Remove tun-ipv6 Option. Instead assume that IPv6 is always supported.
PATCH 1/1 Remove tun-ipv6 Option. Instead assume that IPv6 is always supported.
This option was useful when Ipv6 tun support was non standard and was an internal/user specified flag that tracked the Ipv6 capability of the tun device.
All supported OS support IPv6. Also tun-ipv6 is pushable by the remote so not putting tun-ipv6 does not forbid ipv6 addresses.
This commit also clean up a bit of the ipv6 related tun.c. Changes for most platforms are minimal.
For linux a bit more cleanup is done:
- Remove compatibility defines that were added 2008
- Always use IFF_NO_PI for the linux tun and not only for IPv4 only tun setups (Android also always IFF_NO_PI works fine with Ipv6).
This commit also remove a non ipv6 fallback for tap driver from OpenVPN 2.2-beta or earlier and only warns.
--- src/openvpn/helper.c | 2 - src/openvpn/init.c | 7 +--- src/openvpn/multi.c | 8 ++-- src/openvpn/options.c | 11 +----- src/openvpn/options.h | 1 - src/openvpn/route.c | 14 ------- src/openvpn/tun.c | 105 +++++++++----------------------------------------- src/openvpn/tun.h | 2 - 8 files changed, 25 insertions(+), 125 deletions(-)
src/openvpn/helper.c +0 -2
@@ -200,8 +200,6 @@ helper_client_server (struct options *o)add_in6_addr ( o->server_network_ipv6,0x1000 ); o->ifconfig_ipv6_pool_netbits = o->server_netbits_ipv6; - o->tun_ipv6 = true; -push_option ( o,"tun-ipv6" ,M_USAGE ); }
src/openvpn/init.c +2 -5
@@ -1400,9 +1400,6 @@ do_init_tun (struct context *c) !c->options.ifconfig_nowarn, c->c2.es); -/* flag tunnel for IPv6 config if --tun-ipv6 is set */ - c->c1.tuntap->ipv6 = c->options.tun_ipv6; -init_tun_post (c->c1.tuntap, &c->c2.frame, &c->options.tuntap_options);
@@ -1420,8 +1417,8 @@ do_open_tun (struct context *c)struct gc_arena gc =gc_new ();bool ret = false; - c->c2.ipv4_tun = (!c->options.tun_ipv6 - &&is_dev_type (c->options.dev, c->options.dev_type,"tun" )); +//c->c2.ipv4_tun = (!c->options.tun_ipv6 +// && is_dev_type (c->options.dev, c->options.dev_type, "tun")); #ifndef TARGET_ANDROID if (!c->c1.tuntap)
src/openvpn/multi.c +3 -5
@@ -1377,8 +1377,7 @@ multi_select_virtual_addr (struct multi_context *m, struct multi_instance *mi)* (see below) so issue a warning if that happens - don't break the * session, though, as we don't even know if this client WANTS IPv6 */ -if ( mi->context.c1.tuntap->ipv6 && - mi->context.options.ifconfig_ipv6_pool_defined && +if ( mi->context.options.ifconfig_ipv6_pool_defined && ! mi->context.options.push_ifconfig_ipv6_defined ) {msg (M_INFO ,"MULTI_sva: WARNING: if --ifconfig-push is used for IPv4, automatic IPv6 assignment from --ifconfig-ipv6-pool does not work. Use --ifconfig-ipv6-push for IPv6 then." );
@@ -1451,8 +1450,7 @@ multi_select_virtual_addr (struct multi_context *m, struct multi_instance *mi)* way round ("dynamic IPv4, static IPv6") or "both static" makes sense * -> and so it's implemented right now */ -if ( mi->context.c1.tuntap->ipv6 && - mi->context.options.push_ifconfig_ipv6_defined ) +if ( mi->context.options.push_ifconfig_ipv6_defined ) { mi->context.c2.push_ifconfig_ipv6_local = mi->context.options.push_ifconfig_ipv6_local;
@@ -1510,7 +1508,7 @@ multi_set_virtual_addr_env (struct multi_context *m, struct multi_instance *mi)setenv_del (mi->context.c2.es,"ifconfig_pool_remote_ip6" );setenv_del (mi->context.c2.es,"ifconfig_pool_ip6_netbits" ); -if (mi->context.c1.tuntap->ipv6 && mi->context.c2.push_ifconfig_ipv6_defined) +if (mi->context.c2.push_ifconfig_ipv6_defined) { setenv_in6_addr (mi->context.c2.es, "ifconfig_pool_remote",
src/openvpn/options.c +1 -10
@@ -1496,7 +1496,6 @@ show_settings (const struct options *o)SHOW_STR (dev_node);SHOW_STR (lladdr);SHOW_INT (topology); -SHOW_BOOL (tun_ipv6);SHOW_STR (ifconfig_local);SHOW_STR (ifconfig_remote_netmask);SHOW_BOOL (ifconfig_noexec);
@@ -2099,10 +2098,6 @@ options_postprocess_verify_ce (const struct options *options, const struct conne options->connection_list->array[0]->remote)msg (M_USAGE ,"<connection> cannot be used with --mode server" ); -#if 0 -if (options->tun_ipv6) -msg (M_USAGE ,"--tun-ipv6 cannot be used with --mode server" ); -#endif if (options->shaper)msg (M_USAGE ,"--shaper cannot be used with --mode server" );if (options->inetd)
