github/OpenVPNAdapter
4
0
Fork 0
mirror of https://github.com/deneraraujo/OpenVPNAdapter.git synced 2026-04-24 00:00:05 +08:00
Code Issues Packages Projects Releases Wiki Activity

Squashed 'OpenVPN Adapter/Vendors/openvpn/' changes from 4095565..3e002c8

Browse Source 
3e002c8 remove unused Jenkinsfile
16b1055 [OVPN3-140] Update company names in copyrights
6caca2c [OVPN3-140] Relicense back to AGPLv3
4f9ae74 cliproto: react to tls_warnings
546547b Proto: export tls_warnings attribute from SSL session
7cbaa26 SSLAPI: add tls_warning attribute
7ed93a3 clievent: add Warn event class
7a71ba1 win: get 'arch' param value from environment
61bb21b win: make parameter optional
15d66c4 [OVPN3-141] win: disable WPO
97d9c28 [OU-15] mbedtls: remove duplicated code
95aec32 [OU-15] mbedtls: refactor X509Cert to allow reuse der2pem
946753e [OVPN3-135] Win: remove unneeded default route
d7f8c47 nrpt: create separate policy per dns suffix
577b5ca cli.cpp: fix typ0 in define
fc8f89d [OVPN3-129] android: ensure all SWIG files are archived and saved
e143bc0 [OVPN3-129] android: improve build system in order to perform full build
06d23ec [OVPN3-129] build-system: let scripts download dependencies
76bb99c fix usage of to_string() in Android
44c183a time: mute type conversion warnings for UWP client
7d7490c transport: enable socket protect call for UWP
1c003ac transport: pass protocol type to external factory
c0de92c transport: add stop_requeueing method
e2c60c8 android: build core library with MD5 support
3928069 [OVPN3-119] mbedTLS: create INSECURE profile including MD5
4f99310 remove function accidentally duplicated by last merge
b91d841 self-test: add missing includes
19e33c4 [OA-14] mbedTLS: relax x509 date/time format check
f3cf645 [OVPN3-116] disable SSL_CBC_RECORD_SPLITTING
fca9ed2 [OVPN3-105] ParseClientConfig: avoid crash when not all key material is provided
7299fef [OC-42] Android: specify API level on command line
d3da3df android: build client lib for x86 (for emulator)
8e501c5 Update version for mbedTLS and lz4
e57676e ParseClientConfig: export config to json format
9aa715f ParseClientConfig: export configuration to ovpn file format
1eab4cb ParseClientConfig: add helper constructor
71a59e4 ParseClientConfig: store the entire ovpn profile
e0bb85a Transport: convert from transport protocol to config string
2fe56c3 Compress: convert from ctx type to config string
174ee25 OpenSSL: implement stub methods for new private_key_type/length() SSLAPIs
3d57708 mbedTLS: implement private_key_type/length() API
a3210f0 SSLAPI: add private_key_type/length() getter methods
8ffe888 OpenSSL: implement stub methods for new extract_* SSLAPIs
16e9160 mbedTLS: implement extended API for key material extraction
fe3d519 SSLAPI: extend API with methods to extract key material
2b4c850 Debugging: added header and build flag for valgrind run-time extensions.
b948cde ManClientInstance::Factory: added virtual stop() method.
121e975 client API: added portOverride
106981c JSON: allow alternative JSON library implementations
f206ae2 logging: added logdatetime.hpp which prepends date/time to log lines
49e933d Time: added to_double, delta_float, and delta_str methods
569b1da daemon.hpp: added class WritePid for managing pid files
63e9e04 ClientProto: reset CoarseTime object when AsioTimer is canceled
f64b501 Cleanup: allow functor to be passed by value.
ebe2560 RunContext: add configurable exit via EXIT_IN env var for debugging
1fbff4f tls-crypt: revised server-side validate_initial_packet() methods to use a BufferAllocated rather than a Buffer.
0090c51 SSLConst: added new ssl_flags() method which filters out non-ssl flags from given argument.
8379b0a CryptoDCInstance: added new RekeyType PRIMARY_SECONDARY_SWAP and use it in ProtoContext::promote_secondary_to_primary() since it more accurately reflects the underlying implementation.
18f45c2 ManClientInstance::Send: added AuthStatus::Type parameter to disconnect_user() method.
4bba803 Listen::List: added expand_ports() method.
5122e7d Listen::List: in port_offset(), set n_threads to 0 since number-of-threads data for port_offset items isn't really relevant.
4e11a6c StaticKey: added render_to_base64() and init_from_rng() methods.
190ece9 CryptoAlgs: added mode() method.
76e65cf CryptoAlgs: added AEAD_NONCE_TAIL_SIZE constant (set to 8 bytes) to represent the size in bytes of AEAD "nonce tail" normally taken from the HMAC key material.
2738718 compress: added method_to_string() method, i.e. the inverse of parse_method().
