The linux userspace API header has acquired the MIT license (check the
ovpn-dco repository for the related change), therefore we simply bring
this change in our local copy to ensure compliancy.
Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20230125095321.23063-1-a@unstable.cc>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26077.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 537cde6b8fa7d35414df715678e2cd22ab79a881)
Lev Stipakov [Tue, 24 Jan 2023 14:23:16 +0000 (16:23 +0200)]
openvpnmsica: fix adapters discovery logic for DCO
Custom action "FindSystemInfo" finds adapters with certain hwid and
assigns found adapters' guids to a certain property. Later another custom
action "EvaluateTUNTAPAdapters" schedules adapter creation if the
abovementioned property is not set - which means no adapters exist
with given hwid.
I think this logic is needed to prevent duplicate adapter creation
if adapter was renamed and then new version is installed.
As one can see, there is a typo in property name ("OVPNDCOAPTERS"). As
a result of this typo, installer will always try to create DCO adapter
no matter if there are existing adapters. It however won't do anything
if adapter with the name "OpenVPN Data Channel Offload" already exists,
this is handled in schedule_adapter_create() function.
Because of that typo, following scenario works fine:
1) Upcoming release of OpenVPN Connect is installed, which creates
adapter named "OpenVPN Connect DCO Adapter"
2) OpenVPN-GUI is installed. Because of typo, it ignores adapter created
by Connect and creates own "OpenVPN Data Channel Offload" adapter
3) OpenVPN Connect is uninstalled and it removes
"OpenVPN Connect DCO Adapter".
4) OpenVPN-GUI still has its "OpenVPN Data Channel Offload" adapter
If we just fix a typo, OpenVPN-GUI won't create a adapter on step 2 and
after Connect removal on step 3 there won't be DCO adapters anymore
for OpenVPN-GUI to use.
The ultimate solution to this would be moving adapter creation to MSM,
a shared component which adds/removes the DCO driver. However this change
is not trivial and requires a lot of work. For the time being we apply
this band-aid by excluding Connect-created adapters from enumerations in
"FindSystemInfo" custom action. This makes sure that OpenVPN-GUI won't
rely on adapter created by Connnect (which is deleted on Connect uninstall)
and ensures that additional DCO adapters won't be created on upgrade
if user decides to rename adapter.
Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Selva Nair <selva.nair@gmail.com>
Message-Id: <20230124142316.441-1-lstipakov@gmail.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26072.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 7a23a7dda27349f7c7fd7af2ed1380ede1becf06)
Selva Nair [Sat, 21 Jan 2023 19:42:26 +0000 (14:42 -0500)]
Fix one more 'existing route may get deleted' case
- Ensure net_route_v4/v6_add/del() functions using iproute2 return
error when route addition fails. Return value follows the same logic
as corresponding functions using netlink though all failure reasons
get the same error code of -1.
TODO: Preserve any preexisting direct route to VPN and optionally the
IPv6 connected net route.
v2: Following review, removed the poorly coded RL_DID_LOCAL-related chunks.
That part needs a better fix.
Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20230121194226.2081637-1-selva.nair@gmail.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26067.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 00fac39c58a7d5c8fa6d8f40232e9ab79f3fa9e0)
Selva Nair [Fri, 20 Jan 2023 09:41:00 +0000 (04:41 -0500)]
Cleanup route error and debug logging on Windows
Use a unified logging format for various route-methods
- Route add/delete errors are always logged with M_WARN, so
log only additional information (succeed/exists) with D_ROUTE.
- Non-windows platforms log route errors with a prefix "ERROR:" and
debug info with "ROUTE:". Do the same on Windows. Do not log
errors or success multiple times.
- In add_route_ipv6, log the interface id instead of device name
as the latter always point to the tun/tap adapter name on Windows.
Log lines prefixed with a PACKAGE_NAME "ROUTE" are unchanged.
They appear to use the same format on all platforms.
v2: rebase to master
Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Lev Stipakov <lstipakov@gmail.com>
Message-Id: <20230120094100.2063883-1-selva.nair@gmail.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26058.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit a45c201e2edcf5ccb6baea0a03145023db7f222b)
Selva Nair [Fri, 20 Jan 2023 02:18:41 +0000 (21:18 -0500)]
Warn when pkcs11-id or pkcs11-id-management options are ignored
- If there are no pkcs11-providers either directly specified or
through p11-kit-proxy made available through a build-time detection,
these options are ignored. Log a warning in such cases.
Especially important on Windows where automatic loading of p11-kit
is not enabled in our release builds.
- Document this behaviour.
Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Frank Lichtenheld <frank@lichtenheld.com>
Message-Id: <20230120021841.2048791-1-selva.nair@gmail.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26056.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit abad04fc8ef6c1da7dc4e976bacee9f34931adea)
Arne Schwabe [Thu, 12 Jan 2023 16:37:37 +0000 (17:37 +0100)]
Workaround: make ovpn-dco more reliable
This workaround avoids the kernel trigger ENOBUFS when the kernel
internal queue is overrun with events of disconnectingh clients or
similar. This is a workaround until we come up with a more permanent
solution.
Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Antonio Quartulli <antonio@openvpn.net>
Message-Id: <20230112163737.1240059-1-arne@rfc2549.org>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25988.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit f84a9fc5d4ac0f24912d239a3fccf3701926a50c)
Don't clear capability bounding set on capng_change_id
The bounding set being empty will overpower the likes of su/sudo
and will make it impossible for any child processes to ever gain
additional privileges again.
