLE_DNS_UPDOWN +SUBDIRS += dns-scripts +endif diff --git a/distro/dns-scripts/Makefile.am b/distro/dns-scripts/Makefile.am new file mode 100644 index 0000000..ec7bfde --- /dev/null +++ b/distro/dns-scripts/Makefile.am @@ -0,0 +1,28 @@ +# +# OpenVPN -- An application to securely tunnel IP networks +# over a single UDP port, with support for SSL/TLS-based +# session authentication and key exchange, +# packet encryption, packet authentication, and +# packet compression. +# +# Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> +# + +MAINTAINERCLEANFILES = \ + $(srcdir)/Makefile.in + +EXTRA_DIST = \ + systemd-dns-updown.sh \ + openresolv-dns-updown.sh \ + haikuos_file-dns-updown.sh \ + resolvconf_file-dns-updown.sh + +script_SCRIPTS = \ + dns-updown + +CLEANFILES = $(script_SCRIPTS) + +dns-updown: @DNS...@-d... + cp ${srcdir}/@DNS...@-d... $@ + +all: $(script_SCRIPTS) diff --git a/distro/dns-scripts/haikuos_file-dns-updown.sh b/distro/dns-scripts/haikuos_file-dns-updown.sh new file mode 100644 index 0000000..1b03e9c --- /dev/null +++ b/distro/dns-scripts/haikuos_file-dns-updown.sh @@ -0,0 +1,84 @@ +#!/bin/sh +# +# Simple OpenVPN up/down script for modifying Haiku OS resolv.conf +# (C) Copyright 2024 OpenVPN Inc <sa...@op...> +# +# SPDX-License-Identifier: BSD-2-Clause +# +# Example env from openvpn (most are not applied): +# +# dev tun0 +# script-type dns-up +# dns_search_domain_1 mycorp.in +# dns_search_domain_2 eu.mycorp.com +# dns_server_1_address_1 192.168.99.254 +# dns_server_1_address_2 fd00::99:53 +# dns_server_1_port_1 53 +# dns_server_1_port_2 53 +# dns_server_1_resolve_domain_1 mycorp.in +# dns_server_1_resolve_domain_2 eu.mycorp.com +# dns_server_1_dnssec true +# dns_server_1_transport DoH +# dns_server_1_sni dns.mycorp.in +# + +set -e +u + +conly_standard_server_ports() { + i=1 + while true; do + eval addr=\"\$dns_server_${n}_address_${i}\" + [ -n "$addr" ] || return 0 + + eval port=\"\$dns_server_${n}_port_${i}\" + [ -z "$port" -o "$port" = "53" ] || return 1 + + i=$(expr $i + 1) + done +} + +onf=/boot/system/settings/network/resolv.conf +test -e "$conf" || exit 1 +case "${script_type}" in +dns-up) + n=1 + while :; do + eval addr=\"\$dns_server_${n}_address_1\" + [ -n "$addr" ] || { + echo "setting DNS failed, no compatible server profile" + exit 1 + } + + # Skip server profiles which require DNSSEC, + # secure transport or use a custom port + eval dnssec=\"\$dns_server_${n}_dnssec\" + eval transport=\"\$dns_server_${n}_transport\" + [ -z "$transport" -o "$transport" = "plain" ] \ + && [ -z "$dnssec" -o "$dnssec" = "no" ] \ + && only_standard_server_ports && break + + n=$(expr $n + 1) + done + + eval addr1=\"\$dns_server_${n}_address_1\" + eval addr2=\"\$dns_server_${n}_address_2\" + eval addr3=\"\$dns_server_${n}_address_3\" + text="### openvpn ${dev} begin ###\n" + text="${text}nameserver $addr1\n" + test -z "$addr2" || text="${text}nameserver $addr2\n" + test -z "$addr3" || text="${text}nameserver $addr3\n" + + test -z "$dns_search_domain_1" || { + for i in $(seq 1 6); do + eval domains=\"$domains\$dns_search_domain_${i} \" || break + done + text="${text}search $domains\n" + } + text="${text}### openvpn ${dev} end ###" + + sed -i "1i${text}" "$conf" + ;; +dns-down) + sed -i "/### openvpn ${dev} begin ###/,/### openvpn ${dev} end ###/d" "$conf" + ;; +esac diff --git a/distro/dns-scripts/openresolv-dns-updown.sh b/distro/dns-scripts/openresolv-dns-updown.sh new file mode 100644 index 0000000..1b218f5 --- /dev/null +++ b/distro/dns-scripts/openresolv-dns-updown.sh @@ -0,0 +1,89 @@ +#!/bin/sh +# +# Simple OpenVPN up/down script for openresolv integration +# (C) Copyright 2016 Baptiste Daroussin +# 2024 OpenVPN Inc <sa...@op...> +# +# SPDX-License-Identifier: BSD-2-Clause +# +# Example env from openvpn (most are not applied): +# +# dev tun0 +# script-type dns-up +# dns_search_domain_1 mycorp.in +# dns_search_domain_2 eu.mycorp.com +# dns_server_1_address_1 192.168.99.254 +# dns_server_1_address_2 fd00::99:53 +# dns_server_1_port_1 53 +# dns_server_1_port_2 53 +# dns_server_1_resolve_domain_1 mycorp.in +# dns_server_1_resolve_domain_2 eu.mycorp.com +# dns_server_1_dnssec true +# dns_server_1_transport DoH +# dns_server_1_sni dns.mycorp.in +# + +set -e +u + +only_standard_server_ports() { + i=1 + while true; do + eval addr=\"\$dns_server_${n}_address_${i}\" + [ -n "$addr" ] || return 0 + + eval port=\"\$dns_server_${n}_port_${i}\" + [ -z "$port" -o "$port" = "53" ] || return 1 + + i=$(expr $i + 1) + done +} + +: ${script_type:=dns-down} +case "${script_type}" in +dns-up) + n=1 + while :; do + eval addr=\"\$dns_server_${n}_address_1\" + [ -n "$addr" ] || { + echo "setting DNS failed, no compatible server profile" + exit 1 + } + + # Skip server profiles which require DNSSEC, + # secure transport or use a custom port + eval dnssec=\"\$dns_server_${n}_dnssec\" + eval transport=\"\$dns_server_${n}_transport\" + [ -z "$transport" -o "$transport" = "plain" ] \ + && [ -z "$dnssec" -o "$dnssec" = "no" ] \ + && only_standard_server_ports && break + + n=$(expr $n + 1) + done + + { + i=1 + maxns=3 + while :; do + maxns=$((maxns - 1)) + [ $maxns -gt 0 ] || break + eval option=\"\$dns_server_${n}_address_${i}\" || break + [ "${option}" ] || break + i=$((i + 1)) + echo "nameserver ${option}" + done + i=1 + maxdom=6 + while :; do + maxdom=$((maxdom - 1)) + [ $maxdom -gt 0 ] || break + eval option=\"\$dns_search_domain_${i}\" || break + [ "${option}" ] || break + i=$((i + 1)) + echo "search ${option}" + done + } | /sbin/resolvconf -a "${dev}" + ;; +dns-down) + /sbin/resolvconf -d "${dev}" -f + ;; +esac diff --git a/distro/dns-scripts/resolvconf_file-dns-updown.sh b/distro/dns-scripts/resolvconf_file-dns-updown.sh new file mode 100644 index 0000000..c469490 --- /dev/null +++ b/distro/dns-scripts/resolvconf_file-dns-updown.sh @@ -0,0 +1,84 @@ +#!/bin/sh +# +# Simple OpenVPN up/down script for modifying /etc/resolv.conf +# (C) Copyright 2024 OpenVPN Inc <sa...@op...> +# +# SPDX-License-Identifier: BSD-2-Clause +# +# Example env from openvpn (most are not applied): +# +# dev tun0 +# script-type dns-up +# dns_search_domain_1 mycorp.in +# dns_search_domain_2 eu.mycorp.com +# dns_server_1_address_1 192.168.99.254 +# dns_server_1_address_2 fd00::99:53 +# dns_server_1_port_1 53 +# dns_server_1_port_2 53 +# dns_server_1_resolve_domain_1 mycorp.in +# dns_server_1_resolve_domain_2 eu.mycorp.com +# dns_server_1_dnssec true +# dns_server_1_transport DoH +# dns_server_1_sni dns.mycorp.in +# + +set -e +u + +only_standard_server_ports() { + i=1 + while true; do + eval addr=\"\$dns_server_${n}_address_${i}\" + [ -n "$addr" ] || return 0 + + eval port=\"\$dns_server_${n}_port_${i}\" + [ -z "$port" -o "$port" = "53" ] || return 1 + + i=$(expr $i + 1) + done +} + +conf=/etc/resolv.conf +test -e "$conf" || exit 1 +case "${script_type}" in +dns-up) + n=1 + while :; do + eval addr=\"\$dns_server_${n}_address_1\" + [ -n "$addr" ] || { + echo "setting DNS failed, no compatible server profile" + exit 1 + } + + # Skip server profiles which require DNSSEC, + # secure transport or use a custom port + eval dnssec=\"\$dns_server_${n}_dnssec\" + eval transport=\"\$dns_server_${n}_transport\" + [ -z "$transport" -o "$transport" = "plain" ] \ + && [ -z "$dnssec" -o "$dnssec" = "no" ] \ + && only_standard_server_ports && break + + n=$(expr $n + 1) + done + + eval addr1=\"\$dns_server_${n}_address_1\" + eval addr2=\"\$dns_server_${n}_address_2\" + eval addr3=\"\$dns_server_${n}_address_3\" + text="### openvpn ${dev} begin ###\n" + text="${text}nameserver $addr1\n" + test -z "$addr2" || text="${text}nameserver $addr2\n" + test -z "$addr3" || text="${text}nameserver $addr3\n" + + test -z "$dns_search_domain_1" || { + for i in $(seq 1 6); do + eval domains=\"$domains\$dns_search_domain_${i} \" || break + done + text="${text}search $domains\n" + } + text="${text}### openvpn ${dev} end ###" + + sed -i "1i${text}" "$conf" + ;; +dns-down) + sed -i "/### openvpn ${dev} begin ###/,/### openvpn ${dev} end ###/d" "$conf" + ;; +esac diff --git a/distro/dns-scripts/systemd-dns-updown.sh b/distro/dns-scripts/systemd-dns-updown.sh new file mode 100644 index 0000000..69bbebf --- /dev/null +++ b/distro/dns-scripts/systemd-dns-updown.sh @@ -0,0 +1,194 @@ +#!/bin/bash +# +# dns-updown - add/remove openvpn provided DNS information +# +# Copyright (C) 2024 OpenVPN Inc <sa...@op...> +# +# SPDX-License-Identifier: GPL-2.0 +# +# Add/remove openvpn DNS settings from the env into/from +# the system. Supported backends in this order: +# +# * systemd-resolved +# * resolvconf +# +# Example env from openvpn (not all are always applied): +# +# dev tun0 +# script-type dns-up +# dns_search_domain_1 mycorp.in +# dns_search_domain_2 eu.mycorp.com +# dns_server_1_address_1 192.168.99.254 +# dns_server_1_address_2 fd00::99:53 +# dns_server_1_port_1 53 +# dns_server_1_port_2 53 +# dns_server_1_resolve_domain_1 mycorp.in +# dns_server_1_resolve_domain_2 eu.mycorp.com +# dns_server_1_dnssec true +# dns_server_1_transport DoH +# dns_server_1_sni dns.mycorp.in +# + +function do_resolved_servers { + local sni="" + local transport_var=dns_server_${n}_transport + local sni_var=dns_server_${n}_sni + [ "${!transport_var}" = "DoT" ] && sni="#${!sni_var}" + + local i=1 + local addrs="" + while :; do + local addr_var=dns_server_${n}_address_${i} + local addr="${!addr_var}" + [ -n "$addr" ] || break + + local port_var=dns_server_${n}_port_${i} + if [ -n "${!port_var}" ]; then + if [[ "$addr" =~ : ]]; then + addr="[$addr]" + fi + addrs+="${addr}:${!port_var}${sni} " + else + addrs+="${addr}${sni} " + fi + i=$((i+1)) + done + + resolvectl dns "$dev" $addrs +} + +function do_resolved_domains { + local list="" + for domain_var in ${!dns_search_domain_*}; do + list+="${!domain_var} " + done + local domain_var=dns_server_${n}_resolve_domain_1 + if [ -z "${!domain_var}" ]; then + resolvectl default-route "$dev" true + list+="~." + else + resolvectl default-route "$dev" false + local i=1 + while :; do + domain_var=dns_server_${n}_resolve_domain_${i} + [ -n "${!domain_var}" ] || break + # Add as split domain (~ prefix), if it doesn't already exist + [[ "$list" =~ (^| )"${!domain_var}"( |$) ]] \ + || list+="~${!domain_var} " + i=$((i+1)) + done + fi + + resolvectl domain "$dev" $list +} + +function do_resolved_dnssec { + local dnssec_var=dns_server_${n}_dnssec + if [ "${!dnssec_var}" = "optional" ]; then + resolvectl dnssec "$dev" allow-downgrade + elif [ "${!dnssec_var}" = "yes" ]; then + resolvectl dnssec "$dev" true + else + resolvectl dnssec "$dev" false + fi +} + +function do_resolved_dnsovertls { + local transport_var=dns_server_${n}_transport + if [ "${!transport_var}" = "DoT" ]; then + resolvectl dnsovertls "$dev" true + else + resolvectl dnsovertls "$dev" false + fi +} + +function do_resolved { + [[ "$(readlink /etc/resolv.conf)" =~ systemd ]] || return 1 + + n=1 + while :; do + local addr_var=dns_server_${n}_address_1 + [ -n "${!addr_var}" ] || { + echo "setting DNS failed, no compatible server profile" + return 1 + } + + # Skip server profiles which require DNS-over-HTTPS + local transport_var=dns_server_${n}_transport + [ -n "${!transport_var}" -a "${!transport_var}" = "DoH" ] || break + + n=$((n+1)) + done + + if [ "$script_type" = "dns-up" ]; then + echo "setting DNS using resolvectl" + do_resolved_servers + do_resolved_domains + do_resolved_dnssec + do_resolved_dnsovertls + else + echo "unsetting DNS using resolvectl" + resolvectl revert "$dev" + fi + + return 0 +} + +function only_standard_server_ports { + local i=1 + while :; do + local addr_var=dns_server_${n}_address_${i} + [ -n "${!addr_var}" ] || return 0 + + local port_var=dns_server_${n}_port_${i} + [ -z "${!port_var}" -o "${!port_var}" = "53" ] || return 1 + + i=$((i+1)) + done +} + +function do_resolvconf { + [ -x /sbin/resolvconf ] || return 1 + + n=1 + while :; do + local server_addr_var=dns_server_${n}_address_1 + [ -n "${!server_addr_var}" ] || { + echo "setting DNS failed, no compatible server profile" + return 1 + } + + # Skip server profiles which require DNSSEC, + # secure transport or use a custom port + local dnssec_var=dns_server_${n}_dnssec + local transport_var=dns_server_${n}_transport + [ -z "${!transport_var}" -o "${!transport_var}" = "plain" ] \ + && [ -z "${!dnssec_var}" -o "${!dnssec_var}" = "no" ] \ + && only_standard_server_ports && break + + n=$((n+1)) + done + + if [ "$script_type" = "dns-up" ]; then + echo "setting DNS using resolvconf" + local domains="" + for domain_var in ${!dns_search_domain_*}; do + domains+="${!domain_var} " + done + { + local maxns=3 + for addr_var in ${!dns_server_1_address_*}; do + [ $((maxns--)) -gt 0 ] || break + echo "nameserver ${!addr_var}" + done + [ -z "$domains" ] || echo "search $domains" + } | /sbin/resolvconf -a "$dev" + else + echo "unsetting DNS using resolvconf" + /sbin/resolvconf -d "$dev" + fi + + return 0 +} + +do_resolved || do_resolvconf diff --git a/doc/man-sections/script-options.rst b/doc/man-sections/script-options.rst index 0d1f9ae..de3842b 100644 --- a/doc/man-sections/script-options.rst +++ b/doc/man-sections/script-options.rst @@ -8,9 +8,13 @@ Script Order of Execution ------------------------- +#. ``--dns-updown`` + + Executed after TCP/UDP socket bind and TUN/TAP open, before ``--up``. + #. ``--up`` - Executed after TCP/UDP socket bind and TUN/TAP open. + Executed after TCP/UDP socket bind and TUN/TAP open, after ``--dns-updown``. #. ``--tls-verify`` @@ -38,9 +42,13 @@ Executed in ``--mode server`` mode on client instance shutdown. +#. ``--dns-updown`` + + Executed before TCP/UDP and TUN/TAP close, before ``--down``. + #. ``--down`` - Executed after TCP/UDP and TUN/TAP close. + Executed after TCP/UDP and TUN/TAP close, after ``--dns-updown``. #. ``--learn-address`` @@ -173,7 +181,7 @@ client-crresponse cmd OpenVPN will write the response of the client into a temporary file. - The filename will be passed as an argument to ``cmd``, and the file will be + The filename will be passed as an argument to ``cmd``, and the file will automatically deleted by OpenVPN after the script returns. The response is passed as is from the client. The script needs to check @@ -235,6 +243,31 @@ The ``--client-disconnect`` command is not passed any extra arguments (only those arguments specified in cmd, if any). +--dns-updown cmd + Run command ``cmd``, instead of the default DNS up/down command that comes + with openvpn. If ``cmd`` is ``disable`` the ``--dns-updown`` command is not run. + + If you write your own command, please make sure to ignore ``--dns`` + server profiles that cannot be applied. Port, DNSSEC and secure transport + settings need to be adhered to. If split DNS is not possible a full redirect + can be used as a fallback. If not all of the server addresses or search domains + can be configured, apply them in the order they are listed in. + + Note that ``--dns-updown`` is not supported on all platforms. On Windows DNS + will always be set by the service. On Android DNS will be passed via management + interface. + + Note that DNS-related ``--dhcp-option``\ s might be converted so that they are + available to this hook if no ``--dns`` options exist. If any ``--dns server`` + option is present, DNS-related ``--dhcp-option``\ s will always be ignored. + If an ``--up`` script is defined, foreign_option env vars will be generated + from ``--dns`` options and passed to the script. The default ``--dns-updown`` + command is not run if an ``--up`` script is defined. Both is done for backward + compatibility. In case you want to run the ``--dns-updown`` command even if + there is an ``--up`` defined, you can define a custom command or use ``force`` + as ``cmd`` to run the default command. No DNS env vars will be passed to ``--up`` + in this case. + --down cmd Run command ``cmd`` after TUN/TAP device close (post ``--user`` UID change and/or ``--chroot`` ). ``cmd`` consists of a path to script (or @@ -661,7 +694,7 @@ names). Set prior to ``--up`` or ``--down`` script execution. :code:`dns_*` - The ``--dns`` configuration options will be made available to script + The ``--dns`` configuration options will be made available to ``--dns-updown`` execution through this set of environment variables. Variables appear only if the corresponding option has a value assigned. For the semantics of each individual variable, please refer to the documentation for ``--dns``. diff --git a/src/openvpn/Makefile.am b/src/openvpn/Makefile.am index 37af683..2e93ebb 100644 --- a/src/openvpn/Makefile.am +++ b/src/openvpn/Makefile.am @@ -30,7 +30,8 @@ $(OPTIONAL_LZ4_CFLAGS) \ $(OPTIONAL_PKCS11_HELPER_CFLAGS) \ $(OPTIONAL_INOTIFY_CFLAGS) \ - -DPLUGIN_LIBDIR=\"${plugindir}\" + -DPLUGIN_LIBDIR=\"${plugindir}\" \ + -DDEFAULT_DNS_UPDOWN=\"${scriptdir}/dns-updown\" if WIN32 # we want unicode entry point but not the macro diff --git a/src/openvpn/dns.c b/src/openvpn/dns.c index b6e524f..4da0747 100644 --- a/src/openvpn/dns.c +++ b/src/openvpn/dns.c @@ -30,6 +30,7 @@ #include "dns.h" #include "socket.h" #include "options.h" +#include "run_command.h" #ifdef _WIN32 #include "win32.h" @@ -262,6 +263,8 @@ clone.search_domains = clone_dns_domains(o->search_domains, gc); clone.servers = clone_dns_servers(o->servers, gc); clone.servers_prepull = clone_dns_servers(o->servers_prepull, gc); + clone.updown = o->updown; + clone.user_set_updown = o->user_set_updown; return clone; } @@ -548,6 +551,54 @@ send_msg_iservice(o->msg_channel, &nrpt, sizeof(nrpt), &ack, "DNS"); } +#else /* ifdef _WIN32 */ + +static void +updown_env_set(bool up, const struct dns_options *o, const struct tuntap *tt, struct env_set *es) +{ + setenv_str(es, "dev", tt->actual_name); + setenv_str(es, "script_type", up ? "dns-up" : "dns-down"); + setenv_dns_options(o, es); +} + +static int +do_run_up_down_command(bool up, const struct dns_options *o, const struct tuntap *tt) +{ + struct gc_arena gc = gc_new(); + struct argv argv = argv_new(); + struct env_set *es = env_set_create(&gc); + + updown_env_set(up, o, tt, es); + + argv_printf(&argv, "%s", o->updown); + argv_msg(M_INFO, &argv); + int res; + if (o->user_set_updown) + { + res = openvpn_run_script(&argv, es, S_EXITCODE, "dns updown"); + } + else + { + res = openvpn_execve_check(&argv, es, S_EXITCODE, "WARNING: Failed running dns updown"); + } + argv_free(&argv); + gc_free(&gc); + return res; +} + +static void +run_up_down_command(bool up, struct options *o, const struct tuntap *tt) +{ + if (!o->dns_options.updown) + { + return; + } + + int status; + status = do_run_up_down_command(up, &o->dns_options, tt); + msg(M_INFO, "dns %s command exited with status %d", up ? "up" : "down", status); +} + #endif /* _WIN32 */ void @@ -666,5 +717,7 @@ #ifdef _WIN32 run_up_down_service(up, o, tt); +#else + run_up_down_command(up, o, tt); #endif /* ifdef _WIN32 */ } diff --git a/src/openvpn/dns.h b/src/openvpn/dns.h index f24e30b..c4d19ff 100644 --- a/src/openvpn/dns.h +++ b/src/openvpn/dns.h @@ -73,6 +73,8 @@ struct dns_server *servers_prepull; struct dns_server *servers; struct gc_arena gc; + const char *updown; + bool user_set_updown; }; /** diff --git a/src/openvpn/options.c b/src/openvpn/options.c index 99dd60a..b116740 100644 --- a/src/openvpn/options.c +++ b/src/openvpn/options.c @@ -526,10 +526,12 @@ " address <addr[:port]> [addr[:port] ...] : server addresses 4/6\n" " resolve-domains <domain> [domain ...] : split domains\n" " dnssec <yes|no|optional> : option to use DNSSEC\n" - " type <DoH|DoT> : query server over HTTPS / TLS\n" + " transport <DoH|DoT> : query server over HTTPS / TLS\n" " sni <domain> : DNS server name indication\n" "--dns search-domains <domain> [domain ...]:\n" " Add domains to DNS domain search list\n" + "--dns-updown cmd|force|disable : Run cmd as user defined dns config command,\n" + " force running the default script or disable running it.\n" "--auth-retry t : How to handle auth failures. Set t to\n" " none (default), interact, or nointeract.\n" "--static-challenge t e [<scrv1|concat>]: Enable static challenge/response protocol using\n" @@ -921,6 +923,10 @@ #ifndef ENABLE_DCO o->disable_dco = true; #endif /* ENABLE_DCO */ + +#ifdef ENABLE_DNS_UPDOWN_BY_DEFAULT + o->dns_options.updown = DEFAULT_DNS_UPDOWN; +#endif /* ENABLE_DNS_UPDOWN_BY_DEFAULT */ } void @@ -8087,6 +8093,39 @@ to->ip_win32_defined = true; } #endif /* ifdef _WIN32 */ + else if (streq(p[0], "dns-updown") && p[1]) + { + VERIFY_PERMISSION(OPT_P_SCRIPT); + if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT)) + { + goto err; + } + struct dns_options *dns = &options->dns_options; + if (streq(p[1], "disable")) + { + dns->updown = NULL; + dns->user_set_updown = false; + } + else if (streq(p[1], "force")) + { + /* force dns-updown run, even if a --up script is defined */ + if (dns->user_set_updown == false) + { + dns->updown = DEFAULT_DNS_UPDOWN; + dns->user_set_updown = true; + } + } + else + { + if (streq(dns->updown, DEFAULT_DNS_UPDOWN)) + { + /* Unset the default command to prevent warnings */ + dns->updown = NULL; + } + set_user_script(options, &dns->updown, p[1], p[0], false); + dns->user_set_updown = true; + } + } else if (streq(p[0], "dns") && p[1]) { VERIFY_PERMISSION(OPT_P_DHCPDNS); -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/838?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: Ifbe4ffb44d3bfcaa50adb38cacb3436fcdc71b10 Gerrit-Change-Number: 838 Gerrit-PatchSet: 19 Gerrit-Owner: d12fk <he...@op...> Gerrit-Reviewer: cron2 <ge...@gr...> Gerrit-Reviewer: flichtenheld <fr...@li...> Gerrit-Reviewer: plaisthos <arn...@rf...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-Attention: plaisthos <arn...@rf...> Gerrit-Attention: cron2 <ge...@gr...> Gerrit-Attention: flichtenheld <fr...@li...> Gerrit-Attention: d12fk <he...@op...> Gerrit-MessageType: newpatchset |
| From: d12fk (C. Review) <ge...@op...> - 2025-03-31 07:52:34 |
Attention is currently required from: flichtenheld, plaisthos. Hello flichtenheld, plaisthos, I'd like you to reexamine a change. Please visit http://gerrit.openvpn.net/c/openvpn/+/904?usp=email to look at the new patch set (#12). Change subject: dns: deal with --dhcp-options when --dns is active ...................................................................... dns: deal with --dhcp-options when --dns is active Since --dns settings overrule DNS related --dhcp-options, remove the latter when values were defined via --dns. To stay as backward compatible as possible, we add foreign_options to the script hook environment from the --dns values when a --up script is defined. In that case the default --dns-updown is not run, even when --dns values are present, to prevent double DNS configuration. This way an existing --up script that deals with DNS can run, without the immediate need to change after an openvpn upgrade and a server pushing --dns options. If you specify a custom --dns-updown, or force running the default dns-updown that comes with openvpn, those compat env vars are not set for --up scripts and the dns-updown command is run, even when there's an --up script present. Since Android uses the DNS values from tuntap_options, we always override those with --dns stuff unconditionally. Also on Windows when --ip-win32 is dynamic or adaptive, since DHCP relies on these as well. Change-Id: I635c4018fb43b5976a39b6a90cb2e9cb2570cd6a Signed-off-by: Heiko Hund <he...@is...> --- M src/openvpn/dns.c M src/openvpn/dns.h M src/openvpn/options.c 3 files changed, 311 insertions(+), 186 deletions(-) git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/04/904/12 diff --git a/src/openvpn/dns.c b/src/openvpn/dns.c index 221e9a9..9927961 100644 --- a/src/openvpn/dns.c +++ b/src/openvpn/dns.c @@ -703,7 +703,8 @@ static void run_up_down_command(bool up, struct options *o, const struct tuntap *tt, struct dns_updown_runner_info *updown_runner) { - if (!o->dns_options.updown) + struct dns_options *dns = &o->dns_options; + if (!dns->updown || (o->up_script && !dns->user_set_updown)) { return; } @@ -713,7 +714,7 @@ if (!updown_runner->required) { /* Run dns updown directly */ - status = do_run_up_down_command(up, NULL, &o->dns_options, tt); + status = do_run_up_down_command(up, NULL, dns, tt); } else { diff --git a/src/openvpn/dns.h b/src/openvpn/dns.h index c56d603..8e3556d 100644 --- a/src/openvpn/dns.h +++ b/src/openvpn/dns.h @@ -76,7 +76,28 @@ #endif }; +#ifndef N_DHCP_ADDR +#define N_DHCP_ADDR 4 +#endif + +#ifndef N_SEARCH_LIST_LEN +#define N_SEARCH_LIST_LEN 10 +#endif + +struct dhcp_options { + in_addr_t dns[N_DHCP_ADDR]; + int dns_len; + + struct in6_addr dns6[N_DHCP_ADDR]; + int dns6_len; + + const char *domain; + const char *domain_search_list[N_SEARCH_LIST_LEN]; + int domain_search_list_len; +}; + struct dns_options { + struct dhcp_options from_dhcp; struct dns_domain *search_domains; struct dns_server *servers_prepull; struct dns_server *servers; diff --git a/src/openvpn/options.c b/src/openvpn/options.c index e2e4835..0131ef4 100644 --- a/src/openvpn/options.c +++ b/src/openvpn/options.c @@ -1333,7 +1333,6 @@ #endif /* ifndef ENABLE_SMALL */ #endif /* ifdef _WIN32 */ -#if defined(_WIN32) || defined(TARGET_ANDROID) static void dhcp_option_dns6_parse(const char *parm, struct in6_addr *dns6_list, int *len, int msglevel) { @@ -1376,150 +1375,6 @@ } } -/* - * If DNS options are set use these for TUN/TAP options as well. - * Applies to DNS, DNS6 and DOMAIN-SEARCH. - * Existing options will be discarded. - */ -static void -tuntap_options_copy_dns(struct options *o) -{ - struct tuntap_options *tt = &o->tuntap_options; - struct dns_options *dns = &o->dns_options; - - if (dns->search_domains) - { - tt->domain_search_list_len = 0; - const struct dns_domain *domain = dns->search_domains; - while (domain && tt->domain_search_list_len < N_SEARCH_LIST_LEN) - { - tt->domain_search_list[tt->domain_search_list_len++] = domain->name; - domain = domain->next; - } - if (domain) - { - msg(M_WARN, "WARNING: couldn't copy all --dns search-domains to --dhcp-option"); - } - tt->dhcp_options |= DHCP_OPTIONS_DHCP_REQUIRED; - } - - if (dns->servers) - { - tt->dns_len = 0; - tt->dns6_len = 0; - bool overflow = false; - const struct dns_server *server = dns->servers; - while (server) - { - for (int i = 0; i < server->addr_count; ++i) - { - if (server->addr[i].family == AF_INET) - { - if (tt->dns_len >= N_DHCP_ADDR) - { - overflow = true; - continue; - } - tt->dns[tt->dns_len++] = ntohl(server->addr[i].in.a4.s_addr); - } - else - { - if (tt->dns6_len >= N_DHCP_ADDR) - { - overflow = true; - continue; - } - tt->dns6[tt->dns6_len++] = server->addr[i].in.a6; - } - } - server = server->next; - } - if (overflow) - { - msg(M_WARN, "WARNING: couldn't copy all --dns server addresses to --dhcp-option"); - } - tt->dhcp_options |= DHCP_OPTIONS_DHCP_OPTIONAL; - } -} -#else /* if defined(_WIN32) || defined(TARGET_ANDROID) */ -static void -foreign_options_copy_dns(struct options *o, struct env_set *es) -{ - const struct dns_domain *domain = o->dns_options.search_domains; - const struct dns_server *server = o->dns_options.servers; - if (!domain && !server) - { - return; - } - - /* reset the index since we're starting all over again */ - int opt_max = o->foreign_option_index; - o->foreign_option_index = 0; - - for (int i = 1; i <= opt_max; ++i) - { - char name[32]; - snprintf(name, sizeof(name), "foreign_option_%d", i); - - const char *env_str = env_set_get(es, name); - const char *value = strchr(env_str, '=') + 1; - if ((domain && strstr(value, "dhcp-option DOMAIN-SEARCH") == value) - || (server && strstr(value, "dhcp-option DNS") == value)) - { - setenv_del(es, name); - } - else - { - setenv_foreign_option(o, &value, 1, es); - } - } - - struct gc_arena gc = gc_new(); - - while (server) - { - for (size_t i = 0; i < server->addr_count; ++i) - { - if (server->addr[i].family == AF_INET) - { - const char *argv[] = { - "dhcp-option", - "DNS", - print_in_addr_t(server->addr[i].in.a4.s_addr, 0, &gc) - }; - setenv_foreign_option(o, argv, 3, es); - } - else - { - const char *argv[] = { - "dhcp-option", - "DNS6", - print_in6_addr(server->addr[i].in.a6, 0, &gc) - }; - setenv_foreign_option(o, argv, 3, es); - } - } - server = server->next; - } - while (domain) - { - const char *argv[] = { "dhcp-option", "DOMAIN-SEARCH", domain->name }; - setenv_foreign_option(o, argv, 3, es); - domain = domain->next; - } - - gc_free(&gc); - - /* remove old leftover entries */ - while (o->foreign_option_index < opt_max) - { - char name[32]; - snprintf(name, sizeof(name), "foreign_option_%d", opt_max--); - setenv_del(es, name); - } -} -#endif /* if defined(_WIN32) || defined(TARGET_ANDROID) */ - #ifndef ENABLE_SMALL static const char * print_vlan_accept(enum vlan_acceptable_frames mode) @@ -3617,6 +3472,256 @@ } } +#if defined(_WIN32) || defined(TARGET_ANDROID) +/** + * @brief Postprocess DNS related settings + * + * Set TUN/TAP DNS options with values from either --dns + * or --dhcp-option. + * + * @param o pointer to the options struct + */ +static void +tuntap_options_postprocess_dns(struct options *o) +{ + struct dns_options *dns = &o->dns_options; + struct tuntap_options *tt = &o->tuntap_options; + if (!dns->servers) + { + /* Copy --dhcp-options to tuntap_options */ + struct dhcp_options *dhcp = &dns->from_dhcp; + assert(sizeof(dhcp->dns) == sizeof(tt->dns)); + assert(sizeof(dhcp->dns6) == sizeof(tt->dns6)); + assert(sizeof(dhcp->domain_search_list) == sizeof(tt->domain_search_list)); + + tt->domain = dhcp->domain; + tt->dns_len = dhcp->dns_len; + tt->dns6_len = dhcp->dns6_len; + tt->domain_search_list_len = dhcp->domain_search_list_len; + + memcpy(tt->dns, dhcp->dns, sizeof(tt->dns)); + memcpy(tt->dns6, dhcp->dns6, sizeof(tt->dns6)); + memcpy(tt->domain_search_list, dhcp->domain_search_list, sizeof(tt->domain_search_list)); + + return; + } + +#if defined(_WIN32) + if (tt->ip_win32_type != IPW32_SET_DHCP_MASQ && tt->ip_win32_type != IPW32_SET_ADAPTIVE) + { + return; /* Not in DHCP mode */ + } +#endif /* if defined(_WIN32) */ + + /* Copy --dns options to tuntap_options */ + const struct dns_domain *d = dns->search_domains; + while (d && tt->domain_search_list_len + 1 < N_SEARCH_LIST_LEN) + { + tt->domain_search_list[tt->domain_search_list_len++] = d->name; + d = d->next; + } + if (d) + { + msg(M_WARN, "WARNING: couldn't copy all --dns search-domains to TUN/TAP"); + } + + const struct dns_server *s = dns->servers; + while (s) + { + bool non_standard_server_port = false; + for (int i = 0; i < s->addr_count; ++i) + { + if (s->addr[i].port && s->addr[i].port != 53) + { + non_standard_server_port = true; + break; + } + } + if ((s->transport && s->transport != DNS_TRANSPORT_PLAIN) + || (s->dnssec && s->dnssec != DNS_SECURITY_NO) + || non_standard_server_port) + { + /* Skip servers requiring unsupported config to be set */ + s = s->next; + } + else + { + bool overflow = false; + for (int i = 0; i < s->addr_count; ++i) + { + if (s->addr[i].family == AF_INET && tt->dns_len + 1 < N_DHCP_ADDR) + { + tt->dns[tt->dns_len++] = s->addr[i].in.a4.s_addr; + } + else if (tt->dns6_len + 1 < N_DHCP_ADDR) + { + tt->dns6[tt->dns6_len] = s->addr[i].in.a6; + } + else + { + overflow = true; + } + } + if (overflow) + { + msg(M_WARN, "WARNING: couldn't copy all --dns server addresses to TUN/TAP"); + } + return; + } + } +} + +#else /* if defined(_WIN32) || defined(TARGET_ANDROID) */ + +/** + * @brief Postprocess DNS related settings + * + * Discard existing --dhcp-options from the env if needed and possibly + * replace them with values from --dns. If no --dns servers are set copy + * the --dhcp-option values over for --dns-updown runs. + * + * @param o pointer to the options struct + * @param es env set to modify potentially + */ +static void +dhcp_options_postprocess_dns(struct options *o, struct env_set *es) +{ + struct gc_arena gc = gc_new(); + struct dns_options *dns = &o->dns_options; + + if (dns->servers || dns->user_set_updown) + { + /* Clean up env from --dhcp-option DNS config */ + struct buffer name = alloc_buf_gc(OPTION_PARM_SIZE, &gc); + struct buffer value = alloc_buf_gc(OPTION_PARM_SIZE, &gc); + + const int fo_count = o->foreign_option_index; + o->foreign_option_index = 0; + + for (int i = 1; i <= fo_count; ++i) + { + buf_clear(&name); + buf_printf(&name, "foreign_option_%d", i); + const char *env_str = env_set_get(es, BSTR(&name)); + const char *item_val = strchr(env_str, '=') + 1; + buf_clear(&value); + buf_printf(&value, "%s", item_val); + + /* Remove foreign option item from env set */ + env_set_del(es, BSTR(&name)); + + item_val = BSTR(&value); + if (strncmp(item_val, "dhcp-option ", 12) != 0 + || (strncmp(item_val + 12, "ADAPTER-DOMAIN-SUFFIX ", 22) != 0 + && strncmp(item_val + 12, "DOMAIN-SEARCH ", 14) != 0 + && strncmp(item_val + 12, "DOMAIN ", 7) != 0 + && strncmp(item_val + 12, "DNS6 ", 5) != 0 + && strncmp(item_val + 12, "DNS ", 4) != 0)) + { + /* Re-set the item with potentially updated name */ + buf_clear(&name); + buf_printf(&name, "foreign_option_%d", ++o->foreign_option_index); + setenv_str(es, BSTR(&name), BSTR(&value)); + } + } + } + + if (!dns->servers) + { + /* Copy --dhcp-options to dns_options */ + struct dhcp_options *dhcp = &dns->from_dhcp; + + if (dhcp->dns_len || dhcp->dns6_len) + { + struct dns_domain **entry = &dns->search_domains; + ALLOC_OBJ_CLEAR_GC(*entry, struct dns_domain, &dns->gc); + struct dns_domain *new = *entry; + new->name = dhcp->domain; + entry = &new->next; + + for (size_t i = 0; i < dhcp->domain_search_list_len; ++i) + { + ALLOC_OBJ_CLEAR_GC(*entry, struct dns_domain, &dns->gc); + struct dns_domain *new = *entry; + new->name = dhcp->domain_search_list[i]; + entry = &new->next; + } + + struct dns_server *server = dns_server_get(&dns->servers, 0, &dns->gc); + const size_t max_addrs = SIZE(server->addr); + for (size_t i = 0; i < dhcp->dns_len && server->addr_count < max_addrs; ++i) + { + server->addr[server->addr_count].in.a4.s_addr = htonl(dhcp->dns[i]); + server->addr[server->addr_count].family = AF_INET; + server->addr_count += 1; + } + for (size_t i = 0; i < dhcp->dns6_len && server->addr_count < max_addrs; ++i) + { + server->addr[server->addr_count].in.a6 = dhcp->dns6[i]; + server->addr[server->addr_count].family = AF_INET6; + server->addr_count += 1; + } + } + } + else if (o->up_script && !dns->user_set_updown) + { + /* Set foreign option env vars from --dns config */ + const char *p[] = { "dhcp-option", NULL, NULL }; + size_t p_len = sizeof(p) / sizeof(p[0]); + + p[1] = "DOMAIN"; + const struct dns_domain *d = dns->search_domains; + while (d) + { + p[2] = d->name; + setenv_foreign_option(o, (const char **)p, p_len, es); + d = d->next; + } + + const struct dns_server *s = dns->servers; + while (s) + { + bool non_standard_server_port = false; + for (int i = 0; i < s->addr_count; ++i) + { + if (s->addr[i].port && s->addr[i].port != 53) + { + non_standard_server_port = true; + break; + } + } + if ((s->transport && s->transport != DNS_TRANSPORT_PLAIN) + || (s->dnssec && s->dnssec != DNS_SECURITY_NO) + || non_standard_server_port) + { + /* Skip servers requiring unsupported config to be set */ + s = s->next; + } + else + { + for (int i = 0; i < s->addr_count; ++i) + { + if (s->addr[i].family == AF_INET) + { + p[1] = "DNS"; + p[2] = print_in_addr_t(s->addr[i].in.a4.s_addr, IA_NET_ORDER, &gc); + } + else + { + p[1] = "DNS6"; + p[2] = print_in6_addr(s->addr[i].in.a6, 0, &gc); + } + setenv_foreign_option(o, (const char **)p, p_len, es); + } + break; + } + } + } + + gc_free(&gc); +} +#endif /* if defined(_WIN32) || defined(TARGET_ANDROID) */ + static void options_postprocess_mutate(struct options *o, struct env_set *es) { @@ -3802,9 +3907,9 @@ else { #if defined(_WIN32) || defined(TARGET_ANDROID) - tuntap_options_copy_dns(o); + tuntap_options_postprocess_dns(o); #else - foreign_options_copy_dns(o, es); + dhcp_options_postprocess_dns(o, es); #endif } if (o->auth_token_generate && !o->auth_token_renewal) @@ -4187,9 +4292,9 @@ { dns_options_postprocess_pull(&o->dns_options); #if defined(_WIN32) || defined(TARGET_ANDROID) - tuntap_options_copy_dns(o); + tuntap_options_postprocess_dns(o); #else - foreign_options_copy_dns(o, es); + dhcp_options_postprocess_dns(o, es); #endif } return success; @@ -8210,19 +8315,42 @@ goto err; } } -#if defined(_WIN32) || defined(TARGET_ANDROID) else if (streq(p[0], "dhcp-option") && p[1]) { - struct tuntap_options *o = &options->tuntap_options; + struct dhcp_options *dhcp = &options->dns_options.from_dhcp; VERIFY_PERMISSION(OPT_P_DHCPDNS); - if ((streq(p[1], "DOMAIN") || streq(p[1], "ADAPTER_DOMAIN_SUFFIX")) - && p[2] && !p[3]) + if ((streq(p[1], "DOMAIN") || streq(p[1], "ADAPTER_DOMAIN_SUFFIX")) && p[2] && !p[3]) { - o->domain = p[2]; - o->dhcp_options |= DHCP_OPTIONS_DHCP_OPTIONAL; + dhcp->domain = p[2]; } - else if (streq(p[1], "NBS") && p[2] && !p[3]) + else if (streq(p[1], "DOMAIN-SEARCH") && p[2] && !p[3]) + { + if (dhcp->domain_search_list_len < N_SEARCH_LIST_LEN) + { + dhcp->domain_search_list[dhcp->domain_search_list_len++] = p[2]; + } + else + { + msg(msglevel, "--dhcp-option %s: maximum of %d search entries can be specified", + p[1], N_SEARCH_LIST_LEN); + } + } + else if ((streq(p[1], "DNS") || streq(p[1], "DNS6")) && p[2] && !p[3] + && (!strstr(p[2], ":") || ipv6_addr_safe(p[2]))) + { + if (strstr(p[2], ":")) + { + dhcp_option_dns6_parse(p[2], dhcp->dns6, &dhcp->dns6_len, msglevel); + } + else + { + dhcp_option_address_parse("DNS", p[2], dhcp->dns, &dhcp->dns_len, msglevel); + } + } +#if defined(_WIN32) || defined(TARGET_ANDROID) + struct tuntap_options *o = &options->tuntap_options; + if (streq(p[1], "NBS") && p[2] && !p[3]) { o->netbios_scope = p[2]; o->dhcp_options |= DHCP_OPTIONS_DHCP_REQUIRED; @@ -8239,23 +8367,9 @@ o->netbios_node_type = t; o->dhcp_options |= DHCP_OPTIONS_DHCP_REQUIRED; } - else if ((streq(p[1], "DNS") || streq(p[1], "DNS6")) && p[2] && !p[3] - && (!strstr(p[2], ":") || ipv6_addr_safe(p[2]))) - { - if (strstr(p[2], ":")) - { - dhcp_option_dns6_parse(p[2], o->dns6, &o->dns6_len, msglevel); - } - else - { - dhcp_option_address_parse("DNS", p[2], o->dns, &o->dns_len, msglevel); - o->dhcp_options |= DHCP_OPTIONS_DHCP_OPTIONAL; - } - } else if (streq(p[1], "WINS") && p[2] && !p[3]) { dhcp_option_address_parse("WINS", p[2], o->wins, &o->wins_len, msglevel); - o->dhcp_options |= DHCP_OPTIONS_DHCP_OPTIONAL; } else if (streq(p[1], "NTP") && p[2] && !p[3]) { @@ -8267,19 +8381,6 @@ dhcp_option_address_parse("NBDD", p[2], o->nbdd, &o->nbdd_len, msglevel); o->dhcp_options |= DHCP_OPTIONS_DHCP_REQUIRED; } - else if (streq(p[1], "DOMAIN-SEARCH") && p[2] && !p[3]) - { - if (o->domain_search_list_len < N_SEARCH_LIST_LEN) - { - o->domain_search_list[o->domain_search_list_len++] = p[2]; - } - else - { - msg(msglevel, "--dhcp-option %s: maximum of %d search entries can be specified", - p[1], N_SEARCH_LIST_LEN); - } - o->dhcp_options |= DHCP_OPTIONS_DHCP_OPTIONAL; - } else if (streq(p[1], "DISABLE-NBT") && !p[2]) { o->disable_nbt = 1; @@ -8297,8 +8398,10 @@ msg(msglevel, "--dhcp-option: unknown option type '%s' or missing or unknown parameter", p[1]); goto err; } - } +#else /* if defined(_WIN32) || defined(TARGET_ANDROID) */ + setenv_foreign_option(options, (const char **)p, 3, es); #endif /* if defined(_WIN32) || defined(TARGET_ANDROID) */ + } #ifdef _WIN32 else if (streq(p[0], "show-adapters") && !p[1]) { -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/904?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I635c4018fb43b5976a39b6a90cb2e9cb2570cd6a Gerrit-Change-Number: 904 Gerrit-PatchSet: 12 Gerrit-Owner: d12fk <he...@op...> Gerrit-Reviewer: flichtenheld <fr...@li...> Gerrit-Reviewer: plaisthos <arn...@rf...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-Attention: plaisthos <arn...@rf...> Gerrit-Attention: flichtenheld <fr...@li...> Gerrit-MessageType: newpatchset |
| From: d12fk (C. Review) <ge...@op...> - 2025-03-29 18:48:32 |
Attention is currently required from: d12fk, plaisthos. Hello flichtenheld, plaisthos, stipa, I'd like you to reexamine a change. Please visit http://gerrit.openvpn.net/c/openvpn/+/837?usp=email to look at the new patch set (#16). Change subject: win: implement --dns option support with NRPT ...................................................................... win: implement --dns option support with NRPT Implement support for setting options from --dns. This is hugely different than what we had so far with DNS related --dhcp-option. The main difference it that we support split DNS and DNSSEC by making use of NRPT (Name Resolution Policy Table). Also OpenVPN tries to keep local DNS resolution working when DNS is redirected into the tunnel. To prevent this from happening we have --block-outside-dns, in case you wonder. Basically we collect domains and name server addresses from network adapters and add so called exclude NRPT rules in addition to the catch all rule that is pushed by the server. All is done via the interactive service, since modifying all this requires the elevated privileges that the openvpn process hopefully doesn't have. Change-Id: I576e74f3276362606e9cbd50bb5adbebaaf209cc Signed-off-by: Heiko Hund <he...@is...> --- M include/openvpn-msg.h M src/openvpn/dns.c M src/openvpn/dns.h M src/openvpn/init.c M src/openvpnserv/interactive.c 5 files changed, 1,148 insertions(+), 30 deletions(-) git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/37/837/16 diff --git a/include/openvpn-msg.h b/include/openvpn-msg.h index 7a99335..8b48053 100644 --- a/include/openvpn-msg.h +++ b/include/openvpn-msg.h @@ -35,6 +35,8 @@ msg_del_route, msg_add_dns_cfg, msg_del_dns_cfg, + msg_add_nrpt_cfg, + msg_del_nrpt_cfg, msg_add_nbt_cfg, msg_del_nbt_cfg, msg_flush_neighbors, @@ -96,6 +98,23 @@ inet_address_t addr[4]; /* support up to 4 dns addresses */ } dns_cfg_message_t; + +typedef enum { + nrpt_dnssec +} nrpt_flags_t; + +#define NRPT_ADDR_NUM 8 /* Max. number of addresses */ +#define NRPT_ADDR_SIZE 48 /* Max. address strlen + some */ +typedef char nrpt_address_t[NRPT_ADDR_SIZE]; +typedef struct { + message_header_t header; + interface_t iface; + nrpt_address_t addresses[NRPT_ADDR_NUM]; + char resolve_domains[512]; /* double \0 terminated */ + char search_domains[512]; + nrpt_flags_t flags; +} nrpt_dns_cfg_message_t; + typedef struct { message_header_t header; interface_t iface; diff --git a/src/openvpn/dns.c b/src/openvpn/dns.c index cf48c22..b6e524f 100644 --- a/src/openvpn/dns.c +++ b/src/openvpn/dns.c @@ -29,6 +29,12 @@ #include "dns.h" #include "socket.h" +#include "options.h" + +#ifdef _WIN32 +#include "win32.h" +#include "openvpn-msg.h" +#endif /** * Parses a string as port and stores it @@ -428,6 +434,122 @@ gc_free(&gc); } +#ifdef _WIN32 + +static void +make_domain_list(const char *what, const struct dns_domain *src, + bool nrpt_domains, char *dst, size_t dst_size) +{ + /* NRPT domains need two \0 at the end for REG_MULTI_SZ + * and a leading '.' added in front of the domain name */ + size_t term_size = nrpt_domains ? 2 : 1; + size_t leading_dot = nrpt_domains ? 1 : 0; + size_t offset = 0; + + memset(dst, 0, dst_size); + + while (src) + { + size_t len = strlen(src->name); + if (offset + leading_dot + len + term_size > dst_size) + { + msg(M_WARN, "WARNING: %s truncated", what); + if (offset) + { + /* Remove trailing comma */ + *(dst + offset - 1) = '\0'; + } + break; + } + + if (leading_dot) + { + *(dst + offset++) = '.'; + } + strncpy(dst + offset, src->name, len); + offset += len; + + src = src->next; + if (src) + { + *(dst + offset++) = ','; + } + } +} + +static void +run_up_down_service(bool add, const struct options *o, const struct tuntap *tt) +{ + const struct dns_server *server = o->dns_options.servers; + const struct dns_domain *search_domains = o->dns_options.search_domains; + + while (true) + { + if (!server) + { + if (add) + { + msg(M_WARN, "WARNING: setting DNS failed, no compatible server profile"); + } + return; + } + + bool only_standard_server_ports = true; + for (size_t i = 0; i < NRPT_ADDR_NUM; ++i) + { + if (server->addr[i].port && server->addr[i].port != 53) + { + only_standard_server_ports = false; + break; + } + } + if ((server->transport == DNS_TRANSPORT_UNSET || server->transport == DNS_TRANSPORT_PLAIN) + && only_standard_server_ports) + { + break; /* found compatible server */ + } + + server = server->next; + } + + ack_message_t ack; + nrpt_dns_cfg_message_t nrpt = { + .header = { + (add ? msg_add_nrpt_cfg : msg_del_nrpt_cfg), + sizeof(nrpt_dns_cfg_message_t), + 0 + }, + .iface = { .index = tt->adapter_index, .name = "" }, + .flags = server->dnssec == DNS_SECURITY_NO ? 0 : nrpt_dnssec, + }; + strncpynt(nrpt.iface.name, tt->actual_name, sizeof(nrpt.iface.name)); + + for (size_t i = 0; i < NRPT_ADDR_NUM; ++i) + { + if (server->addr[i].family == AF_UNSPEC) + { + /* No more addresses */ + break; + } + + if (inet_ntop(server->addr[i].family, &server->addr[i].in, + nrpt.addresses[i], NRPT_ADDR_SIZE) == NULL) + { + msg(M_WARN, "WARNING: could not convert dns server address"); + } + } + + make_domain_list("dns server resolve domains", server->domains, true, + nrpt.resolve_domains, sizeof(nrpt.resolve_domains)); + + make_domain_list("dns search domains", search_domains, false, + nrpt.search_domains, sizeof(nrpt.search_domains)); + + send_msg_iservice(o->msg_channel, &nrpt, sizeof(nrpt), &ack, "DNS"); +} + +#endif /* _WIN32 */ + void show_dns_options(const struct dns_options *o) { @@ -506,3 +628,43 @@ gc_free(&gc); } + +void +run_dns_up_down(bool up, struct options *o, const struct tuntap *tt) +{ + if (!o->dns_options.servers) + { + return; + } + + /* Warn about adding servers of unsupported AF */ + const struct dns_server *s = o->dns_options.servers; + while (up && s) + { + size_t bad_count = 0; + for (size_t i = 0; i < s->addr_count; ++i) + { + if ((s->addr[i].family == AF_INET6 && !tt->did_ifconfig_ipv6_setup) + || (s->addr[i].family == AF_INET && !tt->did_ifconfig_setup)) + { + ++bad_count; + } + } + if (bad_count == s->addr_count) + { + msg(M_WARN, "DNS server %ld only has address(es) from a family " + "the tunnel is not configured for - it will not be reachable", + s->priority); + } + else if (bad_count) + { + msg(M_WARN, "DNS server %ld has address(es) from a family " + "the tunnel is not configured for", s->priority); + } + s = s->next; + } + +#ifdef _WIN32 + run_up_down_service(up, o, tt); +#endif /* ifdef _WIN32 */ +} diff --git a/src/openvpn/dns.h b/src/openvpn/dns.h index 838ebe1..f24e30b 100644 --- a/src/openvpn/dns.h +++ b/src/openvpn/dns.h @@ -26,6 +26,7 @@ #include "buffer.h" #include "env_set.h" +#include "tun.h" enum dns_security { DNS_SECURITY_UNSET, @@ -147,6 +148,14 @@ void dns_options_postprocess_pull(struct dns_options *o); /** + * Invokes the action associated with bringing DNS up or down + * @param up Boolean to set this call to "up" when true + * @param o Pointer to the program options + * @param tt Pointer to the connection's tuntap struct + */ +void run_dns_up_down(bool up, struct options *o, const struct tuntap *tt); + +/** * Puts the DNS options into an environment set. * * @param o Pointer to the DNS options to set diff --git a/src/openvpn/init.c b/src/openvpn/init.c index 1be205b..9eb8290 100644 --- a/src/openvpn/init.c +++ b/src/openvpn/init.c @@ -2026,6 +2026,8 @@ c->c2.frame.tun_mtu, c->c2.es, &c->net_ctx); } + run_dns_up_down(true, &c->options, c->c1.tuntap); + /* run the up script */ run_up_down(c->options.up_script, c->plugins, @@ -2064,6 +2066,8 @@ /* explicitly set the ifconfig_* env vars */ do_ifconfig_setenv(c->c1.tuntap, c->c2.es); + run_dns_up_down(true, &c->options, c->c1.tuntap); + /* run the up script if user specified --up-restart */ if (c->options.up_restart) { @@ -2152,6 +2156,8 @@ adapter_index = c->c1.tuntap->adapter_index; #endif + run_dns_up_down(false, &c->options, c->c1.tuntap); + if (force || !