7b47f99 compress: since parse_method() performs a linear search on method, reorder so that more frequently used methods appear at the top of the list.
b428f74 library: added integer is_pow2() and log2() methods based on efficient __builtin_ffs and __builtin_clz intrinsics.
4926011 Android: adapt toolchain scripts to new SDK and move to API 26
ad4e995 mbedTLS: use mbedtls API to initialize cert object
908c611 transport: use socket_protect to communicate socket handle on UWP
92a6216 build win: read certain params from env
8166ea8 common: define uwp platform macro
0186bf6 common: report platform name as "uwp"
3f291b0 netconf: disable getting hwaddr for UWP
6365d26 transport: external factory
2ffa0c9 transport: synchronous DNS lookup
2c09c7c cliconnect.hpp: support for AsioWork always on
4f5a04d rand.hpp: allow external entropy source
b19c5da time.hpp: use GetTickCount64 on Vista and newer
712ccfc android: export DEP_DIR via vars files only if not already defined
1b5a784 asio: make sure to switch to DEP_DIR before building
4302651 changes to support android building
6f56b2b Merge pull request #21 from OpenVPN/make_test_proto_deterministic
3a5ef2b travis-ci: make testing binary deterministic
b76882d mbedtls: fix typ0 in exception message
40065a6 avoid "uninitialized variable warning"
f33e7c2 [OVPN3-5] tls-crypt: add tls-crypt support in proto.hpp test unit
74c5f4f [OVPN3-5] tls-crypt: introduce tls-crypt support
389353c proto.cpp: uninit process at the end of the execution
56a831f [OVPN3-5] crypto/ssl: add support for AES-256-CTR
7cbf539 [OVPN3-5] build script: allow user to specify its own mbedTLS folder and LDFLAGS
8ae2a3f Integrate Google Test framework
68ae101 Add swig build to jenkins pipeline
d496311 ovpncli.hpp: inline LogInfo constructor for clarity
96e0d89 Revert "Merged in OVPN3-21-prepend-log-record-with-unique- (pull request #7)"
7db95cc Make build fail on compilation errors
860129a TunBuilderCapture: make (to|from)_json methods public
2486494 random: added helper class Rand2 containing a crypto and non-crypto RNG
04175c2 appversion.hpp: Stringize VERSION -> MY_VERSION
81cb887 build script: added DPROF=1 flag
a3dd47f timestr.hpp: moved milliseconds_since_epoch() to time/epoch.hpp
59b9492 sslchoose.hpp: added SSL_LIB_NAME
8fcb797 ProtoContext::KeyContext::raw_recv() : fix state transition
e49e993 ProtoContext: comment edit
1d941aa VPNServerNetblock::Netblock refactor
7190495 Server-side renamings to break up long class names using namespaces.
3f74ec1 Listen::List: minor changes
79c789b RandomAPI: comment edit
5b5af36 Added SSLConst::SERVER_TO_SERVER flag
fe00df4 OpenSSLContext::Config::set_rng: call assert_crypto()
3ae0076 In sslchoose.hpp, move OPENVPN_LOG_SSL macro to new file ssllog.hpp
1502cf6 URL::Parse: made is_valid_uri_char() standalone and moved to validate_uri.hpp
2dcb189 Added HTTP::Status::SwitchingProtocols constant
2f57024 HTTP::HeaderList: added get_value_trim_lower() method
bee94d2 HTTP::HeaderList: get_value() and get_value_trim() should return std::string instead of const std::string
5debab1 Frame::Context: #define OPENVPN_NO_IO to allow building without i/o layer
faf8f8f StaticKey: added parse_from_base64() method
d11f250 HashString: added final_base64() method
c373bf8 CompressContext: use C++11 member initialization and remove explicit attribute on constructor
bd75cd7 RCPtr: added operator==() and operator!=() methods
7be33c5 PThreadBarrier: fixed incorrect comment
6f5f77b Link: use move semantics
17a5d89 inotify.hpp: no longer used
8ce39fc added render_hex() and render_hex_sep() methods that accept void* data
ddc8e8a Function: use std::forward
76ee587 write_binary_atomic(): added tmpdir (temporary directory) parameter
f366d55 base64: encode() now accepts void* data
462fe90 BufferType: added read(), write(), and prepend() variants that accept void* data
9ad1be4 IP::RouteType: added host_bits() method
3ebc8c7 IPv[46]::Addr::to_sockaddr() now accepts optional port number
ce0977b Support Cityhash.
fdbb0b9 IP::Addr: added validate_prefix_len()
25146d8 IP::Addr::from_ipv[4|6](): use move semantics
a264f99 Merge pull request #20 from OpenVPN/fix_travis_ci_coverity
966e212 travis: don't mess up the SSL libs for wget/curl
2b8f09d Merge pull request #19 from OpenVPN/antonio/travis-ci-to-coverity
127cbb0 travis.yml: send build to Coverity SCAN when building master
2bca49b Merge pull request #15 from OpenVPN/antonio/travis-ci
a5ce566 add basic support for Travis CI
f9b14e9 macOS: add basic logging support
2b9188d Remotelist: pass meaningful port value to resolve::async_resolve()
4ebdbd0 Merged in OVPN3-38-improve-jenkins-pipeline-script (pull request #8)
832cf7f Report build status to Bitbucket
62423c9 Merged in OVPN3-21-prepend-log-record-with-unique- (pull request #7)
cce2455 Prepend log string with unique reference.
f26b08b Merged in OVPN3-25-pipeline-build (pull request #4)
dc5ff1f Add OpenSSL version building.
c77e1d6 Add pipeline script for multiplatform build.