Github: fixes OpenVPN/openvpn#220
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20230118142428.162-1-timo@rothenpieler.org>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26048.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit d8523119b95db55d2c101b8364ce7e9d0d0f6f3a)
Gert Doering [Wed, 18 Jan 2023 07:46:33 +0000 (08:46 +0100)]
Repair special-casing of EEXIST for Linux/SITNL route install
The code in sitnl_route_set() used to treat "route can not be installed
because it already exists" (EEXIST) as "not an error".
This is arguably a reasonable approach, but needs to handled higher
up - if the low level add_route() function say "no error", we will try
to remove that route later on in delete_route(), possibly removing
someone else's "already existing" route then.
So:
- remove special case in sitnl_route_set()
- do not pass NLM_F_REPLACE flag to sitnl_route_set() call - this would
cause netlink to just replace existing routes, never return EEXIST
(see "man netlink(7)")
- add detailed return code handling to add_route(), assign "2" on
"-EEXIST"
(and log appropriate message).
(Note: sitnl_route_set() is a common function for sitnl route add and
delete, but EEXIST can not happen on delete - so this change has no
impact for the "delete" case)
v2: use RTA_ macros, also adjust add_route_ipv6()
Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Selva Nair <selva.nair@gmail.com>
Message-Id: <20230118074633.27586-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26046.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit adc54f483b210484ff1488e01c8aee1b2b0ea477)
Gert Doering [Fri, 13 Jan 2023 08:07:45 +0000 (09:07 +0100)]
Fix OVPN_DEL_PEER_REASON_TRANSPORT_DISCONNECT breakage on FreeBSD+DCO
commit 67c4eebdae introduces a new peer disconnect reason (transport
disconnected, aka "TCP session closed") which breaks compilation on
FreeBSD - OVPN_DEL_PEER_REASON_TRANSPORT_DISCONNECT not part of the
enum in freebsd_dco.h, and no kernel support for TCP anyway.
This patch is an intermediate bandaid, making the offending code in
multi.c "linux only" while a better solution is discussed.
Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Antonio Quartulli <antonio@openvpn.net>
Message-Id: <20230113080745.82783-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/search?l=mid&q=20230113080745.82783-1-gert@greenie.muc.de Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit cf545d603ecd9fbacc6bd519efaa92d60f944287)
Arne Schwabe [Wed, 11 Jan 2023 13:44:39 +0000 (14:44 +0100)]
Deprecate OCC checking
- Move OCC warnings to debug level. This moves the only useful OCC message
of compress-migrate to D_PUSH
- remove configure option --enable-strict-options
- ignore disable-occ in TLS mode as it is logged under debug now only
disable-occ is now strictly a non-TLS option
- mark opt-verify and disable-occ as deprecated.
Patch v2: change one missed M_WARN to D_OCC
Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20230111134439.1107915-1-arne@rfc2549.org>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25970.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 2104ea62430e4d203f2cd998e053f4192798b9f1)
Not enabled by default with OpenSSL 3, so we don't
see this in our builds.
While here add missing entries to .gitignore (which
is what made me look at engine-key test in the first
place).
Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20230110170257.113527-1-frank@lichtenheld.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25949.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit af25448ee19da5d225a6a1f30f26dc3949ed8921)
Selva Nair [Wed, 11 Jan 2023 06:29:10 +0000 (01:29 -0500)]
Include CE_DISABLED status of remote in "remote-entry-get" response
- The response to the management command "remote-entry-get" is
amended to include the status of the remote entry. The status
reads "disabled" if (ce->flag & DISABLED) is true, "enabled"
otherwise.
- Update and correct the description of this option in
management-notes.txt
Example responses:
In response to "remote-entry-get 0"
0,vpn.example.com,udp,enabled
END
Or, in response to "remote-entry-get all"
0,vpn.example.org,udp,enabled
1,vpn.example.com,udp,enabled
2,vpn.example.net,tcp-client,disabled
END
This helps the management client to show only enabled remotes
to the user.
An alternative would require the UI/GUI to have knowledge of
what makes the daemon set CE_DISABLED (--proto-force,
--htttp-proxy-override etc.).
Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20230111062910.1846688-1-selva.nair@gmail.com>
URL: https://www.mail-archive.com/search?l=mid&q=20230111062910.1846688-1-selva.nair@gmail.com Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit eafbedc583c48fd46405fa0d635c688ce59c3733)
Selva Nair [Thu, 5 Jan 2023 02:27:18 +0000 (21:27 -0500)]
Propagate route error to initialization_completed()
Makes it possible to report management state as CONNECTED,ROUTE_ERROR
instead of CONNECTED,SUCCESS in case of routing errors.
This depends on treating "route already exists" as not
an error which right now works when using netlink on Linux
and IPAPI or iservice on Windows.
For route set via command line there is no easy way to get this
information and current behaviour is unchanged: i.e., the management
state continues to be reported as CONNECTED,SUCCESS.
Status notification to systemd is not affected.
To test on Linux, build with netlink and use a --route option with
an unreachable gateway like:
"--route 192.168.122.0 255.255.255.0 1.1.1.1"
Notes:
On windows, if the route method is "exe", setting a route
that exists *may* get logged as error and this patch will lead to
a slightly misleading CONNECTED,ROUTE_ERROR state message. This is
considered tolerable as no one should be using "exe" (i.e. route.exe)
as the route method.
Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20230105022718.1641751-3-selva.nair@gmail.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25884.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit e04c253618ce2a1bb0996a67b81af891e8607fa9)
Arne Schwabe [Tue, 10 Jan 2023 01:59:01 +0000 (02:59 +0100)]
Add connect-freq-initial option to limit initial connection responses
This limits the number of packets OpenVPN will respond to. This avoids
OpenVPN servers being abused for refelection attacks in a large scale
as we gotten a lot more efficient with the cookie approach in our
initial connection handling.