(c->sig->signal_received == SIGUSR1 && c->options.persist_tun)) { static_context = NULL; diff --git a/src/openvpnserv/interactive.c b/src/openvpnserv/interactive.c index c6963b3..3279b3c 100644 --- a/src/openvpnserv/interactive.c +++ b/src/openvpnserv/interactive.c @@ -88,6 +88,7 @@ wfp_block, undo_dns4, undo_dns6, + undo_nrpt, undo_domains, undo_ring_buffer, undo_wins, @@ -119,12 +120,20 @@ flush_neighbors_message_t flush_neighbors; wfp_block_message_t wfp_block; dns_cfg_message_t dns; + nrpt_dns_cfg_message_t nrpt_dns; enable_dhcp_message_t dhcp; register_ring_buffers_message_t rrb; set_mtu_message_t mtu; wins_cfg_message_t wins; } pipe_message_t; +typedef struct { + CHAR addresses[NRPT_ADDR_NUM * NRPT_ADDR_SIZE]; + WCHAR domains[512]; /* MULTI_SZ string */ + DWORD domains_size; /* bytes in domains */ +} nrpt_exclude_data_t; + + static DWORD AddListItem(list_item_t **pfirst, LPVOID data) { @@ -1194,13 +1203,13 @@ if (apply_gpol && ApplyGpolSettings() == FALSE) { - MsgToEventLog(M_ERR, L"%s: sending GPOL notification failed", __func__); + MsgToEventLog(M_ERR, L"%S: sending GPOL notification failed", __func__); } scm = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS); if (scm == NULL) { - MsgToEventLog(M_ERR, L"%s: OpenSCManager call failed (%lu)", + MsgToEventLog(M_ERR, L"%S: OpenSCManager call failed (%lu)", __func__, GetLastError()); goto out; } @@ -1208,7 +1217,7 @@ dnssvc = OpenServiceA(scm, "Dnscache", SERVICE_PAUSE_CONTINUE); if (dnssvc == NULL) { - MsgToEventLog(M_ERR, L"%s: OpenService call failed (%lu)", + MsgToEventLog(M_ERR, L"%S: OpenService call failed (%lu)", __func__, GetLastError()); goto out; } @@ -1216,7 +1225,7 @@ SERVICE_STATUS status; if (ControlService(dnssvc, SERVICE_CONTROL_PARAMCHANGE, &status) == 0) { - MsgToEventLog(M_ERR, L"%s: ControlService call failed (%lu)", + MsgToEventLog(M_ERR, L"%S: ControlService call failed (%lu)", __func__, GetLastError()); goto out; } @@ -1255,19 +1264,19 @@ err = InterfaceLuid(itf_name, &luid); if (err) { - MsgToEventLog(M_ERR, L"%s: failed to convert itf alias '%s'", __func__, itf_name); + MsgToEventLog(M_ERR, L"%S: failed to convert itf alias '%s'", __func__, itf_name); goto out; } err = ConvertInterfaceLuidToGuid(&luid, &guid); if (err) { - MsgToEventLog(M_ERR, L"%s: Failed to convert itf '%s' LUID", __func__, itf_name); + MsgToEventLog(M_ERR, L"%S: Failed to convert itf '%s' LUID", __func__, itf_name); goto out; } if (StringFromIID(&guid, &iid_str) != S_OK) { - MsgToEventLog(M_ERR, L"%s: Failed to convert itf '%s' IID", __func__, itf_name); + MsgToEventLog(M_ERR, L"%S: Failed to convert itf '%s' IID", __func__, itf_name); err = ERROR_OUTOFMEMORY; goto out; } @@ -1417,7 +1426,7 @@ { return FALSE; } - MsgToEventLog(M_ERR, L"%s: failed to get InitialSearchList (%lu)", + MsgToEventLog(M_ERR, L"%S: failed to get InitialSearchList (%lu)", __func__, err); } @@ -1439,7 +1448,7 @@ { if (!list || wcslen(list) == 0) { - MsgToEventLog(M_ERR, L"StoreInitialDnsSearchList: empty search list"); + MsgToEventLog(M_ERR, L"%S: empty search list", __func__); return FALSE; } @@ -1453,7 +1462,7 @@ LSTATUS err = RegSetValueExW(key, L"InitialSearchList", 0, REG_SZ, (PBYTE)list, size); if (err) { - MsgToEventLog(M_ERR, L"%s: failed to set InitialSearchList value (%lu)", + MsgToEventLog(M_ERR, L"%S: failed to set InitialSearchList value (%lu)", __func__, err); return FALSE; } @@ -1482,7 +1491,7 @@ err = RegGetValueW(key, NULL, L"SearchList", RRF_RT_REG_SZ, NULL, list, &size); if (err) { - MsgToEventLog(M_SYSERR, L"%s: could not get SearchList from registry (%lu)", + MsgToEventLog(M_SYSERR, L"%S: could not get SearchList from registry (%lu)", __func__, err); return FALSE; } @@ -1496,7 +1505,7 @@ size_t domlen = wcslen(domains); if (listlen + domlen + 2 > _countof(list)) { - MsgToEventLog(M_SYSERR, L"%s: not enough space in list for search domains (len=%lu)", + MsgToEventLog(M_SYSERR, L"%S: not enough space in list for search domains (len=%lu)", __func__, domlen); return FALSE; } @@ -1515,7 +1524,7 @@ err = RegSetValueExW(key, L"SearchList", 0, REG_SZ, (PBYTE)list, size); if (err) { - MsgToEventLog(M_SYSERR, L"%s: could not set SearchList to registry (%lu)", + MsgToEventLog(M_SYSERR, L"%S: could not set SearchList to registry (%lu)", __func__, err); return FALSE; } @@ -1547,7 +1556,7 @@ { if (err != ERROR_FILE_NOT_FOUND) { - MsgToEventLog(M_SYSERR, L"%s: could not get InitialSearchList from registry (%lu)", + MsgToEventLog(M_SYSERR, L"%S: could not get InitialSearchList from registry (%lu)", __func__, err); } goto out; @@ -1557,7 +1566,7 @@ err = RegSetValueExW(key, L"SearchList", 0, REG_SZ, (PBYTE)list, size); if (err) { - MsgToEventLog(M_SYSERR, L"%s: could not set SearchList in registry (%lu)", + MsgToEventLog(M_SYSERR, L"%S: could not set SearchList in registry (%lu)", __func__, err); goto out; } @@ -1585,7 +1594,7 @@ err = RegGetValueW(key, NULL, L"SearchList", RRF_RT_REG_SZ, NULL, list, &size); if (err) { - MsgToEventLog(M_SYSERR, L"%s: could not get SearchList from registry (%lu)", + MsgToEventLog(M_SYSERR, L"%S: could not get SearchList from registry (%lu)", __func__, err); return; } @@ -1593,7 +1602,7 @@ PWSTR dst = wcsstr(list, domains); if (!dst) { - MsgToEventLog(M_ERR, L"%s: could not find domains in search list", __func__); + MsgToEventLog(M_ERR, L"%S: could not find domains in search list", __func__); return; } @@ -1613,7 +1622,7 @@ err = RegGetValueW(key, NULL, L"InitialSearchList", RRF_RT_REG_SZ, NULL, initial, &size); if (err) { - MsgToEventLog(M_SYSERR, L"%s: could not get InitialSearchList from registry (%lu)", + MsgToEventLog(M_SYSERR, L"%S: could not get InitialSearchList from registry (%lu)", __func__, err); return; } @@ -1630,7 +1639,7 @@ err = RegSetValueExW(key, L"SearchList", 0, REG_SZ, (PBYTE)list, size); if (err) { - MsgToEventLog(M_SYSERR, L"%s: could not set SearchList in registry (%lu)", + MsgToEventLog(M_SYSERR, L"%S: could not set SearchList in registry (%lu)", __func__, err); } } @@ -1687,7 +1696,7 @@ BOOL have_list = GetDnsSearchListKey(itf_name, gpol, &list_key); if (list_key == INVALID_HANDLE_VALUE) { - MsgToEventLog(M_SYSERR, L"%s: could not get search list registry key", __func__); + MsgToEventLog(M_SYSERR, L"%S: could not get search list registry key", __func__); return ERROR_FILE_NOT_FOUND; } @@ -1756,7 +1765,7 @@ if (err) { *key = INVALID_HANDLE_VALUE; - MsgToEventLog(M_SYSERR, L"%s: could not open interfaces registry key for family %d (%lu)", + MsgToEventLog(M_SYSERR, L"%S: could not open interfaces registry key for family %d (%lu)", __func__, family, err); } @@ -1787,7 +1796,7 @@ err = RegOpenKeyExW(itfs, itf_id, 0, KEY_ALL_ACCESS, &itf); if (err) { - MsgToEventLog(M_SYSERR, L"%s: could not open interface key for %s family %d (%lu)", + MsgToEventLog(M_SYSERR, L"%S: could not open interface key for %s family %d (%lu)", __func__, itf_id, family, err); goto out; } @@ -1795,7 +1804,7 @@ err = RegSetValueExA(itf, "NameServer", 0, REG_SZ, (PBYTE)value, strlen(value) + 1); if (err) { - MsgToEventLog(M_SYSERR, L"%s: could not set name servers '%S' for %s family %d (%lu)", + MsgToEventLog(M_SYSERR, L"%S: could not set name servers '%S' for %s family %d (%lu)", __func__, value, itf_id, family, err); } @@ -1947,6 +1956,902 @@ return err; } +/** + * Checks if DHCP is enabled for an interface + * + * @param key HKEY of the interface to check for + * + * @return BOOL set to TRUE if DHCP is enabled, or FALSE if + * disabled or an error occurred + */ +static BOOL +IsDhcpEnabled(HKEY key) +{ + DWORD dhcp; + DWORD size = sizeof(dhcp); + LSTATUS err; + + err = RegGetValueA(key, NULL, "EnableDHCP", RRF_RT_REG_DWORD, NULL, (PBYTE)&dhcp, &size); + if (err != NO_ERROR) + { + MsgToEventLog(M_SYSERR, L"%S: Could not read DHCP status (%lu)", __func__, err); + return FALSE; + } + + return dhcp ? TRUE : FALSE; +} + +/** + * Set name servers from a NRPT address list + * + * @param itf_id the VPN interface ID to set the name servers for + * @param addresses the list of NRPT addresses + * + * @return LSTATUS NO_ERROR in case of success, a Windows error code otherwise + */ +static LSTATUS +SetNameServerAddresses(PWSTR itf_id, const nrpt_address_t *addresses) +{ + const short families[] = { AF_INET, AF_INET6 }; + for (int i = 0; i < _countof(families); i++) + { + short family = families[i]; + + /* Create a comma sparated list of addresses of this family */ + int offset = 0; + char addr_list[NRPT_ADDR_SIZE * NRPT_ADDR_NUM]; + for (int j = 0; j < NRPT_ADDR_NUM && addresses[j][0]; j++) + { + if ((family == AF_INET6 && strchr(addresses[j], ':') == NULL) + || (family == AF_INET && strchr(addresses[j], ':') != NULL)) + { + /* Address family doesn't match, skip this one */ + continue; + } + if (offset) + { + addr_list[offset++] = ','; + } + strcpy(addr_list + offset, addresses[j]); + offset += strlen(addresses[j]); + } + + if (offset == 0) + { + /* No address for this family to set */ + continue; + } + + /* Set name server addresses */ + LSTATUS err = SetNameServers(itf_id, family, addr_list); + if (err) + { + return err; + } + } + return NO_ERROR; +} + +/** + * Get DNS server IPv4 addresses of an interface + * + * @param itf_key registry key of the IPv4 interface data + * @param addrs pointer to the buffer addresses are returned in + * @param size pointer to the size of the buffer, contains the + * size of the addresses on return + * + * @return LSTATUS NO_ERROR on success, a Windows error code otherwise + */ +static LSTATUS +GetItfDnsServersV4(HKEY itf_key, PSTR addrs, PDWORD size) +{ + addrs[*size - 1] = '\0'; + + LSTATUS err; + DWORD s = *size; + err = RegGetValueA(itf_key, NULL, "NameServer", RRF_RT_REG_SZ, NULL, (PBYTE)addrs, &s); + if (err && err != ERROR_FILE_NOT_FOUND) + { + *size = 0; + return err; + } + + /* Try DHCP addresses if we don't have some already */ + if (!strchr(addrs, '.') && IsDhcpEnabled(itf_key)) + { + s = *size; + RegGetValueA(itf_key, NULL, "DhcpNameServer", RRF_RT_REG_SZ, NULL, (PBYTE)addrs, &s); + if (err) + { + *size = 0; + return err; + } + } + + if (strchr(addrs, '.')) + { + *size = s; + return NO_ERROR; + } + + *size = 0; + return ERROR_FILE_NOT_FOUND; +} + +/** + * Get DNS server IPv6 addresses of an interface + * + * @param itf_key registry key of the IPv6 interface data + * @param addrs pointer to the buffer addresses are returned in + * @param size pointer to the size of the buffer + * + * @return LSTATUS NO_ERROR on success, a Windows error code otherwise + */ +static LSTATUS +GetItfDnsServersV6(HKEY itf_key, PSTR addrs, PDWORD size) +{ + addrs[*size - 1] = '\0'; + + LSTATUS err; + DWORD s = *size; + err = RegGetValueA(itf_key, NULL, "NameServer", RRF_RT_REG_SZ, NULL, (PBYTE)addrs, &s); + if (err && err != ERROR_FILE_NOT_FOUND) + { + *size = 0; + return err; + } + + /* Try DHCP addresses if we don't have some already */ + if (!strchr(addrs, ':') && IsDhcpEnabled(itf_key)) + { + IN6_ADDR in_addrs[8]; + DWORD in_addrs_size = sizeof(in_addrs); + err = RegGetValueA(itf_key, NULL, "Dhcpv6DNSServers", RRF_RT_REG_BINARY, NULL, + (PBYTE)in_addrs, &in_addrs_size); + if (err) + { + *size = 0; + return err; + } + + s = *size; + PSTR pos = addrs; + size_t in_addrs_read = in_addrs_size / sizeof(IN6_ADDR); + for (size_t i = 0; i < in_addrs_read; ++i) + { + if (i != 0) + { + /* Add separator */ + *pos++ = ','; + s--; + } + + if (inet_ntop(AF_INET6, &in_addrs[i], + pos, s) != NULL) + { + *size = 0; + return ERROR_MORE_DATA; + } + + size_t addr_len = strlen(pos); + pos += addr_len; + s -= addr_len; + } + s = strlen(addrs) + 1; + } + + if (strchr(addrs, ':')) + { + *size = s; + return NO_ERROR; + } + + *size = 0; + return ERROR_FILE_NOT_FOUND; +} + +/** + * Return interface specific domain suffix(es) + * + * The \p domains paramter will be set to a MULTI_SZ domains string. + * In case of an error or if no domains are found for the interface + * \p size is set to 0 and the contents of \p domains are invalid. + * Note that the domains could have been set by DHCP or manually. + * + * @param itf HKEY of the interface to read from + * @param domains PWSTR buffer to return the domain(s) in + * @param size pointer to size of the domains buffer in bytes. Will be + * set to the size of the string returned, including + * the terminating zeros or 0. + * + * @return LSTATUS NO_ERROR if the domain suffix(es) were read successfully, + * ERROR_FILE_NOT_FOUND if no domain was found for the interface, + * ERROR_MORE_DATA if the list did not fit into the buffer, + * any other error indicates an error while reading from the registry. + */ +static LSTATUS +GetItfDnsDomains(HKEY itf, PWSTR domains, PDWORD size) +{ + if (domains == NULL || size == 0) + { + return ERROR_INVALID_PARAMETER; + } + + LSTATUS err = ERROR_FILE_NOT_FOUND; + const DWORD buf_size = *size; + const size_t one_glyph = sizeof(*domains); + PWSTR values[] = { L"SearchList", L"Domain", L"DhcpDomainSearchList", L"DhcpDomain", NULL}; + + for (int i = 0; values[i]; i++) + { + err = RegGetValueW(itf, NULL, values[i], RRF_RT_REG_SZ, NULL, (PBYTE)domains, size); + if (!err && *size > one_glyph && wcschr(domains, '.')) + { + /* + * Found domain(s), now convert them: + * - prefix each domain with a dot + * - convert comma separated list to MULTI_SZ + */ + PWCHAR pos = domains; + const DWORD buf_len = buf_size / one_glyph; + while (TRUE) + { + /* Terminate the domain at the next comma */ + PWCHAR comma = wcschr(pos, ','); + if (comma) + { + *comma = '\0'; + } + + /* Check for enough space to convert this domain */ + size_t converted_size = pos - domains; + size_t domain_len = wcslen(pos) + 1; + size_t domain_size = domain_len * one_glyph; + size_t extra_size = 2 * one_glyph; + if (converted_size + domain_size + extra_size > buf_size) + { + /* Domain doesn't fit, bad luck if it's the first one */ + *pos = '\0'; + *size = converted_size == 0 ? 0 : *size + 1; + return ERROR_MORE_DATA; + } + + /* Prefix domain at pos with the dot */ + memmove(pos + 1, pos, buf_size - converted_size - one_glyph); + domains[buf_len - 1] = '\0'; + *pos = '.'; + *size += 1; + + if (!comma) + { + /* Conversion is done */ + *(pos + domain_len) = '\0'; + *size += 1; + return NO_ERROR; + } + + pos = comma + 1; + } + } + } + + *size = 0; + return err; +} + +/** + * Check if an interface is connected and up + * + * @param iid_str the interface GUID as string + * + * @return TRUE if the interface is connected and up, FALSE otherwise or in + * case an error happened + */ +static BOOL +IsInterfaceConnected(PWSTR iid_str) +{ + GUID iid; + BOOL res = FALSE; + MIB_IF_ROW2 itf_row; + + /* Get GUID from string */ + if (IIDFromString(iid_str, &iid) != S_OK) + { + MsgToEventLog(M_SYSERR, L"%S: could not convert interface %s GUID string", __func__, iid_str); + goto out; + } + + /* Get LUID from GUID */ + if (ConvertInterfaceGuidToLuid(&iid, &itf_row.InterfaceLuid) != NO_ERROR) + { + goto out; + } + + /* Look up interface status */ + if (GetIfEntry2(&itf_row) != NO_ERROR) + { + MsgToEventLog(M_SYSERR, L"%S: could not get interface %s status", __func__, iid_str); + goto out; + } + + if (itf_row.MediaConnectState == MediaConnectStateConnected + && itf_row.OperStatus == IfOperStatusUp) + { + res = TRUE; + } + +out: + return res; +} + +/** + * Collect interface DNS settings to be used in excluding NRPT rules. This is + * needed so that local DNS keeps working even when a catch all NRPT rule is + * installed by a VPN connection. + * + * @param data pointer to the data structures the values are returned in + * @param data_size number of exclude data structures pointed to + */ +static void +GetNrptExcludeData(nrpt_exclude_data_t *data, size_t data_size) +{ + HKEY v4_itfs = INVALID_HANDLE_VALUE; + HKEY v6_itfs = INVALID_HANDLE_VALUE; + + if (!GetInterfacesKey(AF_INET, &v4_itfs) + || !GetInterfacesKey(AF_INET6, &v6_itfs)) + { + goto out; + } + + size_t i = 0; + DWORD enum_index = 0; + while (i < data_size) + { + WCHAR itf_guid[MAX_PATH]; + DWORD itf_guid_len = _countof(itf_guid); + LSTATUS err = RegEnumKeyExW(v4_itfs, enum_index++, itf_guid, &itf_guid_len, + NULL, NULL, NULL, NULL); + if (err) + { + if (err != ERROR_NO_MORE_ITEMS) + { + MsgToEventLog(M_SYSERR, L"%S: could not enumerate interfaces (%lu)", __func__, err); + } + goto out; + } + + /* Ignore interfaces that are not connected or disabled */ + if (!IsInterfaceConnected(itf_guid)) + { + continue; + } + + HKEY v4_itf; + if (RegOpenKeyExW(v4_itfs, itf_guid, 0, KEY_READ, &v4_itf) != NO_ERROR) + { + MsgToEventLog(M_SYSERR, L"%S: could not open interface %s v4 registry key", __func__, itf_guid); + goto out; + } + + /* Get the DNS domain(s) for exclude routing */ + data[i].domains_size = sizeof(data[0].domains); + memset(data[i].domains, 0, data[i].domains_size); + err = GetItfDnsDomains(v4_itf, data[i].domains, &data[i].domains_size); + if (err) + { + if (err != ERROR_FILE_NOT_FOUND) + { + MsgToEventLog(M_SYSERR, L"%S: could not read interface %s domain suffix", __func__, itf_guid); + } + goto next_itf; + } + + /* Get the IPv4 DNS servers */ + DWORD v4_addrs_size = sizeof(data[0].addresses); + err = GetItfDnsServersV4(v4_itf, data[i].addresses, &v4_addrs_size); + if (err && err != ERROR_FILE_NOT_FOUND) + { + MsgToEventLog(M_SYSERR, L"%S: could not read interface %s v4 name servers (%ld)", + __func__, itf_guid, err); + goto next_itf; + } + + /* Get the IPv6 DNS servers, if there's space left */ + PSTR v6_addrs = data[i].addresses + v4_addrs_size; + DWORD v6_addrs_size = sizeof(data[0].addresses) - v4_addrs_size; + if (v6_addrs_size > NRPT_ADDR_SIZE) + { + HKEY v6_itf; + if (RegOpenKeyExW(v6_itfs, itf_guid, 0, KEY_READ, &v6_itf) != NO_ERROR) + { + MsgToEventLog(M_SYSERR, L"%S: could not open interface %s v6 registry key", __func__, itf_guid); + goto next_itf; + } + err = GetItfDnsServersV6(v6_itf, v6_addrs, &v6_addrs_size); + RegCloseKey(v6_itf); + if (err && err != ERROR_FILE_NOT_FOUND) + { + MsgToEventLog(M_SYSERR, L"%S: could not read interface %s v6 name servers (%ld)", + __func__, itf_guid, err); + goto next_itf; + } + } + + if (v4_addrs_size || v6_addrs_size) + { + /* Replace comma-delimters with semicolons, as required by NRPT */ + for (int j = 0; j < sizeof(data[0].addresses) && data[i].addresses[j]; j++) + { + if (data[i].addresses[j] == ',') + { + data[i].addresses[j] = ';'; + } + } + ++i; + } + +next_itf: + RegCloseKey(v4_itf); + } + +out: + RegCloseKey(v6_itfs); + RegCloseKey(v4_itfs); +} + +/** + * Set a NRPT rule (subkey) and its values in the registry + * + * @param nrpt_key NRPT registry key handle + * @param subkey subkey string to create + * @param address name server address string + * @param domains domains to resolve by this server as MULTI_SZ + * @param dom_size size of domains in bytes including the terminators + * @param dnssec boolean to determine if DNSSEC is to be enabled + * + * @return NO_ERROR on success, or Windows error code + */ +static DWORD +SetNrptRule(HKEY nrpt_key, PCWSTR subkey, PCSTR address, + PCWSTR domains, DWORD dom_size, BOOL dnssec) +{ + /* Create rule subkey */ + DWORD err = NO_ERROR; + HKEY rule_key; + err = RegCreateKeyExW(nrpt_key, subkey, 0, NULL, 0, KEY_ALL_ACCESS, NULL, &rule_key, NULL); + if (err) + { + return err; + } + + /* Set name(s) for DNS routing */ + err = RegSetValueExW(rule_key, L"Name", 0, REG_MULTI_SZ, (PBYTE)domains, dom_size); + if (err) + { + goto out; + } + + /* Set DNS Server address */ + err = RegSetValueExA(rule_key, "GenericDNSServers", 0, REG_SZ, (PBYTE)address, strlen(address) + 1); + if (err) + { + goto out; + } + + DWORD reg_val; + /* Set DNSSEC if required */ + if (dnssec) + { + reg_val = 1; + err = RegSetValueExA(rule_key, "DNSSECValidationRequired", 0, REG_DWORD, (PBYTE)®_val, sizeof(reg_val)); + if (err) + { + goto out; + } + + reg_val = 0; + err = RegSetValueExA(rule_key, "DNSSECQueryIPSECRequired", 0, REG_DWORD, (PBYTE)®_val, sizeof(reg_val)); + if (err) + { + goto out; + } + + reg_val = 0; + err = RegSetValueExA(rule_key, "DNSSECQueryIPSECEncryption", 0, REG_DWORD, (PBYTE)®_val, sizeof(reg_val)); + if (err) + { + goto out; + } + } + + /* Set NRPT config options */ + reg_val = dnssec ? 