4fab9b0 Merged in OVPN3-18-vs-project (pull request #2)
8eb0d6c Add Visual Studio project info to README
67c4989 Visual Studio 2015 solution and project files
52bfcd3 Merged in OVPN3-17 (pull request #1)
5f648ce Document Windows build process
3213c48 Support for local build settings
b3ec01b Support for gpl version of mbedtls
903abc8 Support for zipballs
4029579 AsioPolySock: support bind to local address.
1e85566 Use openvpn::strerror_str() instead of std::strerror().
3ba37fc OpenVPN 3 client: added OPENVPN_OVPNCLI_ASYNC_SETUP flag.

git-subtree-dir: OpenVPN Adapter/Vendors/openvpn
git-subtree-split: 3e002c83ce2e9f9f40ddcee750d3cfa664238abe
This commit is contained in:
Sergey Abramchuk
2018-01-08 11:44:56 +03:00
parent 9b95600d06
commit 82fea30fcc
437 changed files with 7377 additions and 2864 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openvpn/client/cliconnect.hpp
+8 -5
View File
@@ -4,18 +4,18 @@
// packet encryption, packet authentication, and
// packet compression.
//
// Copyright (C) 2012-2017 OpenVPN Technologies, Inc.
// Copyright (C) 2012-2017 OpenVPN Inc.
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License Version 3
// it under the terms of the GNU Affero General Public License Version 3
// as published by the Free Software Foundation.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// You should have received a copy of the GNU Affero General Public License
// along with this program in the COPYING file.
// If not, see <http://www.gnu.org/licenses/>.
@@ -562,7 +562,10 @@ namespace openvpn {
void new_client()
{
++generation;
asio_work.reset();
if (client_options->asio_work_always_on())
asio_work.reset(new AsioWork(io_context));
else
asio_work.reset();
if (client)
{
client->stop(false);
openvpn/client/cliconstants.hpp
+4 -4
View File
@@ -4,18 +4,18 @@
// packet encryption, packet authentication, and
// packet compression.
//
// Copyright (C) 2012-2017 OpenVPN Technologies, Inc.
// Copyright (C) 2012-2017 OpenVPN Inc.
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License Version 3
// it under the terms of the GNU Affero General Public License Version 3
// as published by the Free Software Foundation.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// You should have received a copy of the GNU Affero General Public License
// along with this program in the COPYING file.
// If not, see <http://www.gnu.org/licenses/>.
openvpn/client/clicreds.hpp
+4 -4
View File
@@ -4,18 +4,18 @@
// packet encryption, packet authentication, and
// packet compression.
//
// Copyright (C) 2012-2017 OpenVPN Technologies, Inc.
// Copyright (C) 2012-2017 OpenVPN Inc.
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License Version 3
// it under the terms of the GNU Affero General Public License Version 3
// as published by the Free Software Foundation.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// You should have received a copy of the GNU Affero General Public License
// along with this program in the COPYING file.
// If not, see <http://www.gnu.org/licenses/>.
openvpn/client/cliemuexr.hpp
+4 -4
View File
@@ -4,18 +4,18 @@
// packet encryption, packet authentication, and
// packet compression.
//
// Copyright (C) 2012-2017 OpenVPN Technologies, Inc.
// Copyright (C) 2012-2017 OpenVPN Inc.
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License Version 3
// it under the terms of the GNU Affero General Public License Version 3
// as published by the Free Software Foundation.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// You should have received a copy of the GNU Affero General Public License
// along with this program in the COPYING file.
// If not, see <http://www.gnu.org/licenses/>.
openvpn/client/clievent.hpp
+33 -4
View File
@@ -4,18 +4,18 @@
// packet encryption, packet authentication, and
// packet compression.
//
// Copyright (C) 2012-2017 OpenVPN Technologies, Inc.
// Copyright (C) 2012-2017 OpenVPN Inc.
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License Version 3
// it under the terms of the GNU Affero General Public License Version 3
// as published by the Free Software Foundation.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// You should have received a copy of the GNU Affero General Public License
// along with this program in the COPYING file.
// If not, see <http://www.gnu.org/licenses/>.