The defaults of 100 attempts per 10s should work for most people,
esepcially since completed three way handshakes are not counted. So
the default will throttle connection attempts on server with high packet
loss or that are actually under a DOS.
The 100 per 10s are similar in size to the old 2.5 and earlier behaviour
where every initial connection attempt would take up a slot of the
max-clients sessions and those would only expire after the TLS timeout.
This roughly translates to 1024 connection attempts in 60s on an
empty server.
OpenVPN will announce once per period when starting to drop packets and
ultimatively how many packets it dropped:
Connection Attempt Note: --connect-freq-initial 100 10 rate limit
exceeded, dropping initial handshake packets for the next 10 seconds
Connection Attempt Dropped 217 initial handshake packets due to
--connect-freq-initial 100 10
to inform an admin about the consequences of this feature.
Patch v2: use strtol instead of atoi to be able to differentiate between
an error parsing and parsing 0. Use int64_t instead int to
avoid overflow errors.
Patch v3: Add message when we start dropping. Add a few fixes to the logic.
improve docs
Gert Doering [Sat, 7 Jan 2023 16:25:58 +0000 (17:25 +0100)]
Undo FreeBSD 12.x workaround on IPv6 ifconfig for 12.4 and up
commit 5e19cc2c1bf22d introduced a workaround for a race condition
that showed itself on IPv6 ifconfig on FreeBSD 12.x - sometimes breaking
IPv6 connectivity on tun/tap interfaces.
This was fixed on the FreeBSD side in 12.4, 13.1 and up, and 13.0 is
no longer supported. So conditionalize the workaround on "12.0..12.3",
to be fully removed later when 12.3 is also running out of support.
v2: fix version number comparison
Trac: 1226
Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20230107162558.59659-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25911.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 16d7f2cd4d904274580b2f031e92dde2f7f260c9)
Selva Nair [Fri, 6 Jan 2023 15:04:12 +0000 (10:04 -0500)]
Distinguish route addition errors from route already exists
When possible, functions that add a route now return 1 on success,
or 2 if route already exists or 0 on other errors instead of true/false.
Note:
net_route_v4/v6_add using netlink filters out EEXIST before returning
this looks like a bug as add_route() and add_route_ipv6() should set
RT_ADDED only if route was really added.
v2: "succeeded/skipped" --> "succeeded" in log.
Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Lev Stipakov <lstipakov@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20230106150412.1667492-1-selva.nair@gmail.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25903.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 9c6d72c783f4212f965e1e855b4fdb0ea34b595b)
Lev Stipakov [Mon, 9 Jan 2023 11:30:46 +0000 (13:30 +0200)]
tun: move print_windows_driver() out of tun.h
We got warnings from MinGW about function being defined
but not used when compiling modules which include tun.h.
This function is not defined as inline, so its definition
should not be in header. Since this is not a performance
critical, no need to make it inline.
Leave declaration in tun.h and move definition to tun.c.
Github: fixes OpenVPN/openvpn#215
Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20230109113046.1678-1-lstipakov@gmail.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25923.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit a0eb1f764df39d9447b666e5a2cbd3aa01b41983)
Selva Nair [Sun, 1 Jan 2023 21:51:07 +0000 (16:51 -0500)]
Assign and honour signal priority order
Signals are ordered as SIGUSR2, SIGUSR1, SIGHUP, SIGTERM, SIGINT
in increasing priority. Lower priority signals are not allowed to
overwrite higher ones.
This should fix Trac #311, #639 -- SIGTER/SIGINT lost during dns
resolution (except for the Windows-specific bug handled in previous commit).
On sending SIGTERM during dns resolution, it still takes several seconds
to terminate as the signal will get processed only after getaddrinfo times
out twice (in phase1 and phase2 inits).
Note: one has to still wait for address resolution to time out as
getaddrinfo() is no interruptible. But a single ctrl-C (and some
patience) is enough.
Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <20230101215109.1521549-4-selva.nair@gmail.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25871.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 3a7257925791a086c1ac88362a8eb422be518b14)
Selva Nair [Fri, 6 Jan 2023 00:54:38 +0000 (19:54 -0500)]
Fix signal handling on Windows
- In win32_signal_get() re-order the check so that Windows
signals are picked up even if signal_received is non-zero
- When management is not active, management_sleep() becomes sleep()
but it is not interruptible by signals on Windows. Fix this by
periodically checking for signal.
Trac: #311 #639 (windows specific part)
Github: Fixes OpenVPN/openvpn#205 (windows specific part)
Note: if stuck in address resolution, press ctrl-C and wait for
getaddrinfo() to timeout.
v2: WIN32 --> _WIN32
add a chunk in management_sleep that was missed by sloppy
conflict-resolution
v3: following review by Lev Stipakov <lstipakov@gmail.com>
win32_sleep()
- Early fallback to Sleep() if no wait handles -- less indentation
- Check signal only if wait-object triggered
- Exit the while loop if not safe to continue
Behaviour of win32_sleep(0) checking signal is retained though may be
redundant
v4: Avoid Sleep(0) and never loop back to wait again if wait-failed
Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Lev Stipakov <lstipakov@gmail.com>
Message-Id: <20230106005438.1664046-1-selva.nair@gmail.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25895.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 22977577ed128ac953e7ebfe30f839bcf651b334)
dco: bail out when no peer-specific message is delivered
multi_process_incoming_dco() is currently partly processing
messages that were actually discarded. This results in a bogus
message being printed:
"Received packet for peer-id unknown to OpenVPN: -1, type 0, reason 2"
Change the flow so that we bail out immediately when we know that no
message was truly delivered by DCO.
