From patchwork Wed Feb 21 11:17:22 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Frank Lichtenheld X-Patchwork-Id: 3627 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7001:a416:b0:559:d8ef:cc57 with SMTP id vo22csp2350966mab; Wed, 21 Feb 2024 03:18:10 -0800 (PST) X-Forwarded-Encrypted: i=2; AJvYcCXE+9/BWNy3kURFEuMAoWBMOXwuwNax9F2We4Bus6T5jYbnNkfKRBc8CuexY58Bw2O78KEdjiHV9lb/j2NiLHEkdc2VjM4= X-Google-Smtp-Source: AGHT+IFbyKuR3Z7FCAz6NZGoDxlAE0iEbrDuvguwRe0P21m5uelXXiNoG4kyTJBS8AaxdFpe6RFq X-Received: by 2002:a05:6a00:1c9c:b0:6e4:8008:acbf with SMTP id y28-20020a056a001c9c00b006e48008acbfmr4125718pfw.2.1708514290693; Wed, 21 Feb 2024 03:18:10 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1708514290; cv=none; d=google.com; s=arc-20160816; b=pW3SxLwVCm7pm9YLp0IJaMe2qx7qOS80j09l2bmrUDoGDow/6Sz55IbbUEHiuESjbd 47XzkKO4SqrWgCGtFo6dgtB4gJQ1tIi0HqinpwWHwnJDfhifSEhweXzf97Uc2ROa6DwL 4WEr9XlR6ezfxxO4usptELn6OvpXOWx4UtdlV5qQoJvt4jIXeNhQUqr/uC0CmGHnUo7z dBkx77JqhjHnsa4FEVDWKrrBvR47wW0E6IAPApNx0+nie4ghfmgqVtL20HQgIU/E9mks WJ/wjlih9huT2c01CGCAD+pJyn7C0RhpTYcIb8fqgJ8ObHL/oqmXvLs2oaPxzAwAyrjG NDow== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=h5lP2gFU8reom89J5Q8SHExtIssxVHDU1OkFrMmZ5Ls=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=EFrA/x7c2QarSgy9WIqI6CeF+MnlJqFB5aWkAP3CFMKxK7+2QUVaDFJIhm6JzY1fFU WbaXrMhVGkR4JiGfNP53LBJxx57VelLASuzoF2jBFExaUuyBUd+y40CEhj7Xp7I1z48l 3Osx3WCr2KLzXAIOx70LcB7q8ZcYnjowGSbTX99QGTsaoHw0031ogmVDAPIrqcyrM+tt xnc9h8imfpXRmgD3zb7YkBxC30rhF5XMil6qCCbaTa0NMFIyj7lFZpuQ1F2xRftFkLnW G6SC1szaeyeLZY1ojANmj8jl/sSO3x6OM6xtY7IZxCkY8iYonX4IZimIMTygzRiY+rBg DV/Q==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=ZGbqsjmn; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b="FNmHB/dp"; dkim=neutral (body hash did not verify) header.i=@lichtenheld.com header.s=MBO0001 header.b=b5HitMan; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id y68-20020a636447000000b005dc359329fasi7954711pgb.23.2024.02.21.03.18.10 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 21 Feb 2024 03:18:10 -0800 (PST) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=ZGbqsjmn; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b="FNmHB/dp"; dkim=neutral (body hash did not verify) header.i=@lichtenheld.com header.s=MBO0001 header.b=b5HitMan; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from [127.0.0.1] (helo=sfs-ml-2.v29.lw.sourceforge.com) by sfs-ml-2.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1rckbg-0003mk-2T; Wed, 21 Feb 2024 11:17:44 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-2.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1rckbe-0003mS-1P for openvpn-devel@lists.sourceforge.net; Wed, 21 Feb 2024 11:17:42 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-Id:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=UebsJ8gIcBy6UE+ZOPV644wUiuZ+yuZfznCIkDLB6QA=; b=ZGbqsjmnHHfHLf/pm3+gagJQqh 5BW+IkY8s3qONld2416hB4l+KaHvpdyvB9qnzaCgjdWHJlwBpYuaqnVnBmEdqCw1LspnY+fIP61bt m+ARQhUvXpSiYMY87tlLXgr6EX/0E1nNkDzrsPzos9DwM9eC3XpeJIxCCbBDcSLMTBmU=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-Id: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=UebsJ8gIcBy6UE+ZOPV644wUiuZ+yuZfznCIkDLB6QA=; b=FNmHB/dpBCp6k9yAK6eVtbpqMq A6n+yxJfeFyT8X1JMc1LeBGZINO8IwDps7G6QPQu7K9zZ0s2gV+44wsVPkTbpp4hZ+QPQyiAC0nE6 kN2VgAI7SpQT/yeHePkTZDpu9jcBFPyJ6nd+/WUb9UtNNSmGgtHGFaeNYWFQMb3XjoSA=; Received: from mout-p-102.mailbox.org ([80.241.56.152]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1rckbY-0000WU-Hm