@@ -2126,9 +2121,6 @@ options_postprocess_verify_ce (const struct options *options, const struct connemsg (M_USAGE ,"--ifconfig-pool-persist must be used with --ifconfig-pool" );if (options->ifconfig_ipv6_pool_defined && !options->ifconfig_ipv6_local )msg (M_USAGE ,"--ifconfig-ipv6-pool needs --ifconfig-ipv6" ); -if (options->ifconfig_ipv6_local && !options->tun_ipv6 ) -msg (M_INFO ,"Warning: --ifconfig-ipv6 without --tun-ipv6 will not do IPv6" ); -if (options->auth_user_pass_file)msg (M_USAGE ,"--auth-user-pass cannot be used with --mode server (it should be used on the client side only)" );if (options->ccd_exclusive && !options->client_config_dir)
@@ -3077,7 +3069,7 @@ options_string (const struct options *o,/* send tun_ipv6 only in peer2peer mode - in client/server mode, it * is usually pushed by the server, triggering a non-helpful warning */ -if (o->tun_ipv6 && o->mode ==MODE_POINT_TO_POINT && !PULL_DEFINED (o)) +if (o->ifconfig_ipv6_local && o->mode ==MODE_POINT_TO_POINT && !PULL_DEFINED (o))buf_printf (&out,",tun-ipv6" );/*
@@ -4578,7 +4570,6 @@ add_option (struct options *options,else if (streq (p[0 ],"tun-ipv6" ) && !p[1 ]) {VERIFY_PERMISSION (OPT_P_UP ); - options->tun_ipv6 = true; }#ifdef ENABLE_IPROUTE else if (streq (p[0], "iproute") && p[1] && !p[2])
src/openvpn/options.h +0 -1
@@ -251,7 +251,6 @@ struct optionsint ping_send_timeout;/* Send a TCP/UDP ping to remote every n seconds */ int ping_rec_timeout;/* Expect a TCP/UDP ping from remote at least once every n seconds */ bool ping_timer_remote;/* Run ping timer only if we have a remote address */ -bool tun_ipv6;/* Build tun dev that supports IPv6 */ # define PING_UNDEF 0# define PING_EXIT 1
src/openvpn/route.c +0 -14
@@ -1729,13 +1729,6 @@ add_route_ipv6 (struct route_ipv6 *r6, const struct tuntap *tt, unsigned int fla }#endif -if ( !tt->ipv6 ) - { -msg (M_INFO ,"add_route_ipv6(): not adding %s/%d, no IPv6 on if %s" , - network, r6->netbits, device ); -return ; - } -msg (M_INFO ,"add_route_ipv6(%s/%d -> %s metric %d) dev %s" , network, r6->netbits, gateway, r6->metric, device );
@@ -2159,13 +2152,6 @@ delete_route_ipv6 (const struct route_ipv6 *r6, const struct tuntap *tt, unsigne }#endif -if ( !tt->ipv6 ) - { -msg (M_INFO ,"delete_route_ipv6(): not deleting %s/%d, no IPv6 on if %s" , - network, r6->netbits, device ); -return ; - } -msg (M_INFO ,"delete_route_ipv6(%s/%d)" , network, r6->netbits );/* if we used a gateway on "add route", we also need to specify it on
src/openvpn/tun.c +19 -86
229 lines not on this page · raw message
src/openvpn/tun.h +0 -2
@@ -139,8 +139,6 @@ struct tuntapbool did_ifconfig_ipv6_setup;bool did_ifconfig; -bool ipv6; -bool persistent_if;/* if existed before, keep on program end */ struct tuntap_options options;/* options set on command line */
Signature · 1 line
2.8.4 (Apple Git-73)
Hi,
src/openvpn/init.c do_open_tun (struct context *c) · line 1421
Quoted 8 lines · Arne Schwabe
src/openvpn/init.c +2
-2@@ -1420,8 +1417,8 @@ do_open_tun (struct context *c)struct gc_arena gc =gc_new ();bool ret = false; - c->c2.ipv4_tun = (!c->options.tun_ipv6 - &&is_dev_type (c->options.dev, c->options.dev_type,"tun" )); +//c->c2.ipv4_tun = (!c->options.tun_ipv6 +// && is_dev_type (c->options.dev, c->options.dev_type, "tun"));
"something sneaked in here" :)
src/openvpn/route.c add_route_ipv6 (struct route_ipv6 *r6, const struct tuntap *tt, unsigned int fla · line 1738
Quoted 13 lines
src/openvpn/route.c +0
-7@@ -1729,13 +1729,6 @@ add_route_ipv6 (struct route_ipv6 *r6, const struct tuntap *tt, unsigned int fla }#endif -if ( !tt->ipv6 ) - { -msg (M_INFO ,"add_route_ipv6(): not adding %s/%d, no IPv6 on if %s" , - network, r6->netbits, device ); -return ; - } -
I think general check should stay, and be turned into "have done ifconfig for IPv6" - because "if no ifconfig, route makes no sense".
[..]
src/openvpn/route.c do_ifconfig (struct tuntap *tt, · line 1144
Quoted 6 lines
src/openvpn/route.c +0
-1@@ -1141,7 +1141,6 @@ do_ifconfig (struct tuntap *tt,add_route_connected_v6_net (tt, es);#else msg (M_INFO ,"no IPv6 support for tun interfaces on NetBSD before 4.0 (if your system is newer, recompile openvpn)" ); - tt->ipv6 = false;#endif
I think that whole #ifdef block can go (NETBSD_MULTI_AF).
gert
Signature · 4 lines
USENET is *not* the non-clickable part of WWW!
//www.muc.de/~gert/
Gert Doering - Munich, Germany [email protected]...
fax: +49-89-35655025 [email protected]...PATCH v2 1/1 ] Remove tun-ipv6 Option. Instead assume that IPv6 is always supported.
This option was useful when Ipv6 tun support was non standard and was an internal/user specified flag that tracked the Ipv6 capability of the tun device.
All supported OS support IPv6. Also tun-ipv6 is pushable by the remote so not putting tun-ipv6 does not forbid ipv6 addresses.
This commit also clean up a bit of the ipv6 related tun.c. Changes for most platforms are minimal.
