From patchwork Thu Aug 18 20:52:50 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Antonio Quartulli X-Patchwork-Id: 2700 Return-Path: Delivered-To: patchwork@openvpn.net Delivered-To: patchwork@openvpn.net Received: from director9.mail.ord1d.rsapps.net ([172.30.191.6]) by backend30.mail.ord1d.rsapps.net with LMTP id 6GYJG54z/2ImdQAAIUCqbw (envelope-from ) for ; Fri, 19 Aug 2022 02:54:22 -0400 Received: from proxy3.mail.ord1d.rsapps.net ([172.30.191.6]) by director9.mail.ord1d.rsapps.net with LMTP id SNMeG54z/2JEHwAAalYnBA (envelope-from ) for ; Fri, 19 Aug 2022 02:54:22 -0400 Received: from smtp35.gate.ord1c ([172.30.191.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by proxy3.mail.ord1d.rsapps.net with LMTPS id iKjXGp4z/2KnVAAA7WKfLA (envelope-from ) for ; Fri, 19 Aug 2022 02:54:22 -0400 X-Spam-Threshold: 95 X-Spam-Score: 0 X-Spam-Flag: NO X-Virus-Scanned: OK X-Orig-To: openvpnslackdevel@openvpn.net X-Originating-Ip: [216.105.38.7] Authentication-Results: smtp35.gate.ord1c.rsapps.net; iprev=pass policy.iprev="216.105.38.7"; spf=pass smtp.mailfrom="openvpn-devel-bounces@lists.sourceforge.net" smtp.helo="lists.sourceforge.net"; dkim=fail (signature verification failed) header.d=sourceforge.net; dkim=fail (signature verification failed) header.d=sf.net; dkim=fail (signature verification failed) header.d=unstable.cc; dmarc=fail (p=none; dis=none) header.from=unstable.cc X-Suspicious-Flag: YES X-Classification-ID: c0c69c7e-1f8b-11ed-ae3e-5452002f485d-1-1 Received: from [216.105.38.7] ([216.105.38.7:49798] helo=lists.sourceforge.net) by smtp35.gate.ord1c.rsapps.net (envelope-from ) (ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id A5/33-29450-D933FF26; Fri, 19 Aug 2022 02:54:22 -0400 Received: from [127.0.0.1] (helo=sfs-ml-1.v29.lw.sourceforge.com) by sfs-ml-1.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1oOvsf-0001r0-TQ; Fri, 19 Aug 2022 06:53:21 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-1.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1oOvse-0001qt-Mq for openvpn-devel@lists.sourceforge.net; Fri, 19 Aug 2022 06:53:20 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-Id:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=KxMlyzq4NCAPDSZ4QKeHyAZ94Zhf8ilvN+emBo1TY+U=; b=kWiutI55qS78KX+FS/w+ifkg2f bLxSKgjHqNqmCahWS5Q7xnqtooiKeZswwjwVmhKVEu5tj7Yds3t72ZGigYdpT9PG8XZD7M33m+XD/ Yy0f5XQbMtvXDIASbrAbRE3+yaMTCq6MhcWMZBdQNEaWL7I6BL2U2j+7M4oSYudT8ZHA=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-Id: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=KxMlyzq4NCAPDSZ4QKeHyAZ94Zhf8ilvN+emBo1TY+U=; b=f/rcsidtTOEDg1ckZ3FJshOt4o LIqlJ8fTMUEPeLeVnBGBbWod22VEXxuXMHyF3wzlnYxnHBNHYfr84nXmQ79C+HtH6XZRsDVl6eJUb 5E3G8N62ZbzK6eKdDNwx7OF6vy0sgjA5cbobkSvvJvgkRNWAAAu3dnspnyJaRYFb28d0=; Received: from wilbur.contactoffice.com ([212.3.242.68]) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1oOvsW-008roW-V7 for openvpn-devel@lists.sourceforge.net; Fri, 19 Aug 2022 06:53:20 +0000 Received: from smtpauth2.co-bxl (smtpauth2.co-bxl [10.2.0.24]) by wilbur.contactoffice.com (Postfix) with ESMTP id 03D79441B; Fri, 19 Aug 2022 08:53:06 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1660891986; s=20220809-q8oc; d=unstable.cc; i=a@unstable.cc; h=From:Cc:Date:Message-Id:In-Reply-To:References:MIME-Version:Content-Transfer-Encoding; l=2951; bh=KxMlyzq4NCAPDSZ4QKeHyAZ94Zhf8ilvN+emBo1TY+U=; b=S0HHbwMN43WZYHlcxIc7cJ8d4ZvDNYDG5vJBpAVtNMaJ8OnRscg88hmSBJhVehNW a3kw5btHHCABZzDWF4gJm2Ns0kyuZXL2ID1lhUGaHgKPtG6CaNlsJ2hMoTw2JQUYF7M oJK+OKBfjU7hQP9N5V3tJj2IFhSTX8EyIL5CEOid1+kILGsq34dRIucsGGnzQ7zEQN1 JquZvHqa9kibwwjpqJPlONE00+owUOgqJ5OCvHLoAEKPc8M/puz91EFyo+SU+G7vUp+ 8S+udoOZ91PhAdYeLJ5exD9exAy2TNkKtZGuUDySLemxP0SBeqyl4VoKy8tjHngn5ep 47/27iJYCA== Received: by smtp.mailfence.com with ESMTPSA ; Fri, 19 Aug 2022 08:53:03 +0200 (CEST) From: Antonio Quartulli To: openvpn-devel@lists.sourceforge.net Date: Fri, 19 Aug 2022 08:52:50 +0200 Message-Id: <20220819065250.222590-1-a@unstable.cc> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20220818100953.191328-1-a@unstable.cc> References: MIME-Version: 1.0 X-Spam-Status: No, hits=-2.9 required=4.7 symbols=ALL_TRUSTED, BAYES_00, T_SCC_BODY_TEXT_LINE device=10.2.0.1 X-ContactOffice-Account: com:375058688 X-Spam-Report: Spam detection software, running on the system "util-spamd-2.v13.lw.sourceforge.