From: Gert Doering Date: Mon, 24 Mar 2025 18:27:26 +0000 (+0100) Subject: Make 'lport 0' no longer sufficient to do '--bind'. X-Git-Tag: v2.7_alpha1~52 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c91948a0e03f0ad03e7fdde59ed9fce87ba00885;p=thirdparty%2Fopenvpn.git Make 'lport 0' no longer sufficient to do '--bind'. 'lport ' used to trigger 'do socket bind', which is not useful in itself for the 'lport 0' case (port 0 -> OS assigns a random port, as it is done for unbound sockets) unless also binding to a particular local IP address ('--local 192.0.2.1'). The trigger for 'lport has been used, do socket bind' is ce.local_port_defined -> change the code to test for "0", and only set this for non-0 ports (NOTE: this is a string match, so if you really really want the old "lport 0" behaviour, using "lport 00" still does that...). The ce.local_port value is still set, so '--lport 0' together with '--local 192.0.2.1' will give you a random port number bound to that IP address - without 'lport 0' it would default to 1194 or the value of '--port' (if not using '--rport'). Summary: socket bind is now only done if one of these is set - --lport with not "0" - --bind (default on the client is "--nobind") - --local
Github: schwabe/ics-openvpn#1794 Change-Id: I1976307a7643c82f31d55ca32c79cbe64b6fffc6 Signed-off-by: Gert Doering Acked-by: Arne Schwabe Message-Id: <20250324182735.12657-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg31222.html Signed-off-by: Gert Doering --- diff --git a/doc/man-sections/link-options.rst b/doc/man-sections/link-options.rst index d48021e01..287473e89 100644 --- a/doc/man-sections/link-options.rst +++ b/doc/man-sections/link-options.rst @@ -122,7 +122,9 @@ the local and the remote host. --lport port Set default TCP/UDP port number. Cannot be used together with - ``--nobind`` option. + ``--nobind`` option. A port number of ``0`` is only honoured to + achieve "bind() to a random assigned port number" if a bind-to IP + address is specified with ``--local``. --mark value Mark encrypted packets being sent with ``value``. The mark value can be diff --git a/src/openvpn/options.c b/src/openvpn/options.c index ab5660919..99dd60ab2 100644 --- a/src/openvpn/options.c +++ b/src/openvpn/options.c @@ -6710,7 +6710,12 @@ add_option(struct options *options, else if (streq(p[0], "lport") && p[1] && !p[2]) { VERIFY_PERMISSION(OPT_P_GENERAL|OPT_P_CONNECTION); - options->ce.local_port_defined = true; + + /* only trigger bind() if port is not 0 (or --local is used) */ + if (!streq(p[1], "0")) + { + options->ce.local_port_defined = true; + } options->ce.local_port = p[1]; } else if (streq(p[0], "rport") && p[1] && !p[2])