Make ValdikSS's DNS leak fix platform agnostic
PATCH 1/1 Make ValdikSS's DNS leak fix platform agnostic
Based on release/2.3 branch and ValdikSS's v9 patch, this patch is cross-compiled on Linux and tested on Windows XP/10. The VC project file is left untouched - you might want to add rpcrt4.lib to compile and link it under MSVC.
Take ValdikSS<[email protected]...>'s patch for "block-outside-dns" option and make it Windows-version-agnostic.
--- src/openvpn/Makefile.am | 2 +- src/openvpn/init.c | 4 - src/openvpn/options.c | 17 +-- src/openvpn/win32.c | 309 +++++++++++++++++++++++++++++++++++++++++++++++- src/openvpn/win32.h | 1 + 5 files changed, 315 insertions(+), 18 deletions(-)
src/openvpn/Makefile.am +1 -2
@@ -123,5 +123,5 @@ openvpn_LDADD = \ $(OPTIONAL_DL_LIBS) if WIN32 openvpn_SOURCES += openvpn_win32_resources.rc -openvpn_LDADD += -lgdi32 -lws2_32 -lwininet -lcrypt32 -liphlpapi -lwinmm +openvpn_LDADD += -lgdi32 -lws2_32 -lwininet -lcrypt32 -liphlpapi -lrpcrt4 -lwinmm
endif
src/openvpn/init.c +0 -4
@@ -1468,14 +1468,12 @@ do_open_tun (struct context *c)"up" , c->c2.es); -#if _WIN32_WINNT >=0x0600 if (c->options.block_outside_dns) {dmsg (D_LOW ,"Blocking outside DNS" );if (!win_wfp_block_dns (c->c1.tuntap->adapter_index))msg (M_FATAL ,"Blocking DNS failed!" ); } -#endif /* possibly add routes */ if (!c->options.route_delay_defined)
@@ -1603,13 +1601,11 @@ do_close_tun (struct context *c, bool force)"down" , c->c2.es); -#if _WIN32_WINNT >=0x0600 if (c->options.block_outside_dns) {if (!win_wfp_uninit ())msg (M_FATAL ,"Uninitialising WFP failed!" ); } -#endif /* actually close tun/tap device based on --down-pre flag */ if (c->options.down_pre)
src/openvpn/options.c +0 -0
@@ -715,9 +715,7 @@ static const char usage_message[] = " optional parameter controls the initial
state of ex.\n"
"--show-net-up : Show " PACKAGE_NAME "'s view of routing table
and net adapter list\n"
" after TAP adapter is up and routes have been added.\n"
-#if _WIN32_WINNT >= 0x0600
"--block-outside-dns : Block DNS on other network adapters to
prevent DNS leaks\n"
-#endif
"Windows Standalone Options:\n"
"\n"
"--show-adapters : Show all TAP-Windows adapters.\n"
@@ -1682,9 +1680,7 @@ show_settings (const struct options *o)
#ifdef WIN32
SHOW_BOOL (show_net_up);
SHOW_INT (route_method);
-#if _WIN32_WINNT >= 0x0600
SHOW_BOOL (block_outside_dns);
-#endif
show_tuntap_options (&o->tuntap_options);
#endif
#endif
@@ -6252,13 +6248,20 @@ add_option (struct options *options,
VERIFY_PERMISSION (OPT_P_IPWIN32);
options->tuntap_options.register_dns = true;
}
-#if _WIN32_WINNT >= 0x0600
else if (streq (p[0], "block-outside-dns") && !p[1])
{
VERIFY_PERMISSION (OPT_P_IPWIN32);
- options->block_outside_dns = true;
+ if (win_wfp_init_funcs())
+ {
+ options->block_outside_dns = true;
+ }
+ else
+ {+ msg (msglevel, "Failed to enable --block-outside-dns. "
+ "Maybe WFP is not supported on your system?");
+ goto err;
+ }
}
-#endif
else if (streq (p[0], "rdns-internal"))
/* standalone method for internal use
*src/openvpn/win32.c +279 -5
307 lines not on this page · raw message
(func_ConvertInterfaceIndexToLuid)GetProcAddress(iphlpapiHandle, "ConvertInterfaceIndexToLuid");
+ FwpmFilterAdd0 = (func_FwpmFilterAdd0)GetProcAddress(fwpuclntHandle, "FwpmFilterAdd0");
+ FwpmEngineOpen0 = (func_FwpmEngineOpen0)GetProcAddress(fwpuclntHandle, "FwpmEngineOpen0");
+ FwpmEngineClose0 = (func_FwpmEngineClose0)GetProcAddress(fwpuclntHandle, "FwpmEngineClose0");
+ FwpmSubLayerAdd0 = (func_FwpmSubLayerAdd0)GetProcAddress(fwpuclntHandle, "FwpmSubLayerAdd0");
+ FwpmSubLayerDeleteByKey0 = (func_FwpmSubLayerDeleteByKey0)GetProcAddress(fwpuclntHandle, "FwpmSubLayerDeleteByKey0");
+ FwpmFreeMemory0 = (func_FwpmFreeMemory0)GetProcAddress(fwpuclntHandle, "FwpmFreeMemory0");
+ FwpmGetAppIdFromFileName0 = (func_FwpmGetAppIdFromFileName0)GetProcAddress(fwpuclntHandle, "FwpmGetAppIdFromFileName0");
+
+ if (!ConvertInterfaceIndexToLuid ||
+ !FwpmFilterAdd0 || + !FwpmEngineOpen0 || + !FwpmEngineClose0 || + !FwpmSubLayerAdd0 || + !FwpmSubLayerDeleteByKey0 || + !FwpmFreeMemory0 || + !FwpmGetAppIdFromFileName0)
+ {
+ msg (M_NONFATAL, "Can't get address for all WFP-related procedures.");
+ return false;
+ }
+
+ return true;
+}
+
bool
win_wfp_add_filter (HANDLE engineHandle,
const FWPM_FILTER0 *filter,
@@ -1292,4 +1590,3 @@ win_wfp_uninit()
}
#endif
-#endif
src/openvpn/win32.h +1 -0
@@ -271,6 +271,7 @@ const char *win_get_tempdir();/* Convert a string from UTF-8 to UCS-2 */ WCHAR *wide_string (const char * utf8,struct gc_arena *gc); +bool win_wfp_init_funcs ();bool win_wfp_block_dns (const NET_IFINDEX index);bool win_wfp_uninit ();
Signature · 1 line
1.9.1
Hi,
The patch is mangled by mailer (added linebreaks etc.). Could you please resend using git send-email? While at it, one thing I noticed:
Quoted 4 lines · Fish Wang
(quoted diff) +0
-1-#if _WIN32_WINNT >= 0x0600 else if (streq (p[0], "block-outside-dns") && !p[1]) {
Review
Quoted 10 lines
(quoted diff) +8
-1VERIFY_PERMISSION (OPT_P_IPWIN32); - options->block_outside_dns = true; + if (win_wfp_init_funcs()) + { + options->block_outside_dns = true; + } + else + { + msg (msglevel, "Failed to enable --block-outside-dns. " + "Maybe WFP is not supported on your system?");
I believe msglevel_fc is more appropriate, as otherwise forward compatible and "setenv opt" usages will not be respected.