For linux a bit more cleanup is done:
- Remove compatibility defines that were added 2008
- Always use IFF_NO_PI for the linux tun and not only for IPv4 only tun setups (Android also always IFF_NO_PI works fine with Ipv6).
This commit also remove a non ipv6 fallback for tap driver from OpenVPN 2.2-beta or earlier and only warns.
Patch V2: Integrate Gert's comments
--- src/openvpn/helper.c | 2 - src/openvpn/init.c | 7 +--- src/openvpn/multi.c | 8 ++-- src/openvpn/options.c | 11 +---- src/openvpn/options.h | 1 - src/openvpn/route.c | 13 ++---- src/openvpn/tun.c | 110 ++++++++++---------------------------------------- src/openvpn/tun.h | 2 - 8 files changed, 30 insertions(+), 124 deletions(-)
src/openvpn/helper.c +0 -2
@@ -200,8 +200,6 @@ helper_client_server (struct options *o)add_in6_addr ( o->server_network_ipv6,0x1000 ); o->ifconfig_ipv6_pool_netbits = o->server_netbits_ipv6; - o->tun_ipv6 = true; -push_option ( o,"tun-ipv6" ,M_USAGE ); }
src/openvpn/init.c +2 -5
@@ -1400,9 +1400,6 @@ do_init_tun (struct context *c) !c->options.ifconfig_nowarn, c->c2.es); -/* flag tunnel for IPv6 config if --tun-ipv6 is set */ - c->c1.tuntap->ipv6 = c->options.tun_ipv6; -init_tun_post (c->c1.tuntap, &c->c2.frame, &c->options.tuntap_options);
@@ -1420,8 +1417,8 @@ do_open_tun (struct context *c)struct gc_arena gc =gc_new ();bool ret = false; - c->c2.ipv4_tun = (!c->options.tun_ipv6 - &&is_dev_type (c->options.dev, c->options.dev_type,"tun" )); +//c->c2.ipv4_tun = (!c->options.tun_ipv6 +// && is_dev_type (c->options.dev, c->options.dev_type, "tun")); #ifndef TARGET_ANDROID if (!c->c1.tuntap)
src/openvpn/multi.c +3 -5
@@ -1377,8 +1377,7 @@ multi_select_virtual_addr (struct multi_context *m, struct multi_instance *mi)* (see below) so issue a warning if that happens - don't break the * session, though, as we don't even know if this client WANTS IPv6 */ -if ( mi->context.c1.tuntap->ipv6 && - mi->context.options.ifconfig_ipv6_pool_defined && +if ( mi->context.options.ifconfig_ipv6_pool_defined && ! mi->context.options.push_ifconfig_ipv6_defined ) {msg (M_INFO ,"MULTI_sva: WARNING: if --ifconfig-push is used for IPv4, automatic IPv6 assignment from --ifconfig-ipv6-pool does not work. Use --ifconfig-ipv6-push for IPv6 then." );
@@ -1451,8 +1450,7 @@ multi_select_virtual_addr (struct multi_context *m, struct multi_instance *mi)* way round ("dynamic IPv4, static IPv6") or "both static" makes sense * -> and so it's implemented right now */ -if ( mi->context.c1.tuntap->ipv6 && - mi->context.options.push_ifconfig_ipv6_defined ) +if ( mi->context.options.push_ifconfig_ipv6_defined ) { mi->context.c2.push_ifconfig_ipv6_local = mi->context.options.push_ifconfig_ipv6_local;
@@ -1510,7 +1508,7 @@ multi_set_virtual_addr_env (struct multi_context *m, struct multi_instance *mi)setenv_del (mi->context.c2.es,"ifconfig_pool_remote_ip6" );setenv_del (mi->context.c2.es,"ifconfig_pool_ip6_netbits" ); -if (mi->context.c1.tuntap->ipv6 && mi->context.c2.push_ifconfig_ipv6_defined) +if (mi->context.c2.push_ifconfig_ipv6_defined) { setenv_in6_addr (mi->context.c2.es, "ifconfig_pool_remote",
src/openvpn/options.c +1 -10
@@ -1496,7 +1496,6 @@ show_settings (const struct options *o)SHOW_STR (dev_node);SHOW_STR (lladdr);SHOW_INT (topology); -SHOW_BOOL (tun_ipv6);SHOW_STR (ifconfig_local);SHOW_STR (ifconfig_remote_netmask);SHOW_BOOL (ifconfig_noexec);
@@ -2099,10 +2098,6 @@ options_postprocess_verify_ce (const struct options *options, const struct conne options->connection_list->array[0]->remote)msg (M_USAGE ,"<connection> cannot be used with --mode server" ); -#if 0 -if (options->tun_ipv6) -msg (M_USAGE ,"--tun-ipv6 cannot be used with --mode server" ); -#endif if (options->shaper)msg (M_USAGE ,"--shaper cannot be used with --mode server" );if (options->inetd)
@@ -2126,9 +2121,6 @@ options_postprocess_verify_ce (const struct options *options, const struct connemsg (M_USAGE ,"--ifconfig-pool-persist must be used with --ifconfig-pool" );if (options->ifconfig_ipv6_pool_defined && !options->ifconfig_ipv6_local )msg (M_USAGE ,"--ifconfig-ipv6-pool needs --ifconfig-ipv6" ); -if (options->ifconfig_ipv6_local && !options->tun_ipv6 ) -msg (M_INFO ,"Warning: --ifconfig-ipv6 without --tun-ipv6 will not do IPv6" ); -if (options->auth_user_pass_file)msg (M_USAGE ,"--auth-user-pass cannot be used with --mode server (it should be used on the client side only)" );if (options->ccd_exclusive && !options->client_config_dir)
@@ -3077,7 +3069,7 @@ options_string (const struct options *o,/* send tun_ipv6 only in peer2peer mode - in client/server mode, it * is usually pushed by the server, triggering a non-helpful warning */ -if (o->tun_ipv6 && o->mode ==MODE_POINT_TO_POINT && !PULL_DEFINED (o)) +if (o->ifconfig_ipv6_local && o->mode ==MODE_POINT_TO_POINT && !PULL_DEFINED (o))buf_printf (&out,",tun-ipv6" );/*