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: At the moment dco-win doesn't support --persist-tun and --server, so check for these options at startup time. Signed-off-by: Antonio Quartulli Signed-off-by: Lev Stipakov --- Content analysis details: (-0.9 points, 6.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 SPF_PASS SPF: sender matches SPF record -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at https://www.dnswl.org/, low trust [212.3.242.68 listed in list.dnswl.org] 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.0 T_SCC_BODY_TEXT_LINE No description available. X-Headers-End: 1oOvsW-008roW-V7 Subject: [Openvpn-devel] [PATCH v104] dco-win: check for incompatible options X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Lev Stipakov , Antonio Quartulli Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox At the moment dco-win doesn't support --persist-tun and --server, so check for these options at startup time. Signed-off-by: Antonio Quartulli Signed-off-by: Lev Stipakov Acked-by: Gert Doering --- Changes from v103: * fix ifdef condition (use || instead of &&) in options.c Changes from v102: * remove platform defined log level and make check_options_ calls on Windows explicit and document why. Changes from v101: * rebased * remove call to dco_check_option_ from verify() and reuse invocation that was already implemented for linux/freebsd in mutate_ce() * hide log level to use in case of option check failure inside dco_win/linux/freebsd.h Changes from v100: * improved commit title/message --- src/openvpn/dco.c | 17 +++++++++++++++-- src/openvpn/options.c | 8 +++++++- 2 files changed, 22 insertions(+), 3 deletions(-) diff --git a/src/openvpn/dco.c b/src/openvpn/dco.c index 08c6fcf7..4190747a 100644 --- a/src/openvpn/dco.c +++ b/src/openvpn/dco.c @@ -225,7 +225,20 @@ dco_update_keys(dco_context_t *dco, struct tls_multi *multi) bool dco_check_startup_option_conflict(int msglevel, const struct options *o) { -#if defined(TARGET_LINUX) +#if defined(_WIN32) + if (o->mode == MODE_SERVER) + { + msg(msglevel, "Only client and p2p data channel offload is supported " + "with ovpn-dco-win."); + return false; + } + + if (o->persist_tun) + { + msg(msglevel, "--persist-tun is not supported with ovpn-dco-win."); + return false; + } +#elif defined(TARGET_LINUX) /* if the device name is fixed, we need to check if an interface with this * name already exists. IF it does, it must be a DCO interface, otherwise * DCO has to be disabled in order to continue. @@ -250,7 +263,7 @@ dco_check_startup_option_conflict(int msglevel, const struct options *o) strerror(-ret), ret); } } -#endif /* if defined(TARGET_LINUX) */ +#endif /* if defined(_WIN32) */ #if defined(HAVE_LIBCAPNG) /* DCO can't operate without CAP_NET_ADMIN. To retain it when switching user diff --git a/src/openvpn/options.c b/src/openvpn/options.c index 2415c1a8..2b0bb20c 100644 --- a/src/openvpn/options.c +++ b/src/openvpn/options.c @@ -3669,10 +3669,16 @@ options_postprocess_mutate(struct options *o, struct env_set *es) "incompatible with each other."); } - /* check if any option should force disabling DCO */ #if defined(TARGET_LINUX) || defined(TARGET_FREEBSD) + /* check if any option should force disabling DCO */ o->tuntap_options.disable_dco = !dco_check_option_conflict(D_DCO, o) || !dco_check_startup_option_conflict(D_DCO, o); +#elif defined(_WIN32) + /* in Windows we have no 'fallback to non-DCO' strategy, so if a conflicting + * option is found, we simply bail out by means of M_USAGE + */ + dco_check_option_conflict(M_USAGE, o); + dco_check_startup_option_conflict(M_USAGE, o); #endif if (dco_enabled(o) && o->dev_node)