Lev Stipakov [Mon, 29 Sep 2025 15:28:41 +0000 (17:28 +0200)]
dco-win: fix broken ASSERT in dco_new_key
Commit
e77c343 ("dco_win: In dco_new_key, document size assumptions for the integer casts")
has added an ASSERT on key-id, but didn't take into account that
key-id 0 is a perfectly valid value and is the first key-id. This
essentially broke dco-win.
Fix by adjusting ASSERT to >= 0.
Change-Id: I3b1243461ec9b6e85897f452f78dc4b05f7e126d Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Frank Lichtenheld <frank@lichtenheld.com>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1223
Message-Id: <20250929152841.177424-1-frank@lichtenheld.com>
URL: https://sourceforge.net/p/openvpn/mailman/message/59240115/ Signed-off-by: Gert Doering <gert@greenie.muc.de>
ssl_openssl: Use uint16_t internally for TLS versions
libressl changed the API for the involved functions. Since
uint16_t is a true subset of int it should be safe to switch
to that for all OpenSSL variants.
One trivial drive-by fix in unrelated code to be able
to enable -Wconversion fully for the file. This just
adds a cast where the comment says we intend a cast.
Change-Id: I9ea87531afb553f789289787403900a4758b8e1c Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: MaxF <max@max-fillinger.net>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1212
Message-Id: <20250924150300.29318-1-gert@greenie.muc.de>
URL: https://sourceforge.net/p/openvpn/mailman/message/59238230/ Signed-off-by: Gert Doering <gert@greenie.muc.de>
Gert Doering [Wed, 24 Sep 2025 20:35:52 +0000 (22:35 +0200)]
OpenVPN Release 2.7_beta2
version.m4, ChangeLog, Changes.rst
Changes.rst has not received an "2.7_beta2" section - it has the
"highlevel" overview of what is new in 2.7, but for alpha/beta releases
it's better to look at git log to see what has been added/fixed.
Notable changes beta1 -> beta2 are:
- even more of signed/unsigned related warnings have been fixed
- #pragmas have been added to all to-be-fixed source files, so we can
now always enable -Wconversion to see if new code brings new warnings
(and the CI infra builds with -Werror)
- add proper input sanitation to DNS strings to prevent an attack
coming from a trusted-but-malicous OpenVPN server (CVE: 2025-10680,
affects unixoid systems with --dns-updown scripts and windows using
the built-in powershell call)
- greatly improved event log handling for the Windows interactive service
- this brings build system changes and a new openvpnservmsg.dll
- bugfixes when using multi-socket on windows
(properly recognize that TCP server mode does not work with DCO,
properly handle TCP multi-socket server setups without DCO)
- bring back configuring of IPv4 broadcast addresses on Linux
(also backported to 2.6.15)
- Rename Fox Crypto to Sentyron in copyright notices
- Switch test_ssl certificate from RSA 2048 to secp384r1
(so "make check" runs with OpenSSL set to @SECLEVEL=3)
- repair "--dhcp-option DNS" setting in combination with DHCP (TAP)
or --up scripts (GH issue #839, #840)
- clean up MI prefix handling
- replace all assert() calls with OpenVPN ASSERT()
On Linux (and similar platforms), those options are written to a tmp file,
which is later sourced by a script running as root. Since options are
controlled by the server, it is possible for a malicious server to
execute script injection attack by pushing something like
--dns search-domains x;id
in which case "id" command will be executed as a root.
On Windows, the value of DOMAIN/ADAPTER_DOMAIN_SUFFIX is passed to
a powershell script. A malicious server could push:
--dhcp-option DOMAIN a';Restart-Computer'
and if openvpn is not using DHCP (this is the default, with dco-win driver)
and running without interactive service, that powershell command will be
executed.
Validation is performed in a way that value only contains following
symbols:
[A-Za-z0-9.-_\x80-\0xff]
Reported-By: Stanislav Fort <disclosure@aisle.com>
CVE: 2025-10680
Change-Id: I09209ccd785cc368b2fcf467a3d211fbd41005c6 Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1213
Message-Id: <20250924201601.25304-1-gert@greenie.muc.de>
URL: https://sourceforge.net/p/openvpn/mailman/message/59238367/ Signed-off-by: Gert Doering <gert@greenie.muc.de>
Enable -Wconversion -Wno-sign-conversion by default
Grand-father all known locations of existing errors,
so that -Werror builds still pass and we do not spam
build logs.