@@ -4578,7 +4570,6 @@ add_option (struct options *options,else if (streq (p[0 ],"tun-ipv6" ) && !p[1 ]) {VERIFY_PERMISSION (OPT_P_UP ); - options->tun_ipv6 = true; }#ifdef ENABLE_IPROUTE else if (streq (p[0], "iproute") && p[1] && !p[2])
src/openvpn/options.h +0 -1
@@ -251,7 +251,6 @@ struct optionsint ping_send_timeout;/* Send a TCP/UDP ping to remote every n seconds */ int ping_rec_timeout;/* Expect a TCP/UDP ping from remote at least once every n seconds */ bool ping_timer_remote;/* Run ping timer only if we have a remote address */ -bool tun_ipv6;/* Build tun dev that supports IPv6 */ # define PING_UNDEF 0# define PING_EXIT 1
src/openvpn/route.c +3 -10
@@ -1729,10 +1729,10 @@ add_route_ipv6 (struct route_ipv6 *r6, const struct tuntap *tt, unsigned int fla }#endif -if ( !tt->ipv6 ) +if (!tt->did_ifconfig_ipv6_setup) { -msg (M_INFO ,"add_route_ipv6(): not adding %s/%d, no IPv6 on if %s" , - network, r6->netbits, device ); +msg (M_INFO ,"add_route_ipv6(): not adding %s/%d, no IPv6 ifconfig on if %s" , + network, r6->netbits, device);return ; }
@@ -2159,13 +2159,6 @@ delete_route_ipv6 (const struct route_ipv6 *r6, const struct tuntap *tt, unsigne }#endif -if ( !tt->ipv6 ) - { -msg (M_INFO ,"delete_route_ipv6(): not deleting %s/%d, no IPv6 on if %s" , - network, r6->netbits, device ); -return ; - } -msg (M_INFO ,"delete_route_ipv6(%s/%d)" , network, r6->netbits );/* if we used a gateway on "add route", we also need to specify it on
src/openvpn/tun.c +21 -89
240 lines not on this page · raw message
src/openvpn/tun.h +0 -2
@@ -139,8 +139,6 @@ struct tuntapbool did_ifconfig_ipv6_setup;bool did_ifconfig; -bool ipv6; -bool persistent_if;/* if existed before, keep on program end */ struct tuntap_options options;/* options set on command line */
Signature · 1 line
2.8.4 (Apple Git-73)
Re: [Openvpn-devel] [[PATCH v2]] Remove tun-ipv6 Option. Instead assume that IPv6 is always supported.
funny enough, neither Azure, nor GCP are running ipv6. well, GCP images are compiled with ipv6 support actually.
2016-09-17 14:23 GMT+05:00 Arne Schwabe <[email protected]...>:
Quoted 530 lines
This option was useful when Ipv6 tun support was non standard and was an internal/user specified flag that tracked the Ipv6 capability of the tun device.
All supported OS support IPv6. Also tun-ipv6 is pushable by the remote so not putting tun-ipv6 does not forbid ipv6 addresses.
This commit also clean up a bit of the ipv6 related
tun.c. Changes for most platforms are minimal.For linux a bit more cleanup is done:
- Remove compatibility defines that were added 2008
- Always useIFF_NO_PIfor the linux tun and not only for IPv4 only tun setups (Android also alwaysIFF_NO_PIworks fine with Ipv6).This commit also remove a non ipv6 fallback for tap driver from OpenVPN 2.2-beta or earlier and only warns.
Patch V2: Integrate Gert's comments
--- src/openvpn/helper.c | 2 - src/openvpn/init.c | 7 +--- src/openvpn/multi.c | 8 ++-- src/openvpn/options.c | 11 +---- src/openvpn/options.h | 1 - src/openvpn/route.c | 13 ++---- src/openvpn/tun.c | 110 ++++++++++-------------------- -------------------- src/openvpn/tun.h | 2 - 8 files changed, 30 insertions(+), 124 deletions(-)src/openvpn/helper.c +0
-2@@ -200,8 +200,6 @@ helper_client_server (struct options *o)add_in6_addr ( o->server_network_ipv6,0x1000 ); o->ifconfig_ipv6_pool_netbits = o->server_netbits_ipv6; - o->tun_ipv6 = true; -push_option ( o,"tun-ipv6" ,M_USAGE ); }src/openvpn/init.c +2
-5@@ -1400,9 +1400,6 @@ do_init_tun (struct context *c) !c->options.ifconfig_nowarn, c->c2.es); -/* flag tunnel for IPv6 config if --tun-ipv6 is set */ - c->c1.tuntap->ipv6 = c->options.tun_ipv6; -init_tun_post (c->c1.tuntap, &c->c2.frame, &c->options.tuntap_options);@@ -1420,8 +1417,8 @@ do_open_tun (struct context *c)struct gc_arena gc =gc_new ();bool ret = false; - c->c2.ipv4_tun = (!c->options.tun_ipv6 - &&is_dev_type (c->options.dev, c->options.dev_type, "tun")); +//c->c2.ipv4_tun = (!c->options.tun_ipv6 +// && is_dev_type (c->options.dev, c->options.dev_type, "tun"));#ifndef TARGET_ANDROID if (!c->c1.tuntap)src/openvpn/multi.c +1
-2@@ -1377,8 +1377,7 @@ multi_select_virtual_addr (struct multi_context *m,struct multi_instance *mi) * (see below) so issue a warning if that happens - don't break the * session, though, as we don't even know if this client WANTS IPv6 */ -if ( mi->context.c1.tuntap->ipv6 && - mi->context.options.ifconfig_ipv6_pool_defined && +if ( mi->context.options.ifconfig_ipv6_pool_defined && ! mi->context.options.push_ifconfig_ipv6_defined ) {msg( M_INFO, "MULTI_sva: WARNING: if --ifconfig-push is used forIPv4, automatic IPv6 assignment from --ifconfig-ipv6-pool does not work. Use --ifconfig-ipv6-push for IPv6 then." );