Selva
PATCH 1/1 Make ValdikSS's DNS leak fix platform agnostic
In reply to Fish WangBased on release/2.3 branch and ValdikSS's v9 patch, this patch is cross-compiled on Linux and tested on Windows XP/10. The VC project file is left untouched - you might want to add rpcrt4.lib to compile and link it under MSVC.
Take ValdikSS<[email protected]...>'s patch for "block-outside-dns" option and make it Windows-version-agnostic.
--- src/openvpn/Makefile.am | 2 +- src/openvpn/init.c | 4 - src/openvpn/options.c | 17 +-- src/openvpn/win32.c | 309 +++++++++++++++++++++++++++++++++++++++++++++++- src/openvpn/win32.h | 1 + 5 files changed, 315 insertions(+), 18 deletions(-)
src/openvpn/Makefile.am +1 -1
@@ -123,5 +123,5 @@ openvpn_LDADD = \ $(OPTIONAL_DL_LIBS) if WIN32 openvpn_SOURCES += openvpn_win32_resources.rc -openvpn_LDADD += -lgdi32 -lws2_32 -lwininet -lcrypt32 -liphlpapi -lwinmm +openvpn_LDADD += -lgdi32 -lws2_32 -lwininet -lcrypt32 -liphlpapi -lrpcrt4 -lwinmm endif
src/openvpn/init.c +0 -4
@@ -1468,14 +1468,12 @@ do_open_tun (struct context *c)"up" , c->c2.es); -#if _WIN32_WINNT >=0x0600 if (c->options.block_outside_dns) {dmsg (D_LOW ,"Blocking outside DNS" );if (!win_wfp_block_dns (c->c1.tuntap->adapter_index))msg (M_FATAL ,"Blocking DNS failed!" ); } -#endif /* possibly add routes */ if (!c->options.route_delay_defined)
@@ -1603,13 +1601,11 @@ do_close_tun (struct context *c, bool force)"down" , c->c2.es); -#if _WIN32_WINNT >=0x0600 if (c->options.block_outside_dns) {if (!win_wfp_uninit ())msg (M_FATAL ,"Uninitialising WFP failed!" ); } -#endif /* actually close tun/tap device based on --down-pre flag */ if (c->options.down_pre)
src/openvpn/options.c +10 -7
@@ -715,9 +715,7 @@ static const char usage_message[] =" optional parameter controls the initial state of ex.\n" "--show-net-up : Show " PACKAGE_NAME "'s view of routing table and net adapter list\n" " after TAP adapter is up and routes have been added.\n" -#if _WIN32_WINNT >=0x0600 "--block-outside-dns : Block DNS on other network adapters to prevent DNS leaks\n" -#endif "Windows Standalone Options:\n" "\n" "--show-adapters : Show all TAP-Windows adapters.\n"
@@ -1682,9 +1680,7 @@ show_settings (const struct options *o)#ifdef WIN32 SHOW_BOOL (show_net_up);SHOW_INT (route_method); -#if _WIN32_WINNT >=0x0600 SHOW_BOOL (block_outside_dns); -#endif show_tuntap_options (&o->tuntap_options);#endif #endif
@@ -6252,13 +6248,20 @@ add_option (struct options *options,VERIFY_PERMISSION (OPT_P_IPWIN32 ); options->tuntap_options.register_dns = true; } -#if _WIN32_WINNT >=0x0600 else if (streq (p[0 ],"block-outside-dns" ) && !p[1 ]) {VERIFY_PERMISSION (OPT_P_IPWIN32 ); - options->block_outside_dns = true; +if (win_wfp_init_funcs ()) + { + options->block_outside_dns = true; + } +else + { +msg (msglevel_fc,"Failed to enable --block-outside-dns. " +"Maybe WFP is not supported on your system?" ); + goto err; + } } -#endif else if (streq (p[0 ],"rdns-internal" ))/* standalone method for internal use *
src/openvpn/win32.c +303 -6
338 lines not on this page · raw message
src/openvpn/win32.h +1 -0
@@ -271,6 +271,7 @@ const char *win_get_tempdir();/* Convert a string from UTF-8 to UCS-2 */ WCHAR *wide_string (const char * utf8,struct gc_arena *gc); +bool win_wfp_init_funcs ();bool win_wfp_block_dns (const NET_IFINDEX index);bool win_wfp_uninit ();
Signature · 1 line
2.6.4
Hi,
Quoted 6 lines · Fish
Based on release/2.3 branch and ValdikSS's v9 patch, this patch is cross-compiled on Linux and tested on Windows XP/10. The VC project file is left untouched - you might want to add rpcrt4.lib to compile and link it under
MSVC.
Builds on 2.3 out of the box (i.e., target WINXP).
