From patchwork Mon Aug 24 16:05:47 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gert Doering X-Patchwork-Id: 5267 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:4306:b0:87d:ab56:3700 with SMTP id q6csp4615026mae; Mon, 24 Aug 2026 09:06:13 -0700 (PDT) X-Forwarded-Encrypted: i=2; AHgh+RqbDH5xUxQWLIJ7xzU+4FCb5AiLHv7vhGK7e0asq3s35zKylxqsBmCvi/jXrc5tbMjo0mSMUTtbrTI=@openvpn.net X-Received: by 2002:a05:6808:1642:b0:495:feaa:9e39 with SMTP id 5614622812f47-4b309a06e98mr17874692b6e.6.1787587573205; Mon, 24 Aug 2026 09:06:13 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1787587573; cv=none; d=google.com; s=arc-20260327; b=Jj7f8hdZYD1cuiLh/Qypf5/eRuPgEGF1dNTxBJRWvP39zUQw5sz8j3lrB+zrX2fYdF LUOg3BEdp7QA7cJURBaE9/pEi3r959PFOApx9NgRrH51+LRRFm4gS0Ej9ICqe7m0XV3k ElNZUqcFsNhHgFeKo6rpIE5C2zRn6alBtZQHRIT3ke0/iEdOzvuyqL9vN0Y06NWjWslT eLjKIH351F87lhqsAnaLnLRRm/pmmh5W0/LKFJ/c/bMNpiLxQQVqpIH1Tb3spn45mJLZ rxi0qoTTpwBSmvRevO2WfTFNaueIvogsbwQPeWc0/dny/IPPPRvWaK8sbZJF4zfOMR52 9Y9w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=XusDdBb9lwMNIj2+fFecu9CUSBSRV6xMdk02wluy06A=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=rPfDkfJsX20wYB4PCGW575Vc9xn8EzxYbnSUwsHDVjSiuxrc5JL+yMI6UtO3jI2zFc WZxPriXxSsiwZlAp3FUfyG6JSPYWbNO2l4/HsMtqgTLwp487+XlVFXVqiFD7y04q5053 o644BNz8QrMlG0AtYenfcbzum1+JmdPyYwNdwyG/fvdcKNuxdPnEOhj/9y3S7i96iPsx aVQl6CKDiIku5sz3oe58/WKluoctGaMoF6nDJfuv4NgyjBwtBZk/o4kjmnQr7cXnawVi cYPggoxO73GowcLkyGyqYpnEkVVS898qSZDK8ykmJ5SU3Nyvc15LSU0UduU4EBgFjzp6 GN/Q==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=IQuRupCz; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=MTrpkQ52; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=MaaFXaqM; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 5614622812f47-4b32c91fc7dsi6373750b6e.119.2026.08.24.09.06.12 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 24 Aug 2026 09:06:12 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=IQuRupCz; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=MTrpkQ52; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=MaaFXaqM; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=XusDdBb9lwMNIj2+fFecu9CUSBSRV6xMdk02wluy06A=; b=IQuRupCzLR/FAJExZV6sHmXCKl E+Om2ZqOjEHAOur7nkf4+PEUcqNeKEWU7uUZbCHY4XXG26qj1msqKTT3Y8+XhIAh5FoI2jnMqgAw0 WOnhtOFfKgw/4W9/4a5xe3/XVsI+Fl6mVqheJcb8/xxhPVytwiSGYhhKNC+/W/XC225M=; Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1wyXBW-0002r1-8g; Mon, 24 Aug 2026 16:06:06 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1wyXBU-0002qt-If for openvpn-devel@lists.sourceforge.net; Mon, 24 Aug 2026 16:06:04 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=S7D3FOsdexT/DfHblc5bcl77XJxUGs1+zfIm1iYIxO0=; b=MTrpkQ52N97ZBhnAKCot2nNz3k +czSzTI/+2FDa9jsCUPZFXUyptFM25pwBelAXeOPaWjN6VIQyRnUNFbScjO44Uw7vILr+dJ+Efhgm u7m7VvJtGUVAqj1nAQO1o9enDExZwewcqAjp5AlPWhMNYS2sy+lTb777ObCoXBuaHtuQ=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=S7D3FOsdexT/DfHblc5bcl77XJxUGs1+zfIm1iYIxO0=; b=MaaFXaqM9/i7Qxo8iDvU7DAWPG j5kyiNWilAy7nDf3xLpodm7Xl2H3CQcbyA2A1pbfvmN6v0rWndnwb2rVctGydUa1qFnSyVbmTXNDZ WcMiogTiFVQ8+rMrl+heThQPpKTXnLfNLuaamo3gYwNVyT1sbgtaHla7SrP7wOc+KObY=; Received: from [193.149.48.129] (helo=blue.greenie.muc.de) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1wyXBR-00019g-71 for openvpn-devel@lists.sourceforge.net; Mon, 24 Aug 2026 16:06:04 +0000 Received: from blue.greenie.muc.de (localhost [127.0.0.1]) by blue.greenie.muc.de (8.18.1/8.18.1) with ESMTP id 67OG5saX000775 for ; Mon, 24 Aug 2026 18:05:54 +0200 Received: (from gert@localhost) by blue.greenie.muc.de (8.18.2/8.18.1/Submit) id 67OG5s9r000774 for openvpn-devel@lists.sourceforge.net; Mon, 24 Aug 2026 18:05:54 +0200 From: Gert Doering To: openvpn-devel@lists.sourceforge.net Date: Mon, 24 Aug 2026 18:05:47 +0200 Message-ID: <20260824160553.761-1-gert@greenie.muc.de> X-Mailer: git-send-email 2.53.