src/openvpn/multi.c +1
-2@@ -1451,8 +1450,7 @@ multi_select_virtual_addr (struct multi_context *m,struct multi_instance *mi) * way round ("dynamic IPv4, static IPv6") or "both static" makes sense * -> and so it's implemented right now */ -if ( mi->context.c1.tuntap->ipv6 && - mi->context.options.push_ifconfig_ipv6_defined ) +if ( mi->context.options.push_ifconfig_ipv6_defined ) { mi->context.c2.push_ifconfig_ipv6_local =mi->context.options.push_ifconfig_ipv6_local;src/openvpn/multi.c +1
-1@@ -1510,7 +1508,7 @@ multi_set_virtual_addr_env (struct multi_context *m, struct multi_instance *mi) setenv_del (mi->context.c2.es, "ifconfig_pool_remote_ip6");setenv_del (mi->context.c2.es,"ifconfig_pool_ip6_netbits" ); -if (mi->context.c1.tuntap->ipv6 && mi->context.c2.push_ifconfig_ ipv6_defined) +if (mi->context.c2.push_ifconfig_ipv6_defined) {setenv_in6_addr (mi->context.c2.es, "ifconfig_pool_remote",src/openvpn/options.c +0
-5@@ -1496,7 +1496,6 @@ show_settings (const struct options *o)SHOW_STR (dev_node);SHOW_STR (lladdr);SHOW_INT (topology); -SHOW_BOOL (tun_ipv6);SHOW_STR (ifconfig_local);SHOW_STR (ifconfig_remote_netmask);SHOW_BOOL (ifconfig_noexec);@@ -2099,10 +2098,6 @@ options_postprocess_verify_ce (const struct options *options, const struct conne options->connection_list->array[0]->remote) msg (M_USAGE, "<connection> cannot be used with --mode server"); -#if 0 -if (options->tun_ipv6) -msg (M_USAGE ,"--tun-ipv6 cannot be used with --mode server" ); -#endif if (options->shaper)msg (M_USAGE ,"--shaper cannot be used with --mode server" );if (options->inetd)src/openvpn/options.c +0
-4@@ -2126,9 +2121,6 @@ options_postprocess_verify_ce (const struct options *options, const struct conne msg (M_USAGE, "--ifconfig-pool-persist must be used with --ifconfig-pool");if (options->ifconfig_ipv6_pool_defined && !options->ifconfig_ipv6_local )msg (M_USAGE ,"--ifconfig-ipv6-pool needs --ifconfig-ipv6" ); -if (options->ifconfig_ipv6_local && !options->tun_ipv6 ) - msg (M_INFO, "Warning: --ifconfig-ipv6 without --tun-ipv6 will not do IPv6"); - if (options->auth_user_pass_file) msg (M_USAGE, "--auth-user-pass cannot be used with --mode server(it should be used on the client side only)");
if (options->ccd_exclusive && !options->client_config_dir)src/openvpn/options.c +1
-1@@ -3077,7 +3069,7 @@ options_string (const struct options *o,/* send tun_ipv6 only in peer2peer mode - in client/server mode, it * is usually pushed by the server, triggering a non-helpful warning */ -if (o->tun_ipv6 && o->mode ==MODE_POINT_TO_POINT && !PULL_DEFINED (o)) +if (o->ifconfig_ipv6_local && o->mode ==MODE_POINT_TO_POINT && !PULL_DEFINED (o))buf_printf (&out,",tun-ipv6" );/*src/openvpn/options.c +0
-1@@ -4578,7 +4570,6 @@ add_option (struct options *options,else if (streq (p[0 ],"tun-ipv6" ) && !p[1 ]) {VERIFY_PERMISSION (OPT_P_UP ); - options->tun_ipv6 = true; }#ifdef ENABLE_IPROUTE else if (streq (p[0], "iproute") && p[1] && !p[2])src/openvpn/options.h +0
-0@@ -251,7 +251,6 @@ struct optionsint ping_send_timeout;/* Send a TCP/UDP ping to remote every n seconds */
intping_rec_timeout; /* Expect a TCP/UDP ping from remote at
least once every n seconds */
boolping_timer_remote; /* Run ping timer only if we have a
remote address */src/openvpn/options.h +0
-1-bool tun_ipv6;/* Build tun dev that supports IPv6 */ # define PING_UNDEF 0# define PING_EXIT 1src/openvpn/route.c +0
-0@@ -1729,10 +1729,10 @@ add_route_ipv6 (struct route_ipv6 *r6, conststruct tuntap *tt, unsigned int fla
}#endif
src/openvpn/route.c +2
-3-if ( !tt->ipv6 ) +if (!tt->did_ifconfig_ipv6_setup) { -msg (M_INFO ,"add_route_ipv6(): not adding %s/%d, no IPv6 on if %s" , - network, r6->netbits, device ); + msg( M_INFO, "add_route_ipv6(): not adding %s/%d, no IPv6 ifconfigon if %s",
src/openvpn/route.c +1
-0+ network, r6->netbits, device);return ; }@@ -2159,13 +2159,6 @@ delete_route_ipv6 (const struct route_ipv6 *r6,const struct tuntap *tt, unsigne
}#endif
src/openvpn/route.c +0
-3-if ( !tt->ipv6 ) - { - msg( M_INFO, "delete_route_ipv6(): not deleting %s/%d, no IPv6 onif %s",
src/openvpn/route.c +0
-4- network, r6->netbits, device ); -return ; - } -msg (M_INFO ,"delete_route_ipv6(%s/%d)" , network, r6->netbits );/* if we used a gateway on "add route", we also need to specify it on src/openvpn/tun.c +2
-2@@ -741,8 +741,8 @@ do_ifconfig (struct tuntap *tt,argv_init (&argv); - msg( M_INFO, "do_ifconfig, tt->ipv6=%d, tt->did_ifconfig_ipv6_setup=%d", - tt->ipv6, tt->did_ifconfig_ipv6_setup ); + msg(M_INFO ,"do_ifconfig, tt->did_ifconfig_ipv6_setup=%d" , + tt->did_ifconfig_ipv6_setup );/* * We only handle TUN/TAP devices here, not --dev null devices.