Currently this can be verified by chacking that the peed_is is greater
than -1.
Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <20230103202330.1835-2-a@unstable.cc>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25882.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 388e032019ec3674b8294c856039b96fe35e5f32)
Selva Nair [Sun, 1 Jan 2023 21:51:06 +0000 (16:51 -0500)]
Refactor signal handling in openvpn_getaddrinfo
Pass in sig_info struct to use register signal instead of
modifying signal_received.
No functional changes though some may be warranted.
Questions:
- Why are we overwriting SIGUSR1 in this function?
- Why the special interrupted syscall treatment for getaddrinfo?
Its not a syscall, is it?
Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20230101215109.1521549-3-selva.nair@gmail.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25872.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit eff95d500481c7927c5a9edd6b5c0dfa056a0cbb)
Selva Nair [Sun, 1 Jan 2023 21:51:05 +0000 (16:51 -0500)]
Preparing for better signal handling: some code refactoring
- Do not directly update signal_received: always use register_signal()
throw_signal() or signal_reset().
To facilitate this, register_signal() now takes c->sig as an argument
instead of the context c itself, and sig_info struct is passed-in to
functions that need to set a signal.
- openvpn_getaddrinfo() is updated in a following commit as it
could benefit from some logic changes that we may or may not want
to do.
No functional changes.
TODO:
(i) update signal handling in openvpn_getaddrinfo
(ii) enforce signal priority
(iii) fix signal handling on Windows
for 2.7?
(iv) replace system-V signal with POSIX sigaction
Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20230101215109.1521549-2-selva.nair@gmail.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25874.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 05715485b45816e18b52ffb9b47ca22a55abb334)
Selva Nair [Thu, 29 Dec 2022 18:27:39 +0000 (13:27 -0500)]
Cleanup: Close duplicated handles in interactive service
Several handles from openvpn.exe are duplicated in the
service for registering ring buffer memory maps with the
driver. These handles are not required after registration,
as all access is through handles in openvpn.exe. Only the
map base address (send_ring, rceive_ring) need be retained
for later unmapping.
Use local variables for duplicated handles and close them
soon after use.
The struct ring_buffer_handles_t is renamed to ring_buffer_maps_t
as there are no handles in there any longer.
Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Lev Stipakov <lstipakov@gmail.com>
Message-Id: <20221229182739.1477336-2-selva.nair@gmail.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25863.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit a10564c71608dca6172a89dc458e6e23254d600b)
Selva Nair [Thu, 29 Dec 2022 18:27:38 +0000 (13:27 -0500)]
Use undo_lists for saving ring-buffer handles in interactive service
HandleRegisterRingBuffers() in interactive.c did not follow the
the original API of HandleMessage(): a new argument was added
to HandleMessage to pass-in prer-process ring-buffer handles. The
existing undo lists argument is meant for such use.
Rewrite following the original design.
Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Lev Stipakov <lstipakov@gmail.com>
Message-Id: <20221229182739.1477336-1-selva.nair@gmail.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25864.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 6ea9cf8146b1d72aa6a4790bc3ac2b99562b2cac)
options.c: fix format security error when compiling without optimization
error: format not a string literal and no format arguments
[-Werror=format-security]
2309 | msg(M_USAGE, str);
Found by accident, since it only happens without optimization.
Seems the compiler can figure out that this is harmless when
thinking a bit harder about it. Fix anyway.
Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <20221228110752.34060-1-frank@lichtenheld.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25848.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 24fc4ce25432a42170477f21133bb0f25a8a860d)
Gert Doering [Tue, 27 Dec 2022 20:26:14 +0000 (21:26 +0100)]
bandaid fix for TCP multipoint server crash with Linux-DCO
TCP multipoint servers with Linux-DCO can crash under yet-unknown
circumstances where a TCP socket gets handed to the kernel (= userland
shall not acceess it again) but the socket still lands in the event
polling mechanism, and is passed to link_socket_read() with
sock->fd being "-1" (SOCKET_UNDEFINED).
This is a bug, but it happens very unfrequently so not fixed yet.
When this happens, the server gets stuck in an endless loop of
"trying recvfrom(-1, ..), getting an error, looging that error,
continue" until the server's disk is full.
The situation is being made a bit more complex by the dco-win
approach of treating "all kernel sockets as UDP", so the Linux
implementation tries to access the -1 socket as UDP, confusing
the picture more.
As a bandaid to avoid the crash, this patch changes
- socket.h: only do the "if dco_installed, treat as UDP" for WIN32
(link_socket_read())
- socket.c: add ASSERT(sock->fd >= 0); checks to all UDP socket paths
(we should never even hit those as this is a TCP specific problem,
but in the "sock->fd = -1" case, doing a clean server abort is
preferred to "the disk is full with non-helpful logfiles, and then
the server crashes anyway")
- socket.c: in the TCP read function, link_socket_read_tcp(),
check for sock->fd < 0 and trigger "sock->stream_reset = true"
(+ write to the log what happened).