The implementation looks fine, and works on win7 and 10, but I've no XP machines for the crucial test.
A minor suggestion: All those prototypes taken from mingw (32 or -w64?) may be better placed in new header file to be included only from win32.c -- -- preferably with a license matching the source (PD or ZPL?). Makes win32.c less cluttered as well.
I'm not familiar with the policy of OpenVPN on license-related matters, though.
Selva
Hi all,
A minor suggestion: All those prototypes taken from mingw (32 or -w64?) may be better placed in new header file to be included only from win32.c -- -- preferably with a license matching the source (PD or ZPL?). Makes win32.c less cluttered as well.
Will do. However, I’m by no means a license expert. Based on Licensing Terms page on MinGW’s website ([1], win32api), I believe the code I stripped out of MinGW should be fine as long as a copy of the notice and its license [2] is included. Please correct me if I’m wrong.
Best,
Fish
[1] http://www.mingw.org/license
From: Selva Nair [mailto:[email protected]...]
Sent: Sunday, December 13, 2015 1:14 PM
To: Fish <[email protected]...>
Cc: [email protected]
Subject: Re: [Openvpn-devel] [PATCH] Make ValdikSS's DNS leak fix platform agnostic
Hi,
On Thu, Dec 10, 2015 at 7:46 PM, Fish <[email protected]... <mailto:[email protected]...> > wrote:
Based on release/2.3 branch and ValdikSS's v9 patch, this patch is cross-compiled on Linux and tested on Windows XP/10. The VC project file is left untouched - you might want to add rpcrt4.lib to compile and link it under MSVC.
Builds on 2.3 out of the box (i.e., target WINXP).
The implementation looks fine, and works on win7 and 10, but I've no XP machines for the crucial test.
A minor suggestion: All those prototypes taken from mingw (32 or -w64?) may be better placed in new header file to be included only from win32.c -- -- preferably with a license matching the source (PD or ZPL?). Makes win32.c less cluttered as well.
I'm not familiar with the policy of OpenVPN on license-related matters, though.
Selva
Hi,
Quoted 4 lines · Fish Wang
Will do. However, I’m by no means a license expert. Based on Licensing Terms page on MinGW’s website ([1], win32api), I believe the code I stripped out of MinGW should be fine as long as a copy of the notice and its license [2] is included. Please correct me if I’m wrong.
I thought those headers are from the mingw-w64 (a different code base from mingw32)..
Anyway, I did not mean to imply any licensing issues with extracting parts from mingw32 or mingw-w64 --- both have permissive licenses so there is no clash. However, some GPL projects have clear guidelines of how to incorporate code from other licenses.
Personally I prefer to keep public domain code (and minor edits to it) in a separate file which clearly indicates its in PD with the original notice so that one wouldn't slap on a GPL header on it later. While some projects want all their additions to be GPL keeping the original in PD etc..(Fro example, see various practices disscussed in
https://www.softwarefreedom.org/resources/2007/gpl-non-gpl-collaboration.pdf
).
Better wait for a core developer to comment on this..
Selva
You are absolutely right, the code I grabbed is indeed from mingw-w64, not MinGW. Let me send out another patch with mingw-w64’s disclaimer soon. I’ll see what core people says about this patch.
Thanks!
Best,
Fish
From: Selva Nair [mailto:[email protected]...]
Sent: Sunday, December 13, 2015 5:09 PM
To: Fish Wang <[email protected]...>
Cc: [email protected]
Subject: Re: [Openvpn-devel] [PATCH] Make ValdikSS's DNS leak fix platform agnostic
Hi,
On Sun, Dec 13, 2015 at 7:20 PM, Fish Wang <[email protected]... <mailto:[email protected]...> > wrote:
Will do. However, I’m by no means a license expert. Based on Licensing Terms page on MinGW’s website ([1], win32api), I believe the code I stripped out of MinGW should be fine as long as a copy of the notice and its license [2] is included. Please correct me if I’m wrong.
I thought those headers are from the mingw-w64 (a different code base from mingw32)..
Anyway, I did not mean to imply any licensing issues with extracting parts from mingw32 or mingw-w64 --- both have permissive licenses so there is no clash. However, some GPL projects have clear guidelines of how to incorporate code from other licenses.
Personally I prefer to keep public domain code (and minor edits to it) in a separate file which clearly indicates its in PD with the original notice so that one wouldn't slap on a GPL header on it later. While some projects want all their additions to be GPL keeping the original in PD etc..(Fro example, see various practices disscussed in
https://www.softwarefreedom.org/resources/2007/gpl-non-gpl-collaboration.pdf).
Better wait for a core developer to comment on this..
Selva
Hi,
Quoted 1 line · Fish Wang
Will do. However, I???m by no means a license expert. Based on Licensing Terms page on MinGW???s website ([1], win32api), I believe the code I stripped out of MinGW should be fine as long as a copy of the notice and its license [2] is included. Please correct me if I???m wrong.
By no means a license expert myself, I think it would be good to have something like "win32-api.h" (name stands to be discussed) which has all the bits we take from MinGW with a comment and their license included (your [2], if I'm not mistaken) - so it's totally clear where the stuff came from. Less of a "technical" design issue, but being nice about attribution.
Quoted 1 line
gert
Signature · 4 lines
USENET is *not* the non-clickable part of WWW!
//www.muc.de/~gert/
Gert Doering - Munich, Germany [email protected]...
fax: +49-89-35655025 [email protected]...PATCH 1/1 Make "block-outside-dns" option platform agnostic
In reply to Selva NairMake the "block-outside-dns" option agnostic of Windows versions by dynamically loading WFP-related functions. Cross-compiled on Linux and tested on Windows XP/10.