0x0000000A : 0x00000008; + err = RegSetValueExA(rule_key, "ConfigOptions", 0, REG_DWORD, (const PBYTE)®_val, sizeof(reg_val)); + if (err) + { + goto out; + } + + /* Mandatory NRPT version */ + reg_val = 2; + err = RegSetValueExA(rule_key, "Version", 0, REG_DWORD, (const PBYTE)®_val, sizeof(reg_val)); + if (err) + { + goto out; + } + +out: + if (err) + { + RegDeleteKeyW(nrpt_key, subkey); + } + RegCloseKey(rule_key); + return err; +} + +/** + * Set NRPT exclude rules to accompany a catch all rule. This is done so that + * local resolution of names is not interfered with in case the VPN resolves + * all names. + * + * @param nrpt_key the registry key to set the rules under + * @param ovpn_pid the PID of the openvpn process + */ +static void +SetNrptExcludeRules(HKEY nrpt_key, DWORD ovpn_pid) +{ + nrpt_exclude_data_t data[8]; /* data from up to 8 interfaces */ + memset(data, 0, sizeof(data)); + GetNrptExcludeData(data, _countof(data)); + + unsigned n = 0; + for (int i = 0; i < _countof(data); ++i) + { + nrpt_exclude_data_t *d = &data[i]; + if (d->domains_size == 0) + { + break; + } + + DWORD err; + WCHAR subkey[48]; + swprintf(subkey, _countof(subkey), L"OpenVPNDNSRoutingX-%02x-%lu", ++n, ovpn_pid); + err = SetNrptRule(nrpt_key, subkey, d->addresses, d->domains, d->domains_size, FALSE); + if (err) + { + MsgToEventLog(M_ERR, L"%S: failed to set rule %s (%lu)", __func__, subkey, err); + } + } +} + +/** + * Set NRPT rules for a openvpn process + * + * @param nrpt_key the registry key to set the rules under + * @param addresses name server addresses + * @param domains optional list of split routing domains + * @param dnssec boolean whether DNSSEC is to be used + * @param ovpn_pid the PID of the openvpn process + * + * @return NO_ERROR on success, or a Windows error code + */ +static DWORD +SetNrptRules(HKEY nrpt_key, const nrpt_address_t *addresses, + const char *domains, BOOL dnssec, DWORD ovpn_pid) +{ + DWORD err = NO_ERROR; + PWSTR wide_domains = L".\0"; /* DNS route everything by default */ + DWORD dom_size = 6; + + /* Prepare DNS routing domains / split DNS */ + if (domains[0]) + { + size_t domains_len = strlen(domains); + dom_size = domains_len + 2; /* len + the trailing NULs */ + + wide_domains = utf8to16_size(domains, dom_size); + dom_size *= sizeof(*wide_domains); + if (!wide_domains) + { + return ERROR_OUTOFMEMORY; + } + /* Make a MULTI_SZ from a comma separated list */ + for (size_t i = 0; i < domains_len; ++i) + { + if (wide_domains[i] == ',') + { + wide_domains[i] = 0; + } + } + } + else + { + SetNrptExcludeRules(nrpt_key, ovpn_pid); + } + + /* Create address string list */ + CHAR addr_list[NRPT_ADDR_NUM * NRPT_ADDR_SIZE]; + PSTR pos = addr_list; + for (int i = 0; i < NRPT_ADDR_NUM && addresses[i][0]; ++i) + { + if (i != 0) + { + *pos++ = ';'; + } + strcpy(pos, addresses[i]); + pos += strlen(pos); + } + + WCHAR subkey[MAX_PATH]; + swprintf(subkey, _countof(subkey), L"OpenVPNDNSRouting-%lu", ovpn_pid); + err = SetNrptRule(nrpt_key, subkey, addr_list, wide_domains, dom_size, dnssec); + if (err) + { + MsgToEventLog(M_ERR, L"%S: failed to set rule %s (%lu)", __func__, subkey, err); + } + + if (domains[0]) + { + free(wide_domains); + } + return err; +} + +/** + * Return the registry key where NRPT rules are stored + * + * @param key pointer to the HKEY it is returned in + * @param gpol pointer to BOOL the use of GPOL hive is returned in + * + * @return NO_ERROR on success, or a Windows error code + */ +static LSTATUS +OpenNrptBaseKey(PHKEY key, PBOOL gpol) +{ + /* + * Registry keys Name Service Policy Table (NRPT) rules can be stored at. + * When the group policy key exists, NRPT rules must be placed there. + * It is created when NRPT rules are pushed via group policy and it + * remains in the registry even if the last GP-NRPT rule is deleted. + */ + static PCSTR gpol_key = "SOFTWARE\\Policies\\Microsoft\\Windows NT\\DNSClient\\DnsPolicyConfig"; + static PCSTR sys_key = "SYSTEM\\CurrentControlSet\\Services\\Dnscache\\Parameters\\DnsPolicyConfig"; + + HKEY nrpt; + *gpol = TRUE; + LSTATUS err = RegOpenKeyExA(HKEY_LOCAL_MACHINE, gpol_key, 0, KEY_ALL_ACCESS, &nrpt); + if (err == ERROR_FILE_NOT_FOUND) + { + *gpol = FALSE; + err = RegOpenKeyExA(HKEY_LOCAL_MACHINE, sys_key, 0, KEY_ALL_ACCESS, &nrpt); + if (err) + { + nrpt = INVALID_HANDLE_VALUE; + } + } + *key = nrpt; + return err; +} + +/** + * Delete OpenVPN NRPT rules from the registry + * + * If the pid parameter is 0 all NRPT rules added by OpenVPN are deleted. + * In all other cases only rules matching the pid are deleted. + * + * @param pid PID of the process to delete the rules for or 0 + * @param gpol + * + * @return BOOL to indicate if rules were deleted + */ +static BOOL +DeleteNrptRules(DWORD pid, PBOOL gpol) +{ + HKEY key; + LSTATUS err = OpenNrptBaseKey(&key, gpol); + if (err) + { + MsgToEventLog(M_SYSERR, L"%S: could not open NRPT base key (%lu)", __func__, err); + return FALSE; + } + + /* PID suffix string to compare against later */ + WCHAR pid_str[16]; + size_t pidlen = 0; + if (pid) + { + swprintf(pid_str, _countof(pid_str), L"-%lu", pid); + pidlen = wcslen(pid_str); + } + + int deleted = 0; + DWORD enum_index = 0; + while (TRUE) + { + WCHAR name[MAX_PATH]; + DWORD namelen = _countof(name); + err = RegEnumKeyExW(key, enum_index++, name, &namelen, NULL, NULL, NULL, NULL); + if (err) + { + if (err != ERROR_NO_MORE_ITEMS) + { + MsgToEventLog(M_SYSERR, L"%S: could not enumerate NRPT rules (%lu)", __func__, err); + } + break; + } + + /* Keep rule if name doesn't match */ + if (wcsncmp(name, L"OpenVPNDNSRouting", 17) != 0 + || (pid && wcsncmp(name + namelen - pidlen, pid_str, pidlen) != 0)) + { + continue; + } + + if (RegDeleteKeyW(key, name) == NO_ERROR) + { + enum_index--; + deleted++; + } + } + + RegCloseKey(key); + return deleted ? TRUE : FALSE; +} + +/** + * Delete a process' NRPT rules and apply the reduced set of rules + * + * @param ovpn_pid OpenVPN process id to delete rules for + */ +static void +UndoNrptRules(DWORD ovpn_pid) +{ + BOOL gpol; + if (DeleteNrptRules(ovpn_pid, &gpol)) + { + ApplyDnsSettings(gpol); + } +} + +/** + * Add Name Resolution Policy Table (NRPT) rules as documented in + * https://msdn.microsoft.com/en-us/library/ff957356.aspx for DNS name + * resolution, as well as DNS search domain(s), if given. + * + * @param msg config messages sent by the openvpn process + * @param ovpn_pid process id of the sending openvpn process + * @param lists undo lists for this process + * + * @return NO_ERROR on success, or a Windows error code + */ +static DWORD +HandleDNSConfigNrptMessage(const nrpt_dns_cfg_message_t *msg, + DWORD ovpn_pid, undo_lists_t *lists) +{ + /* + * Use a non-const reference with limited scope to + * enforce null-termination of strings from client + */ + { + nrpt_dns_cfg_message_t *msgptr = (nrpt_dns_cfg_message_t *) msg; + msgptr->iface.name[_countof(msg->iface.name) - 1] = '\0'; + msgptr->search_domains[_countof(msg->search_domains) - 1] = '\0'; + msgptr->resolve_domains[_countof(msg->resolve_domains) - 1] = '\0'; + for (size_t i = 0; i < NRPT_ADDR_NUM; ++i) + { + msgptr->addresses[i][_countof(msg->addresses[0]) - 1] = '\0'; + } + } + + /* Make sure we have the VPN interface name */ + if (msg->iface.name[0] == 0) + { + return ERROR_MESSAGE_DATA; + } + + /* Some sanity checks on the add message data */ + if (msg->header.type == msg_add_nrpt_cfg) + { + /* At least one name server address is set */ + if (msg->addresses[0][0] == 0) + { + return ERROR_MESSAGE_DATA; + } + /* Resolve domains are double zero terminated (MULTI_SZ) */ + const char *rdom = msg->resolve_domains; + size_t rdom_size = sizeof(msg->resolve_domains); + size_t rdom_len = strlen(rdom); + if (rdom_len && (rdom_len + 1 >= rdom_size || rdom[rdom_len + 2] != 0)) + { + return ERROR_MESSAGE_DATA; + } + } + + BOOL gpol_nrpt = FALSE; + BOOL gpol_list = FALSE; + + WCHAR iid[64]; + DWORD iid_err = InterfaceIdString(msg->iface.name, iid, _countof(iid)); + if (iid_err) + { + return iid_err; + } + + /* Delete previously set values for this instance first, if any */ + PDWORD undo_pid = RemoveListItem(&(*lists)[undo_nrpt], CmpAny, NULL); + if (undo_pid) + { + if (*undo_pid != ovpn_pid) + { + MsgToEventLog(M_INFO, + L"%S: PID stored for undo doesn't match: %lu vs %lu. " + "This is likely an error. Cleaning up anyway.", + __func__, *undo_pid, ovpn_pid); + } + DeleteNrptRules(*undo_pid, &gpol_nrpt); + free(undo_pid); + + ResetNameServers(iid, AF_INET); + ResetNameServers(iid, AF_INET6); + } + SetDnsSearchDomains(msg->iface.name, NULL, &gpol_list, lists); + + if (msg->header.type == msg_del_nrpt_cfg) + { + ApplyDnsSettings(gpol_nrpt || gpol_list); + return NO_ERROR; /* Done dealing with del message */ + } + + HKEY key; + LSTATUS err = OpenNrptBaseKey(&key, &gpol_nrpt); + if (err) + { + goto out; + } + + /* Add undo information first in case there's no heap left */ + PDWORD pid = malloc(sizeof(ovpn_pid)); + if (!pid) + { + err = ERROR_OUTOFMEMORY; + goto out; + } + *pid = ovpn_pid; + if (AddListItem(&(*lists)[undo_nrpt], pid)) + { + err = ERROR_OUTOFMEMORY; + free(pid); + goto out; + } + + /* Set NRPT rules */ + BOOL dnssec = (msg->flags & nrpt_dnssec) != 0; + err = SetNrptRules(key, msg->addresses, msg->resolve_domains, dnssec, ovpn_pid); + if (err) + { + goto out; + } + + /* Set name servers */ + err = SetNameServerAddresses(iid, msg->addresses); + if (err) + { + goto out; + } + + /* Set search domains, if any */ + if (msg->search_domains[0]) + { + err = SetDnsSearchDomains(msg->iface.name, msg->search_domains, &gpol_list, lists); + } + + ApplyDnsSettings(gpol_nrpt || gpol_list); + +out: + return err; +} + static DWORD HandleWINSConfigMessage(const wins_cfg_message_t *msg, undo_lists_t *lists) { @@ -2202,7 +3107,7 @@ } static VOID -HandleMessage(HANDLE pipe, HANDLE ovpn_proc, +HandleMessage(HANDLE pipe, PPROCESS_INFORMATION proc_info, DWORD bytes, DWORD count, LPHANDLE events, undo_lists_t *lists) { pipe_message_t msg; @@ -2265,6 +3170,14 @@ ack.error_number = HandleDNSConfigMessage(&msg.dns, lists); break; + case msg_add_nrpt_cfg: + case msg_del_nrpt_cfg: + { + DWORD ovpn_pid = proc_info->dwProcessId; + ack.error_number = HandleDNSConfigNrptMessage(&msg.nrpt_dns, ovpn_pid, lists); + } + break; + case msg_add_wins_cfg: case msg_del_wins_cfg: ack.error_number = HandleWINSConfigMessage(&msg.wins, lists); @@ -2280,7 +3193,8 @@ case msg_register_ring_buffers: if (msg.header.size == sizeof(msg.rrb)) { - ack.error_number = HandleRegisterRingBuffers(&msg.rrb, ovpn_proc, lists); + HANDLE ovpn_hnd = proc_info->hProcess; + ack.error_number = HandleRegisterRingBuffers(&msg.rrb, ovpn_hnd, lists); } break; @@ -2331,6 +3245,10 @@ ResetNameServers(item->data, AF_INET6); break; + case undo_nrpt: + UndoNrptRules(*(PDWORD)item->data); + break; + case undo_domains: UndoDnsSearchDomains(item->data); break; @@ -2652,7 +3570,7 @@ break; } - HandleMessage(ovpn_pipe, proc_info.hProcess, bytes, 1, &exit_event, &undo_lists); + HandleMessage(ovpn_pipe, &proc_info, bytes, 1, &exit_event, &undo_lists); } WaitForSingleObject(proc_info.hProcess, IO_TIMEOUT); @@ -2848,24 +3766,28 @@ static void CleanupRegistry(void) { - HKEY key; - DWORD changed = 0; + BOOL changed = FALSE; + + /* Clean up leftover NRPT rules */ + BOOL gpol_nrpt; + changed = DeleteNrptRules(0, &gpol_nrpt); /* Clean up leftover DNS search list fragments */ + HKEY key; BOOL gpol_list; GetDnsSearchListKey(NULL, &gpol_list, &key); if (key != INVALID_HANDLE_VALUE) { if (ResetDnsSearchDomains(key)) { - changed++; + changed = TRUE; } RegCloseKey(key); } if (changed) { - ApplyDnsSettings(gpol_list); + ApplyDnsSettings(gpol_nrpt || gpol_list); } } -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/837?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I576e74f3276362606e9cbd50bb5adbebaaf209cc Gerrit-Change-Number: 837 Gerrit-PatchSet: 16 Gerrit-Owner: d12fk <he...@op...> Gerrit-Reviewer: flichtenheld <fr...@li...> Gerrit-Reviewer: plaisthos <arn...@rf...> Gerrit-Reviewer: stipa <lst...@gm...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-Attention: plaisthos <arn...@rf...> Gerrit-Attention: d12fk <he...@op...> Gerrit-MessageType: newpatchset |
| From: cron2 (C. Review) <ge...@op...> - 2025-03-28 21:34:47 |
Attention is currently required from: flichtenheld, its_Giaan, plaisthos. cron2 has posted comments on this change. ( http://gerrit.openvpn.net/c/openvpn/+/925?usp=email ) Change subject: Fix FreeBSD-DCO and Multisocket interaction ...................................................................... Patch Set 1: (3 comments) Patchset: PS1: questions... File src/openvpn/dco.c: http://gerrit.openvpn.net/c/openvpn/+/925/comment/9d655d2e_4fc29dc7 : PS1, Line 263: if (ce->local_list) will this also catch clients that have no `--local` at all, just `--remote ... tcp`? FreeBSD DCO also needs to be disabled for TCP clients. http://gerrit.openvpn.net/c/openvpn/+/925/comment/95331584_9525203f : PS1, Line 277: if (!proto_is_udp(ce->proto) && mode == MODE_SERVER) this looks as if we need the fix for windows too... maybe keep & use the has_tcp_in_local_list() for this? -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/925?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I9b6359076a61ae2bbb8e5cea00e33969cb5f92cf Gerrit-Change-Number: 925 Gerrit-PatchSet: 1 Gerrit-Owner: its_Giaan <gia...@ma...> Gerrit-Reviewer: flichtenheld <fr...@li...> Gerrit-Reviewer: plaisthos <arn...@rf...> Gerrit-CC: cron2 <ge...@gr...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-Attention: plaisthos <arn...@rf...> Gerrit-Attention: its_Giaan <gia...@ma...> Gerrit-Attention: flichtenheld <fr...@li...> Gerrit-Comment-Date: Fri, 28 Mar 2025 21:34:30 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Gerrit-MessageType: comment |
| From: its_Giaan (C. Review) <ge...@op...> - 2025-03-28 15:26:57 |
Attention is currently required from: flichtenheld, plaisthos. Hello plaisthos, flichtenheld, I'd like you to do a code review. Please visit http://gerrit.openvpn.net/c/openvpn/+/925?usp=email to review the following change. Change subject: Fix FreeBSD-DCO and Multisocket interaction ...................................................................... Fix FreeBSD-DCO and Multisocket interaction FreeBSD-DCO does not support TCP as transport protocol so in order to be able to use DCO in a multi-socket environment we need to check the local_list entries and disable DCO if any of the listening socket is TCP. While at it, removed some dead code left from Multisocket polishing. Github: #710 Change-Id: I9b6359076a61ae2bbb8e5cea00e33969cb5f92cf Signed-off-by: Gianmarco De Gregori <gia...@ma...> --- M src/openvpn/dco.c M src/openvpn/options.c M src/openvpn/options.h 3 files changed, 9 insertions(+), 22 deletions(-) git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/25/925/1 diff --git a/src/openvpn/dco.c b/src/openvpn/dco.c index d00958d..7ad9cb3 100644 --- a/src/openvpn/dco.c +++ b/src/openvpn/dco.c @@ -260,10 +260,16 @@ } #if defined(TARGET_FREEBSD) - if (!proto_is_udp(ce->proto)) + if (ce->local_list) { - msg(msglevel, "NOTE: TCP transport disables data channel offload on FreeBSD."); - return false; + for (int i = 0; i < ce->local_list->len; i++) + { + if (!proto_is_dgram(ce->local_list->array[i]->proto)) + { + msg(msglevel, "NOTE: TCP transport disables data channel offload on FreeBSD."); + return false; + } + } } #endif diff --git a/src/openvpn/options.c b/src/openvpn/options.c index 99dd60a..6605a42 100644 --- a/src/openvpn/options.c +++ b/src/openvpn/options.c @@ -9577,20 +9577,3 @@ return false; } - -bool -has_tcp_in_local_list(const struct options *options) -{ - if (options->ce.local_list) - { - for (int i = 0; i < options->ce.local_list->len; i++) - { - if (!proto_is_dgram(options->ce.local_list->array[i]->proto)) - { - return true; - } - } - } - - return false; -} diff --git a/src/openvpn/options.h b/src/openvpn/options.h index fa617c8..8d1ef6c 100644 --- a/src/openvpn/options.h +++ b/src/openvpn/options.h @@ -921,8 +921,6 @@ bool has_udp_in_local_list(const struct options *options); -bool has_tcp_in_local_list(const struct options *options); - /** * Returns whether the current configuration has dco enabled. */ -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/925?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I9b6359076a61ae2bbb8e5cea00e33969cb5f92cf Gerrit-Change-Number: 925 Gerrit-PatchSet: 1 Gerrit-Owner: its_Giaan <gia...@ma...> Gerrit-Reviewer: flichtenheld <fr...@li...> Gerrit-Reviewer: plaisthos <arn...@rf...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-Attention: plaisthos <arn...@rf...> Gerrit-Attention: flichtenheld <fr...@li...> Gerrit-MessageType: newchange |