This change will kill this particular TCP client instance (SIGTERM),
but leave the rest of the server running fine - and given that
in our tests this issue seems to be triggered by inbound TCP RST
in just the wrong moment, it seems to be "a properly-sized bandaid".
v2: rebase on top of "move dco_installed back to link_socket"
v3: move sock->fd check inside !residual_fully_formed clause (so
we can still handle already-read packets)
Github: OpenVPN/openvpn#190
Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <20221227202614.2114971-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25844.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit c7416160fb2e5a66d5801e4b789751a7480e6384)
Arne Schwabe [Tue, 27 Dec 2022 14:02:45 +0000 (15:02 +0100)]
Replace realloc with new gc_realloc function
The realloc logic has the problem that it relies on the memory being
deallocated by uninit_options rather than by freeing the gc. This
does not always happen in all code path. Especially the crypto selftest
run by make check will not call uninit_options.
This introduces a gc_realloc function that ensures that the pointer is
instead freed when gc_free is called.
Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20221227140249.3524943-2-arne@rfc2549.org>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25829.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit e7f2169772f90f9bf158a17f5656a6a985e74e31)
Allow skipping multple remotes via management interface
The mamangement command "remote SKIP" is extended with an
optional parameter 'count' > 0. If count is greater than
number of connection entries (len), count % len is used.
On going past the index of the last connection entry,
counting is restarted from the first connection entry.
Without this, use of management-query-remote from a UI is
virtually impractical except when there are only a handful
of remote entries. Skipping the entries one by one takes
a long time when there are many entries to be skipped
(~ 1 second per entry). Use of "remote MOD" is not an
option as change of protocol is not supported.
Management clients can determine the availability of this
feature by checking that the management interface version
is > 3. Older versions will ignore the count parameter and
behave identically to using count = 1.
Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <20210907223614.8574-1-selva.nair@gmail.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22817.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit ec5ffe35a394c44b1ea25b7c10dab7da7d792ef2)
Use a template for 'unsupported management commands' error
The message
"ERROR: The 'foo' commmand is not supported by current daemon mode"
is repeatedly used in manage.c. Move it to a function for uniformity
in messaging.
v3, v3: no change Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <20210907223126.8440-3-selva.nair@gmail.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22814.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit caf1b9030f28a984a0e12dd87b128b428d3683f0)
Currently we allow a max of 64 connection entries and remotes.
A larger number would allow users with 100's of independent
config files for different end points of same provider to
consolidate them to connection entries.
v2,v3: no change
Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <20210907223126.8440-2-selva.nair@gmail.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22816.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 4954beb618e8bf2dc756019d5a36040d791a8f38)
Add remote-count and remote-entry query via management
Selecting the remote host via the management interface
(management-query-remote) provides a restrictive user
experience as there is no easy way to tabulate all available
remote entries and show a list to the user to choose from.
Fix that.
Two new commands for querying the management interface are added:
(i) remote-entry-count : returns the number of remotes specified
in the config file. Example result:
10
END
(ii) remote-entry-get i [j]: returns the remote entry at index i
in the form index,host,port,protocol. Or, if j is present
all entries from index i to j-1 are returned, one per line.
Example result for i = 2:
2,ovpn.example.com,1194,udp
END
Example result for i = 2, j = 4
2,ovpn.example.com,1194,udp
3,ovpn.example.com,443,tcp-client
END
remote-entry-get all: returns all remote entries.
v2: use independent callback functions for the two commands
v3: return results as 0 or more lines terminated by END, as done
for all other similar commands. v1 was fashioned after
pkcs11-id-count and pkcs11-id-get which uses a format not
consistent with the rest of the management commands.
See also management-notes.txt
Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <20210907223126.8440-1-selva.nair@gmail.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22815.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 125263804701f9e62a5a27587e4ea6afdb21f54d)
Arne Schwabe [Sat, 24 Dec 2022 19:42:50 +0000 (20:42 +0100)]
Do not set nl socket buffer size
libnl increases the sizes we pass to 8192 anyway. Currently when we have
a lot of events queued we might run into a NLE_NOMEM message and that
terminates the server. So rather let the kernel decide the buffer sizes.
Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20221224194253.3202231-7-arne@rfc2549.org>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25789.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit b2ca179ce2678115c3a61fd3f843c64c1d059fbc)
Arne Schwabe [Sat, 24 Dec 2022 19:42:47 +0000 (20:42 +0100)]
Move dco_installed back to link_socket from link_socket.info.actual
this change was done in order to be able to differentiate when needing to
use dco and when to use normal socket sendto. Since we want to eventually
completely use the userspace sockets for sending/receiving, we just switch
to always use UDP sendto even if the socket is already installed in the
kernel.
Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20221224194253.3202231-4-arne@rfc2549.org>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25792.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 1413b38d0eacafb6c03c701236fe546f44f39a8d)
Arne Schwabe [Sat, 24 Dec 2022 19:42:45 +0000 (20:42 +0100)]
Rename TM_UNTRUSTED to TM_INITIAL, always start session in TM_INITIAL rather than TM_ACTIVE or TM_INITIAL
Currently we start new session in TM_ACTIVE or TM_INITIAL depending if
we already have an active session in TM_ACTIVE or not.
With this change, all session will be started in TM_INITIAL both initiated
by a peer but also session by ourselves. This simplifies state transitions
and eliminates the wacky state transition that when we have a failed
reneogitiation (and move TM_ACTIVE to TM_LAME_DUCK) that a new session of
a peer starts in TM_ACTIVE rather than TM_INITIAL
This is a squash of two mailing list patches:
Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20221224194253.3202231-2-arne@rfc2549.org>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25798.html Signed-off-by: Gert Doering <gert@greenie.muc.de> Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20221224194253.3202231-3-arne@rfc2549.org>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25795.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 7dcde87b7a4323ffb173576d4559e14fcfe4e627)
Arne Schwabe [Tue, 20 Dec 2022 14:04:58 +0000 (15:04 +0100)]
Make management password check constant time
This changes the password check on the management interface to be constant
time. Normally the management port should not be exposed in a way that
allows an attacker to even interact with it but making the check constant
time as an additional layer of security is always good.