--- src/openvpn/Makefile.am | 2 +- src/openvpn/init.c | 4 - src/openvpn/options.c | 17 ++- src/openvpn/win32.c | 114 ++++++++------- src/openvpn/win32.h | 1 + src/openvpn/win32_wfp.h | 361 ++++++++++++++++++++++++++++++++++++++++++++++++ 6 files changed, 427 insertions(+), 72 deletions(-) create mode 100644 src/openvpn/win32_wfp.h
src/openvpn/Makefile.am +1 -1
@@ -123,5 +123,5 @@ openvpn_LDADD = \ $(OPTIONAL_DL_LIBS) if WIN32 openvpn_SOURCES += openvpn_win32_resources.rc -openvpn_LDADD += -lgdi32 -lws2_32 -lwininet -lcrypt32 -liphlpapi -lwinmm +openvpn_LDADD += -lgdi32 -lws2_32 -lwininet -lcrypt32 -liphlpapi -lrpcrt4 -lwinmm endif
src/openvpn/init.c +0 -4
@@ -1468,14 +1468,12 @@ do_open_tun (struct context *c)"up" , c->c2.es); -#if _WIN32_WINNT >=0x0600 if (c->options.block_outside_dns) {dmsg (D_LOW ,"Blocking outside DNS" );if (!win_wfp_block_dns (c->c1.tuntap->adapter_index))msg (M_FATAL ,"Blocking DNS failed!" ); } -#endif /* possibly add routes */ if (!c->options.route_delay_defined)
@@ -1603,13 +1601,11 @@ do_close_tun (struct context *c, bool force)"down" , c->c2.es); -#if _WIN32_WINNT >=0x0600 if (c->options.block_outside_dns) {if (!win_wfp_uninit ())msg (M_FATAL ,"Uninitialising WFP failed!" ); } -#endif /* actually close tun/tap device based on --down-pre flag */ if (c->options.down_pre)
src/openvpn/options.c +10 -7
@@ -715,9 +715,7 @@ static const char usage_message[] =" optional parameter controls the initial state of ex.\n" "--show-net-up : Show " PACKAGE_NAME "'s view of routing table and net adapter list\n" " after TAP adapter is up and routes have been added.\n" -#if _WIN32_WINNT >=0x0600 "--block-outside-dns : Block DNS on other network adapters to prevent DNS leaks\n" -#endif "Windows Standalone Options:\n" "\n" "--show-adapters : Show all TAP-Windows adapters.\n"
@@ -1682,9 +1680,7 @@ show_settings (const struct options *o)#ifdef WIN32 SHOW_BOOL (show_net_up);SHOW_INT (route_method); -#if _WIN32_WINNT >=0x0600 SHOW_BOOL (block_outside_dns); -#endif show_tuntap_options (&o->tuntap_options);#endif #endif
@@ -6252,13 +6248,20 @@ add_option (struct options *options,VERIFY_PERMISSION (OPT_P_IPWIN32 ); options->tuntap_options.register_dns = true; } -#if _WIN32_WINNT >=0x0600 else if (streq (p[0 ],"block-outside-dns" ) && !p[1 ]) {VERIFY_PERMISSION (OPT_P_IPWIN32 ); - options->block_outside_dns = true; +if (win_wfp_init_funcs ()) + { + options->block_outside_dns = true; + } +else + { +msg (msglevel_fc,"Failed to enable --block-outside-dns. " +"Maybe WFP is not supported on your system?" ); + goto err; + } } -#endif else if (streq (p[0 ],"rdns-internal" ))/* standalone method for internal use *
src/openvpn/win32.c +54 -60
135 lines not on this page · raw message
src/openvpn/win32.h +1 -0
@@ -271,6 +271,7 @@ const char *win_get_tempdir();/* Convert a string from UTF-8 to UCS-2 */ WCHAR *wide_string (const char * utf8,struct gc_arena *gc); +bool win_wfp_init_funcs ();bool win_wfp_block_dns (const NET_IFINDEX index);bool win_wfp_uninit ();
src/openvpn/win32_wfp.h new file +361 -0
361 lines not on this page · raw message
Signature · 1 line
2.6.4
PATCH 1/1 Make "block-outside-dns" option platform agnostic
Make the "block-outside-dns" option agnostic of Windows versions by dynamically loading WFP-related functions. Cross-compiled on Linux and tested on Windows XP/10.
--- src/openvpn/Makefile.am | 2 +- src/openvpn/init.c | 4 - src/openvpn/options.c | 17 ++- src/openvpn/win32.c | 114 ++++++++------- src/openvpn/win32.h | 1 + src/openvpn/win32_wfp.h | 359 ++++++++++++++++++++++++++++++++++++++++++++++++ 6 files changed, 425 insertions(+), 72 deletions(-) create mode 100644 src/openvpn/win32_wfp.h
src/openvpn/Makefile.am +1 -1
@@ -123,5 +123,5 @@ openvpn_LDADD = \ $(OPTIONAL_DL_LIBS) if WIN32 openvpn_SOURCES += openvpn_win32_resources.rc -openvpn_LDADD += -lgdi32 -lws2_32 -lwininet -lcrypt32 -liphlpapi -lwinmm +openvpn_LDADD += -lgdi32 -lws2_32 -lwininet -lcrypt32 -liphlpapi -lrpcrt4 -lwinmm endif
src/openvpn/init.c +0 -4
@@ -1468,14 +1468,12 @@ do_open_tun (struct context *c)"up" , c->c2.es); -#if _WIN32_WINNT >=0x0600 if (c->options.block_outside_dns) {dmsg (D_LOW ,"Blocking outside DNS" );if (!win_wfp_block_dns (c->c1.tuntap->adapter_index))msg (M_FATAL ,"Blocking DNS failed!" ); } -#endif /* possibly add routes */ if (!c->options.route_delay_defined)