@@ -50,6 +50,7 @@ namespace openvpn {
ADD_ROUTES,
ECHO_OPT,
INFO,
WARN,
PAUSE,
RESUME,
RELAY,
@@ -64,6 +65,7 @@ namespace openvpn {
CERT_VERIFY_FAIL,
TLS_VERSION_MIN,
CLIENT_HALT,
CLIENT_SETUP,
CONNECTION_TIMEOUT,
INACTIVE_TIMEOUT,
DYNAMIC_CHALLENGE,
@@ -99,6 +101,7 @@ namespace openvpn {
"ADD_ROUTES",
"ECHO",
"INFO",
"WARN",
"PAUSE",
"RESUME",
"RELAY",
@@ -113,6 +116,7 @@ namespace openvpn {
"CERT_VERIFY_FAIL",
"TLS_VERSION_MIN",
"CLIENT_HALT",
"CLIENT_SETUP",
"CONNECTION_TIMEOUT",
"INACTIVE_TIMEOUT",
"DYNAMIC_CHALLENGE",
@@ -395,6 +399,31 @@ namespace openvpn {
Info(std::string value) : ReasonBase(INFO, std::move(value)) {}
};
struct Warn : public ReasonBase
{
Warn(std::string value) : ReasonBase(WARN, std::move(value)) {}
};
class ClientSetup : public ReasonBase
{
public:
ClientSetup(const std::string& status, const std::string& message)
: ReasonBase(CLIENT_SETUP, make(status, message))
{
}
private:
static std::string make(const std::string& status, const std::string& message)
{
std::string ret;
ret += status;
if (!status.empty() && !message.empty())
ret += ": ";
ret += message;
return ret;
}
};
class Queue : public RC<thread_unsafe_refcount>
{
public:
openvpn/client/clihalt.hpp
+4 -4
View File
@@ -4,18 +4,18 @@
// packet encryption, packet authentication, and
// packet compression.
//
// Copyright (C) 2012-2017 OpenVPN Technologies, Inc.
// Copyright (C) 2012-2017 OpenVPN Inc.
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License Version 3
// it under the terms of the GNU Affero General Public License Version 3
// as published by the Free Software Foundation.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// You should have received a copy of the GNU Affero General Public License
// along with this program in the COPYING file.
// If not, see <http://www.gnu.org/licenses/>.
openvpn/client/clilife.hpp
+4 -4
View File
@@ -4,18 +4,18 @@
// packet encryption, packet authentication, and
// packet compression.
//
// Copyright (C) 2012-2017 OpenVPN Technologies, Inc.
// Copyright (C) 2012-2017 OpenVPN Inc.
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License Version 3
// it under the terms of the GNU Affero General Public License Version 3
// as published by the Free Software Foundation.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// You should have received a copy of the GNU Affero General Public License
// along with this program in the COPYING file.
// If not, see <http://www.gnu.org/licenses/>.
openvpn/client/cliopt.hpp
+57 -6
View File
@@ -4,18 +4,18 @@
// packet encryption, packet authentication, and
// packet compression.
//
// Copyright (C) 2012-2017 OpenVPN Technologies, Inc.
// Copyright (C) 2012-2017 OpenVPN Inc.
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License Version 3
// it under the terms of the GNU Affero General Public License Version 3
// as published by the Free Software Foundation.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// You should have received a copy of the GNU Affero General Public License
// along with this program in the COPYING file.
// If not, see <http://www.gnu.org/licenses/>.
@@ -66,6 +66,11 @@
#include <openvpn/client/cliemuexr.hpp>
#endif
#if defined(OPENVPN_EXTERNAL_TRANSPORT_FACTORY)
#include <openvpn/transport/client/extern/config.hpp>
#include <openvpn/transport/client/extern/fw.hpp>
#endif
#if defined(OPENVPN_EXTERNAL_TUN_FACTORY)
// requires that client implements ExternalTun::Factory::new_tun_factory
#include <openvpn/tun/extern/config.hpp>
@@ -116,6 +121,7 @@ namespace openvpn {
{
std::string gui_version;
std::string server_override;
std::string port_override;
Protocol proto_override;
IPv6Setting ipv6;
int conn_timeout = 0;
@@ -129,6 +135,7 @@ namespace openvpn {
bool info = false;
bool tun_persist = false;
bool google_dns_fallback = false;
bool synchronous_dns_lookup = false;
std::string private_key_password;
bool disable_client_cert = false;
int ssl_debug_level = 0;
@@ -156,6 +163,10 @@ namespace openvpn {
#if defined(OPENVPN_EXTERNAL_TUN_FACTORY)
ExternalTun::Factory* extern_tun_factory = nullptr;
#endif
#if defined(OPENVPN_EXTERNAL_TRANSPORT_FACTORY)
ExternalTransport::Factory* extern_transport_factory = nullptr;
#endif
};
ClientOptions(const OptionList& opt, // only needs to remain in scope for duration of constructor call
@@ -167,6 +178,7 @@ namespace openvpn {
cli_events(config.cli_events),
server_poll_timeout_(10),
server_override(config.server_override),
port_override(config.port_override),
proto_override(config.proto_override),
conn_timeout_(config.conn_timeout),
tcp_queue_limit(64),
@@ -179,7 +191,12 @@ namespace openvpn {
info(config.info),
autologin(false),
autologin_sessions(false),
creds_locked(false)
creds_locked(false),
asio_work_always_on_(false),
synchronous_dns_lookup(false)
#ifdef OPENVPN_EXTERNAL_TRANSPORT_FACTORY
,extern_transport_factory(config.extern_transport_factory)
#endif
{
// parse general client options
const ParseClientConfig pcc(opt);
@@ -245,8 +262,9 @@ namespace openvpn {
// reconnections.