src/openvpn/tun.c +1
-1@@ -755,7 +755,7 @@ do_ifconfig (struct tuntap *tt, ifconfig_local =print_in_addr_t (tt->local,0 , &gc); ifconfig_remote_netmask =print_in_addr_t (tt->remote_netmask,0 , &gc); -if ( tt->ipv6 && tt->did_ifconfig_ipv6_setup ) +if (tt->did_ifconfig_ipv6_setup ) { ifconfig_ipv6_local =print_in6_addr (tt->local_ipv6,0 , &gc);ifconfig_ipv6_remote = print_in6_addr (tt->remote_ipv6, 0, &gc);src/openvpn/tun.c +1
-0@@ -1127,6 +1127,8 @@ do_ifconfig (struct tuntap *tt,if ( do_ipv6 ) {#ifdef NETBSD_MULTI_AF +#error no IPv6 support for tun interfaces on NetBSD before 4.0, upgradeyour system.
src/openvpn/tun.c +2
-6+#endif argv_printf (&argv, "%s %s inet6 %s/%d", IFCONFIG_PATH,@@ -1139,10 +1141,6 @@ do_ifconfig (struct tuntap *tt,/* and, hooray, we explicitely need to add a route... */ add_route_connected_v6_net (tt, es); -#else - msg( M_INFO, "no IPv6 support for tun interfaces on NetBSD before 4.0 (if your system is newer, recompile openvpn)" ); - tt->ipv6 = false; -#endif } tt->did_ifconfig = true;@@ -1425,7 +1423,6 @@ clear_tuntap (struct tuntap *tuntap)#ifdef TARGET_SOLARIS tuntap->ip_fd =-1 ;#endif - tuntap->ipv6 = false; } static void@@ -1478,7 +1475,7 @@ write_tun_header (struct tuntap* tt, uint8_t *buf, int len) iph = (struct ip *) buf; -if (tt->ipv6 && iph->ip_v ==6 ) +if (iph->ip_v ==6 ) type =htonl (AF_INET6 );else type = htonl (AF_INET);src/openvpn/tun.c +1
-1@@ -1526,7 +1523,7 @@ open_tun_generic (const char *dev, const char *dev_type, const char *dev_node, bool dynamic_opened = false; -if ( tt->ipv6 && ! ipv6_explicitly_supported ) +if ( ! ipv6_explicitly_supported ) msg (M_WARN, "NOTE: explicit support for IPv6 tun devices is not provided for this OS");if (tt->type == DEV_TYPE_NULL)src/openvpn/tun.c +0
-1@@ -1710,7 +1707,6 @@ read_tun (struct tuntap* tt, uint8_t *buf, int len) }#elif defined(TARGET_LINUX) -#ifdef HAVE_LINUX_IF_TUN_H /* New driver support */ #ifndef HAVE_LINUX_SOCKIOS_H #error header file linux/sockios.h required@@ -1751,8 +1747,7 @@ open_tun (const char *dev, const char *dev_type,const char
*dev_node, struct tu* Process --tun-ipv6 */ CLEAR (ifr);src/openvpn/tun.c +1
-2-if (!tt->ipv6) - ifr.ifr_flags =IFF_NO_PI ; + ifr.ifr_flags =IFF_NO_PI ;#if defined(IFF_ONE_QUEUE ) && defined(SIOCSIFTXQLEN ) ifr.ifr_flags |=IFF_ONE_QUEUE ;@@ -1833,32 +1828,10 @@ open_tun (const char *dev, const char *dev_type,const char
*dev_node, struct tu
ASSERT (0);
}src/openvpn/tun.c +0
-6-#endif - -#else - -void -open_tun (const char *dev, const char *dev_type, const char *dev_node,struct tuntap *tt)
src/openvpn/tun.c +1
-17-{ -open_tun_generic (dev, dev_type, dev_node, false, true, tt); -} - -#endif /* HAVE_LINUX_IF_TUN_H */ +#endif /* !PENDANTIC */ #ifdef ENABLE_FEATURE_TUN_PERSIST -/* -* This can be removed in future -* when all systems will use newer -* linux-headers -*/ -#ifndef TUNSETOWNER -#define TUNSETOWNER _IOW('T', 204, int) -#endif -#ifndef TUNSETGROUP -#define TUNSETGROUP _IOW('T', 206, int) -#endif -void tuncfg (const char *dev, const char *dev_type, const char *dev_node, int
persist_mode, const char *username, const char *groupname, const structtuntap_options*options)
{src/openvpn/tun.c +1
-1@@ -1940,7 +1913,7 @@ close_tun (struct tuntap *tt)argv_msg (M_INFO , &argv);openvpn_execve_check (&argv,NULL ,0 ,"Linux ip addr del failed"); -if (tt->ipv6 && tt->did_ifconfig_ipv6_setup) +if (tt->did_ifconfig_ipv6_setup) {const char * ifconfig_ipv6_local = print_in6_addr(
tt->local_ipv6, 0, &gc);src/openvpn/tun.c +7