| From: flichtenheld (C. Review) <ge...@op...> - 2025-03-28 14:18:26 |
Attention is currently required from: plaisthos. Hello plaisthos, I'd like you to do a code review. Please visit http://gerrit.openvpn.net/c/openvpn/+/923?usp=email to review the following change. Change subject: CMake: Sync list of compiler flags with configure.ac ...................................................................... CMake: Sync list of compiler flags with configure.ac Also fix one issue reported by the build. Change-Id: I28af9eac2e9fb615903a82c8f4087602b72c134d Signed-off-by: Frank Lichtenheld <fr...@li...> --- M CMakeLists.txt M tests/unit_tests/openvpn/test_cryptoapi.c 2 files changed, 11 insertions(+), 6 deletions(-) git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/23/923/1 diff --git a/CMakeLists.txt b/CMakeLists.txt index b04adce..ba11056 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -66,6 +66,13 @@ CACHE STRING "Flags used by the C++ compiler during AddressSanitizer builds." FORCE) +function(check_and_add_compiler_flag flag variable) + check_c_compiler_flag(${flag} ${variable}) + if (${variable}) + add_compile_options(${flag}) + endif() +endfunction() + if (MSVC) add_definitions(-D_CRT_SECURE_NO_WARNINGS -D_CRT_NONSTDC_NO_DEPRECATE -D_WINSOCK_DEPRECATED_NO_WARNINGS) if (USE_WERROR) @@ -96,11 +103,9 @@ endif() else () add_compile_options(-Wall -Wuninitialized) - check_c_compiler_flag(-Wno-stringop-truncation NoStringOpTruncation) - - if (${NoStringOpTruncation}) - add_compile_options(-Wno-stringop-truncation) - endif() + check_and_add_compiler_flag(-Wno-stringop-truncation NoStringOpTruncation) + check_and_add_compiler_flag(-Wstrict-prototypes StrictPrototypes) + check_and_add_compiler_flag(-Wold-style-definition OldStyleDefinition) # We are not ready for this #add_compile_options(-Wconversion -Wno-sign-conversion -Wsign-compare) if (USE_WERROR) diff --git a/tests/unit_tests/openvpn/test_cryptoapi.c b/tests/unit_tests/openvpn/test_cryptoapi.c index 98102ef..478995f 100644 --- a/tests/unit_tests/openvpn/test_cryptoapi.c +++ b/tests/unit_tests/openvpn/test_cryptoapi.c @@ -116,7 +116,7 @@ /* Fill-in certs[] array */ void -init_cert_data() +init_cert_data(void) { struct test_cert certs_local[] = { {cert1, key1, cname1, "OVPN TEST CA1", "OVPN Test Cert 1", hash1, 1}, -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/923?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I28af9eac2e9fb615903a82c8f4087602b72c134d Gerrit-Change-Number: 923 Gerrit-PatchSet: 1 Gerrit-Owner: flichtenheld <fr...@li...> Gerrit-Reviewer: plaisthos <arn...@rf...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-Attention: plaisthos <arn...@rf...> Gerrit-MessageType: newchange |
| From: flichtenheld (C. Review) <ge...@op...> - 2025-03-28 14:18:21 |
Attention is currently required from: plaisthos. Hello plaisthos, I'd like you to do a code review. Please visit http://gerrit.openvpn.net/c/openvpn/+/924?usp=email to review the following change. Change subject: CMake: Reorganize header and symbol tests ...................................................................... CMake: Reorganize header and symbol tests When we check for the header and then symbols in that header combine this so that the relationship between the tests is clear and that we do not do tests we know will fail. Change-Id: I0c4fce76c81c5297ff5469d787114f1279bf35e5 Signed-off-by: Frank Lichtenheld <fr...@li...> --- M CMakeLists.txt 1 file changed, 83 insertions(+), 65 deletions(-) git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/24/924/1 diff --git a/CMakeLists.txt b/CMakeLists.txt index ba11056..2169e69 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -74,7 +74,11 @@ endfunction() if (MSVC) - add_definitions(-D_CRT_SECURE_NO_WARNINGS -D_CRT_NONSTDC_NO_DEPRECATE -D_WINSOCK_DEPRECATED_NO_WARNINGS) + add_compile_definitions( + _CRT_SECURE_NO_WARNINGS + _CRT_NONSTDC_NO_DEPRECATE + _WINSOCK_DEPRECATED_NO_WARNINGS + ) if (USE_WERROR) add_compile_options(/WX) endif () @@ -171,88 +175,102 @@ set(TARGET_WIN32 YES) endif () -check_symbol_exists(chroot unistd.h HAVE_CHROOT) -check_symbol_exists(chdir unistd.h HAVE_CHDIR) -check_symbol_exists(dup unistd.h HAVE_DUP) -check_symbol_exists(dup2 unistd.h HAVE_DUP2) -check_symbol_exists(fork unistd.h HAVE_FORK) -check_symbol_exists(execve unistd.h HAVE_EXECVE) -check_symbol_exists(ftruncate unistd.h HAVE_FTRUNCATE) -check_symbol_exists(nice unistd.h HAVE_NICE) -check_symbol_exists(setgid unistd.h HAVE_SETGID) -check_symbol_exists(setuid unistd.h HAVE_SETUID) -check_symbol_exists(setsid unistd.h HAVE_SETSID) -check_symbol_exists(getpeereid "unistd.h;sys/socket.h" HAVE_GETPEEREID) +check_include_files(unistd.h HAVE_UNISTD_H) +if (HAVE_UNISTD_H) + check_symbol_exists(chroot unistd.h HAVE_CHROOT) + check_symbol_exists(chdir unistd.h HAVE_CHDIR) + check_symbol_exists(dup unistd.h HAVE_DUP) + check_symbol_exists(dup2 unistd.h HAVE_DUP2) + check_symbol_exists(fork unistd.h HAVE_FORK) + check_symbol_exists(execve unistd.h HAVE_EXECVE) + check_symbol_exists(ftruncate unistd.h HAVE_FTRUNCATE) + check_symbol_exists(nice unistd.h HAVE_NICE) + check_symbol_exists(setgid unistd.h HAVE_SETGID) + check_symbol_exists(setuid unistd.h HAVE_SETUID) + check_symbol_exists(setsid unistd.h HAVE_SETSID) + check_symbol_exists(daemon "unistd.h;stdlib.h" HAVE_DAEMON) + check_symbol_exists(getpeereid "unistd.h;sys/socket.h" HAVE_GETPEEREID) +endif() -check_symbol_exists(epoll_create sys/epoll.h HAVE_EPOLL_CREATE) +check_include_files(grp.h HAVE_GRP_H) +if (HAVE_GRP_H) + check_symbol_exists(getgrnam grp.h HAVE_GETGRNAM) +endif() +check_include_files(libgen.h HAVE_LIBGEN_H) +if (HAVE_LIBGEN_H) + check_symbol_exists(basename libgen.h HAVE_BASENAME) + check_symbol_exists(dirname libgen.h HAVE_DIRNAME) +endif() +check_include_files(pwd.h HAVE_PWD_H) +if (HAVE_PWD_H) + check_symbol_exists(getpwnam pwd.h HAVE_GETPWNAM) +endif() +check_include_files(sys/epoll.h HAVE_SYS_EPOLL_H) +if (HAVE_SYS_EPOLL_H) + check_symbol_exists(epoll_create sys/epoll.h HAVE_EPOLL_CREATE) +endif() +check_include_files(syslog.h HAVE_SYSLOG_H) +if (HAVE_SYSLOG_H) + check_symbol_exists(openlog syslog.h HAVE_OPENLOG) + check_symbol_exists(syslog syslog.h HAVE_SYSLOG) +endif() +check_include_files(sys/mman.h HAVE_SYS_MMAN_H) +if (HAVE_SYS_MMAN_H) + check_symbol_exists(mlockall sys/mman.h HAVE_MLOCKALL) +endif() +check_include_files(sys/socket.h HAVE_SYS_SOCKET_H) +if (HAVE_SYS_SOCKET_H) + check_symbol_exists(sendmsg sys/socket.h HAVE_SENDMSG) + check_symbol_exists(recvmsg sys/socket.h HAVE_RECVMSG) + check_symbol_exists(getsockname sys/socket.h HAVE_GETSOCKNAME) + # Checking for existence of structs with check_symbol_exists does not work, + # so we use check_struct_hash_member with a member instead + check_struct_has_member("struct cmsghdr" cmsg_len sys/socket.h HAVE_CMSGHDR) +endif() +check_include_files(sys/time.h HAVE_SYS_TIME_H) +if (HAVE_SYS_TIME_H) + check_symbol_exists(gettimeofday sys/time.h HAVE_GETTIMEOFDAY) + check_symbol_exists(getrlimit "sys/time.h;sys/resource.h" HAVE_GETRLIMIT) +endif() -check_symbol_exists(gettimeofday sys/time.h HAVE_GETTIMEOFDAY) -check_symbol_exists(basename libgen.h HAVE_BASENAME) check_symbol_exists(chsize io.h HAVE_CHSIZE) -check_symbol_exists(daemon "unistd.h;stdlib.h" HAVE_DAEMON) -check_symbol_exists(dirname libgen.h HAVE_DIRNAME) check_symbol_exists(getrlimit sys/resource.h HAVE_GETRLIMIT) -check_symbol_exists(mlockall sys/mman.h HAVE_MLOCKALL) - -check_symbol_exists(sendmsg sys/socket.h HAVE_SENDMSG) -check_symbol_exists(recvmsg sys/socket.h HAVE_RECVMSG) -check_symbol_exists(openlog syslog.h HAVE_OPENLOG) -check_symbol_exists(syslog syslog.h HAVE_SYSLOG) -check_symbol_exists(getgrnam grp.h HAVE_GETGRNAM) -check_symbol_exists(getpwnam pwd.h HAVE_GETPWNAM) -check_symbol_exists(getsockname sys/socket.h HAVE_GETSOCKNAME) -check_symbol_exists(getrlimit "sys/time.h;sys/resource.h" HAVE_GETRLIMIT) - -# Checking for existence of structs with check_symbol_exists does not work, -# so we use check_struct_hash_member with a member instead -check_struct_has_member("struct cmsghdr" cmsg_len sys/socket.h HAVE_CMSGHDR) - # Some OS (e.g. FreeBSD) need some basic headers to allow # including network headers set(NETEXTRA sys/types.h) check_include_files("${NETEXTRA};netinet/in.h" HAVE_NETINET_IN_H) - if (HAVE_NETINET_IN_H) list(APPEND NETEXTRA netinet/in.h) endif () -check_include_files("${NETEXTRA};netinet/in6.h" HAVE_NETINET_IN_H) +check_include_files(arpa/inet.h HAVE_ARPA_INET_H) +check_include_files(dlfcn.h HAVE_DLFCN_H) +check_include_files(dmalloc.h HAVE_DMALLOC_H) +check_include_files(fcntl.h HAVE_FCNTL_H) +check_include_files(err.h HAVE_ERR_H) check_include_files(linux/if_tun.h HAVE_LINUX_IF_TUN_H) check_include_files(linux/sockios.h HAVE_LINUX_SOCKIOS_H) -check_include_files(dlfcn.h HAVE_DLFCN_H) -check_include_files(fcntl.h HAVE_FCNTL_H) -check_include_files(dmalloc.h HAVE_DMALLOC_H) -check_include_files(err.h HAVE_ERR_H) -check_include_files(sys/epoll.h HAVE_SYS_EPOLL_H) -check_include_files(poll.h HAVE_POLL_H) -check_include_files(sys/socket.h HAVE_SYS_SOCKET_H) -check_include_files(sys/time.h HAVE_SYS_TIME_H) check_include_files(netdb.h HAVE_NETDB_H) -check_include_files(unistd.h HAVE_UNISTD_H) -check_include_files(sys/un.h HAVE_SYS_UN_H) -check_include_files(libgen.h HAVE_LIBGEN_H) +check_include_files("${NETEXTRA};netinet/in6.h" HAVE_NETINET_IN_H) check_include_files(net/if.h HAVE_NET_IF_H) -check_include_files("${NETEXTRA};netinet/ip.h" HAVE_NETINET_IP_H) -check_include_files(arpa/inet.h HAVE_ARPA_INET_H) +check_include_files("${NETEXTRA};net/if_tun.h" HAVE_NET_IF_TUN_H) +check_include_files(poll.h HAVE_POLL_H) +check_include_files("${NETEXTRA};resolv.h" HAVE_RESOLV_H) check_include_files(sys/ioctl.h HAVE_SYS_IOCTL_H) check_include_files(sys/inotify.h HAVE_SYS_INOTIFY_H) check_include_files("${NETEXTRA};sys/uio.h" HAVE_SYS_UIO_H) -check_include_files(syslog.h HAVE_SYSLOG_H) +check_include_files(sys/un.h HAVE_SYS_UN_H) check_include_files(sys/wait.h HAVE_SYS_WAIT_H) -check_include_files(grp.h HAVE_GRP_H) -check_include_files(pwd.h HAVE_PWD_H) -check_include_files(sys/mman.h HAVE_SYS_MMAN_H) - -check_include_files("${NETEXTRA};resolv.h" HAVE_RESOLV_H) -check_include_files("${NETEXTRA};net/if_tun.h" HAVE_NET_IF_TUN_H) - -set(CMAKE_EXTRA_INCLUDE_FILES netinet/ip.h) -check_type_size("struct in_pktinfo" IN_PKTINFO) -check_struct_has_member("struct in_pktinfo" ipi_spec_dst netinet/ip.h HAVE_IPI_SPEC_DST) -check_type_size("struct msghdr" MSGHDR) -set(CMAKE_EXTRA_INCLUDE_FILES) +check_include_files("${NETEXTRA};netinet/ip.h" HAVE_NETINET_IP_H) +if (HAVE_NETINET_IP_H) + set(CMAKE_EXTRA_INCLUDE_FILES netinet/ip.h) + check_type_size("struct in_pktinfo" IN_PKTINFO) + check_struct_has_member("struct in_pktinfo" ipi_spec_dst netinet/ip.h HAVE_IPI_SPEC_DST) + check_type_size("struct msghdr" MSGHDR) + set(CMAKE_EXTRA_INCLUDE_FILES) +endif() find_program(IFCONFIG_PATH ifconfig) find_program(IPROUTE_PATH ip) @@ -316,8 +334,8 @@ if (MINGW) target_compile_definitions(${target} PRIVATE - -DWIN32_LEAN_AND_MEAN - -DNTDDI_VERSION=NTDDI_VISTA -D_WIN32_WINNT=_WIN32_WINNT_VISTA + WIN32_LEAN_AND_MEAN + NTDDI_VERSION=NTDDI_VISTA _WIN32_WINNT=_WIN32_WINNT_VISTA ) endif() @@ -359,7 +377,7 @@ configure_file(config.h.cmake.in config.h) configure_file(include/openvpn-plugin.h.in openvpn-plugin.h) # TODO we should remove the need for this, and always include config.h -add_definitions(-DHAVE_CONFIG_H) +add_compile_definitions(HAVE_CONFIG_H) include_directories(${CMAKE_CURRENT_BINARY_DIR}) @@ -707,7 +725,7 @@ # for compat with IDEs like Clion that ignore the tests properties # for the environment variable srcdir when running tests as fallback - target_compile_definitions(${test_name} PRIVATE "-DUNIT_TEST_SOURCEDIR=\"${CMAKE_SOURCE_DIR}/tests/unit_tests/openvpn\"") + target_compile_definitions(${test_name} PRIVATE "UNIT_TEST_SOURCEDIR=\"${CMAKE_SOURCE_DIR}/tests/unit_tests/openvpn\"") if (NOT ${test_name} STREQUAL "test_buffer") target_sources(${test_name} PRIVATE -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/924?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I0c4fce76c81c5297ff5469d787114f1279bf35e5 Gerrit-Change-Number: 924 Gerrit-PatchSet: 1 Gerrit-Owner: flichtenheld <fr...@li...> Gerrit-Reviewer: plaisthos <arn...@rf...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-Attention: plaisthos <arn...@rf...> Gerrit-MessageType: newchange |
| From: flichtenheld (C. Review) <ge...@op...> - 2025-03-28 11:37:13 |
Attention is currently required from: plaisthos. Hello plaisthos, I'd like you to reexamine a change. Please visit http://gerrit.openvpn.net/c/openvpn/+/848?usp=email to look at the new patch set (#5). Change subject: Doxygen: Fix missing parameter warnings ...................................................................... Doxygen: Fix missing parameter warnings This fixes almost all of the remaining warnings in our doxygen. Mostly about missing parameters in otherwise documented functions (completely undocumented functions do not cause warnings). Other changes: - Exclude out/ directory (used by CMakePresets.json) - Output doxygen warnings into a separate file, which can be used by CI systems to check for new warnings - Increase DOT_GRAPH_MAX_NODES to avoid warnings about some of the central header files (syshead.h and buffer.h) Change-Id: I3bf775bbdea742575210606e174ccafe840677c9 Signed-off-by: Frank Lichtenheld <fr...@li...