remote_list->set_enable_cache(config.tun_persist);
// process server override
// process server/port overrides
remote_list->set_server_override(config.server_override);
remote_list->set_port_override(config.port_override);
// process protocol override, should be called after set_enable_cache
remote_list->handle_proto_override(config.proto_override,
@@ -279,6 +297,13 @@ namespace openvpn {
if (opt.exists("fragment"))
throw option_error("sorry, 'fragment' directive is not supported, nor is connecting to a server that uses 'fragment' directive");
#ifdef OPENVPN_PLATFORM_UWP
// workaround for OVPN3-62 Busy loop in win_event.hpp
asio_work_always_on_ = true;
#endif
synchronous_dns_lookup = config.synchronous_dns_lookup;
// init transport config
const std::string session_name = load_transport_config();
@@ -580,6 +605,8 @@ namespace openvpn {
int conn_timeout() const { return conn_timeout_; }
bool asio_work_always_on() const { return asio_work_always_on_; }
RemoteList::Ptr remote_list_precache() const
{
RemoteList::Ptr r;
@@ -654,6 +681,7 @@ namespace openvpn {
cp->dc.set_factory(new CryptoDCSelect<SSLLib::CryptoAPI>(frame, cli_stats, prng));
cp->dc_deferred = true; // defer data channel setup until after options pull
cp->tls_auth_factory.reset(new CryptoOvpnHMACFactory<SSLLib::CryptoAPI>());
cp->tls_crypt_factory.reset(new CryptoTLSCryptFactory<SSLLib::CryptoAPI>());
cp->tlsprf_factory.reset(new CryptoTLSPRFFactory<SSLLib::CryptoAPI>());
cp->ssl_factory = cc->new_factory();
cp->load(opt, *proto_context_options, config.default_key_direction, false);
@@ -679,6 +707,22 @@ namespace openvpn {
// should have been caught earlier in RemoteList::handle_proto_override.
// construct transport object
#ifdef OPENVPN_EXTERNAL_TRANSPORT_FACTORY
ExternalTransport::Config transconf;
transconf.remote_list = remote_list;
transconf.frame = frame;
transconf.stats = cli_stats;
transconf.socket_protect = socket_protect;
transconf.server_addr_float = server_addr_float;
transconf.synchronous_dns_lookup = synchronous_dns_lookup;
transconf.protocol = transport_protocol;
transport_factory = extern_transport_factory->new_transport_factory(transconf);
#ifdef OPENVPN_GREMLIN
udpconf->gremlin_config = gremlin_config;
#endif
#else
if (dco)
{
DCO::TransportConfig transconf;
@@ -753,6 +797,7 @@ namespace openvpn {
else
throw option_error("internal error: unknown transport protocol");
}
#endif // OPENVPN_EXTERNAL_TRANSPORT_FACTORY
return remote_list->current_server_host();
}
@@ -774,6 +819,7 @@ namespace openvpn {
ClientCreds::Ptr creds;
unsigned int server_poll_timeout_;
std::string server_override;
std::string port_override;
Protocol proto_override;
int conn_timeout_;
unsigned int tcp_queue_limit;
@@ -788,11 +834,16 @@ namespace openvpn {
bool autologin;
bool autologin_sessions;
bool creds_locked;
bool asio_work_always_on_;
bool synchronous_dns_lookup;
PushOptionsBase::Ptr push_base;
OptionList::FilterBase::Ptr pushed_options_filter;
ClientLifeCycle::Ptr client_lifecycle;
AltProxy::Ptr alt_proxy;
DCO::Ptr dco;
#ifdef OPENVPN_EXTERNAL_TRANSPORT_FACTORY
ExternalTransport::Factory* extern_transport_factory;
#endif
};
}
openvpn/client/cliopthelper.hpp
+220 -13
View File
@@ -4,18 +4,18 @@
// packet encryption, packet authentication, and
// packet compression.
//
// Copyright (C) 2012-2017 OpenVPN Technologies, Inc.
// Copyright (C) 2012-2017 OpenVPN Inc.
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License Version 3
// it under the terms of the GNU Affero General Public License Version 3
// as published by the Free Software Foundation.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// You should have received a copy of the GNU Affero General Public License
// along with this program in the COPYING file.
// If not, see <http://www.gnu.org/licenses/>.