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Frank Lichtenheld - We assume that addrinfo->ai_family always fits into a sa_family_t, so we do not check those. - Reduce places where we explicitly pass ai_family and prefer sock->info.af. - Make sure that --bind-dev [...] Content analysis details: (1.3 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS X-Headers-End: 1wyXBR-00019g-71 Subject: [Openvpn-devel] [PATCH v10] socket: Fix various conversion warnings X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1874421427082271642 X-GMAIL-MSGID: 1874421427082271642 From: Frank Lichtenheld - We assume that addrinfo->ai_family always fits into a sa_family_t, so we do not check those. - Reduce places where we explicitly pass ai_family and prefer sock->info.af. - Make sure that --bind-dev has a suitable length. - Treat PROTO_* as uint8_t where possible (however, much code uses proto = -1 for various error handling). Change-Id: I7be7427480d3540d43dd818eddb6eb5860956459 Signed-off-by: Frank Lichtenheld Acked-by: Razvan Cojocaru Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1476 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1476 This mail reflects revision 10 of this Change. Acked-by according to Gerrit (reflected above): Razvan Cojocaru diff --git a/src/openvpn/options.c b/src/openvpn/options.c index 107b3fa9..089bff4 100644 --- a/src/openvpn/options.c +++ b/src/openvpn/options.c @@ -5125,7 +5125,15 @@ else if (streq(p[0], "bind-dev") && p[1]) { VERIFY_PERMISSION(OPT_P_SOCKFLAGS); - options->bind_dev = p[1]; + if (strlen(p[1]) < IFNAMSIZ) + { + options->bind_dev = p[1]; + } + else + { + msg(msglevel, "argument to --bind-dev is longer than allowed %u", IFNAMSIZ - 1); + goto err; + } } #endif else if (streq(p[0], "txqueuelen") && p[1] && !p[2]) @@ -5211,11 +5219,9 @@ } else if (streq(p[0], "proto") && p[1] && !p[2]) { - int proto; - sa_family_t af; VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION); - proto = ascii2proto(p[1]); - af = ascii2af(p[1]); + int proto = ascii2proto(p[1]); + sa_family_t af = ascii2af(p[1]); if (proto < 0) { msg(msglevel, "Bad protocol: '%s'. Allowed protocols with --proto option: %s", p[1], diff --git a/src/openvpn/socket.c b/src/openvpn/socket.c index 0f66ad51..0a08267 100644 --- a/src/openvpn/socket.c +++ b/src/openvpn/socket.c @@ -619,28 +619,23 @@ } static void -bind_local(struct link_socket *sock, const sa_family_t ai_family) +bind_local(struct link_socket *sock) { /* bind to local address/port */ if (sock->bind_local) { if (sock->socks_proxy && sock->info.proto == PROTO_UDP) { - socket_bind(sock->ctrl_sd, sock->info.lsa->bind_local, ai_family, "SOCKS", false); + socket_bind(sock->ctrl_sd, sock->info.lsa->bind_local, sock->info.af, "SOCKS", false); } else { - socket_bind(sock->sd, sock->info.lsa->bind_local, ai_family, "TCP/UDP", + socket_bind(sock->sd, sock->info.lsa->bind_local, sock->info.af, "TCP/UDP", sock->info.bind_ipv6_only); } } } -#if defined(__GNUC__) || defined(__clang__) -#pragma GCC diagnostic push -#pragma GCC diagnostic ignored "-Wconversion" -#endif - static void create_socket(struct link_socket *sock, struct addrinfo *addr) { @@ -672,7 +667,7 @@ } /* Set af field of sock->info, so it always reflects the address family * of the created socket */ - sock->info.af = addr->ai_family; + sock->info.af = (sa_family_t)addr->ai_family; /* set socket buffers