Update --block-outside-dns to work on Windows Vista

PATCH In review ValdikSS 4 participants 6 messages Jan 15, 2016 – Feb 25, 2016

Share & tools

ValdikSS

author

2016-01-15 23:35 UTC #0 lore raw

PATCH 1/1 Update --block-outside-dns to work on Windows Vista

Windows Vista doesn't support non-equal matching of application name, it is available only since Windows 7. This commit splits 2 filtering conditions with non-equal matching to 2 filters each with 1 filtering
condition: permit IPv4 (first filter) and IPv6 (second filter) port 53 traffic from openvpn.exe instead of blocking all non-openvpn.exe traffic on port 53 for both protocols.

---
 src/openvpn/win32.c | 35 +++++++++++++++++++++++++++--------
 1 file changed, 27 insertions(+), 8 deletions(-)

src/openvpn/win32.c +27 -8

index a01121b..e21870c 100644
@@ -1222,13 +1222,14 @@ win_wfp_block_dns (const NET_IFINDEX index)
     /* Prepare filter. */
     Filter.subLayerKey = SubLayer.subLayerKey;
     Filter.displayData.name = FIREWALL_NAME;
-    Filter.weight.type = FWP_EMPTY;
+    Filter.weight.type = FWP_UINT8;
+    Filter.weight.uint8 = 0xF;
     Filter.filterCondition = Condition;
     Filter.numFilterConditions = 2;
 
-    /* First filter. Block IPv4 DNS queries except from OpenVPN itself. */
+    /* First filter. Permit IPv4 DNS queries from OpenVPN itself. */
     Filter.layerKey = FWPM_LAYER_ALE_AUTH_CONNECT_V4;
-    Filter.action.type = FWP_ACTION_BLOCK;
+    Filter.action.type = FWP_ACTION_PERMIT;
 
     Condition[0].fieldKey = FWPM_CONDITION_IP_REMOTE_PORT;
     Condition[0].matchType = FWP_MATCH_EQUAL;

@@ -1236,26 +1237,44 @@ win_wfp_block_dns (const NET_IFINDEX index)
     Condition[0].conditionValue.uint16 = 53;
 
     Condition[1].fieldKey = FWPM_CONDITION_ALE_APP_ID;
-    Condition[1].matchType = FWP_MATCH_NOT_EQUAL;
+    Condition[1].matchType = FWP_MATCH_EQUAL;
     Condition[1].conditionValue.type = FWP_BYTE_BLOB_TYPE;
     Condition[1].conditionValue.byteBlob = openvpnblob;
 
     /* Add filter condition to our interface. */
     if (!win_wfp_add_filter(m_hEngineHandle, &Filter, NULL, &filterid))
         goto err;
-    dmsg (D_LOW, "Filter (Block IPv4 DNS) added with ID=%I64d", filterid);
+    dmsg (D_LOW, "Filter (Permit OpenVPN IPv4 DNS) added with ID=%I64d", filterid);
 
-    /* Second filter. Block IPv6 DNS queries except from OpenVPN itself. */
+    /* Second filter. Permit IPv6 DNS queries from OpenVPN itself. */
     Filter.layerKey = FWPM_LAYER_ALE_AUTH_CONNECT_V6;
 
     /* Add filter condition to our interface. */
     if (!win_wfp_add_filter(m_hEngineHandle, &Filter, NULL, &filterid))
         goto err;
+    dmsg (D_LOW, "Filter (Permit OpenVPN IPv6 DNS) added with ID=%I64d", filterid);
+
+    /* Third filter. Block all IPv4 DNS queries. */
+    Filter.layerKey = FWPM_LAYER_ALE_AUTH_CONNECT_V4;
+    Filter.action.type = FWP_ACTION_BLOCK;
+    Filter.weight.type = FWP_EMPTY;
+    Filter.numFilterConditions = 1;
+
+    if (!win_wfp_add_filter(m_hEngineHandle, &Filter, NULL, &filterid))
+        goto err;
+    dmsg (D_LOW, "Filter (Block IPv4 DNS) added with ID=%I64d", filterid);
+
+    /* Forth filter. Block all IPv6 DNS queries. */
+    Filter.layerKey = FWPM_LAYER_ALE_AUTH_CONNECT_V6;
+
+    if (!win_wfp_add_filter(m_hEngineHandle, &Filter, NULL, &filterid))
+        goto err;
     dmsg (D_LOW, "Filter (Block IPv6 DNS) added with ID=%I64d", filterid);
 
-    /* Third filter. Permit IPv4 DNS queries from TAP. */
+    /* Fifth filter. Permit IPv4 DNS queries from TAP. */
     Filter.layerKey = FWPM_LAYER_ALE_AUTH_CONNECT_V4;
     Filter.action.type = FWP_ACTION_PERMIT;
+    Filter.numFilterConditions = 2;
 
     Condition[1].fieldKey = FWPM_CONDITION_IP_LOCAL_INTERFACE;
     Condition[1].matchType = FWP_MATCH_EQUAL;

@@ -1267,7 +1286,7 @@ win_wfp_block_dns (const NET_IFINDEX index)
         goto err;
     dmsg (D_LOW, "Filter (Permit IPv4 DNS queries from TAP) added with ID=%I64d", filterid);
 
-    /* Forth filter. Permit IPv6 DNS queries from TAP. */
+    /* Sixth filter. Permit IPv6 DNS queries from TAP. */
     Filter.layerKey = FWPM_LAYER_ALE_AUTH_CONNECT_V6;
 
     /* Add filter condition to our interface. */

Signature · 1 line

2.7.0

Gert Doering

2016-02-25 12:47 UTC #1 lore raw

Thanks, and sorry for the long delay.