@@ -28,6 +28,10 @@
#include <string>
#include <sstream>
#ifdef HAVE_CONFIG_JSONCPP
#include "json/json.h"
#endif /* HAVE_CONFIG_JSONCPP */
#include <openvpn/common/size.hpp>
#include <openvpn/common/exception.hpp>
#include <openvpn/common/options.hpp>
@@ -38,6 +42,9 @@
#include <openvpn/client/remotelist.hpp>
#include <openvpn/client/cliconstants.hpp>
#include <openvpn/ssl/peerinfo.hpp>
#include <openvpn/ssl/proto.hpp>
#include <openvpn/ssl/proto_context_options.hpp>
#include <openvpn/ssl/sslchoose.hpp>
namespace openvpn {
class ParseClientConfig {
@@ -57,6 +64,11 @@ namespace openvpn {
std::string proto;
};
ParseClientConfig()
{
reset_pod();
}
ParseClientConfig(const OptionList& options)
{
try {
@@ -179,9 +191,9 @@ namespace openvpn {
}
// validate remote list
RemoteList rl(options, "", 0, nullptr);
remoteList.reset(new RemoteList(options, "", 0, nullptr));
{
const RemoteList::Item* ri = rl.first_item();
const RemoteList::Item* ri = remoteList->first_item();
if (ri)
{
firstRemoteListItem_.host = ri->server_host;
@@ -222,8 +234,8 @@ namespace openvpn {
}
else
{
if (rl.defined())
profileName_ = rl.first_server_host();
if (remoteList)
profileName_ = remoteList->first_server_host();
}
}
@@ -260,6 +272,31 @@ namespace openvpn {
if (pushPeerInfo_)
peerInfoUV_ = peer_info_uv;
}
// dev name
{
const Option *o = options.get_ptr("dev");
if (o)
{
dev = o->get(1, 256);
}
}
// protocol configuration
{
protoConfig.reset(new ProtoContext::Config());
protoConfig->tls_auth_factory.reset(new CryptoOvpnHMACFactory<SSLLib::CryptoAPI>());
protoConfig->tls_crypt_factory.reset(new CryptoTLSCryptFactory<SSLLib::CryptoAPI>());
protoConfig->load(options, ProtoContextOptions(), -1, false);
}
// ssl lib configuration
try {
sslConfig.reset(new SSLLib::SSLAPI::Config());
sslConfig->load(options, SSLConfigAPI::LF_PARSE_MODE);
} catch (...) {
sslConfig.reset();
}
}
catch (const std::exception& e)
{
@@ -268,6 +305,11 @@ namespace openvpn {
}
}
static ParseClientConfig parse(const std::string& content)
{
return parse(content, nullptr);
}
static ParseClientConfig parse(const std::string& content, OptionList::KeyValueList* content_list)
{
OptionList options;
@@ -397,7 +439,173 @@ namespace openvpn {
return os.str();
}
std::string to_string_config() const
{
std::ostringstream os;
os << "client" << std::endl;
os << "dev " << dev << std::endl;
os << "dev-type " << protoConfig->layer.dev_type() << std::endl;
for (size_t i = 0; i < remoteList->size(); i++)
{
const RemoteList::Item& item = remoteList->get_item(i);
os << "remote " << item.server_host << " " << item.server_port;
const char *proto = item.transport_protocol.protocol_to_string();
if (proto)
os << " " << proto;
os << std::endl;
}
if (protoConfig->tls_crypt_context)
{
os << "<tls-crypt>" << std::endl << protoConfig->tls_key.render() << "</tls-crypt>"
<< std::endl;
}
else if (protoConfig->tls_auth_context)
{
os << "<tls-auth>" << std::endl << protoConfig->tls_key.render() << "</tls-auth>"
<< std::endl;
os << "key_direction " << protoConfig->key_direction << std::endl;
}
// SSL parameters
if (sslConfig)
{
print_pem(os, "ca", sslConfig->extract_ca());
print_pem(os, "crl", sslConfig->extract_crl());
print_pem(os, "key", sslConfig->extract_private_key());
print_pem(os, "cert", sslConfig->extract_cert());
std::vector<std::string> extra_certs = sslConfig->extract_extra_certs();
if (extra_certs.size() > 0)
{
os << "<extra-certs>" << std::endl;
for (auto& cert : extra_certs)
{
os << cert;
}
os << "</extra-certs>" << std::endl;
}
}
os << "cipher " << CryptoAlgs::name(protoConfig->dc.cipher(), "none")
<< std::endl;
os << "auth " << CryptoAlgs::name(protoConfig->dc.digest(), "none")
<< std::endl;
const char *comp = protoConfig->comp_ctx.method_to_string();
if (comp)
os << "compress " << comp << std::endl;
os << "keepalive " << protoConfig->keepalive_ping.to_seconds() << " "
<< protoConfig->keepalive_timeout.to_seconds() << std::endl;
os << "tun-mtu " << protoConfig->tun_mtu << std::endl;
os << "reneg-sec " << protoConfig->renegotiate.to_seconds() << std::endl;
return os.str();
}
#ifdef HAVE_CONFIG_JSONCPP
std::string to_json_config() const