Still, this should give us a much better roadmap to
work on these issues one by one while still enabling
the warnings for a lot of code-paths.
In general I did go for least amount of pragmas, so
usually there is only one override per file, covering
ALL of the failures in that file. While this protects
a lot of code that doesn't need it, it also cut down
the amount of pragmas by a lot.
This does cover gcc builds including mingw and clang
builds. Does not cover MSVC.
Once the amount of issues has been suitable reduced
more warnings could be enabled.
Change-Id: Iad5b00c35a1f1993b1fa99e8b945ab17b230ef59 Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Gert Doering <gert@greenie.muc.de>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1168
Message-Id: <20250924122755.14391-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg33181.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
dns: Fix bug in error handling when talking to script
Comparing the result of read/write to a size_t value
is dangerous C. Since ssize_t and size_t have the same
size ssize_t is promoted to size_t, so -1 becomes
size_t max value and is not smaller than the expected
length.
Make sure to compare ssize_t to ssize_t to avoid any
suprises.
We take two values and try to massage them in various
ways. But this function only has one caller and that
puts exactly the same value into both of them. So
simplify the code.
Change-Id: I9cb8aa6ef01445cb99758583aba8ae8f9ded0862 Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Gert Doering <gert@greenie.muc.de>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1209
Message-Id: <20250923160459.32273-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg33176.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
- Includes fixes for
- -Wimplicit-fallthrough=2
(=3 is default but requires replacing all
fallthrough comments)
- -Wmissing-field-initializers
- -Wold-style-declaration
- All other warnings that would need fixes are
disabled for now.
Change-Id: I9ce664d073a4e6a6d433e9e6f986a5086dae8aa1 Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Gert Doering <gert@greenie.muc.de>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1202
Message-Id: <20250923140854.21766-1-gert@greenie.muc.de>
URL: https://sourceforge.net/p/openvpn/mailman/message/59237558/ Signed-off-by: Gert Doering <gert@greenie.muc.de>
Gert Doering [Mon, 22 Sep 2025 08:02:59 +0000 (10:02 +0200)]
Fix t_net.sh / networking_testdriver after 'broadcast' change
Commit 0df0edc49c re-introduced explicit setting of broadcast addresses
for Linux IPv4 interfaces. t_net.sh verifies that the built-in netlink
code (sitnl) achieves the same result as "equivalent" iproute2 statements
- and we missed adjusting of these iproute2 statements (printed by
networking_testdriver). Done.
Change-Id: I5fea6ca1ccadb434b5c4f4b49881524a079a9d15 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Antonio Quartulli <antonio@mandelbit.com>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1203
Message-Id: <20250922080305.18477-1-gert@greenie.muc.de>
URL: https://sourceforge.net/p/openvpn/mailman/message/59236810/ Signed-off-by: Gert Doering <gert@greenie.muc.de>
This fixes a problem that was introduced in OpenVPN 2.5. Previously,
the ifconfig utility was used for adding the local address to an
interface. This utility automatically sets the correct broadcast address
based on the given unicast address and netmask.
Due to switching to iproute and Netlink, this does not happen
automatically any longer, which means that applications that rely on
broadcasts do not work correctly.
This patch fixes this issue both when using iproute (by telling iproute
to set the broadcast address based on the local address and prefix) and
when using Netlink (by calculating the correct broadcast address and
setting it).
Signed-off-by: Sebastian Marsching <sebastian-git-2016@marsching.com> Acked-by: Antonio Quartulli <antonio@openvpn.net>
Message-Id: <20250915110507.20557-1-sebastian-git-2016@marsching.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg33131.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
Introduce msglvl_t to unify msglevel type handling
msglevel was definitely unsigned as the first
argument to msg(), but many parts of the code
had it as signed. So this produced a LOT of
warnings when enabling -Wsign-conversion.
Introduce a msglvl_t typedef and switch all
users to it. This includes any values that
are stored in the msglevel field, including
debug level and mute level.
There is one exception in struct status_output
where -1 is a valid value in the API. Only
positive values are translated into standard
message levels.