for openvpn-devel@lists.sourceforge.net; Wed, 21 Feb 2024 11:17:42 +0000 Received: from smtp2.mailbox.org (smtp2.mailbox.org [IPv6:2001:67c:2050:b231:465::2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-p-102.mailbox.org (Postfix) with ESMTPS id 4Tftz803w0z9sZT; Wed, 21 Feb 2024 12:17:24 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lichtenheld.com; s=MBO0001; t=1708514244; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=UebsJ8gIcBy6UE+ZOPV644wUiuZ+yuZfznCIkDLB6QA=; b=b5HitManofEa9VY86C8OFwk6t0q5Jc5J38RkA8MxQmWlng88wkOnwbv1oBKTI2FaGF27ci fAcHMgPb9p/Ix9Q2L5PZpCNVIKc3I4DBL+bKsA1dF00laHn3DAnPncP8xDma86w3xcD1Yi JlsVKEI29j6rresCWqu4fn5+vp3/juqvoVtq0vEmokyqj/CQLnG/R4bSlIz+kcg4/2KLJP dbYxVg+BhLnJCsqwlvccJG7JKm5UK4R49JXh4IBKu9IMec1DmnPYHH+u3tMstwzQc3oJyF nBABe0fAuOFrvK1DxS39jvN/ZUBTlc+KhLAM4JeWrjOnmWujiRkPS0IT/7nhtA== From: Frank Lichtenheld To: openvpn-devel@lists.sourceforge.net Date: Wed, 21 Feb 2024 12:17:22 +0100 Message-Id: <20240221111722.927042-1-frank@lichtenheld.com> In-Reply-To: References: MIME-Version: 1.0 X-Rspamd-Queue-Id: 4Tftz803w0z9sZT X-Spam-Score: -0.9 (/) X-Spam-Report: Spam detection software, running on the system "util-spamd-2.v13.lw.sourceforge.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Gianmarco De Gregori Removed if-guard checking if any feature is enabled before performing per-feature check. It doesn't save us much but instead introduces uneeded complexity. Content analysis details: (-0.9 points, 6.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at https://www.dnswl.org/, low trust [80.241.56.152 listed in list.dnswl.org] 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record -0.0 SPF_PASS SPF: sender matches SPF record 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.0 T_SCC_BODY_TEXT_LINE No description available. X-Headers-End: 1rckbY-0000WU-Hm Subject: [Openvpn-devel] [PATCH v2] Minor fix to process_ip_header X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: =?utf-8?q?1791507080768391696?= X-GMAIL-MSGID: =?utf-8?q?1791507080768391696?= From: Gianmarco De Gregori Removed if-guard checking if any feature is enabled before performing per-feature check. It doesn't save us much but instead introduces uneeded complexity. While at it, fixed a typo IMCP -> ICMP for defined PIPV6_ICMP_NOHOST_CLIENT and PIPV6_ICMP_NOHOST_SERVER macros. Fixes: Trac https://community.openvpn.net/openvpn/ticket/269 Change-Id: I4b5e8357d872c920efdb64632e9bce72cebee202 Signed-off-by: Gianmarco De Gregori Acked-by: Frank Lichtenheld --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/525 This mail reflects revision 2 of this Change. Acked-by according to Gerrit (reflected above): Frank Lichtenheld diff --git a/src/openvpn/forward.c b/src/openvpn/forward.c index 0443ca0..556c465 100644 --- a/src/openvpn/forward.c +++ b/src/openvpn/forward.c @@ -1460,7 +1460,7 @@ * us to examine the IP header (IPv4 or IPv6). */ unsigned int flags = PIPV4_PASSTOS | PIP_MSSFIX | PIPV4_CLIENT_NAT - | PIPV6_IMCP_NOHOST_CLIENT; + | PIPV6_ICMP_NOHOST_CLIENT; process_ip_header(c, flags, &c->c2.buf); #ifdef PACKET_TRUNCATION_CHECK @@ -1644,73 +1644,60 @@ } if (!c->options.block_ipv6) { - flags &= ~(PIPV6_IMCP_NOHOST_CLIENT | PIPV6_IMCP_NOHOST_SERVER); + flags &= ~(PIPV6_ICMP_NOHOST_CLIENT | PIPV6_ICMP_NOHOST_SERVER); } if (buf->len > 0) { - /* - * The --passtos and --mssfix options require - * us to examine the IPv4 header. - */ - - if (flags & (PIP_MSSFIX -#if PASSTOS_CAPABILITY - | PIPV4_PASSTOS -#endif - | PIPV4_CLIENT_NAT - )) + struct buffer ipbuf = *buf; + if (is_ipv4(TUNNEL_TYPE(c->c1.tuntap), &ipbuf)) { - struct buffer ipbuf = *buf; - if (is_ipv4(TUNNEL_TYPE(c->c1.tuntap), &ipbuf)) - { #if PASSTOS_CAPABILITY - /* extract TOS from IP header */ - if (flags & PIPV4_PASSTOS) - { - link_socket_extract_tos(c->c2.link_socket, &ipbuf); - } + /* extract TOS from IP header */ + if (flags & PIPV4_PASSTOS) + { + link_socket_extract_tos(c->c2.link_socket, &ipbuf); + } #endif - /* possibly alter the TCP MSS */ - if (flags & PIP_MSSFIX) - { - mss_fixup_ipv4(&ipbuf, c->c2.frame.mss_fix); - } - - /* possibly do NAT on packet */ - if ((flags & PIPV4_CLIENT_NAT) && c->options.client_nat) - { - const int direction = (flags & PIP_OUTGOING) ? CN_INCOMING : CN_OUTGOING; - client_nat_transform(c->options.client_nat, &ipbuf, direction); - } - /* possibly extract a DHCP router message */ - if (flags & PIPV4_EXTRACT_DHCP_ROUTER) - { - const in_addr_t dhcp_router = dhcp_extract_router_msg(&ipbuf); - if (dhcp_router) - { - route_list_add_vpn_gateway(c->c1.route_list, c->c2.es, dhcp_router); - } - } - } - else if (is_ipv6(TUNNEL_TYPE(c->c1.tuntap), &ipbuf)) + /* possibly alter the TCP MSS */ + if (flags & PIP_MSSFIX) { - /* possibly alter the TCP MSS */ - if (flags & PIP_MSSFIX) - { - mss_fixup_ipv6(&ipbuf, c->c2.frame.mss_fix); - } - if (!(flags & PIP_OUTGOING) && (flags - &(PIPV6_IMCP_NOHOST_CLIENT | PIPV6_IMCP_NOHOST_SERVER))) - { - ipv6_send_icmp_unreachable(c, buf, - (bool)(flags & PIPV6_IMCP_NOHOST_CLIENT)); - /* Drop the IPv6 packet */ - buf->len = 0; - } - + mss_fixup_ipv4(&ipbuf, c->c2.frame.mss_fix); } + + /* possibly do NAT on packet */ + if ((flags & PIPV4_CLIENT_NAT) && c->options.client_nat) + { + const int direction = (flags & PIP_OUTGOING) ? CN_INCOMING : CN_OUTGOING; + client_nat_transform(c->options.client_nat, &ipbuf, direction); + } + /* possibly extract a DHCP router message */ + if (flags & PIPV4_EXTRACT_DHCP_ROUTER) + { + const in_addr_t dhcp_router = dhcp_extract_router_msg(&ipbuf); + if (dhcp_router) + { + route_list_add_vpn_gateway(c->c1.route_list, c->c2.es, dhcp_router); + } + } + } + else if (is_ipv6(TUNNEL_TYPE(c->c1.tuntap), &ipbuf)) + { + /* possibly alter the TCP MSS */ + if (flags & PIP_MSSFIX) + { + mss_fixup_ipv6(&ipbuf, c->c2.frame.mss_fix); + } + if (!(flags & PIP_OUTGOING) && (flags + &(PIPV6_ICMP_NOHOST_CLIENT | PIPV6_ICMP_NOHOST_SERVER))) + { + ipv6_send_icmp_unreachable(c, buf, + (bool)(flags & PIPV6_ICMP_NOHOST_CLIENT)); + /* Drop the IPv6 packet */ + buf->len = 0; + } + } } } diff --git a/src/openvpn/forward.h b/src/openvpn/forward.h index e19115e..bc00ba5 100644 --- a/src/openvpn/forward.h +++ b/src/openvpn/forward.h @@ -297,8 +297,9 @@ #define PIP_OUTGOING (1<<2) #define PIPV4_EXTRACT_DHCP_ROUTER (1<<3) #define PIPV4_CLIENT_NAT (1<<4) -#define PIPV6_IMCP_NOHOST_CLIENT (1<<5) -#define PIPV6_IMCP_NOHOST_SERVER (1<<6) +#define PIPV6_ICMP_NOHOST_CLIENT (1<<5) +#define PIPV6_ICMP_NOHOST_SERVER (1<<6) + void process_ip_header(struct context *c, unsigned int flags, struct buffer *buf); diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c index 4344126..712456c 100644 --- a/src/openvpn/multi.c +++ b/src/openvpn/multi.c @@ -3645,7 +3645,7 @@ if (mbuf_extract_item(ms, &item)) /* cleartext IP packet */ { - unsigned int pip_flags = PIPV4_PASSTOS | PIPV6_IMCP_NOHOST_SERVER; + unsigned int pip_flags = PIPV4_PASSTOS | PIPV6_ICMP_NOHOST_SERVER; set_prefix(item.instance); item.instance->context.c2.buf = item.buffer->buf;