{
std::ostringstream os;
Json::Value root(Json::objectValue);
root["mode"] = Json::Value("client");
root["dev"] = Json::Value(dev);
root["dev-type"] = Json::Value(protoConfig->layer.dev_type());
root["remotes"] = Json::Value(Json::arrayValue);
for (size_t i = 0; i < remoteList->size(); i++)
{
const RemoteList::Item& item = remoteList->get_item(i);
Json::Value el = Json::Value(Json::objectValue);
el["address"] = Json::Value(item.server_host);
el["port"] = Json::Value((Json::UInt)std::stoi(item.server_port));
if (item.transport_protocol() == Protocol::NONE)
el["proto"] = Json::Value("adaptive");
else
el["proto"] = Json::Value(item.transport_protocol.str());
root["remotes"].append(el);
}
if (protoConfig->tls_crypt_context)
{
root["tls_wrap"] = Json::Value(Json::objectValue);
root["tls_wrap"]["mode"] = Json::Value("tls_crypt");
root["tls_wrap"]["key"] = Json::Value(protoConfig->tls_key.render());
}
else if (protoConfig->tls_auth_context)
{
root["tls_wrap"] = Json::Value(Json::objectValue);
root["tls_wrap"]["mode"] = Json::Value("tls_auth");
root["tls_wrap"]["key_direction"] = Json::Value((Json::UInt)protoConfig->key_direction);
root["tls_wrap"]["key"] = Json::Value(protoConfig->tls_key.render());
}
// SSL parameters
if (sslConfig)
{
json_pem(root, "ca", sslConfig->extract_ca());
json_pem(root, "crl", sslConfig->extract_crl());
json_pem(root, "cert", sslConfig->extract_cert());
// JSON config is aimed to users, therefore we do not export the raw private
// key, but only some basic info
SSLConfigAPI::PKType priv_key_type = sslConfig->private_key_type();
if (priv_key_type != SSLConfigAPI::PK_NONE)
{
root["key"] = Json::Value(Json::objectValue);
root["key"]["type"] = Json::Value(sslConfig->private_key_type_string());
root["key"]["length"] = Json::Value((Json::UInt)sslConfig->private_key_length());
}
std::vector<std::string> extra_certs = sslConfig->extract_extra_certs();
if (extra_certs.size() > 0)
{
root["extra_certs"] = Json::Value(Json::arrayValue);
for (auto cert = extra_certs.begin(); cert != extra_certs.end(); cert++)
{
if (!cert->empty())
root["extra_certs"].append(Json::Value(*cert));
}
}
}
root["cipher"] = Json::Value(CryptoAlgs::name(protoConfig->dc.cipher(), "none"));
root["auth"] = Json::Value(CryptoAlgs::name(protoConfig->dc.digest(), "none"));
if (protoConfig->comp_ctx.type() != CompressContext::NONE)
root["compression"] = Json::Value(protoConfig->comp_ctx.str());
root["keepalive"] = Json::Value(Json::objectValue);
root["keepalive"]["ping"] = Json::Value((Json::UInt)protoConfig->keepalive_ping.to_seconds());
root["keepalive"]["timeout"] = Json::Value((Json::UInt)protoConfig->keepalive_timeout.to_seconds());
root["tun_mtu"] = Json::Value((Json::UInt)protoConfig->tun_mtu);
root["reneg_sec"] = Json::Value((Json::UInt)protoConfig->renegotiate.to_seconds());
return root.toStyledString();
}
#endif /* HAVE_CONFIG_JSONCPP */
private:
static void print_pem(std::ostream& os, std::string label, std::string pem)
{
if (pem.empty())
return;
os << "<" << label << ">" << std::endl << pem << "</" << label << ">" << std::endl;
}
#ifdef HAVE_CONFIG_JSONCPP
static void json_pem(Json::Value& obj, std::string key, std::string pem)
{
if (pem.empty())
return;
obj[key] = Json::Value(pem);
}
#endif /* HAVE_CONFIG_JSONCPP */
static bool parse_auth_user_pass(const OptionList& options, std::vector<std::string>* user_pass)
{
return UserPass::parse(options, "auth-user-pass", 0, user_pass);
@@ -456,11 +664,6 @@ namespace openvpn {
}
}
ParseClientConfig()
{
reset_pod();
}
void reset_pod()
{
error_ = autologin_ = externalPki_ = staticChallengeEcho_ = false;
@@ -496,8 +699,12 @@ namespace openvpn {
ServerList serverList_;
bool hasEmbeddedPassword_;
std::string embeddedPassword_;
RemoteList::Ptr remoteList;
RemoteItem firstRemoteListItem_;
PeerInfo::Set::Ptr peerInfoUV_;
ProtoContext::Config::Ptr protoConfig;
SSLLib::SSLAPI::Config::Ptr sslConfig;
std::string dev;
};
}
openvpn/client/cliproto.hpp
+18 -4
View File
@@ -4,18 +4,18 @@
// packet encryption, packet authentication, and
// packet compression.
//
// Copyright (C) 2012-2017 OpenVPN Technologies, Inc.