Change-Id: Id492cb774c6d022d06bb3cf5fec2a4bdd410e619 Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Gert Doering <gert@greenie.muc.de>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1110
Message-Id: <20250917170428.3310-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg33028.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
Gert Doering [Fri, 19 Sep 2025 11:24:19 +0000 (13:24 +0200)]
fix building of openvpnsrvmsg.dll from eventmsg.mc in mingw builds
commit 06919a60ae61 introduces .mc files that need to be compiled to
.h and .bin by the windows "mc.exe" tool, and from there into a new
.dll. This worked for MSVC builds, did nothing for cmake/mingw builds,
and broke compilation on autoconf/mingw builds.
This patch consists of two parts:
1. add building of openvpnsrvmsg.dll to autoconf/mingw builds
Add logic to configure.ac to find the "windmc" binary in the linux or
mingw variants, add rules to src/openvpnserv/Makefile.am so make knows
what to do.
Libtool is getting in the way when "openvpnsrvmsg.dll" is created as
anything listed in ...BIN or ...LIB, so decare it as "DATA" and make
the necessary rules explicit.
2. fix building of openvpnsrvmsg.dll on cmake/mingw builds
Fix "find_program()" invocation to avoid using "midnight commander"
binary (mc) on Linux (called "windmc" there).
Change from "-Wl,--noentry" to linker invocation that works.
See also:
https://learn.microsoft.com/en-us/cpp/build/creating-a-resource-only-dll?view=msvc-170
Change-Id: I071e8190dac28f429257b8af1c6f9e68f8896bc0 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Frank Lichtenheld <frank@lichtenheld.com>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1197
Message-Id: <20250919112424.24728-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg33083.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
Lev Stipakov [Wed, 17 Sep 2025 09:05:48 +0000 (11:05 +0200)]
openvpnserv: Fix writing messages to the event log
There are two problems with the current implementation:
- due to the code bug, we never display actual error message
corresponding to the Windows error code. We use
FORMAT_MESSAGE_ALLOCATE_BUFFER, in which case we must pass
a pointer to the LPTSTR, not the LPTSTR itself.
- The error is not displayed in the "General" tab, which is very confusing.
One needs to go to the "Details" tab to see what is wrong.
This commit solves both problems. We now display a proper error
message in addition to the text provided by the service ("what went wrong").
While on it, remove trailing symbols ín a safer way.
To display the message in "General" tab, we create a registered message file
(openvpnservmsg.dll), which contains message template. Note that this requires
changes to the installer - we need to install the new DLL and
add a registry entry.
Gert Doering [Wed, 17 Sep 2025 12:07:15 +0000 (14:07 +0200)]
dev-tools/gerrit-send-mail.py: include Gerrit URL into the commit message
We used to reference to one of the mailing list archives as the formal
reference for the patch and the review discussions. With the problematic
reliability of the archives, I've started to manually add the URLs in
the OpenVPN Gerrit to the commits because they give a better reference
and (usually) all the feedback is there in a useful format.
So, enhance this dev-tool script to do this automatically.
Change-Id: Idb137ecbade4b0584a4d74aee34978062e247bc5 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Frank Lichtenheld <frank@lichtenheld.com>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1196
Message-Id: <20250917120720.30738-1-gert@greenie.muc.de>
URL: https://sourceforge.net/p/openvpn/mailman/message/59234672/ Signed-off-by: Gert Doering <gert@greenie.muc.de>
The dco_check_option_ce(), for dco_win, checked only
the global protocol of the current connection entry,
but now it should be extended to the local_list
and since dco_win does not support more than 1
socket, checking the first entry of the local_list
will be enough.
Change-Id: I74e2b6aed3c7454e897db57f777e6a191be3d87f Signed-off-by: Gianmarco De Gregori <gianmarco@mandelbit.com> Acked-by: Lev Stipakov <lstipakov@gmail.com>
Message-Id: <20250912131056.42342-1-frank@lichtenheld.com>
URL: https://sourceforge.net/p/openvpn/mailman/message/59232442/
URL: https://gerrit.openvpn.net/c/openvpn/+/1173 Signed-off-by: Gert Doering <gert@greenie.muc.de>
Lev Stipakov [Fri, 12 Sep 2025 13:22:35 +0000 (15:22 +0200)]
Preserve --dhcp-option values from local config
Commit
2dfc4f8 ("dns: deal with --dhcp-options when --dns is active")
has changed the way how --dhcp-option values are stored. Instead of
storing them directly in tuntap_options, they are now stored in
dns_options->from_dhcp.