Patch v2: include NUL byte in comparison
Reported-by: Connor Edwards <cedw@pm.me> Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20221220140458.2666637-1-arne@rfc2549.org>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25784.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit e567f34262b0670fd51cbbcb6c6866b046454cee)
Selva Nair [Mon, 19 Dec 2022 14:04:05 +0000 (09:04 -0500)]
Do not include auth-token in pulled option digest
As change in auth-token is common on restart and does not
require tun-reopen, exclude it from the "pulled options digest"
calculation. Without this tun is always re-opened on SIGUSR1
if auth-token is in use which breaks persist-tun.
Github: Fixes OpenVPN/openvpn#200
v2: explcitly filter auth-token and auth-token-user
Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20221219140405.1221341-1-selva.nair@gmail.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25768.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit f778f4f88e56851c0a68205e95110c021f3032b3)
Arne Schwabe [Mon, 19 Dec 2022 17:21:41 +0000 (18:21 +0100)]
Use include "buffer.h" instead of include <buffer.h>
My own non-standard cmake based build system found this one. But
even if this is not a problem with the normal autoconf based system
we should still be consistent.
Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20221219172141.2565798-1-arne@rfc2549.org>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25777.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 5bd787bb8fc647f508635b948be75179fbb0b8a5)
Arne Schwabe [Thu, 15 Dec 2022 19:01:43 +0000 (20:01 +0100)]
Deprecate NTLMv1 proxy auth method.
NTLMv1 is ancient and not considered secure anymore and we are not
aware of any users or software still requiring this feature.
Additionally it currently depends on our "doing single DES using
3DES" workaround for OpenSSL (cipher_des_encrypt_ecb). So removing
NTLMv1 will also allow us to remove that workaround.
Reported-By: Trial of Bits (TOB-OVPN-7) Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20221215190143.2107896-9-arne@rfc2549.org>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25731.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit e005b8d1fda1ad1e26fe0dbe7e09184a1f19b553)
Arne Schwabe [Thu, 15 Dec 2022 19:01:42 +0000 (20:01 +0100)]
Fix corner case that might lead to leaked file descriptor
Reported-By: Trail of Bits Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20221215190143.2107896-8-arne@rfc2549.org>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25730.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit a034dc8153522713c3cfda90b2cda114cea70e2d)
Arne Schwabe [Thu, 15 Dec 2022 19:01:41 +0000 (20:01 +0100)]
Remove unused gc_arena
Reported-By: Trail of Bits Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20221215190143.2107896-7-arne@rfc2549.org>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25736.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 97929d16a4eb05cb521a469ff4eaca32761699f3)
Arne Schwabe [Thu, 15 Dec 2022 19:01:40 +0000 (20:01 +0100)]
Eliminate or comment empty blocks and switch fallthrough
These empty blocks are intentional but trigger code checkers and
were pointed out by Trail of Bits in the security audits. Add comments
to them or eliminate them whatever makes more sense.
For fallthrough C23 [1] has a standard way to signal that but we not
adding a C23 feature to our codebase, so use a comment for now.
Arne Schwabe [Thu, 15 Dec 2022 19:01:38 +0000 (20:01 +0100)]
Ensure that argument to parse_line has always space for final sentinel
This fixes two places were we do not have enough space in the array
of parameters given to parse_line for the final NULL parameter that
signal the end of the parsed argument errors.
Both these cases can lead to a buffer overflow. But both of these
cases require root/admin access to OpenVPN:
- parse_argv, only able to trigger if starting openvpn from the command
line, at this point you cannot gain more privileges than you already
have.
Way to reproduce, compile with ASAN and run:
openvpn --tls-verify a a a a a a a a a a a a a a a
- remove_iroutes_from_push_route_list
This operates on the list of pushed entries that is generated
by the server itself. So trigger this, you need to have control
over config, management interface, a plugin or cdd files.
The parse_argv problem was found by Trial of Bits. I found the
remove_iroutes_from_push_route_list problem by looking for similar
problems.
Reported-By: Trial of Bits (TOB-OVPN-4) Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20221215190143.2107896-4-arne@rfc2549.org>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25734.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 749beb6d0cb9f8628997bb656ba2f64e31cac377)
David Sommerseth [Thu, 15 Dec 2022 19:01:37 +0000 (20:01 +0100)]
ssl_verify: Fix memleak if creating deferred auth control files fails
If the key_state_gen_auth_control_files() call fails, the code would
just return without freeing the argv container. Instead the code should
jump to an appropriate exit point where memory is being released.
Also adjust the related comment, to indicate that these deferred auth
control files are really pre-created.
Signed-off-by: David Sommerseth <davids@openvpn.net> Reported-by: Trail of Bits (TOB-OVPN-2) Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20221215190143.2107896-3-arne@rfc2549.org>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25737.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 0567da5377704cf64bd2599f2d49aa478d386941)
Lev Stipakov [Wed, 14 Dec 2022 22:42:20 +0000 (00:42 +0200)]
management: add timer to output BYTECOUNT
BYTECOUNT on management interface is used to display client stats,
for example by openvpn-gui. At the moment BYTECOUNT is sent if
there is a traffic. With DCO, userspace process doesn't see data
channel traffic, BYTECOUNT is not sent and therefore stats
are not updated.
Fix displaying DCO client stats by adding a timer, which is triggerd
every n seconds, where n is set by existing management command
bytecount <n>. Output stats, taking into account stats from DCO,
when timer is triggered.
