From: Antonio Quartulli <a@unstable.cc>
Date: Thu, 4 Aug 2022 06:40:16 +0000 (+0200)
Subject: dco: check that pulled options are compatible
X-Git-Tag: v2.6_beta1~139
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=46f6a7e8b6daf02bebe4a46498665274f1673ac0;p=thirdparty%2Fopenvpn.git

dco: check that pulled options are compatible

A server may push options that are not compatible with DCO.
In this case we should log a message and bail out.

Signed-off-by: Antonio Quartulli <a@unstable.cc>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20220804064016.20414-1-a@unstable.cc>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24797.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>
---

diff --git a/src/openvpn/dco.c b/src/openvpn/dco.c
index b92a0e9c9..8c22b7ea1 100644
--- a/src/openvpn/dco.c
+++ b/src/openvpn/dco.c
@@ -370,4 +370,16 @@ dco_check_option_conflict(int msglevel, const struct options *o)
     return true;
 }
 
+bool
+dco_check_pull_options(int msglevel, const struct options *o)
+{
+    if (!o->use_peer_id)
+    {
+        msg(msglevel, "OPTIONS IMPORT: Server did not request DATA_V2 packet "
+            "format required for data channel offload");
+        return false;
+    }
+    return true;
+}
+
 #endif /* defined(ENABLE_DCO) */
diff --git a/src/openvpn/dco.h b/src/openvpn/dco.h
index b926e2369..fbb359064 100644
--- a/src/openvpn/dco.h
+++ b/src/openvpn/dco.h
@@ -65,6 +65,17 @@ bool dco_available(int msglevel);
  */
 bool dco_check_option_conflict(int msglevel, const struct options *o);
 
+/**
+ * Check whether any of the options pushed by the server is not supported by
+ * our current dco implementation. If so print a warning at warning level
+ * for the first conflicting option found and return false.
+ *
+ * @param msglevel  the msg level to use to print the warnings
+ * @param o         the options struct that hold the options
+ * @return          true if no conflict was detected, false otherwise
+ */
+bool dco_check_pull_options(int msglevel, const struct options *o);
+
 /**
  * Initialize the DCO context
  *
@@ -156,6 +167,12 @@ dco_check_option_conflict(int msglevel, const struct options *o)
     return false;
 }
 
+static inline bool
+dco_check_pull_options(int msglevel, const struct options *o)
+{
+    return false;
+}
+
 static inline bool
 ovpn_dco_init(int mode, dco_context_t *dco)
 {
diff --git a/src/openvpn/init.c b/src/openvpn/init.c
index de8faeb4c..c327daff1 100644
--- a/src/openvpn/init.c
+++ b/src/openvpn/init.c
@@ -2382,6 +2382,15 @@ do_deferred_options(struct context *c, const unsigned int found)
         }
     }
 
+    /* Check if pushed options are compatible with DCO, if enabled */
+    if (dco_enabled(&c->options)
+        && !dco_check_pull_options(D_PUSH_ERRORS, &c->options))
+    {
+        msg(D_PUSH_ERRORS, "OPTIONS ERROR: pushed options are incompatible with "
+            "data channel offload. Use --disable-dco to connect to this server");
+        return false;
+    }
+
     return true;
 }