Before connect, we save options before --pull is applied, and for that
we call clone_dns_options(). However, this was missing to clone the
"from_dhcp" struct, and as a result, the values of --dhcp-option from
the local config have been lost.
Fix by adding shallow-copying of dhcp_options to clone_dns_options(). It
is safe to do because it only contains fixed-size arrays, scalar types
and pointers to the strings which this struct doesn't own.
dco: add standard mi prefix handling to multi_process_incoming_dco()
Our code generally expects functions that deal with a multi instance
to set up a log prefix at the beginning with set_prefix(mi) and clear
it at the end with clear_prefix().
Add the calls to multi_process_incoming_dco() in a similar way to
what is done for multi_process_incoming_link() - handling "link
events" and "dco events" the same, with correct prefix in the
function and no leftover prefix afterwards.
Github: closes OpenVPN/openvpn#799
Change-Id: I1ad5df0f6785ffe9becd9f83329a9335d1a36f24 Signed-off-by: Antonio Quartulli <antonio@mandelbit.com> Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20250911201222.25382-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg32859.html
URL: https://gerrit.openvpn.net/c/openvpn/+/1116 Signed-off-by: Gert Doering <gert@greenie.muc.de>
On Windows, multi-socket support failed with mixed protocols due
to repeated socket_set() calls, which caused accept() to be triggered
before having an event to process. This fix skips socket_set()
calls for non-UDP sockets in MODE_SERVER inside multi_io_process_flags().
Change-Id: Ia389fcec50fb2bbc0aa5ad41a2c23c17c04e6e9b Signed-off-by: Gianmarco De Gregori <gianmarco@mandelbit.com> Acked-by: Lev Stipakov <lstipakov@gmail.com>
Message-Id: <20250912131207.42597-1-frank@lichtenheld.com>
URL: https://sourceforge.net/p/openvpn/mailman/message/59232443/
URL: https://gerrit.openvpn.net/c/openvpn/+/1174 Signed-off-by: Gert Doering <gert@greenie.muc.de>
Gert Doering [Sun, 7 Sep 2025 21:12:46 +0000 (23:12 +0200)]
replace assert() calls with ASSERT()
OpenVPN's ASSERT() macro will do a bit more than the standard-libc
assert() call, namely print out which function and what expression
failed, before calling _exit(1). Also, it can not be accidentially
compiled-away (-DNDEBUG).
Use of ASSERT() is generally only advised in cases of "this must not
happen, but if it does, it's a programming or state corruption error
that we must know about". Use of assert() is lacking the extra debug
info, and as such, not advised at all.
Change-Id: I6480d6f741c2368a0d951004b91167d5943f8f9d Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: mandree <matthias.andree@gmx.de>
Message-Id: <20250907211252.23924-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg32824.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
Gert Doering [Wed, 3 Sep 2025 17:03:39 +0000 (19:03 +0200)]
OpenVPN Release 2.7_beta1
version.m4, ChangeLog, Changes.rst
Changes.rst has not received an "2.7_beta1" section - it has the
"highlevel" overview of what is new in 2.7, but for alpha/beta releases
it's better to look at git log to see what has been added/fixed.
New features alpha3 -> beta1 are
- a large number of signed/unsigned related warnings have been fixed
- bugfixes in --dns-updown script for linux systems using resolvconf
- rewrite of the management interface "bytecount" infastructure to better
interact with DCO
- PUSH_UPDATE server support (via management interface)
- introduction of route_redirect_gateway_ipv4 and _ipv6 env variables
- speeding up t_client tests by reducing per-test startup delay 3s -> 1s
The biggest noticeable difference in beta1 is the reformatting using
clang-format, leaving uncrustify as that wasn't stable across versions.