> --- M doc/doxygen/openvpn.doxyfile.in M src/openvpn/forward.c M src/openvpn/fragment.h M src/openvpn/manage.c M src/openvpn/mudp.h M src/openvpn/multi.c M src/openvpn/options.c M src/openvpn/ssl.h M src/openvpn/ssl_backend.h M src/openvpn/ssl_ncp.h M src/openvpn/ssl_pkt.c M src/openvpn/ssl_pkt.h M src/openvpn/ssl_util.h M src/openvpn/ssl_verify.h M src/openvpn/tls_crypt.h 15 files changed, 45 insertions(+), 33 deletions(-) git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/48/848/5 diff --git a/doc/doxygen/openvpn.doxyfile.in b/doc/doxygen/openvpn.doxyfile.in index 573b7c2..dd5f08f 100644 --- a/doc/doxygen/openvpn.doxyfile.in +++ b/doc/doxygen/openvpn.doxyfile.in @@ -852,7 +852,7 @@ # messages should be written. If left blank the output is written to standard # error (stderr). -WARN_LOGFILE = +WARN_LOGFILE = @abs_top_builddir@/doc/doxygen.warnings.log #--------------------------------------------------------------------------- # Configuration options related to the input files @@ -938,7 +938,7 @@ # Note that relative paths are relative to the directory from which doxygen is # run. -EXCLUDE = +EXCLUDE = @abs_top_srcdir@/out/ # The EXCLUDE_SYMLINKS tag can be used to select whether or not files or # directories that are symbolic links (a Unix file system feature) are excluded @@ -2600,7 +2600,7 @@ # Minimum value: 0, maximum value: 10000, default value: 50. # This tag requires that the tag HAVE_DOT is set to YES. -DOT_GRAPH_MAX_NODES = 50 +DOT_GRAPH_MAX_NODES = 150 # The MAX_DOT_GRAPH_DEPTH tag can be used to set the maximum depth of the graphs # generated by dot. A depth value of 3 means that only nodes reachable from the diff --git a/src/openvpn/forward.c b/src/openvpn/forward.c index af1d008..ea8cce1 100644 --- a/src/openvpn/forward.c +++ b/src/openvpn/forward.c @@ -1523,10 +1523,10 @@ * IPv6 packet in buf and sends it directly back to the client via the tun * device when used on a client and via the link if used on the server. * - * @param buf - The buf containing the packet for which the icmp6 - * unreachable should be constructed. - * - * @param client - determines whether to the send packet back via tun or link + * @param c Tunnel context + * @param buf The buf containing the packet for which the icmp6 + * unreachable should be constructed. + * @param client Determines whether to the send packet back via tun or link */ void ipv6_send_icmp_unreachable(struct context *c, struct buffer *buf, bool client) diff --git a/src/openvpn/fragment.h b/src/openvpn/fragment.h index 3cd0ee7..66994bb 100644 --- a/src/openvpn/fragment.h +++ b/src/openvpn/fragment.h @@ -454,10 +454,11 @@ * packets which have not yet been reassembled completely but are already * older than their time-to-live. * - * @param f - The \c fragment_master structure for this VPN - * tunnel. - * @param frame - The packet geometry parameters for this VPN - * tunnel. + * @param[in] f The \c fragment_master structure for this VPN + * tunnel. + * @param[in] frame The packet geometry parameters for this VPN + * tunnel. + * @param[out] tv Will be set to time for next housekeeping. */ static inline void fragment_housekeeping(struct fragment_master *f, struct frame *frame, struct timeval *tv) diff --git a/src/openvpn/manage.c b/src/openvpn/manage.c index 0e73942..6baedb7 100644 --- a/src/openvpn/manage.c +++ b/src/openvpn/manage.c @@ -1059,8 +1059,9 @@ * @param man The management interface struct * @param cid_str The CID in string form * @param kid_str The key ID in string form - * @param extra The string to be send to the client containing + * @param extra The string to be sent to the client containing * the information of the additional steps + * @param timeout_str The timeout value in string form */ static void man_client_pending_auth(struct management *man, const char *cid_str, diff --git a/src/openvpn/mudp.h b/src/openvpn/mudp.h index 37752e1..2fa4c4d 100644 --- a/src/openvpn/mudp.h +++ b/src/openvpn/mudp.h @@ -46,12 +46,13 @@ * it. If no entry exists, this function handles its creation, and if * successful, returns the newly created instance. * - * @param m - The single multi_context structure. - * @param sock - Listening socket where this instance is connecting to + * @param m The single multi_context structure. + * @param[out] floated Returns whether the client has floated. + * @param sock Listening socket where this instance is connecting to * * @return A pointer to a multi_instance if one already existed for the * packet's source address or if one was a newly created successfully. - * NULL if one did not yet exist and a new one was not created. + * NULL if one did not yet exist and a new one was not created. */ struct multi_instance *multi_get_create_instance_udp(struct multi_context *m, bool *floated, struct link_socket *sock); diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c index a673ec1..8810f9e 100644 --- a/src/openvpn/multi.c +++ b/src/openvpn/multi.c @@ -4241,7 +4241,7 @@ * Main event loop for OpenVPN in point-to-multipoint server mode. * @ingroup eventloop * - * @param top - Top-level context structure. + * @param multi context structure */ static void tunnel_server_loop(struct multi_context *multi) diff --git a/src/openvpn/options.c b/src/openvpn/options.c index 99dd60a..31d07d8 100644 --- a/src/openvpn/options.c +++ b/src/openvpn/options.c @@ -3508,6 +3508,7 @@ * altered to guarantee compatibility with the version specified by the * user via --compat-mode. * + * @param o Options state * @param version need compatibility with openvpn versions before the * one specified (20401 = before 2.4.1) * @return whether compatibility should be enabled diff --git a/src/openvpn/ssl.h b/src/openvpn/ssl.h index c32cb6c..c158b35 100644 --- a/src/openvpn/ssl.h +++ b/src/openvpn/ssl.h @@ -281,13 +281,14 @@ * packet is inserted into the Reliability Layer and will be handled * later. * - * @param multi - The TLS multi structure associated with the VPN tunnel + * @param[in] multi The TLS multi structure associated with the VPN tunnel * of this packet. - * @param from - The source address of the packet. - * @param buf - A buffer structure containing the incoming packet. - * @param opt - Returns a crypto options structure with the appropriate security - * parameters to handle the packet if it is a data channel packet. - * @param ad_start - Returns a pointer to the start of the authenticated data of + * @param[in] from The source address of the packet. + * @param[in] buf buffer structure containing the incoming packet. + * @param[out] opt Returns a crypto options structure with the appropriate + * security parameters to handle the packet if it is a data channel packet. + * @param[in] floated Set whether the peer is allowed to have floated. + * @param[out] ad_start Returns a pointer to the start of the authenticated data * of this packet * * @return diff --git a/src/openvpn/ssl_backend.h b/src/openvpn/ssl_backend.h index e25727f..21abacc 100644 --- a/src/openvpn/ssl_backend.h +++ b/src/openvpn/ssl_backend.h @@ -241,6 +241,8 @@ * a string containing the information in the case * of inline files. * @param pkcs12_file_inline True if pkcs12_file is an inline file. + * @param load_ca_file True if CAs from the file should be added to + * the cert store and be trusted. * * @return 1 if an error occurred, 0 if parsing was * successful. @@ -313,6 +315,9 @@ * inline files. * @param ca_file_inline True if ca_file is an inline file * @param ca_path The path to load the CAs from + * @param tls_server True if we are the server side of the TLS + * connection and should use the CA for verifying + * client certificates */ void tls_ctx_load_ca(struct tls_root_ctx *ctx, const char *ca_file, bool ca_file_inline, const char *ca_path, bool tls_server); diff --git a/src/openvpn/ssl_ncp.h b/src/openvpn/ssl_ncp.h index 36be65b..d2e8300 100644 --- a/src/openvpn/ssl_ncp.h +++ b/src/openvpn/ssl_ncp.h @@ -66,7 +66,10 @@ * Make sure to call tls_session_update_crypto_params() after calling this * function. * - * @param gc gc arena that is ONLY used to allocate the returned string + * @param server_list Our own cipher list + * @param peer_info Peer information + * @param remote_cipher Fallback cipher, ignored if peer sent \c IV_CIPHERS + * @param gc gc arena that is used to allocate the returned string * * @returns NULL if no common cipher is available, otherwise the best common * cipher diff --git a/src/openvpn/ssl_pkt.c b/src/openvpn/ssl_pkt.c index 689cd7f..e573859 100644 --- a/src/openvpn/ssl_pkt.c +++ b/src/openvpn/ssl_pkt.c @@ -295,8 +295,8 @@ /* * This function is similar to tls_pre_decrypt, except it is called * when we are in server mode and receive an initial incoming - * packet. Note that we don't modify - * any state in our parameter objects. The purpose is solely to + * packet. Note that we don't modify any state in our parameter + * objects except state. The purpose is solely to * determine whether we should generate a client instance * object, in which case true is returned. * diff --git a/src/openvpn/ssl_pkt.h b/src/openvpn/ssl_pkt.h index b2c4b37..d5a5a2c 100644 --- a/src/openvpn/ssl_pkt.h +++ b/src/openvpn/ssl_pkt.h @@ -109,10 +109,6 @@ struct session_id server_session_id; }; -/** - * - * @param state - */ void free_tls_pre_decrypt_state(struct tls_pre_decrypt_state *state); /** @@ -137,10 +133,11 @@ * * This function is only used in the UDP p2mp server code path * - * @param tas - The standalone TLS authentication setting structure for + * @param[in] tas The standalone TLS authentication setting structure for * this process. - * @param from - The source address of the packet. - * @param buf - A buffer structure containing the incoming packet. + * @param[out] state The state struct to store information in. + * @param[in] from The source address of the packet. + * @param[in] buf buffer structure containing the incoming packet. * * @return * @li True if the packet is valid and a new VPN tunnel should be created diff --git a/src/openvpn/ssl_util.h b/src/openvpn/ssl_util.h index 71a37d4..25f169c 100644 --- a/src/openvpn/ssl_util.h +++ b/src/openvpn/ssl_util.h @@ -39,6 +39,7 @@ * * @param peer_info The peer's peer_info * @param var The variable *including* =, e.g. IV_CIPHERS= + * @param gc GC arena to allocate return value in * * @return The content of the variable as NULL terminated string or NULL if the * variable cannot be found. diff --git a/src/openvpn/ssl_verify.h b/src/openvpn/ssl_verify.h index eba3832..3eb4082 100644 --- a/src/openvpn/ssl_verify.h +++ b/src/openvpn/ssl_verify.h @@ -153,7 +153,7 @@ /** * Sets the common name field for the given tunnel * - * @param multi The tunnel to set the common name for + * @param session The session to set the common name for * @param common_name The name to set the common name to */ void diff --git a/src/openvpn/tls_crypt.h b/src/openvpn/tls_crypt.h index e98aae7..d6d4fba 100644 --- a/src/openvpn/tls_crypt.h +++ b/src/openvpn/tls_crypt.h @@ -204,6 +204,7 @@ * @param buf Buffer containing a received P_CONTROL_HARD_RESET_CLIENT_V3 * message. * @param ctx tls-wrap context to be initialized with the client key. + * @param opt TLS options, used for \c tls-crypt-v2-verify script. * * @returns true if a key was successfully extracted. */ -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/848?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I3bf775bbdea742575210606e174ccafe840677c9 Gerrit-Change-Number: 848 Gerrit-PatchSet: 5 Gerrit-Owner: flichtenheld <fr...@li...> Gerrit-Reviewer: plaisthos <arn...@rf...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-Attention: plaisthos <arn...@rf...> Gerrit-MessageType: newpatchset |
| From: flichtenheld (C. Review) <ge...@op...> - 2025-03-28 10:57:29 |
Attention is currently required from: mattock, plaisthos. flichtenheld has posted comments on this change. ( http://gerrit.openvpn.net/c/openvpn/+/919?usp=email ) Change subject: t_server_null: add multi-socket testing ...................................................................... Patch Set 3: Code-Review-1 (1 comment) Patchset: PS3: generally LGTM, but test failures need to be fixed first -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/919?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I4ebe1158c36a641888131e824f59004a0f8fb4c5 Gerrit-Change-Number: 919 Gerrit-PatchSet: 3 Gerrit-Owner: mattock <sa...@pr...> Gerrit-Reviewer: flichtenheld <fr...@li...> Gerrit-Reviewer: plaisthos <arn...@rf...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-Attention: plaisthos <arn...@rf...> Gerrit-Attention: mattock <sa...@pr...> Gerrit-Comment-Date: Fri, 28 Mar 2025 10:57:09 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes Gerrit-MessageType: comment |
| From: mattock (C. Review) <ge...@op...> - 2025-03-28 07:38:46 |
Attention is currently required from: flichtenheld, plaisthos. Hello flichtenheld, plaisthos, I'd like you to reexamine a change. Please visit http://gerrit.openvpn.net/c/openvpn/+/919?usp=email to look at the new patch set (#3). Change subject: t_server_null: add multi-socket testing ...................................................................... t_server_null: add multi-socket testing This adds a new multi-socket server that listens on IPv4 and IPv6 localhost addresses for TCP and UDP connections respectively. It also adds two success tests and one failure test with wrong protocol defined at the client side. Change-Id: I4ebe1158c36a641888131e824f59004a0f8fb4c5 Signed-off-by: Samuli Seppänen <sam...@gm...> --- M tests/t_server_null_default.rc 1 file changed, 27 insertions(+), 4 deletions(-) git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/19/919/3 diff --git a/tests/t_server_null_default.rc b/tests/t_server_null_default.rc index ca8004a..5b74761 100755 --- a/tests/t_server_null_default.rc +++ b/tests/t_server_null_default.rc @@ -38,12 +38,14 @@ MAX_CLIENTS="10" CLIENT_MATCH="Test-Client" SERVER_EXEC="${top_builddir}/src/openvpn/openvpn" -SERVER_BASE_OPTS="--daemon --local 127.0.0.1 --dev tun --topology subnet --max-clients $MAX_CLIENTS --persist-tun --verb 3 --duplicate-cn" +SERVER_BASE_OPTS="--daemon --dev tun --topology subnet --max-clients $MAX_CLIENTS --persist-tun --verb 3 --duplicate-cn" +SERVER_BIND_OPTS="--local 127.0.0.1" SERVER_CIPHER_OPTS="" SERVER_CERT_OPTS="--ca ${CA} --dh ${DH} --cert ${SERVER_CERT} --key ${SERVER_KEY} --tls-auth ${TA} 0" -SERVER_CONF_BASE="${SERVER_BASE_OPTS} ${SERVER_CIPHER_OPTS} ${SERVER_CERT_OPTS}" +SERVER_CONF_BASE="${SERVER_BASE_OPTS} ${SERVER_CIPHER_OPTS} ${SERVER_CERT_OPTS} ${SERVER_BIND_OPTS}" +SERVER_CONF_BASE_MULTISOCKET="${SERVER_BASE_OPTS} ${SERVER_CIPHER_OPTS} ${SERVER_CERT_OPTS}" -TEST_SERVER_LIST="1 2 3" +TEST_SERVER_LIST="1 2 3 4" SERVER_NAME_1="t_server_null_server-1194_udp" SERVER_SERVER_1="--server 10.29.41.0 255.255.255.0" @@ -63,6 +65,12 @@ SERVER_EXEC_3="${SERVER_EXEC}" SERVER_CONF_3="${SERVER_CONF_BASE} ${SERVER_SERVER_3} --lport 1196 --proto udp --management 127.0.0.1 ${SERVER_MGMT_PORT_3} --cipher AES-192-CBC --data-ciphers DEFAULT:AES-192-CBC" +SERVER_NAME_4="t_server_null_server-1197_multisocket_ipv4_ipv6" +SERVER_SERVER_4="--server 10.29.43.0 255.255.255.0" +SERVER_MGMT_PORT_4="11197" +SERVER_EXEC_4="${SERVER_EXEC}" +SERVER_CONF_4="${SERVER_CONF_BASE_MULTISOCKET} ${SERVER_SERVER_4} --local 127.0.0.1 1197 tcp --local ::1 1197 udp --management 127.0.0.1 ${SERVER_MGMT_PORT_4}" + # Test client configurations CLIENT_EXEC="${top_builddir}/src/openvpn/openvpn" CLIENT_BASE_OPTS="--client --nobind --remote-cert-tls server --persist-tun --verb 3 --resolv-retry infinite --connect-retry-max 3 --server-poll-timeout 5 --explicit-exit-notify 3 --script-security 2" @@ -72,7 +80,7 @@ CLIENT_CIPHER_OPTS="" CLIENT_CERT_OPTS="--ca ${CA} --cert ${CLIENT_CERT} --key ${CLIENT_KEY} --tls-auth ${TA} 1" -TEST_RUN_LIST="1 1L 2 2L 3 4a 4b 4c" +TEST_RUN_LIST="1 1L 2 2L 3 4a 4b 4c 5a 5b 5c" CLIENT_CONF_BASE="${CLIENT_NULL_OPTS} ${CLIENT_BASE_OPTS} ${CLIENT_CIPHER_OPTS} ${CLIENT_CERT_OPTS}" CLIENT_CONF_BASE_LWIP="${CLIENT_LWIP_OPTS} ${CLIENT_BASE_OPTS} ${CLIENT_CIPHER_OPTS} ${CLIENT_CERT_OPTS}" @@ -121,3 +129,18 @@ SHOULD_PASS_4c="no" CLIENT_EXEC_4c="${CLIENT_EXEC}" CLIENT_CONF_4c="${CLIENT_CONF_BASE} --remote 127.0.0.1 1196 udp --proto udp --cipher AES-192-CBC --data-ciphers AES-128-CBC" + +TEST_NAME_5a="t_server_null_client.sh-openvpn_current_multisocket_ipv4_tcp" +SHOULD_PASS_5a="yes" +CLIENT_EXEC_5a="${CLIENT_EXEC}" +CLIENT_CONF_5a="${CLIENT_CONF_BASE} --remote 127.0.0.1 1197 tcp" + +TEST_NAME_5b="t_server_null_client.sh-openvpn_current_multisocket_ipv6_udp" +SHOULD_PASS_5b="yes" +CLIENT_EXEC_5b="${CLIENT_EXEC}" +CLIENT_CONF_5b="${CLIENT_CONF_BASE} --remote ::1 1197 udp" + +TEST_NAME_5c="t_server_null_client.sh-openvpn_current_multisocket_ipv6_tcp_fail" +SHOULD_PASS_5c="no" +CLIENT_EXEC_5c="${CLIENT_EXEC}" +CLIENT_CONF_5c="${CLIENT_CONF_BASE} --remote ::1 1197 tcp" -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/919?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I4ebe1158c36a641888131e824f59004a0f8fb4c5 Gerrit-Change-Number: 919 Gerrit-PatchSet: 3 Gerrit-Owner: mattock <sa...@pr...> Gerrit-Reviewer: flichtenheld <fr...@li...> Gerrit-Reviewer: plaisthos <arn...@rf...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-Attention: plaisthos <arn...@rf...> Gerrit-Attention: flichtenheld <fr...@li...> Gerrit-MessageType: newpatchset |
| From: cron2 (C. Review) <ge...@op...> - 2025-03-27 16:09:25 |
cron2 has submitted this change. ( http://gerrit.openvpn.net/c/openvpn/+/921?usp=email ) Change subject: Do not leave half-initialised key wrap struct when dynamic tls-crypt fails ...................................................................... Do not leave half-initialised key wrap struct when dynamic tls-crypt fails In case when key_state_export_keying_material fails we left a half-initialised tls_wrap_reneg structure in the tls_session. Later calls to try to free this structure causes freeing of invalid memory locations. To test: make key_state_export_keying_material return false even though HAVE_EXPORT_KEYING_MATERIAL is defined and connect to a server supporting dynamic tls-crypt (2.6.0+) Change-Id: I54073f8b63894a62699f6ecdc90a77f9f131205b Signed-off-by: Arne Schwabe <ar...@rf...> Acked-by: MaxF <ma...@ma...> Message-Id: <202...@gr...> URL: https://www.mail-archive.com/ope...@li.../msg31267.html Signed-off-by: Gert Doering <ge...@gr...> --- M src/openvpn/tls_crypt.c 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/src/openvpn/tls_crypt.c b/src/openvpn/tls_crypt.c index eb7b03d..9e9807d 100644 --- a/src/openvpn/tls_crypt.c +++ b/src/openvpn/tls_crypt.c @@ -97,6 +97,15 @@ bool tls_session_generate_dynamic_tls_crypt_key(struct tls_session *session) { + struct key2 rengokeys; + if (!key_state_export_keying_material(session, EXPORT_DYNAMIC_TLS_CRYPT_LABEL, + strlen(EXPORT_DYNAMIC_TLS_CRYPT_LABEL), + rengokeys.keys, sizeof(rengokeys.keys))) + { + return false; + } + rengokeys.n = 2; + session->tls_wrap_reneg.opt = session->tls_wrap.opt; session->tls_wrap_reneg.mode = TLS_WRAP_CRYPT; session->tls_wrap_reneg.cleanup_key_ctx = true; @@ -108,16 +117,6 @@ session->opt->replay_time, "TLS_WRAP_RENEG", session->key_id); - - struct key2 rengokeys; - if (!key_state_export_keying_material(session, EXPORT_DYNAMIC_TLS_CRYPT_LABEL, - strlen(EXPORT_DYNAMIC_TLS_CRYPT_LABEL), - rengokeys.keys, sizeof(rengokeys.keys))) - { - return false; - } - rengokeys.n = 2; - if (session->tls_wrap.mode == TLS_WRAP_CRYPT || session->tls_wrap.mode == TLS_WRAP_AUTH) { -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/921?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I54073f8b63894a62699f6ecdc90a77f9f131205b Gerrit-Change-Number: 921 Gerrit-PatchSet: 2 Gerrit-Owner: plaisthos <arn...@rf...> Gerrit-Reviewer: MaxF <ma...@ma...> Gerrit-Reviewer: flichtenheld <fr...@li...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-MessageType: merged |