based on --sndbuf and --rcvbuf options */ socket_set_buffers(sock->sd, &sock->socket_buffer_sizes, true); @@ -684,8 +679,9 @@ if (sock->bind_dev) { msg(M_INFO, "Using bind-dev %s", sock->bind_dev); + /* Note: We verify strlen of bind_dev in options parsing */ if (setsockopt(sock->sd, SOL_SOCKET, SO_BINDTODEVICE, sock->bind_dev, - strlen(sock->bind_dev) + 1) + (socklen_t)(strlen(sock->bind_dev) + 1)) != 0) { msg(M_WARN | M_ERRNO, "WARN: setsockopt SO_BINDTODEVICE=%s failed", sock->bind_dev); @@ -693,13 +689,9 @@ } #endif - bind_local(sock, addr->ai_family); + bind_local(sock); } -#if defined(__GNUC__) || defined(__clang__) -#pragma GCC diagnostic pop -#endif - #ifdef TARGET_ANDROID static void protect_fd_nonlocal(int fd, const struct sockaddr *addr) @@ -1131,13 +1123,8 @@ } } -#if defined(__GNUC__) || defined(__clang__) -#pragma GCC diagnostic push -#pragma GCC diagnostic ignored "-Wconversion" -#endif - static void -resolve_bind_local(struct link_socket *sock, const sa_family_t af) +resolve_bind_local(struct link_socket *sock) { struct gc_arena gc = gc_new(); @@ -1153,12 +1140,12 @@ } /* will return AF_{INET|INET6}from local_host */ - status = get_cached_dns_entry(sock->dns_cache, sock->local_host, sock->local_port, af, + status = get_cached_dns_entry(sock->dns_cache, sock->local_host, sock->local_port, sock->info.af, flags, &sock->info.lsa->bind_local); if (status) { - status = openvpn_getaddrinfo(flags, sock->local_host, sock->local_port, 0, NULL, af, + status = openvpn_getaddrinfo(flags, sock->local_host, sock->local_port, 0, NULL, sock->info.af, &sock->info.lsa->bind_local); } @@ -1179,7 +1166,7 @@ /* the resolved 'local entry' might have a different family than * what was globally configured */ - sock->info.af = sock->info.lsa->bind_local->ai_family; + sock->info.af = (sa_family_t)sock->info.lsa->bind_local->ai_family; } } @@ -1382,7 +1369,8 @@ sock->mark = o->mark; sock->bind_dev = o->bind_dev; - sock->info.proto = proto; + ASSERT(proto >= 0 && proto < PROTO_N); + sock->info.proto = (uint8_t)proto; sock->info.af = o->ce.af; sock->info.remote_float = o->ce.remote_float; sock->info.lsa = &c->c1.link_socket_addrs[sock_index]; @@ -1448,7 +1436,7 @@ { if (sock->bind_local) { - resolve_bind_local(sock, sock->info.af); + resolve_bind_local(sock); } resolve_remote(sock, 1, NULL); } @@ -1713,9 +1701,9 @@ * and we should not connect a remote */ if (sock->info.af == AF_UNSPEC) { + sock->info.af = (sa_family_t)sock->info.lsa->bind_local->ai_family; msg(M_WARN, "Could not determine IPv4/IPv6 protocol. Using %s", - addr_family_name(sock->info.lsa->bind_local->ai_family)); - sock->info.af = sock->info.lsa->bind_local->ai_family; + addr_family_name(sock->info.af)); } create_socket(sock, sock->info.lsa->bind_local); } @@ -1775,10 +1763,6 @@ } } -#if defined(__GNUC__) || defined(__clang__) -#pragma GCC diagnostic pop -#endif - void link_socket_close(struct link_socket *sock) { @@ -2384,8 +2368,8 @@ else if (cmsg != NULL) { msg(M_WARN, - "CMSG received that cannot be parsed (cmsg_level=%d, cmsg_type=%d, cmsg=len=%d)", - (int)cmsg->cmsg_level, (int)cmsg->cmsg_type, (int)cmsg->cmsg_len); + "CMSG received that cannot be parsed (cmsg_level=%d, cmsg_type=%d, cmsg=len=%zu)", + cmsg->cmsg_level, cmsg->cmsg_type, (size_t)cmsg->cmsg_len); } return buf->len; diff --git a/src/openvpn/socket_util.c b/src/openvpn/socket_util.c index 0194f38..913ac69 100644 --- a/src/openvpn/socket_util.c +++ b/src/openvpn/socket_util.c @@ -356,7 +356,7 @@ const char *short_form; const char *display_form; sa_family_t proto_af; - int proto; + uint8_t proto; }; /* Indexed by PROTO_x */