-47@@ -1977,53 +1950,13 @@ close_tun (struct tuntap *tt)int write_tun (struct tuntap * tt,uint8_t *buf,int len) { -if (tt->ipv6) - { -struct tun_pi pi; -struct iphdr *iph; -struct iovec vect[2 ]; -int ret; - - iph = (struct iphdr *)buf; - - pi.flags =0 ; - -if (iph->version ==6 ) - pi.proto =htons (OPENVPN_ETH_P_IPV6 ); -else - pi.proto =htons (OPENVPN_ETH_P_IPV4 ); - - vect[0 ].iov_len =sizeof (pi); - vect[0 ].iov_base = π - vect[1 ].iov_len = len; - vect[1 ].iov_base = buf; - - ret =writev (tt->fd, vect,2 ); -return (ret -sizeof (pi)); - } -else -return write (tt->fd, buf, len); +return write (tt->fd, buf, len); }int read_tun (struct tuntap * tt,uint8_t *buf,int len) { -if (tt->ipv6) - { -struct iovec vect[2 ]; -struct tun_pi pi; -int ret; - - vect[0 ].iov_len =sizeof (pi); - vect[0 ].iov_base = π - vect[1 ].iov_len = len; - vect[1 ].iov_base = buf; - - ret =readv (tt->fd, vect,2 ); -return (ret -sizeof (pi)); - } -else -return read (tt->fd, buf, len); +return read (tt->fd, buf, len); }#elif defined(TARGET_SOLARIS )@@ -2227,7 +2160,7 @@ solaris_close_tun (struct tuntap *tt)if (tt) {/* IPv6 interfaces need to be 'manually' de-configured */ -if ( tt->ipv6 && tt->did_ifconfig_ipv6_setup ) +if ( tt->did_ifconfig_ipv6_setup ) {struct argv argv;argv_init (&argv);@@ -2518,7 +2451,7 @@ write_tun (struct tuntap* tt, uint8_t *buf, int len) iph = (struct openvpn_iphdr *) buf; -if (tt->ipv6 &&OPENVPN_IPH_GET_VER (iph->version_len) ==6 ) +if (OPENVPN_IPH_GET_VER (iph->version_len) ==6 ) type =htonl (AF_INET6 );else type =htonl (AF_INET );@@ -2644,7 +2577,7 @@ write_tun (struct tuntap* tt, uint8_t *buf, int len) iph = (struct ip *) buf; -if (tt->ipv6 && iph->ip_v ==6 ) +if (iph->ip_v ==6 ) type =htonl (AF_INET6 );else type =htonl (AF_INET );@@ -2727,7 +2660,7 @@ write_tun (struct tuntap* tt, uint8_t *buf, int len) iph = (struct ip *) buf; -if (tt->ipv6 && iph->ip_v ==6 ) +if (iph->ip_v ==6 ) type =htonl (AF_INET6 );else type =htonl (AF_INET );@@ -2954,7 +2887,7 @@ close_tun (struct tuntap* tt)struct argv argv;argv_init (&argv); -if ( tt->ipv6 && tt->did_ifconfig_ipv6_setup ) +if (tt->did_ifconfig_ipv6_setup ) {const char * ifconfig_ipv6_local =print_in6_addr (tt->local_ipv6,0 , &gc);@@ -5182,7 +5115,7 @@ open_tun (const char *dev, const char *dev_type,const char
*dev_node, struct tu/*netcmd_semaphore_lock ();*/src/openvpn/tun.c +1
-1-msg (M_INFO ,"open_tun, tt->ipv6=%d" , tt->ipv6 ); +msg (M_INFO ,"open_tun" );if (tt->type ==DEV_TYPE_NULL ) {@@ -5308,11 +5241,10 @@ open_tun (const char *dev, const char *dev_type,const char
*dev_node, struct tu/* usage of numeric constants is ugly, but this is really tied to * *this* version of the driver */src/openvpn/tun.c +1
-2-if ( tt->ipv6 && tt->type ==DEV_TYPE_TUN && +if (tt->type ==DEV_TYPE_TUN && info[0 ] ==9 && info[1 ] <8 ) { - msg( M_INFO, "WARNING: Tap-Win32 driver version %d.%d does notsupport IPv6 in TUN mode. IPv6 will be disabled. Upgrade to Tap-Win32 9.8 (2.2-beta3 release or later) or use TAP mode to get IPv6", (int) info[0], (int) info[1] );
src/openvpn/tun.c +1
-1- tt->ipv6 = false; + msg( M_INFO, "WARNING: Tap-Win32 driver version %d.%d does notsupport IPv6 in TUN mode. IPv6 will not work. Upgrade to Tap-Win32 9.8 (2.2-beta3 release or later) or use TAP mode to get IPv6", (int) info[0],
(int) info[1] ); } /* tap driver 9.8 (2.2.0 and 2.2.1 release) is buggysrc/openvpn/tun.c +1
-1@@ -5653,7 +5585,7 @@ close_tun (struct tuntap *tt)if (tt) { -if ( tt->ipv6 && tt->did_ifconfig_ipv6_setup ) +if ( tt->did_ifconfig_ipv6_setup ) {if (tt->options.msg_channel) {src/openvpn/tun.h +0
-2@@ -139,8 +139,6 @@ struct tuntapbool did_ifconfig_ipv6_setup;bool did_ifconfig; -bool ipv6; -bool persistent_if;/* if existed before, keep on program end */ struct
tuntap_optionsoptions; /* options set on command line */
--
2.8.4 (Apple Git-73)------------------------------------------------------------
------------------
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
Re: [Openvpn-devel] [[PATCH v2]] Remove tun-ipv6 Option. Instead assume that IPv6 is always supported.