// Copyright (C) 2012-2017 OpenVPN Inc.
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License Version 3
// it under the terms of the GNU Affero General Public License Version 3
// as published by the Free Software Foundation.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// You should have received a copy of the GNU Affero General Public License
// along with this program in the COPYING file.
// If not, see <http://www.gnu.org/licenses/>.
@@ -785,10 +785,23 @@ namespace openvpn {
}
}
// react to any tls warning triggered during the tls-handshake
virtual void check_tls_warnings()
{
uint32_t tls_warnings = get_tls_warnings();
if (tls_warnings & SSLAPI::TLS_WARN_SIG_MD5)
{
ClientEvent::Base::Ptr ev = new ClientEvent::Warn("TLS: received certificate signed with MD5. Please inform your admin to upgrade to a stronger algorithm. Support for MD5 will be dropped at end of Apr 2018");
cli_events->add_event(std::move(ev));
}
}
// base class calls here when primary session transitions to ACTIVE state
virtual void active()
{
OPENVPN_LOG("Session is ACTIVE");
check_tls_warnings();
schedule_push_request_callback(Time::Duration::seconds(0));
}
@@ -842,6 +855,7 @@ namespace openvpn {
else
{
housekeeping_timer.cancel();
housekeeping_schedule.reset();
}
}
}
openvpn/client/ipverflags.hpp
+4 -4
View File
@@ -4,18 +4,18 @@
// packet encryption, packet authentication, and
// packet compression.
//
// Copyright (C) 2012-2017 OpenVPN Technologies, Inc.
// Copyright (C) 2012-2017 OpenVPN Inc.
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License Version 3
// it under the terms of the GNU Affero General Public License Version 3
// as published by the Free Software Foundation.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// You should have received a copy of the GNU Affero General Public License
// along with this program in the COPYING file.
// If not, see <http://www.gnu.org/licenses/>.
openvpn/client/optfilt.hpp
+4 -4
View File
@@ -4,18 +4,18 @@
// packet encryption, packet authentication, and
// packet compression.
//
// Copyright (C) 2012-2017 OpenVPN Technologies, Inc.
// Copyright (C) 2012-2017 OpenVPN Inc.
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License Version 3
// it under the terms of the GNU Affero General Public License Version 3
// as published by the Free Software Foundation.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// You should have received a copy of the GNU Affero General Public License
// along with this program in the COPYING file.
// If not, see <http://www.gnu.org/licenses/>.
openvpn/client/remotelist.hpp
+25 -14
View File
@@ -4,18 +4,18 @@
// packet encryption, packet authentication, and
// packet compression.
//
// Copyright (C) 2012-2017 OpenVPN Technologies, Inc.
// Copyright (C) 2012-2017 OpenVPN Inc.
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License Version 3
// it under the terms of the GNU Affero General Public License Version 3
// as published by the Free Software Foundation.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// You should have received a copy of the GNU Affero General Public License
// along with this program in the COPYING file.
// If not, see <http://www.gnu.org/licenses/>.
@@ -338,8 +338,8 @@ namespace openvpn {
else
{
// call into Asio to do the resolve operation
OPENVPN_LOG_REMOTELIST("*** PreResolve RESOLVE on " << item.server_host);
resolver.async_resolve(item.server_host, "",
OPENVPN_LOG_REMOTELIST("*** PreResolve RESOLVE on " << item.server_host << " : " << item.server_port);
resolver.async_resolve(item.server_host, item.server_port,
[self=Ptr(this)](const openvpn_io::error_code& error, openvpn_io::ip::tcp::resolver::results_type results)
{
self->resolve_callback(error, results);
@@ -517,16 +517,27 @@ namespace openvpn {
// override all server hosts to server_override
void set_server_override(const std::string& server_override)
{
if (!server_override.empty())
if (server_override.empty())
return;
for (auto &item : list)
{
for (std::vector<Item::Ptr>::iterator i = list.begin(); i != list.end(); ++i)
{
Item& item = **i;
item.server_host = server_override;
item.res_addr_list.reset(nullptr);
}
reset_cache();
item->server_host = server_override;
item->res_addr_list.reset();
}
reset_cache();
}
// override all server ports to port_override
void set_port_override(const std::string& port_override)
{
if (port_override.empty())
return;
for (auto &item : list)
{
item->server_port = port_override;
item->res_addr_list.reset();
}
reset_cache();
}
void set_random(const RandomAPI::Ptr& rng_arg)
openvpn/client/rgopt.hpp
+4 -4
View File
@@ -4,18 +4,18 @@
// packet encryption, packet authentication, and
// packet compression.
//
// Copyright (C) 2012-2017 OpenVPN Technologies, Inc.
// Copyright (C) 2012-2017 OpenVPN Inc.
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License Version 3
// it under the terms of the GNU Affero General Public License Version 3
// as published by the Free Software Foundation.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// You should have received a copy of the GNU Affero General Public License
// along with this program in the COPYING file.
// If not, see <http://www.gnu.org/licenses/>.