Marco Baffo [Wed, 3 Sep 2025 16:48:20 +0000 (18:48 +0200)]
PUSH_UPDATE message sender: enabling the server to send PUSH_UPDATE control messages
Using the management interface you can now target one or more clients
(via broadcast or via cid) and send a PUSH_UPDATE control message
to update some options. See doc/management-notes.txt for details.
Change-Id: Ie82bcc7a8e583de9156b185d71d1a323ed8df3fc Signed-off-by: Marco Baffo <marco@mandelbit.com> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20250903164826.13284-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg32807.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
management: stop bytecount on client disconnection
When a management interface client requests periodic bytecount
notifications, openvpn continues to emit them even after the client has
disconnected. Additionally, upon reconnecting, the client starts
receiving these notifications without having issued a new bytecount
command.
Stop the periodic bytecount operation when the management interface
client disconnects, preventing unnecessary stats polling when using DCO
and ensuring that clients only receive notifications they have
explicitly requested.
Change-Id: I1474d232278433d097baf85352dfc9a79853bad1 Signed-off-by: Ralf Lici <ralf@mandelbit.com> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20250902163514.22339-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg32765.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
dco_linux: validate tun interface before fetching stats
If dco_get_peer_stats() is called with an uninitialized c->c1.tuntap it
results in a segfault. This issue happens when a client who has not
connected to any server:
- has --management and exits,
- has --management and a management interface client issues either
`bytecount` or `status` or
- if SIGUSR2 is sent to it.
Add a check to ensure the tun interface was set up before attempting to
retrieve peer statistics.
Change-Id: I40c11864745cc1619cb9cbf490b168f90feb5eac Signed-off-by: Ralf Lici <ralf@mandelbit.com> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20250902164521.23145-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg32768.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
On messages printed for async DCO events, the currently-set mi prefix
does not (always) belong to the peer that the async messages refer to,
creating confusion.
To avoid this, the M_NOIPREFIX flag is now used along with msglevel.
Change-Id: I84a73d625c79d6a6a19122e48c91960dbe01ec49 Signed-off-by: Gianmarco De Gregori <gianmarco@mandelbit.com> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20250902115954.29021-1-gert@greenie.muc.de>
URL: https://sourceforge.net/p/openvpn/mailman/message/59228149/ Signed-off-by: Gert Doering <gert@greenie.muc.de>
management: resync timer on bytecount interval change
coarse_timer_wakeup tracks when the next timer-driven task will occur.
If a user issues `bytecount n` via the management interface, but the
next scheduled wakeup is more than n seconds away, bandwidth logging
will be delayed until that timer fires.
To ensure timely logging, reset the timer whenever a new `bytecount`
command is received. This guarantees that logging begins exactly n
seconds after the command, matching the user-defined interval.
Change-Id: Ic0035d52e0ea123398318870d2f4d21af927a602 Signed-off-by: Ralf Lici <ralf@mandelbit.com> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20250902160050.18640-1-gert@greenie.muc.de>
URL: https://sourceforge.net/p/openvpn/mailman/message/59228306/ Signed-off-by: Gert Doering <gert@greenie.muc.de>
Lev Stipakov [Tue, 2 Sep 2025 10:36:01 +0000 (12:36 +0200)]
Refactor management bytecount tracking
There are few issues with it:
- when using DCO, the server part doesn't output BYTECOUNT_CLI since
process_incoming_link_part1/process_outgoing_link are not called
- when using DCO, the server part applies bytecount timer to the each
connection, unneccessary making too many calls to the kernel and also
uses incorrect BYTECOUNT output.
- client part outputs counters using timer, server part utilizes
traffic activity -> inconsistency
Following changes have been made:
- Use timer to output counters in client and server mode. Code which
deals with bytecount on traffic activity has been removed. This unifies
DCO and non-DCO, as well as client and server mode
- In server mode, peers stats are fetched with the single ioctl call
- Per-packet stats are not persisted anymore in the client mode during
traffic activity. Instead cumulative stats (including DCO stats) are
persisted when the session closes.
GitHub: closes OpenVPN/openvpn#820
Change-Id: I43a93f0d84f01fd808a64115e1b8c3b806706491 Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20250902103606.22181-1-gert@greenie.muc.de>
URL: https://sourceforge.net/p/openvpn/mailman/message/59228150/ Signed-off-by: Gert Doering <gert@greenie.muc.de>
Lev Stipakov [Tue, 2 Sep 2025 12:25:36 +0000 (14:25 +0200)]
dco-win: add support for multipeer stats
Use the new driver API to fetch per-peer link and VPN byte counters
in both client and server modes.