@@ -1603,13 +1601,11 @@ do_close_tun (struct context *c, bool force)"down" , c->c2.es); -#if _WIN32_WINNT >=0x0600 if (c->options.block_outside_dns) {if (!win_wfp_uninit ())msg (M_FATAL ,"Uninitialising WFP failed!" ); } -#endif /* actually close tun/tap device based on --down-pre flag */ if (c->options.down_pre)
src/openvpn/options.c +10 -7
@@ -715,9 +715,7 @@ static const char usage_message[] =" optional parameter controls the initial state of ex.\n" "--show-net-up : Show " PACKAGE_NAME "'s view of routing table and net adapter list\n" " after TAP adapter is up and routes have been added.\n" -#if _WIN32_WINNT >=0x0600 "--block-outside-dns : Block DNS on other network adapters to prevent DNS leaks\n" -#endif "Windows Standalone Options:\n" "\n" "--show-adapters : Show all TAP-Windows adapters.\n"
@@ -1682,9 +1680,7 @@ show_settings (const struct options *o)#ifdef WIN32 SHOW_BOOL (show_net_up);SHOW_INT (route_method); -#if _WIN32_WINNT >=0x0600 SHOW_BOOL (block_outside_dns); -#endif show_tuntap_options (&o->tuntap_options);#endif #endif
@@ -6252,13 +6248,20 @@ add_option (struct options *options,VERIFY_PERMISSION (OPT_P_IPWIN32 ); options->tuntap_options.register_dns = true; } -#if _WIN32_WINNT >=0x0600 else if (streq (p[0 ],"block-outside-dns" ) && !p[1 ]) {VERIFY_PERMISSION (OPT_P_IPWIN32 ); - options->block_outside_dns = true; +if (win_wfp_init_funcs ()) + { + options->block_outside_dns = true; + } +else + { +msg (msglevel_fc,"Failed to enable --block-outside-dns. " +"Maybe WFP is not supported on your system?" ); + goto err; + } } -#endif else if (streq (p[0 ],"rdns-internal" ))/* standalone method for internal use *
src/openvpn/win32.c +54 -60
135 lines not on this page · raw message
src/openvpn/win32.h +1 -0
@@ -271,6 +271,7 @@ const char *win_get_tempdir();/* Convert a string from UTF-8 to UCS-2 */ WCHAR *wide_string (const char * utf8,struct gc_arena *gc); +bool win_wfp_init_funcs ();bool win_wfp_block_dns (const NET_IFINDEX index);bool win_wfp_uninit ();
src/openvpn/win32_wfp.h new file +359 -0
359 lines not on this page · raw message
Signature · 1 line
2.6.4
Re: [Openvpn-devel] [PATCH] Make "block-outside-dns" option platform agnostic
Hi,
Quoted 5 lines · Fish
Make the "block-outside-dns" option agnostic of Windows versions by dynamically
loading WFP-related functions. Cross-compiled on Linux and tested on Windows
XP/10.
Quoted 8 lines
--- src/openvpn/Makefile.am | 2 +- src/openvpn/init.c | 4 - src/openvpn/options.c | 17 ++- src/openvpn/win32.c | 114 ++++++++------- src/openvpn/win32.h | 1 + src/openvpn/win32_wfp.h | 359++++++++++++++++++++++++++++++++++++++++++++++++
Looks good, including the attribution to the right mingw upstream..
But won't build, as the new header (win32_wfp.h) is not added to src/openvpn/Makefile.am --- without that it wont get into the dist tarball etc..
Next time please append a version number to the mail header:
something like [PATCH v2] would do. I'm getting confused with too many versions :)
Thanks,
Selva
Re: [Openvpn-devel] [PATCH] Make "block-outside-dns" option platform agnostic
I see, let me add that file to Makefile.am. My modified build system does not create the dist tarball :-(
Best,
Fish
From: Selva Nair [mailto:[email protected]...]
Sent: Monday, December 14, 2015 9:01 AM
To: Fish <[email protected]...>
Cc: [email protected]
Subject: Re: [PATCH] Make "block-outside-dns" option platform agnostic
Hi,
On Sun, Dec 13, 2015 at 8:25 PM, Fish <[email protected]... <mailto:[email protected]...> > wrote:
Make the "block-outside-dns" option agnostic of Windows versions by dynamically loading WFP-related functions. Cross-compiled on Linux and tested on Windows XP/10.
--- src/openvpn/Makefile.am | 2 +- src/openvpn/init.c | 4 - src/openvpn/options.c | 17 ++- src/openvpn/win32.c | 114 ++++++++------- src/openvpn/win32.h | 1 + src/openvpn/win32_wfp.h | 359 ++++++++++++++++++++++++++++++++++++++++++++++++
Looks good, including the attribution to the right mingw upstream..
But won't build, as the new header (win32_wfp.h) is not added to src/openvpn/Makefile.am --- without that it wont get into the dist tarball etc..
Next time please append a version number to the mail header:
something like [PATCH v2] would do. I'm getting confused with too many versions :)
Thanks,
Selva
PATCH v2 1/1 Make "block-outside-dns" option platform agnostic
In reply to Selva NairMake the "block-outside-dns" option agnostic of Windows versions by dynamically loading WFP-related functions. Cross-compiled on Linux and tested on Windows XP/10.