| From: cron2 (C. Review) <ge...@op...> - 2025-03-27 16:09:24 |
cron2 has uploaded a new patch set (#2) to the change originally created by plaisthos. ( http://gerrit.openvpn.net/c/openvpn/+/921?usp=email ) The following approvals got outdated and were removed: Code-Review+2 by MaxF Change subject: Do not leave half-initialised key wrap struct when dynamic tls-crypt fails ...................................................................... Do not leave half-initialised key wrap struct when dynamic tls-crypt fails In case when key_state_export_keying_material fails we left a half-initialised tls_wrap_reneg structure in the tls_session. Later calls to try to free this structure causes freeing of invalid memory locations. To test: make key_state_export_keying_material return false even though HAVE_EXPORT_KEYING_MATERIAL is defined and connect to a server supporting dynamic tls-crypt (2.6.0+) Change-Id: I54073f8b63894a62699f6ecdc90a77f9f131205b Signed-off-by: Arne Schwabe <ar...@rf...> Acked-by: MaxF <ma...@ma...> Message-Id: <202...@gr...> URL: https://www.mail-archive.com/ope...@li.../msg31267.html Signed-off-by: Gert Doering <ge...@gr...> --- M src/openvpn/tls_crypt.c 1 file changed, 9 insertions(+), 10 deletions(-) git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/21/921/2 diff --git a/src/openvpn/tls_crypt.c b/src/openvpn/tls_crypt.c index eb7b03d..9e9807d 100644 --- a/src/openvpn/tls_crypt.c +++ b/src/openvpn/tls_crypt.c @@ -97,6 +97,15 @@ bool tls_session_generate_dynamic_tls_crypt_key(struct tls_session *session) { + struct key2 rengokeys; + if (!key_state_export_keying_material(session, EXPORT_DYNAMIC_TLS_CRYPT_LABEL, + strlen(EXPORT_DYNAMIC_TLS_CRYPT_LABEL), + rengokeys.keys, sizeof(rengokeys.keys))) + { + return false; + } + rengokeys.n = 2; + session->tls_wrap_reneg.opt = session->tls_wrap.opt; session->tls_wrap_reneg.mode = TLS_WRAP_CRYPT; session->tls_wrap_reneg.cleanup_key_ctx = true; @@ -108,16 +117,6 @@ session->opt->replay_time, "TLS_WRAP_RENEG", session->key_id); - - struct key2 rengokeys; - if (!key_state_export_keying_material(session, EXPORT_DYNAMIC_TLS_CRYPT_LABEL, - strlen(EXPORT_DYNAMIC_TLS_CRYPT_LABEL), - rengokeys.keys, sizeof(rengokeys.keys))) - { - return false; - } - rengokeys.n = 2; - if (session->tls_wrap.mode == TLS_WRAP_CRYPT || session->tls_wrap.mode == TLS_WRAP_AUTH) { -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/921?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I54073f8b63894a62699f6ecdc90a77f9f131205b Gerrit-Change-Number: 921 Gerrit-PatchSet: 2 Gerrit-Owner: plaisthos <arn...@rf...> Gerrit-Reviewer: MaxF <ma...@ma...> Gerrit-Reviewer: flichtenheld <fr...@li...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-MessageType: newpatchset |
| From: Gert D. <ge...@gr...> - 2025-03-27 16:08:42 |
Looking at this with "git show --color-moved=zebra -U20" makes clear that it's just moving around the call that could fail, and if it fails, do not modify anything else that might then become inconsistent. As far as I can see, nothing of this has side effects where order would be important (except when erroring-out, of course). Your patch has been applied to the master branch. commit 7825a8c586a8beba209370f1594cd0987b653ab7 Author: Arne Schwabe Date: Thu Mar 27 16:36:00 2025 +0100 Do not leave half-initialised key wrap struct when dynamic tls-crypt fails Signed-off-by: Arne Schwabe <ar...@rf...> Acked-by: MaxF <ma...@ma...> Message-Id: <202...@gr...> URL: https://www.mail-archive.com/ope...@li.../msg31267.html Signed-off-by: Gert Doering <ge...@gr...> -- kind regards, Gert Doering |
| From: MaxF (C. Review) <ge...@op...> - 2025-03-27 16:07:19 |
Attention is currently required from: flichtenheld, plaisthos. MaxF has posted comments on this change. ( http://gerrit.openvpn.net/c/openvpn/+/920?usp=email ) Change subject: Fix mbed TLS key exporter functionality in 3.6.x and cmake ...................................................................... Patch Set 1: (2 comments) Patchset: PS1: Tiny bug in the error message, but the change makes sense. What I don't understand is how this gets triggered. I looked at configure.ac again and as far as I understand it, it does the following (starting from line 1041): Set have_export_keying_material to "yes". Check if mbedtls_ssl_conf_export_keys_ext_cb exists. If not, check if mbedtls_ssl_set_export_keys_cb exists. If that doesn't exist either, set have_export_keying_material to "no". File src/openvpn/ssl_mbedtls.c: http://gerrit.openvpn.net/c/openvpn/+/920/comment/1220b775_cb2a77f6 : PS1, Line 257: HAVE_MBEDTLS_SSL_CONF_EXPORT_KEYS_EXT_CB The second one should be HAVE_MBEDTLS_SSL_SET_EXPORT_KEYS_CB -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/920?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: If38e80e268dc0ee7e57de2c175c5b4db0ce55ed0 Gerrit-Change-Number: 920 Gerrit-PatchSet: 1 Gerrit-Owner: plaisthos <arn...@rf...> Gerrit-Reviewer: flichtenheld <fr...@li...> Gerrit-CC: MaxF <ma...@ma...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-Attention: plaisthos <arn...@rf...> Gerrit-Attention: flichtenheld <fr...@li...> Gerrit-Comment-Date: Thu, 27 Mar 2025 15:43:08 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Gerrit-MessageType: comment |
| From: mattock (C. Review) <ge...@op...> - 2025-03-27 16:05:09 |
Attention is currently required from: flichtenheld, its_Giaan, plaisthos. mattock has posted comments on this change. ( http://gerrit.openvpn.net/c/openvpn/+/922?usp=email ) Change subject: manpage: fix HTML format for --local ...................................................................... Patch Set 1: Code-Review+2 (1 comment) Patchset: PS1: This fixes the formatting issue based on my tests. -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/922?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I8d981a66932a5424ed959b12ee0cdddf881de91e Gerrit-Change-Number: 922 Gerrit-PatchSet: 1 Gerrit-Owner: its_Giaan <gia...@ma...> Gerrit-Reviewer: flichtenheld <fr...@li...> Gerrit-Reviewer: mattock <sa...@pr...> Gerrit-Reviewer: plaisthos <arn...@rf...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-Attention: plaisthos <arn...@rf...> Gerrit-Attention: its_Giaan <gia...@ma...> Gerrit-Attention: flichtenheld <fr...@li...> Gerrit-Comment-Date: Thu, 27 Mar 2025 16:04:45 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes Gerrit-MessageType: comment |
| From: cron2 (C. Review) <ge...@op...> - 2025-03-27 15:56:16 |
cron2 has submitted this change. ( http://gerrit.openvpn.net/c/openvpn/+/847?usp=email ) Change subject: t_server_null_default.rc: Add some tests with --data-ciphers ...................................................................... t_server_null_default.rc: Add some tests with --data-ciphers Trying to verify some of the negotiation parts. Change-Id: I47d95eee8a00b9878331fd6cd6a7db12665f5537 Signed-off-by: Frank Lichtenheld <fr...@li...> Acked-by: Samuli Seppänen <sa...@pr...> Message-Id: <202...@li...> URL: https://www.mail-archive.com/ope...@li.../msg31258.html Signed-off-by: Gert Doering <ge...@gr...> --- M tests/t_server_null_default.rc 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/tests/t_server_null_default.rc b/tests/t_server_null_default.rc index e7bf5bc..ca8004a 100755 --- a/tests/t_server_null_default.rc +++ b/tests/t_server_null_default.rc @@ -1,3 +1,4 @@ +# -*- shell-script -*- # Notes regarding --dev null server and client configurations: # # The t_server_null_server.sh exits when all client pid files have gone @@ -42,7 +43,7 @@ SERVER_CERT_OPTS="--ca ${CA} --dh ${DH} --cert ${SERVER_CERT} --key ${SERVER_KEY} --tls-auth ${TA} 0" SERVER_CONF_BASE="${SERVER_BASE_OPTS} ${SERVER_CIPHER_OPTS} ${SERVER_CERT_OPTS}" -TEST_SERVER_LIST="1 2" +TEST_SERVER_LIST="1 2 3" SERVER_NAME_1="t_server_null_server-1194_udp" SERVER_SERVER_1="--server 10.29.41.0 255.255.255.0" @@ -56,6 +57,12 @@ SERVER_EXEC_2="${SERVER_EXEC}" SERVER_CONF_2="${SERVER_CONF_BASE} ${SERVER_SERVER_2} --lport 1195 --proto tcp --management 127.0.0.1 ${SERVER_MGMT_PORT_2}" +SERVER_NAME_3="t_server_null_server-1196_udp" +SERVER_SERVER_3="--server 10.29.43.0 255.255.255.0" +SERVER_MGMT_PORT_3="11196" +SERVER_EXEC_3="${SERVER_EXEC}" +SERVER_CONF_3="${SERVER_CONF_BASE} ${SERVER_SERVER_3} --lport 1196 --proto udp --management 127.0.0.1 ${SERVER_MGMT_PORT_3} --cipher AES-192-CBC --data-ciphers DEFAULT:AES-192-CBC" + # Test client configurations CLIENT_EXEC="${top_builddir}/src/openvpn/openvpn" CLIENT_BASE_OPTS="--client --nobind --remote-cert-tls server --persist-tun --verb 3 --resolv-retry infinite --connect-retry-max 3 --server-poll-timeout 5 --explicit-exit-notify 3 --script-security 2" @@ -65,7 +72,7 @@ CLIENT_CIPHER_OPTS="" CLIENT_CERT_OPTS="--ca ${CA} --cert ${CLIENT_CERT} --key ${CLIENT_KEY} --tls-auth ${TA} 1" -TEST_RUN_LIST="1 1L 2 2L 3" +TEST_RUN_LIST="1 1L 2 2L 3 4a 4b 4c" CLIENT_CONF_BASE="${CLIENT_NULL_OPTS} ${CLIENT_BASE_OPTS} ${CLIENT_CIPHER_OPTS} ${CLIENT_CERT_OPTS}" CLIENT_CONF_BASE_LWIP="${CLIENT_LWIP_OPTS} ${CLIENT_BASE_OPTS} ${CLIENT_CIPHER_OPTS} ${CLIENT_CERT_OPTS}" @@ -93,3 +100,24 @@ SHOULD_PASS_3="no" CLIENT_EXEC_3="${CLIENT_EXEC}" CLIENT_CONF_3="${CLIENT_CONF_BASE} --remote 127.0.0.1 11194 udp --proto udp" + +# --data-cipher list against server with defaults +# --cipher ignored +TEST_NAME_4a="t_server_null_client.sh-openvpn_current_udp_dc1" +SHOULD_PASS_4a="yes" +CLIENT_EXEC_4a="${CLIENT_EXEC}" +CLIENT_CONF_4a="${CLIENT_CONF_BASE} --remote 127.0.0.1 1194 udp --proto udp --cipher AES-128-CBC --data-ciphers AES-192-CBC:DEFAULT" + +# specific --data-cipher against server that supports that cipher +# --cipher ignored +TEST_NAME_4b="t_server_null_client.sh-openvpn_current_udp_dc3" +SHOULD_PASS_4b="yes" +CLIENT_EXEC_4b="${CLIENT_EXEC}" +CLIENT_CONF_4b="${CLIENT_CONF_BASE} --remote 127.0.0.1 1196 udp --proto udp --cipher AES-128-CBC --data-ciphers AES-192-CBC" + +# specific --data-cipher against server that doesn't support that cipher +# --cipher ignored +TEST_NAME_4c="t_server_null_client.sh-openvpn_current_udp_dc3_fail" +SHOULD_PASS_4c="no" +CLIENT_EXEC_4c="${CLIENT_EXEC}" +CLIENT_CONF_4c="${CLIENT_CONF_BASE} --remote 127.0.0.1 1196 udp --proto udp --cipher AES-192-CBC --data-ciphers AES-128-CBC" -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/847?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I47d95eee8a00b9878331fd6cd6a7db12665f5537 Gerrit-Change-Number: 847 Gerrit-PatchSet: 3 Gerrit-Owner: flichtenheld <fr...@li...> Gerrit-Reviewer: mattock <sa...@pr...> Gerrit-Reviewer: plaisthos <arn...@rf...> Gerrit-CC: cron2 <ge...@gr...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-MessageType: merged |
| From: cron2 (C. Review) <ge...@op...> - 2025-03-27 15:56:13 |
cron2 has uploaded a new patch set (#3) to the change originally created by flichtenheld. ( http://gerrit.openvpn.net/c/openvpn/+/847?usp=email ) The following approvals got outdated and were removed: Code-Review+2 by mattock Change subject: t_server_null_default.rc: Add some tests with --data-ciphers ...................................................................... t_server_null_default.rc: Add some tests with --data-ciphers Trying to verify some of the negotiation parts. Change-Id: I47d95eee8a00b9878331fd6cd6a7db12665f5537 Signed-off-by: Frank Lichtenheld <fr...@li...> Acked-by: Samuli Seppänen <sa...@pr...> Message-Id: <202...@li...> URL: https://www.mail-archive.com/ope...@li.../msg31258.html Signed-off-by: Gert Doering <ge...@gr...> --- M tests/t_server_null_default.rc 1 file changed, 30 insertions(+), 2 deletions(-) git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/47/847/3 diff --git a/tests/t_server_null_default.rc b/tests/t_server_null_default.rc index e7bf5bc..ca8004a 100755 --- a/tests/t_server_null_default.rc +++ b/tests/t_server_null_default.rc @@ -1,3 +1,4 @@ +# -*- shell-script -*- # Notes regarding --dev null server and client configurations: # # The t_server_null_server.sh exits when all client pid files have gone @@ -42,7 +43,7 @@ SERVER_CERT_OPTS="--ca ${CA} --dh ${DH} --cert ${SERVER_CERT} --key ${SERVER_KEY} --tls-auth ${TA} 0" SERVER_CONF_BASE="${SERVER_BASE_OPTS} ${SERVER_CIPHER_OPTS} ${SERVER_CERT_OPTS}" -TEST_SERVER_LIST="1 2" +TEST_SERVER_LIST="1 2 3" SERVER_NAME_1="t_server_null_server-1194_udp" SERVER_SERVER_1="--server 10.29.41.0 255.255.255.0" @@ -56,6 +57,12 @@ SERVER_EXEC_2="${SERVER_EXEC}" SERVER_CONF_2="${SERVER_CONF_BASE} ${SERVER_SERVER_2} --lport 1195 --proto tcp --management 127.0.0.1 ${SERVER_MGMT_PORT_2}" +SERVER_NAME_3="t_server_null_server-1196_udp" +SERVER_SERVER_3="--server 10.29.43.0 255.255.255.0" +SERVER_MGMT_PORT_3="11196" +SERVER_EXEC_3="${SERVER_EXEC}" +SERVER_CONF_3="${SERVER_CONF_BASE} ${SERVER_SERVER_3} --lport 1196 --proto udp --management 127.0.0.1 ${SERVER_MGMT_PORT_3} --cipher AES-192-CBC --data-ciphers DEFAULT:AES-192-CBC" + # Test client configurations CLIENT_EXEC="${top_builddir}/src/openvpn/openvpn" CLIENT_BASE_OPTS="--client --nobind --remote-cert-tls server --persist-tun --verb 3 --resolv-retry infinite --connect-retry-max 3 --server-poll-timeout 5 --explicit-exit-notify 3 --script-security 2" @@ -65,7 +72,7 @@ CLIENT_CIPHER_OPTS="" CLIENT_CERT_OPTS="--ca ${CA} --cert ${CLIENT_CERT} --key ${CLIENT_KEY} --tls-auth ${TA} 1" -TEST_RUN_LIST="1 1L 2 2L 3" +TEST_RUN_LIST="1 1L 2 2L 3 4a 4b 4c" CLIENT_CONF_BASE="${CLIENT_NULL_OPTS} ${CLIENT_BASE_OPTS} ${CLIENT_CIPHER_OPTS} ${CLIENT_CERT_OPTS}" CLIENT_CONF_BASE_LWIP="${CLIENT_LWIP_OPTS} ${CLIENT_BASE_OPTS} ${CLIENT_CIPHER_OPTS} ${CLIENT_CERT_OPTS}" @@ -93,3 +100,24 @@ SHOULD_PASS_3="no" CLIENT_EXEC_3="${CLIENT_EXEC}" CLIENT_CONF_3="${CLIENT_CONF_BASE} --remote 127.0.0.1 11194 udp --proto udp" + +# --data-cipher list against server with defaults +# --cipher ignored +TEST_NAME_4a="t_server_null_client.sh-openvpn_current_udp_dc1" +SHOULD_PASS_4a="yes" +CLIENT_EXEC_4a="${CLIENT_EXEC}" +CLIENT_CONF_4a="${CLIENT_CONF_BASE} --remote 127.0.0.1 1194 udp --proto udp --cipher AES-128-CBC --data-ciphers AES-192-CBC:DEFAULT" + +# specific --data-cipher against server that supports that cipher +# --cipher ignored +TEST_NAME_4b="t_server_null_client.sh-openvpn_current_udp_dc3" +SHOULD_PASS_4b="yes" +CLIENT_EXEC_4b="${CLIENT_EXEC}" +CLIENT_CONF_4b="${CLIENT_CONF_BASE} --remote 127.0.0.1 1196 udp --proto udp --cipher AES-128-CBC --data-ciphers AES-192-CBC" + +# specific --data-cipher against server that doesn't support that cipher +# --cipher ignored +TEST_NAME_4c="t_server_null_client.sh-openvpn_current_udp_dc3_fail" +SHOULD_PASS_4c="no" +CLIENT_EXEC_4c="${CLIENT_EXEC}" +CLIENT_CONF_4c="${CLIENT_CONF_BASE} --remote 127.0.0.1 1196 udp --proto udp --cipher AES-192-CBC --data-ciphers AES-128-CBC" -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/847?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I47d95eee8a00b9878331fd6cd6a7db12665f5537 Gerrit-Change-Number: 847 Gerrit-PatchSet: 3 Gerrit-Owner: flichtenheld <fr...@li...> Gerrit-Reviewer: mattock <sa...@pr...> Gerrit-Reviewer: plaisthos <arn...@rf...> Gerrit-CC: cron2 <ge...@gr...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-MessageType: newpatchset |
| From: Gert D. <ge...@gr...> - 2025-03-27 15:56:05 |
Tests are good :-) - I have not really looked into it in more detail, but this is what the infra is there for, and Samuli knows it best. Your patch has been applied to the master branch. commit 5ad560a9237dedde83b8797aac457fd1e6832b54 Author: Frank Lichtenheld Date: Thu Mar 27 10:47:00 2025 +0100 t_server_null_default.rc: Add some tests with --data-ciphers Signed-off-by: Frank Lichtenheld <fr...@li...> Acked-by: Samuli Seppänen <sa...@pr...> Message-Id: <202...@li...> URL: https://www.mail-archive.com/ope...@li.../msg31258.html Signed-off-by: Gert Doering <ge...@gr...> -- kind regards, Gert Doering |