While on it, simplify bytecount routines call chains - inlining
functions which are used only once.
DCO stats fetching is not yet implemented.
Stats for the server mode (BYTECOUNT_CLI) are unaffected
by this change - to output those in timer callback we would need to
enumerate all peers, and I am not sure we want to output stats
for all peers every <n> seconds.
Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <20221214224220.307-1-lstipakov@gmail.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25707.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit a9991b3eb6644785421398bff8cb3a728d131713)
Marc Becker [Sun, 11 Dec 2022 20:01:08 +0000 (21:01 +0100)]
special handling for PKCS11 providers on win32
Change win32 dynamic loader behavior when supplying an absolute path.
The DLL location is considered/preferred to resolve dependencies.
Support in pkcs11-helper for loader flag is detected at compile time.
3rd party DLLs and additional dependencies do no longer need to be moved
to the OpenVPN directory or require changes to %PATH% configuration.
Signed-off-by: Marc Becker <marc.becker@astos.de> Acked-by: Selva Nair <selva.nair@gmail.com>
Message-Id: <20221211200108.1402-1-marc.becker@astos.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25646.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit e299b8d0d62a4763b20bf9a3bd6aadf414aa89fe)
Marc Becker [Sun, 11 Dec 2022 19:14:03 +0000 (20:14 +0100)]
use new pkcs11-helper interface to add providers
The new interface in pkcs11-helper 1.28 allows decoupling of provider
registration and initialization.
This allows modifying more (and future) properties apart from the
6 fixed ones supported as arguments to pkcs11h_addProvider().
With the new interface it is easier to see (from a code perspective)
which option is set to which value.
It's also not necessary to supply values for built-in defaults:
- slot_event_method=PKCS11H_SLOTEVENT_METHOD_AUTO
- slot_poll_interval=0
Signed-off-by: Marc Becker <marc.becker@astos.de> Acked-by: Selva Nair <selva.nair@gmail.com>
Message-Id: <20221211191403.805-1-marc.becker@astos.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25643.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 45d9b0210a22353e587c29c5d3c3990346a4a189)
Max Fillinger [Wed, 14 Dec 2022 15:34:14 +0000 (16:34 +0100)]
Fix message for too long tls-crypt-v2 metadata
The current code only checks if the base64-encoded metadata is at most
980 characters. However, that can encode up to 735 bytes of data, while
only up to 733 bytes are allowed. When passing 734 or 735 bytes, openvpn
prints a misleading error message saying that the base64 cannot be
decoded.
This patch checks the decoded length to show an accurate error message.
v2: Remove now-unused macro and fix an off-by-one error.
Signed-off-by: Max Fillinger <maximilian.fillinger@foxcrypto.com> Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <20221214153414.12671-1-maximilian.fillinger@foxcrypto.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25694.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 860bf4bf9248077259690a518925ecc14da4b320)
Lev Stipakov [Wed, 14 Dec 2022 13:28:35 +0000 (15:28 +0200)]
Rename dco_get_peer_stats to dco_get_peer_stats_multi
Existing API and implementation (FreeBSD only) are designed for
server usage. Rename it to *_multi to indicate that and not to mix
with upcoming client API/implementation.
Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20221214132835.1010-1-lstipakov@gmail.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25690.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 6dbf8352ef2151dfdee7f02ccbdd9560b3e2be75)
Kristof Provost [Mon, 5 Dec 2022 16:41:02 +0000 (17:41 +0100)]
Read the peer deletion reason from the kernel
Recent FreeBSD kernels supply a reason for the OVPN_NOTIF_DEL_PEER
notification. Parse this from the nvlist so we can distinguish
user-requested removals from timeouts.
Signed-off-by: Kristof Provost <kprovost@netgate.com> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20221205164103.9190-4-kprovost@netgate.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25617.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 10ea19092ded38ff25a445f987ad948aa9eac49f)
Kristof Provost [Mon, 5 Dec 2022 16:41:01 +0000 (17:41 +0100)]
dco: Update counters when a client disconnects
When the kernel module (Linux or FreeBSD) notifies us that a peer has
disconnected we'd like to get a final count of the in/out bytes for that
peer.
We can't request that information any more, because the kernel has
already removed the peer at that point.
Have the kernel send that information as part of the "delete peer"
notification, and update the counters a final time.
This implements the FreeBSD-specific DCO code, but not the
Linux-specific code. It will simply add 0 to the count on Linux.
Signed-off-by: Kristof Provost <kprovost@netgate.com> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20221205164103.9190-3-kprovost@netgate.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25614.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 6674963debfb88c0dd3dd4eae4533010ffc319b1)
Arne Schwabe [Tue, 13 Dec 2022 22:54:30 +0000 (23:54 +0100)]
Set DCO_NOT_INSTALLED also for keys not in the get_key_scan range
We have 6 key slots but normally only consider 3 of them to be
active/valid keys. Especially the secondary key of TM_LAME_DUCK can
in rare corner cases have a key that is still installed in the kernel.
While this should not cause any issues since I do not see way for this
key to become active ever again, it is better to keep the state correctly.
Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Antonio Quartulli <antonio@openvpn.net>
Message-Id: <20221213225430.1892940-3-arne@rfc2549.org>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25681.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 4cf7409e82580f2890c391372d60ed713ba4650c)
Arne Schwabe [Tue, 13 Dec 2022 22:54:29 +0000 (23:54 +0100)]
Trigger a USR1 if dco_update_keys fails
When dco_update_keys fails, we are in some weird state that we are
unlikely to recover since what userspace and kernel space think of
the keys is very likely to not in sync anymore. So abandon the
connection if this happens.
Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Antonio Quartulli <antonio@openvpn.net>
Message-Id: <20221213225430.1892940-2-arne@rfc2549.org>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25679.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 419051c96e9fb1f3202fd67733aa3b6a4bbc3181)
Kristof Provost [Mon, 5 Dec 2022 16:41:00 +0000 (17:41 +0100)]
Read DCO traffic stats from the kernel
When DCO is active userspace doesn't see all of the traffic, so when we
access these stats we must update them.
Retrieve kernel statistics every time we access the
link_(read|write)_bytes values.
Introduce a dco_(read|write)_bytes so that we don't clobber the existing
statistics, which still count control packets, sent or received directly
through the socket.
Signed-off-by: Kristof Provost <kprovost@netgate.com> Acked-by: Antonio Quartulli <antonio@openvpn.net>
Message-Id: <20221205164103.9190-2-kprovost@netgate.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25618.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit ce2b459dabc29d071be28b8ddaa0512f8c8143ec)
Arne Schwabe [Thu, 8 Dec 2022 15:31:29 +0000 (16:31 +0100)]
Ignore connection attempts while server is shutting down
Currently we still allow clients to connect while the server is waiting
to shut down. This window is very small (2s) and is only used when
explicit-exit-notify is enabled on the server side.
The chance of a client connecting during this time period is very low
unless someone puts something stupid like --connect-retry 1 3 into his/her
client config and forces the client to reconnect during this time period.
Github: OpenVPN/openvpn#189
Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20221208153129.1207228-1-arne@rfc2549.org>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25638.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 7d0a90335fe79a352456f262ce42ea501796ae87)
Max Fillinger [Sat, 26 Nov 2022 16:26:47 +0000 (17:26 +0100)]
Correct tls-crypt-v2 metadata length in man page
The manual page claims that the client metadata can be up to 735 bytes
(encoded as upt to 980 characters base64), but the actual maximum length
is 733 bytes which is also encoded as 980 characters in base64.
Signed-off-by: Max Fillinger <maximilian.fillinger@foxcrypto.com> Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <20221126162648.150678-1-maximilian.fillinger@foxcrypto.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25546.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 0bd2fa38fb70ad9022c05ffa67b2bd8751ca5a5b)
So Linux basically has a 16 bit uint16 instead of two uint8_t. Because
s390x is big endian, this happens to be same in memory layout as on all
BSDs with first byte being 0 and second byte being the family.
Introduce a second array to check against, if we are on little endian
Linux.
This is a bit fragile but this is also just a unit test.
This also fixes compiling test_pkt with windows.
Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20221207140259.1083577-1-arne@rfc2549.org>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25633.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 0f904615bd2eac9d246055ff1ca4e4da95586f86)
P2P mode with pre-shared key is deprecated, unsecure and should NOT be
used. This said we still carry it around for a bit and we have to make
sure it does not fight with DCO.
Disable DCO at all when --secret is specified.
Github: OpenVPN/openvpn#188
Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20221207100201.6467-1-a@unstable.cc>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25629.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit f5febf7f8998e425afb051cd6f965f4dd40b1659)
Arne Schwabe [Tue, 6 Dec 2022 13:36:47 +0000 (14:36 +0100)]
Fix connection cookie not including address and fix endianness in test
We accidentially checked the adress family size instead of the address
family.
For unit test checks we need to consider endianess to ensure the hmac
for the adress is always the same. The real code does not care about
endian since it only needs it to be same on the same architecture.
Converting the session to endianess is strictly speaking unecessary
for the actual function of the function but is almost no overhead
and makes the unit testing more robust.
Reported by David trying to the package on Red Hat/s390x and painfully
debugged by setting up a s390x qemu machine that takes 40s just to
run ./configure.
Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20221206133647.954724-1-arne@rfc2549.org>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25619.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 67bef0357280040b83f2185c91c4f830ba542d6b)
Arne Schwabe [Thu, 1 Dec 2022 11:01:28 +0000 (12:01 +0100)]
Allow reconnecting in p2p mode work under FreeBSD
This commit consists of two parts.
- explicitly removing an existing peer in p2p mode
- ignoring the ping timeout notification that is generated by the first
part
Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20221201110128.271064-1-arne@rfc2549.org>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25602.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
Arne Schwabe [Wed, 30 Nov 2022 16:57:12 +0000 (17:57 +0100)]
Signal USR1 when connection initialising fails
When we fail initialisation the connection (e.g. P2P cipher NCP), we have
a non-working connection. Even though previous version would then stay in
this state, it does not really make sense to be in this state until the
keepalive timeout expires and triggers a USR1 anyway.
Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20221130165712.159683-1-arne@rfc2549.org>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25596.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
Arne Schwabe [Wed, 30 Nov 2022 16:57:05 +0000 (17:57 +0100)]
Introduce connection state for reconnecting peer in p2p
We introduce this state to make the reconnecting of a client more
obvious and what is called again instead of making it implicit. The
new state CAS_RECONNECT_PENDING is between CAS_WAITING_OPTIONS_IMPORT and
CAS_CONNECT_DONE as we need to redo some of the steps of the connection
setup, so this new state is going a "half step" back in the state machine.
We also do no longer generate data channel keys for untrusted session. This
is done for clarity but also to allow them being generated after the
session has become actually active.
These changes allow a reconnect in p2p mode with DCO to work as the initial
reconnect working.
Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20221130165705.159610-1-arne@rfc2549.org>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25595.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
projects / thirdparty / openvpn.git / log