--- src/openvpn/Makefile.am | 4 +- src/openvpn/init.c | 4 - src/openvpn/options.c | 17 ++- src/openvpn/win32.c | 114 ++++++++------- src/openvpn/win32.h | 1 + src/openvpn/win32_wfp.h | 359 ++++++++++++++++++++++++++++++++++++++++++++++++ 6 files changed, 426 insertions(+), 73 deletions(-) create mode 100644 src/openvpn/win32_wfp.h
src/openvpn/Makefile.am +2 -2
@@ -110,7 +110,7 @@ openvpn_SOURCES = \ status.c status.h \ syshead.h \ tun.c tun.h \ - win32.h win32.c \ + win32.h win32_wfp.h win32.c \ cryptoapi.h cryptoapi.c openvpn_LDADD = \ $(top_builddir)/src/compat/libcompat.la \
@@ -123,5 +123,5 @@ openvpn_LDADD = \ $(OPTIONAL_DL_LIBS) if WIN32 openvpn_SOURCES += openvpn_win32_resources.rc -openvpn_LDADD += -lgdi32 -lws2_32 -lwininet -lcrypt32 -liphlpapi -lwinmm +openvpn_LDADD += -lgdi32 -lws2_32 -lwininet -lcrypt32 -liphlpapi -lrpcrt4 -lwinmm endif
src/openvpn/init.c +0 -4
@@ -1468,14 +1468,12 @@ do_open_tun (struct context *c)"up" , c->c2.es); -#if _WIN32_WINNT >=0x0600 if (c->options.block_outside_dns) {dmsg (D_LOW ,"Blocking outside DNS" );if (!win_wfp_block_dns (c->c1.tuntap->adapter_index))msg (M_FATAL ,"Blocking DNS failed!" ); } -#endif /* possibly add routes */ if (!c->options.route_delay_defined)
@@ -1603,13 +1601,11 @@ do_close_tun (struct context *c, bool force)"down" , c->c2.es); -#if _WIN32_WINNT >=0x0600 if (c->options.block_outside_dns) {if (!win_wfp_uninit ())msg (M_FATAL ,"Uninitialising WFP failed!" ); } -#endif /* actually close tun/tap device based on --down-pre flag */ if (c->options.down_pre)
src/openvpn/options.c +10 -7
@@ -715,9 +715,7 @@ static const char usage_message[] =" optional parameter controls the initial state of ex.\n" "--show-net-up : Show " PACKAGE_NAME "'s view of routing table and net adapter list\n" " after TAP adapter is up and routes have been added.\n" -#if _WIN32_WINNT >=0x0600 "--block-outside-dns : Block DNS on other network adapters to prevent DNS leaks\n" -#endif "Windows Standalone Options:\n" "\n" "--show-adapters : Show all TAP-Windows adapters.\n"
@@ -1682,9 +1680,7 @@ show_settings (const struct options *o)#ifdef WIN32 SHOW_BOOL (show_net_up);SHOW_INT (route_method); -#if _WIN32_WINNT >=0x0600 SHOW_BOOL (block_outside_dns); -#endif show_tuntap_options (&o->tuntap_options);#endif #endif
@@ -6252,13 +6248,20 @@ add_option (struct options *options,VERIFY_PERMISSION (OPT_P_IPWIN32 ); options->tuntap_options.register_dns = true; } -#if _WIN32_WINNT >=0x0600 else if (streq (p[0 ],"block-outside-dns" ) && !p[1 ]) {VERIFY_PERMISSION (OPT_P_IPWIN32 ); - options->block_outside_dns = true; +if (win_wfp_init_funcs ()) + { + options->block_outside_dns = true; + } +else + { +msg (msglevel_fc,"Failed to enable --block-outside-dns. " +"Maybe WFP is not supported on your system?" ); + goto err; + } } -#endif else if (streq (p[0 ],"rdns-internal" ))/* standalone method for internal use *
src/openvpn/win32.c +54 -60
135 lines not on this page · raw message
src/openvpn/win32.h +1 -0
@@ -271,6 +271,7 @@ const char *win_get_tempdir();/* Convert a string from UTF-8 to UCS-2 */ WCHAR *wide_string (const char * utf8,struct gc_arena *gc); +bool win_wfp_init_funcs ();bool win_wfp_block_dns (const NET_IFINDEX index);bool win_wfp_uninit ();
src/openvpn/win32_wfp.h new file +359 -0
359 lines not on this page · raw message
Signature · 1 line
2.6.4
PATCH v3 1/1 Make "block-outside-dns" option platform agnostic
Make the "block-outside-dns" option agnostic of Windows versions by dynamically loading WFP-related functions. Cross-compiled on Linux and tested on Windows XP/10.
--- src/openvpn/Makefile.am | 4 +- src/openvpn/init.c | 4 +- src/openvpn/options.c | 17 ++- src/openvpn/win32.c | 114 ++++++++------- src/openvpn/win32.h | 1 + src/openvpn/win32_wfp.h | 359 ++++++++++++++++++++++++++++++++++++++++++++++++ 6 files changed, 429 insertions(+), 70 deletions(-) create mode 100644 src/openvpn/win32_wfp.h
src/openvpn/Makefile.am +2 -2
@@ -110,7 +110,7 @@ openvpn_SOURCES = \ status.c status.h \ syshead.h \ tun.c tun.h \ - win32.h win32.c \ + win32.h win32_wfp.h win32.c \ cryptoapi.h cryptoapi.c openvpn_LDADD = \ $(top_builddir)/src/compat/libcompat.la \
@@ -123,5 +123,5 @@ openvpn_LDADD = \ $(OPTIONAL_DL_LIBS) if WIN32 openvpn_SOURCES += openvpn_win32_resources.rc -openvpn_LDADD += -lgdi32 -lws2_32 -lwininet -lcrypt32 -liphlpapi -lwinmm +openvpn_LDADD += -lgdi32 -lws2_32 -lwininet -lcrypt32 -liphlpapi -lrpcrt4 -lwinmm endif
src/openvpn/init.c +2 -2
@@ -1468,7 +1468,7 @@ do_open_tun (struct context *c)"up" , c->c2.es); -#if _WIN32_WINNT >=0x0600 +#ifdef WIN32 if (c->options.block_outside_dns) {dmsg (D_LOW ,"Blocking outside DNS" );
@@ -1603,7 +1603,7 @@ do_close_tun (struct context *c, bool force)"down" , c->c2.es); -#if _WIN32_WINNT >=0x0600 +#ifdef WIN32 if (c->options.block_outside_dns) {if (!win_wfp_uninit ())
src/openvpn/options.c +11 -6
@@ -715,9 +715,7 @@ static const char usage_message[] =" optional parameter controls the initial state of ex.\n" "--show-net-up : Show " PACKAGE_NAME "'s view of routing table and net adapter list\n" " after TAP adapter is up and routes have been added.\n" -#if _WIN32_WINNT >=0x0600 "--block-outside-dns : Block DNS on other network adapters to prevent DNS leaks\n" -#endif "Windows Standalone Options:\n" "\n" "--show-adapters : Show all TAP-Windows adapters.\n"
@@ -1682,9 +1680,7 @@ show_settings (const struct options *o)#ifdef WIN32 SHOW_BOOL (show_net_up);SHOW_INT (route_method); -#if _WIN32_WINNT >=0x0600 SHOW_BOOL (block_outside_dns); -#endif show_tuntap_options (&o->tuntap_options);#endif #endif
@@ -6252,11 +6248,20 @@ add_option (struct options *options,VERIFY_PERMISSION (OPT_P_IPWIN32 ); options->tuntap_options.register_dns = true; } -#if _WIN32_WINNT >=0x0600 +#ifdef WIN32 else if (streq (p[0], "block-outside-dns") && !p[1]) {VERIFY_PERMISSION (OPT_P_IPWIN32 ); - options->block_outside_dns = true; +if (win_wfp_init_funcs ()) + { + options->block_outside_dns = true; + } +else + { +msg (msglevel_fc,"Failed to enable --block-outside-dns. " +"Maybe WFP is not supported on your system?" ); + goto err; + } }#endif else if (streq (p[0], "rdns-internal"))
src/openvpn/win32.c +54 -60
135 lines not on this page · raw message
src/openvpn/win32.h +1 -0
@@ -271,6 +271,7 @@ const char *win_get_tempdir();/* Convert a string from UTF-8 to UCS-2 */ WCHAR *wide_string (const char * utf8,struct gc_arena *gc); +bool win_wfp_init_funcs ();bool win_wfp_block_dns (const NET_IFINDEX index);bool win_wfp_uninit ();
src/openvpn/win32_wfp.h new file +359 -0
359 lines not on this page · raw message
Signature · 1 line
2.6.4
PATCH v4 1/1 Make "block-outside-dns" option platform agnostic
Make the "block-outside-dns" option agnostic of Windows versions by dynamically loading WFP-related functions. Cross-compiled on Linux and tested on Windows XP/10.