The ACK from Selva is in a different thread, but referring to this patch (Message-ID: <[email protected]...>)

I have added a reference to trac #648 and reformatted the commit message slightly (too-long lines get wrapped in weird ways by git am).

Your patch has been applied to the master and release/2.3 branch.

commit 236769150f64087c590c718c76916ee3c8c9d3b5 (master) commit 0209fafea2a4205c43d7952dcc5d32d2dbd353e5 (release/2.3)

Author: ValdikSS
Date:   Sat Jan 16 02:35:38 2016 +0300

     Update --block-outside-dns to work on Windows Vista

     Acked-by: Selva Nair <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/10998
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering

Samuli Seppänen

2016-02-02 17:51 UTC #2 lore raw

[Openvpn-devel] Test installers with the Interactive service / Vista-compatible block-outside-dns

Hi,

Here are test installers based on latest Git code plus the Interactive service patch, which allows non-admin users to launch OpenVPN connections:

<http://build.openvpn.net/downloads/temp/openvpn-install-2.3_iservice-I601-i686.exe>
<http://build.openvpn.net/downloads/temp/openvpn-install-2.3_iservice-I601-x86_64.exe>

A second pair of installers contain a patch which makes the new --block-outside-dns work with Windows Vista:

<http://build.openvpn.net/downloads/temp/openvpn-install-2.3_blockoutsidedns-I601-i686.exe>
<http://build.openvpn.net/downloads/temp/openvpn-install-2.3_blockoutsidedns-I601-x86_64.exe>

If you test these, please let us know about your experience with them (worked/did not work/had issues).

Signature · 5 lines

Samuli Seppänen
Community Manager
OpenVPN Technologies, Inc

irc freenode net: mattock

Selva Nair

2016-02-04 03:05 UTC #3 lore raw

Re: [Openvpn-devel] Test installers with the Interactive service / Vista-compatible block-outside-dns

Hi,

A second pair of installers contain a patch which makes the new

Quoted 9 lines

--block-outside-dns work with Windows Vista:
<
http://build.openvpn.net/downloads/temp/openvpn-install-2.3_blockoutsidedns-I601-i686.exe
Quoted 1 line
<
http://build.openvpn.net/downloads/temp/openvpn-install-2.3_blockoutsidedns-I601-x86_64.exe
Quoted 1 line

I tested this on Windows 10. While it works same as before as far as blocking dns is concerned, the filter that allows openvpn.exe to do name resolution through all interfaces does not appear to work.

When a openvpn connection is running with block-outside-dns and no DNS server is defined on the TAP adapter, all dns queries fail as expected. But starting a second openvpn.exe also fails at name resolution although the apparent purpose of the permit filter is to allow that traffic through the LAN or any other interface

Review win_wfp_block_dns (const NET_IFINDEX index) · line 1244

Quoted 10 lines

(quoted diff) +1 -1

@@ -1236,26 +1237,44 @@ win_wfp_block_dns (const NET_IFINDEX index)
     Condition[0].conditionValue.uint16 = 53;
 
     Condition[1].fieldKey = FWPM_CONDITION_ALE_APP_ID;
-    Condition[1].matchType = FWP_MATCH_NOT_EQUAL;
+    Condition[1].matchType = FWP_MATCH_EQUAL;
     Condition[1].conditionValue.type = FWP_BYTE_BLOB_TYPE;
     Condition[1].conditionValue.byteBlob = openvpnblob;
 
 Valdikss: Is this filter useful at all? When openvpn does name resolution,

I suppose its the dns client service that would open the port 53 connection.

Selva

ValdikSS

author

2016-02-04 10:51 UTC #4 lore raw

Re: [Openvpn-devel] Test installers with the Interactive service / Vista-compatible block-outside-dns

It's not for DNS resolution (although it should work if "DNS Client" service is disabled), it's not to break OpenVPN servers on TCP/UDP port 53.

Quoted 14 lines · Selva Nair

Hi,
I tested this on Windows 10. While it works same as before as far as blocking dns is concerned, the filter that allows openvpn.exe to do name resolution through all interfaces does not appear to work.
When a openvpn connection is running with block-outside-dns and no DNS server is defined on the TAP adapter, all dns queries fail as expected. But starting a second openvpn.exe also fails at name resolution although the apparent purpose of the permit filter is to allow that traffic through the LAN or any other interface
Valdikss: Is this filter useful at all? When openvpn does name resolution, I suppose its the dns client service that would open the port 53 connection.
Selva

Selva Nair

2016-02-05 05:15 UTC #5 lore raw

Re: [Openvpn-devel] Test installers with the Interactive service / Vista-compatible block-outside-dns

Hi,

Quoted 2 lines · ValdikSS

It's not for DNS resolution (although it should work if "DNS Client" service is disabled), it's not to break OpenVPN servers on TCP/UDP port 53.

I missed that.. Thanks and that does work.

So back to the patch, I lost the original email, so referring to
http://article.gmane.org/gmane.network.openvpn.devel/10998

From: ValdikSS <iam <at> valdikss.org.ru>

Quoted 10 lines

Subject: [PATCH] Update --block-outside-dns to work on Windows Vista
Date: 2016-01-15 23:35:38 GMT
Windows Vista doesn't support non-equal matching of application name, it is available only since Windows 7.
This commit splits 2 filtering conditions with non-equal matching to 2 filters each with 1 filtering
condition: permit IPv4 (first filter) and IPv6 (second filter) port 53 traffic from openvpn.exe
instead of blocking all non-openvpn.exe traffic on port 53 for both protocols.

Quoted 3 lines

---
 src/openvpn/win32.c | 35 +++++++++++++++++++++++++++--------
 1 file changed, 27 insertions(+), 8 deletions(-)

Code looks fine, and tested on Win7/Win10.

Assuming this fixes the vista issue, ACK.

Selva