Two usage modes are supported:
- Single peer: pass the peer ID and a fixed-size output buffer. If the
IOCTL is not supported (old driver), fall back to the legacy API.
- All peers: first call the IOCTL with a small output buffer to get
the required size, then allocate a buffer and call again to fetch
stats for all peers.
Change-Id: I525d7300e49f9a5a18e7146ee35ccc2af8184b8a Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20250902122542.31023-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg32744.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
Gert Doering [Tue, 26 Aug 2025 18:40:38 +0000 (20:40 +0200)]
Introduce env variables to communicate desired gateway redirection to NM.
When run under Network Manager control, OpenVPN is not allowed to
control routing. Instead, NM uses the OpenVPN-set environment variables
("route_network_1" etc) to set up routes as requested. This method never
worked properly for "redirect-gateway", as the information was not made
available in environment variables.
<not set> = no gateway redirection desired
1 = "redirect-gateway for that protocol in question"
2 = "include block-local to redirect the local LAN as well"
We intentionally do not expose all the IPv4 flags ("local", "def1", ...)
as this is really internal OpenVPN historical cruft.
Change-Id: I1e623b4a836f7216750867243299c7e4d0bd32d0 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne-openvpn@rfc2549.org>
Message-Id: <20250826184046.21434-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg32686.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
Arne Schwabe [Tue, 19 Aug 2025 21:22:09 +0000 (23:22 +0200)]
Check message id/acked ids too when doing sessionid cookie checks
This fixes that control packets on a floating client can trigger
creating a new session in special circumstances:
To trigger this circumstance a connection needs to
- starts on IP A
- successfully floats to IP B by data packet
- then has a control packet from IP A before any
data packet can trigger the float back to IP A
and all of this needs to happen in the 60s time
that hmac cookie is valid in the default
configuration.
In this scenario we would trigger a new connection as the HMAC
session id would be valid.
This patch adds checking also of the message-id and acked ids to
discern packet from the initial three-way handshake where these
ids are 0 or 1 from any later packet.
This will now trigger (at verb 4 or higher) a messaged like:
Packet (P_ACK_V1) with invalid or missing SID
instead.
Also remove a few duplicated free_tls_pre_decrypt_state in test_ssl.
Reported-By: Walter Doekes <walter.openvpn@wjd.nu> Tested-By: Walter Doekes <walter.openvpn@wjd.nu>
Change-Id: I6752dcd5aff3e5cea2b439366479e86751a1c403 Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: MaxF <max@max-fillinger.net>
Message-Id: <20250819212214.16218-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg32626.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
Previously we ignored the second argument to --hash-size.
This bug is older than the openvpn git repository, but
clearly this is not an option often used (or at all).
Change-Id: Ibec7ffb9085503f72e79514776042bc310384f13 Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20250822205223.3492-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg32658.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
Gert Doering [Wed, 20 Aug 2025 17:54:53 +0000 (19:54 +0200)]
Remove use of 'dh dh2048.pem' from sample configs, remove 'dh2048.pem' file
Since commit bd9aa06feb41 (Jan 2015) OpenVPN has allowed to use
'--dh none' to disable traditional Diffie Hellman, since more secure
ECDH algorithms are available that do not use explicit DH parameters.
If configured with a suffiently high securelevel (3+), or if running in
FIPS mode, OpenSSL 3.5 will refuse 2048 bit DH files, making our tests
fail.
Thus, remove all the DH2048 stuff from our sample configs.
Github: triggered by OpenVPN/openvpn#819
Change-Id: If66438662bd862a195b2a69c4fa45f63838982b7 Signed-off-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20250820175459.11227-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg32632.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
Heiko Hund [Mon, 18 Aug 2025 16:46:08 +0000 (18:46 +0200)]
dns: fix systemd dns-updown script
In the resolvconf part of the script there was one instance of a dynamic
variable using _* left. The _* ones do not work as the regular ones, but
only when you directly place them within ${!}, not indirectly using a
variable.