Also make MSVC happy.
--- src/openvpn/Makefile.am | 4 +- src/openvpn/init.c | 4 +- src/openvpn/openvpn.vcxproj | 6 +- src/openvpn/openvpn.vcxproj.filters | 5 +- src/openvpn/options.c | 17 +- src/openvpn/win32.c | 117 ++++++------ src/openvpn/win32.h | 1 + src/openvpn/win32_wfp.h | 359 ++++++++++++++++++++++++++++++++++++ 8 files changed, 439 insertions(+), 74 deletions(-) create mode 100644 src/openvpn/win32_wfp.h
src/openvpn/Makefile.am +2 -2
@@ -110,7 +110,7 @@ openvpn_SOURCES = \ status.c status.h \ syshead.h \ tun.c tun.h \ - win32.h win32.c \ + win32.h win32_wfp.h win32.c \ cryptoapi.h cryptoapi.c openvpn_LDADD = \ $(top_builddir)/src/compat/libcompat.la \
@@ -123,5 +123,5 @@ openvpn_LDADD = \ $(OPTIONAL_DL_LIBS) if WIN32 openvpn_SOURCES += openvpn_win32_resources.rc -openvpn_LDADD += -lgdi32 -lws2_32 -lwininet -lcrypt32 -liphlpapi -lwinmm +openvpn_LDADD += -lgdi32 -lws2_32 -lwininet -lcrypt32 -liphlpapi -lrpcrt4 -lwinmm endif
src/openvpn/init.c +2 -2
@@ -1468,7 +1468,7 @@ do_open_tun (struct context *c)"up" , c->c2.es); -#if _WIN32_WINNT >=0x0600 +#ifdef WIN32 if (c->options.block_outside_dns) {dmsg (D_LOW ,"Blocking outside DNS" );
@@ -1603,7 +1603,7 @@ do_close_tun (struct context *c, bool force)"down" , c->c2.es); -#if _WIN32_WINNT >=0x0600 +#ifdef WIN32 if (c->options.block_outside_dns) {if (!win_wfp_uninit ())
src/openvpn/openvpn.vcxproj +3 -3
@@ -62,7 +62,7 @@ <AdditionalIncludeDirectories>$(SOURCEBASE);%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories> </ResourceCompile> <Link> - <AdditionalDependencies>libeay32.lib;ssleay32.lib;lzo2.lib;pkcs11-helper.dll.lib;gdi32.lib;ws2_32.lib;wininet.lib;crypt32.lib;iphlpapi.lib;winmm.lib;%(AdditionalDependencies)</AdditionalDependencies> + <AdditionalDependencies>libeay32.lib;ssleay32.lib;lzo2.lib;pkcs11-helper.dll.lib;gdi32.lib;ws2_32.lib;wininet.lib;crypt32.lib;iphlpapi.lib;winmm.lib;rpcrt4.lib;%(AdditionalDependencies)</AdditionalDependencies> <AdditionalLibraryDirectories>$(OPENSSL_HOME)/lib;$(LZO_HOME)/lib;$(PKCS11H_HOME)/lib;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories> <GenerateDebugInformation>true</GenerateDebugInformation> <SubSystem>Console</SubSystem>
@@ -87,7 +87,7 @@ <AdditionalIncludeDirectories>$(SOURCEBASE);%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories> </ResourceCompile> <Link> - <AdditionalDependencies>libeay32.lib;ssleay32.lib;lzo2.lib;pkcs11-helper.dll.lib;gdi32.lib;ws2_32.lib;wininet.lib;crypt32.lib;iphlpapi.lib;winmm.lib;%(AdditionalDependencies)</AdditionalDependencies> + <AdditionalDependencies>libeay32.lib;ssleay32.lib;lzo2.lib;pkcs11-helper.dll.lib;gdi32.lib;ws2_32.lib;wininet.lib;crypt32.lib;iphlpapi.lib;winmm.lib;rpcrt4.lib;%(AdditionalDependencies)</AdditionalDependencies> <AdditionalLibraryDirectories>$(OPENSSL_HOME)/lib;$(LZO_HOME)/lib;$(PKCS11H_HOME)/lib;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories> <GenerateDebugInformation>true</GenerateDebugInformation> <SubSystem>Console</SubSystem>
@@ -260,4 +260,4 @@ <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" /> <ImportGroup Label="ExtensionTargets"> </ImportGroup> -</Project> +</Project>
src/openvpn/openvpn.vcxproj.filters +4 -1
@@ -449,10 +449,13 @@ <ClInclude Include="win32.h"> <Filter>Header Files</Filter> </ClInclude> + <ClInclude Include="win32_wfp.h"> + <Filter>Header Files</Filter> + </ClInclude> </ItemGroup> <ItemGroup> <ResourceCompile Include="openvpn_win32_resources.rc"> <Filter>Resource Files</Filter> </ResourceCompile> </ItemGroup> -</Project> +</Project>
src/openvpn/options.c +11 -6
@@ -715,9 +715,7 @@ static const char usage_message[] =" optional parameter controls the initial state of ex.\n" "--show-net-up : Show " PACKAGE_NAME "'s view of routing table and net adapter list\n" " after TAP adapter is up and routes have been added.\n" -#if _WIN32_WINNT >=0x0600 "--block-outside-dns : Block DNS on other network adapters to prevent DNS leaks\n" -#endif "Windows Standalone Options:\n" "\n" "--show-adapters : Show all TAP-Windows adapters.\n"
