dco: check that pulled options are compatible

A server may push options that are not compatible with DCO.
In this case we should log a message and bail out.

Signed-off-by: Antonio Quartulli <a@unstable.cc>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20220804064016.20414-1-a@unstable.cc>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24797.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>

diff --git a/src/openvpn/dco.c b/src/openvpn/dco.c
index b92a0e9c979e7e795810f5a2eb6a89cfeedd9e92..8c22b7ea165ad3d39e8ed5e5fe1fd685c9857b2c 100644 (file)
--- a/src/openvpn/dco.c
+++ b/src/openvpn/dco.c
@@ -370,4 +370,16 @@ dco_check_option_conflict(int msglevel, const struct options *o)
     return true;
 }
 
+bool
+dco_check_pull_options(int msglevel, const struct options *o)
+{
+    if (!o->use_peer_id)
+    {
+        msg(msglevel, "OPTIONS IMPORT: Server did not request DATA_V2 packet "
+            "format required for data channel offload");
+        return false;
+    }
+    return true;
+}
+
 #endif /* defined(ENABLE_DCO) */

diff --git a/src/openvpn/dco.h b/src/openvpn/dco.h
index b926e2369b8462720c9c008d48cabf406afda9bb..fbb359064c1527e01ad8100fcc66903db41fd96d 100644 (file)
--- a/src/openvpn/dco.h
+++ b/src/openvpn/dco.h
@@ -65,6 +65,17 @@ bool dco_available(int msglevel);
  */
 bool dco_check_option_conflict(int msglevel, const struct options *o);
 
+/**
+ * Check whether any of the options pushed by the server is not supported by
+ * our current dco implementation. If so print a warning at warning level
+ * for the first conflicting option found and return false.
+ *
+ * @param msglevel  the msg level to use to print the warnings
+ * @param o         the options struct that hold the options
+ * @return          true if no conflict was detected, false otherwise
+ */
+bool dco_check_pull_options(int msglevel, const struct options *o);
+
 /**
  * Initialize the DCO context
  *
@@ -156,6 +167,12 @@ dco_check_option_conflict(int msglevel, const struct options *o)
     return false;
 }
 
+static inline bool
+dco_check_pull_options(int msglevel, const struct options *o)
+{
+    return false;
+}
+
 static inline bool
 ovpn_dco_init(int mode, dco_context_t *dco)
 {

diff --git a/src/openvpn/init.c b/src/openvpn/init.c
index de8faeb4c99abc79856d45a7cf833a49881fde8c..c327daff15f2e901a8b3ef43d609a685913537d5 100644 (file)
--- a/src/openvpn/init.c
+++ b/src/openvpn/init.c
@@ -2382,6 +2382,15 @@ do_deferred_options(struct context *c, const unsigned int found)
         }
     }
 
+    /* Check if pushed options are compatible with DCO, if enabled */
+    if (dco_enabled(&c->options)
+        && !dco_check_pull_options(D_PUSH_ERRORS, &c->options))
+    {
+        msg(D_PUSH_ERRORS, "OPTIONS ERROR: pushed options are incompatible with "
+            "data channel offload. Use --disable-dco to connect to this server");
+        return false;
+    }
+
     return true;
 }