Convert the code to use a loop and a check, like in all the other places
in the script.
Change-Id: Id800cad0e92e0abc0d96079fdb5a9d57578e1446 Signed-off-by: Heiko Hund <heiko@ist.eigentlich.net> Acked-by: Frank Lichtenheld <frank@lichtenheld.com>
Message-Id: <20250818164608.39836-1-frank@lichtenheld.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg32621.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
t_client.sh: Do not wait 3 seconds for OpenVPN to come up
On most machines 1 second should be quite enough. Given
that we run currently 23 tests on most t_client runs, this
makes over 40 seconds difference. Not nothing.
We keep the existing 30s maximum wait-time since sometimes
we want to do tests with intentionally slow servers.
Change-Id: Ice8c7ff4d8118a9e6465a4724207a355138360b8 Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20250807203741.31359-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg32585.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
In some cases an actual ColumnLimit leads to unfortunate
formatting. So leave the decision to developers after all.
This commit contains:
- changes that clang-format did as reaction to the config
change
- manual cleanups of these changes
- manual cleanup of some previous changes done
with ColumnLimit 100
Change-Id: Ibd900adfc775b7f785f1d5630184a124f5d8ff4b Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20250805132706.27619-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg32523.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
Lev Stipakov [Sun, 3 Aug 2025 14:49:45 +0000 (16:49 +0200)]
Log setting DNS via NRPT
Unlike other ways of setting DNS, we don't log anything
when we use NRPT. Since dco-win/--dns is the recommended
configuration and it uses NRPT to set DNS, let's log it.
Change-Id: Ib2f30fe69cb676e347e4d59cd2db68db7568ba5b Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20250803144950.21034-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg32480.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
Update GPL header in all source files to current recommended version
This removes the postal address of the FSF and replaces
it with their URL.
Mostly generated with
sed -i -e 's@if not, write to the Free Software Foundation, Inc.,\
@if not, see <https://www.gnu.org/licenses/>.@'
sed -i -e '/51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA/d'
sed -i -e '/59 Temple Place, Suite 330, Boston, MA 02111-1307 USA/d'
With some manual fix-ups afterwards.
Change-Id: Ic3959970fa9ab993e98d4b38c025fd0efc7b92f2 Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20250803145126.23494-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg32481.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
Gert Doering [Thu, 31 Jul 2025 06:51:26 +0000 (08:51 +0200)]
OpenVPN Release 2.7_alpha3
version.m4, ChangeLog, Changes.rst
Changes.rst has not received an "2.7_alpha3" section - it has the
"highlevel" overview of what is new in 2.7, but for alpha/beta releases
it's better to look at git log to see what has been added/fixed.
New features alpha2 -> alpha3 are
- --dns-updown script for macOS
- client-side support for PUSH_UPDATE handling
- support for floating TLS clients when DCO is active
(handling float notifications sent from kernel to userland)
- use of user-defined routing tables on Linux
- PQE support for WolfSSL
Besides new features, alpha3 sees a rewrite of the way kernel events
are handled by the linux DCO module, because under certain circumstances
notifications could get lost, leading to problems later.
Lev Stipakov [Thu, 31 Jul 2025 12:24:05 +0000 (14:24 +0200)]
Fix DNS options duplication on PUSH_UPDATE
Commit
2dfc4f ("dns: deal with --dhcp-options when --dns is active")
has removed reset of tuntap DNS options. Due to that, incoming --dns
options are added to existing ones instead of overwriting them.
It has also added a new storage for --dhcp-option. The push-update
code didn't clear it and as a result, incoming --dhcp-option options
were added to existing ones instead of overwriting them.
Fixed by:
- resetting tuntap DNS options (regression from abovementioned commit)
- clearing dhcp options storage in push-update code
GitHub: fixes OpenVPN/openvpn#804
Change-Id: Ife4d8fc5f8e2183e61226d66a76bbaa02c06f787 Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Heiko Hund <heiko@openvpn.net>
Message-Id: <20250731122410.12200-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg32448.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
Update systemd service name param to match command
The service name displays `%I` which invokes systemd's path mangling
(notably, converting `-` to `/`), suggesting you need to provide an
encoded parameter (via e.g. `systemd-escape`), but the start command
itself uses `%i` which doesn't do the conversion.