@@ -1682,9 +1680,7 @@ show_settings (const struct options *o)#ifdef WIN32 SHOW_BOOL (show_net_up);SHOW_INT (route_method); -#if _WIN32_WINNT >=0x0600 SHOW_BOOL (block_outside_dns); -#endif show_tuntap_options (&o->tuntap_options);#endif #endif
@@ -6252,11 +6248,20 @@ add_option (struct options *options,VERIFY_PERMISSION (OPT_P_IPWIN32 ); options->tuntap_options.register_dns = true; } -#if _WIN32_WINNT >=0x0600 +#ifdef WIN32 else if (streq (p[0], "block-outside-dns") && !p[1]) {VERIFY_PERMISSION (OPT_P_IPWIN32 ); - options->block_outside_dns = true; +if (win_wfp_init_funcs ()) + { + options->block_outside_dns = true; + } +else + { +msg (msglevel_fc,"Failed to enable --block-outside-dns. " +"Maybe WFP is not supported on your system?" ); + goto err; + } }#endif else if (streq (p[0], "rdns-internal"))
src/openvpn/win32.c +57 -60
138 lines not on this page · raw message
src/openvpn/win32.h +1 -0
@@ -271,6 +271,7 @@ const char *win_get_tempdir();/* Convert a string from UTF-8 to UCS-2 */ WCHAR *wide_string (const char * utf8,struct gc_arena *gc); +bool win_wfp_init_funcs ();bool win_wfp_block_dns (const NET_IFINDEX index);bool win_wfp_uninit ();
src/openvpn/win32_wfp.h new file +359 -0
359 lines not on this page · raw message
Signature · 1 line
2.6.4
[Openvpn-devel] [PATCH applied] Re: Make block-outside-dns option platform agnostic
ACK, thanks a lot (and thanks to valdikss and lev for this a thorough testing)
Your patch has been applied to the release/2.3 branch.
commit 367067f3cb29785338686426667df30c86663ed1 (release/2.3)
Author: Fish Date: Mon Dec 14 12:41:35 2015 -0800
Make block-outside-dns option platform agnostic
Acked-by: Gert Doering <[email protected]...>
Message-Id: <[email protected]...>
URL: http://article.gmane.org/gmane.network.openvpn.devel/10795
Signed-off-by: Gert Doering <[email protected]...>--
kind regards,
Gert Doering
Re: [Openvpn-devel] [PATCH] Make "block-outside-dns" option platform agnostic
In reply to FishHi,
Quoted 10 lines · Fish
Make the "block-outside-dns" option agnostic of Windows versions by dynamically loading WFP-related functions. Cross-compiled on Linux and tested on Windows XP/10.
--- src/openvpn/Makefile.am | 2 +- src/openvpn/init.c | 4 - src/openvpn/options.c | 17 ++- src/openvpn/win32.c | 114 ++++++++------- src/openvpn/win32.h | 1 + src/openvpn/win32_wfp.h | 361 ++++++++++++++++++++++++++++++++++++++++++++++++
This layout of "all the copied API bits go to win32_wfp.h" is good enough for me (so, mails crossed here). Thanks.
I leave the final decision on "how do we want 2.3 binaries to look like" (single openvpn binary with copied-API bits or xp-binary and vista+ binary) to the windows team. Both would work for me.
gert
Signature · 4 lines
USENET is *not* the non-clickable part of WWW!
//www.muc.de/~gert/
Gert Doering - Munich, Germany [email protected]...
fax: +49-89-35655025 [email protected]...Re: [Openvpn-devel] [PATCH] Make "block-outside-dns" option platform agnostic
Quoted 15 lines
Hi,
Quoted 10 lines · Fish
Make the "block-outside-dns" option agnostic of Windows versions by dynamically loading WFP-related functions. Cross-compiled on Linux and tested on Windows XP/10.
--- src/openvpn/Makefile.am | 2 +- src/openvpn/init.c | 4 - src/openvpn/options.c | 17 ++- src/openvpn/win32.c | 114 ++++++++------- src/openvpn/win32.h | 1 + src/openvpn/win32_wfp.h | 361 ++++++++++++++++++++++++++++++++++++++++++++++++
Quoted 6 lines
This layout of "all the copied API bits go to
win32_wfp.h" is good enough for me (so, mails crossed here). Thanks.I leave the final decision on "how do we want 2.3 binaries to look like" (single openvpn binary with copied-API bits or xp-binary and vista+ binary) to the windows team. Both would work for me.
The build team (=me) would definitely prefer a single binary. Building separate binaries would be lots of hassle. I can give this patch a feature-ACK - can't comment on the code quality due to lack of C-fu. I also don't have a Windows XP to test this on.
Signature · 5 lines
Samuli Seppänen Community Manager OpenVPN Technologies, Inc irc freenode net: mattock