This updates the service name to match the start command.
Signed-off-by: Terrance <git@terrance.allofti.me> Acked-by: Frank Lichtenheld <frank@lichtenheld.com>
Message-Id: <20250729180014.11550-2-sourceforge@terrance.allofti.me>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg32423.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
Lev Stipakov [Thu, 31 Jul 2025 10:48:27 +0000 (12:48 +0200)]
Fix --dns options for TAP adapter
Commit
2dfc4f ("dns: deal with --dhcp-options when --dns is active")
has accidentally removed setting of the DHCP_OPTIONS_DHCP_OPTIONAL
flag when copying --dns options. This flag is required to apply options
via DHCP string, which we do for TAP adapter. As a result, --dns options
stopped working for TAP.
Fix by setting this flag when copying --dns options to tuntap_options.
Change-Id: Id95cd14095a03afb3140a03ae96e9f5679e4fe89 Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20250731104833.23305-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg32436.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
Lev Stipakov [Wed, 30 Jul 2025 18:04:26 +0000 (20:04 +0200)]
Fix broken DHCP options
Commit
2dfc4f ("dns: deal with --dhcp-options when --dns is active")
broke support for --dhcp-options. It removed the setting of the
DHCP_OPTIONS_DHCP_OPTIONAL flag for some DHCP options. This flag is
required for those options to be applied correctly, as it is used
when building the DHCP options string that is passed to the TAP driver.
This commit fixes the issue by restoring the setting of this flag.
GitHub: fixes OpenVPN/openvpn#791
Change-Id: I0d75efcceb826d06e74abd003d5377468ff9fe3b Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20250730180527.25339-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg32427.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
To support link-local (IPv6) addresses we must pass the scope to the kernel as
well. We should also extract it from the kernel notification for float events.
Signed-off-by: Kristof Provost <kprovost@netgate.com> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20250729093857.37832-1-kprovost@netgate.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg32401.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
Marco Baffo [Tue, 29 Jul 2025 10:41:01 +0000 (12:41 +0200)]
PUSH_UPDATE: Added update_option() function.
When the function receives an option to update, it first checks whether it has
already received an option of the same type within the same update message.
If it has already received it, it simply calls add_option(), otherwise it
deletes all the values already present for that option first.
Change-Id: Ia45c99e6df7b3ad24020c10b8a9b3577984ecdc2 Signed-off-by: Marco Baffo <marco@mandelbit.com> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20250729104110.27704-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg32408.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
Marco Baffo [Tue, 29 Jul 2025 10:40:50 +0000 (12:40 +0200)]
PUSH_UPDATE: Added remove_option() and do_update().
* Added remove_option() function and some utility functions to remove options at
runtime following the push-update logic.
* Added do_update() function to close and reopen the tun and apply option updates.
Change-Id: I507180d7397b6959844a30908010132bc3411067 Signed-off-by: Marco Baffo <marco@mandelbit.com> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20250729104056.27634-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg32407.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
Marco Baffo [Tue, 29 Jul 2025 10:40:39 +0000 (12:40 +0200)]
PUSH_UPDATE: Allow OpenVPN in client mode to receive and handle PUSH UPDATE control messages to allow options updating at runtime.
* Added IV_PROTO_PUSH_UPDATE flag bit to support push-updates.
* Added process_incoming_push_update(), in a separate file to create tests more easily.
* Modified incoming_push_message(), process_incoming_push_msg(), apply_push_options(),
apply_pull_filter() to process also push-update messages.
* Added the check_push_update_option_flags() function used in apply_pull_filter() to
check options formatting inside push-update messages, if the options are updatables
and to check for '?' and '-' flags that may be present in front of the options.
The '-' flag is used to indicate that the option in question should be removed,
while the '?' indicates that the option is optional and to do not generate
errors if the client cannot update that option.
For more info you can read the RFC at https://github.com/OpenVPN/openvpn-rfc .
* Created some unit tests for the push-update message handling in test_push_update_msg.c.
Change-Id: I6ecd4cb47571cc8c20e46de8595c742aeec6064a Signed-off-by: Marco Baffo <marco@mandelbit.com> Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20250729104045.27582-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg32406.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
projects / thirdparty / openvpn.git / log