Am 17.09.16 um 12:40 schrieb Илья Шипицин:
Quoted 2 lines
funny enough, neither Azure, nor GCP are running ipv6. well, GCP images are compiled with ipv6 support actually.
Yeah. But the patch is not about ipv6 actually working. Just about telling that the OS support of IPv6 tun.
Arne
PATCH v3 1/1 Remove tun-ipv6 Option. Instead assume that IPv6 is always supported.
In reply to Gert DoeringThis option was useful when Ipv6 tun support was non standard and was an internal/user specified flag that tracked the Ipv6 capability of the tun device.
All supported OS support IPv6. Also tun-ipv6 is pushable by the remote so not putting tun-ipv6 does not forbid ipv6 addresses.
This commit also clean up a bit of the ipv6 related tun.c. Changes for most platforms are minimal.
For linux a bit more cleanup is done:
- Remove compatibility defines that were added 2008
- Always use IFF_NO_PI for the linux tun and not only for IPv4 only tun setups (Android also always IFF_NO_PI works fine with Ipv6).
This commit also remove a non ipv6 fallback for tap driver from OpenVPN 2.2-beta or earlier and only warns.
--- src/openvpn/helper.c | 2 - src/openvpn/init.c | 7 +--- src/openvpn/multi.c | 8 ++-- src/openvpn/options.c | 11 +---- src/openvpn/options.h | 1 - src/openvpn/route.c | 13 ++---- src/openvpn/tun.c | 110 ++++++++++---------------------------------------- src/openvpn/tun.h | 2 - 8 files changed, 30 insertions(+), 124 deletions(-)
src/openvpn/helper.c +0 -2
@@ -200,8 +200,6 @@ helper_client_server (struct options *o)add_in6_addr ( o->server_network_ipv6,0x1000 ); o->ifconfig_ipv6_pool_netbits = o->server_netbits_ipv6; - o->tun_ipv6 = true; -push_option ( o,"tun-ipv6" ,M_USAGE ); }
src/openvpn/init.c +2 -5
@@ -1400,9 +1400,6 @@ do_init_tun (struct context *c) !c->options.ifconfig_nowarn, c->c2.es); -/* flag tunnel for IPv6 config if --tun-ipv6 is set */ - c->c1.tuntap->ipv6 = c->options.tun_ipv6; -init_tun_post (c->c1.tuntap, &c->c2.frame, &c->options.tuntap_options);
@@ -1420,8 +1417,8 @@ do_open_tun (struct context *c)struct gc_arena gc =gc_new ();bool ret = false; - c->c2.ipv4_tun = (!c->options.tun_ipv6 - &&is_dev_type (c->options.dev, c->options.dev_type,"tun" )); +//c->c2.ipv4_tun = (!c->options.tun_ipv6 +// && is_dev_type (c->options.dev, c->options.dev_type, "tun")); #ifndef TARGET_ANDROID if (!c->c1.tuntap)
src/openvpn/multi.c +3 -5
@@ -1377,8 +1377,7 @@ multi_select_virtual_addr (struct multi_context *m, struct multi_instance *mi)* (see below) so issue a warning if that happens - don't break the * session, though, as we don't even know if this client WANTS IPv6 */ -if ( mi->context.c1.tuntap->ipv6 && - mi->context.options.ifconfig_ipv6_pool_defined && +if ( mi->context.options.ifconfig_ipv6_pool_defined && ! mi->context.options.push_ifconfig_ipv6_defined ) {msg (M_INFO ,"MULTI_sva: WARNING: if --ifconfig-push is used for IPv4, automatic IPv6 assignment from --ifconfig-ipv6-pool does not work. Use --ifconfig-ipv6-push for IPv6 then." );
@@ -1451,8 +1450,7 @@ multi_select_virtual_addr (struct multi_context *m, struct multi_instance *mi)* way round ("dynamic IPv4, static IPv6") or "both static" makes sense * -> and so it's implemented right now */ -if ( mi->context.c1.tuntap->ipv6 && - mi->context.options.push_ifconfig_ipv6_defined ) +if ( mi->context.options.push_ifconfig_ipv6_defined ) { mi->context.c2.push_ifconfig_ipv6_local = mi->context.options.push_ifconfig_ipv6_local;
@@ -1510,7 +1508,7 @@ multi_set_virtual_addr_env (struct multi_context *m, struct multi_instance *mi)setenv_del (mi->context.c2.es,"ifconfig_pool_remote_ip6" );setenv_del (mi->context.c2.es,"ifconfig_pool_ip6_netbits" ); -if (mi->context.c1.tuntap->ipv6 && mi->context.c2.push_ifconfig_ipv6_defined) +if (mi->context.c2.push_ifconfig_ipv6_defined) { setenv_in6_addr (mi->context.c2.es, "ifconfig_pool_remote",
src/openvpn/options.c +1 -10
@@ -1496,7 +1496,6 @@ show_settings (const struct options *o)SHOW_STR (dev_node);SHOW_STR (lladdr);SHOW_INT (topology); -SHOW_BOOL (tun_ipv6);SHOW_STR (ifconfig_local);SHOW_STR (ifconfig_remote_netmask);SHOW_BOOL (ifconfig_noexec);
@@ -2099,10 +2098,6 @@ options_postprocess_verify_ce (const struct options *options, const struct conne options->connection_list->array[0]->remote)msg (M_USAGE ,"<connection> cannot be used with --mode server" ); -#if 0 -if (options->tun_ipv6) -msg (M_USAGE ,"--tun-ipv6 cannot be used with --mode server" ); -#endif if (options->shaper)msg (M_USAGE ,"--shaper cannot be used with --mode server" );if (options->inetd)
@@ -2126,9 +2121,6 @@ options_postprocess_verify_ce (const struct options *options, const struct connemsg (M_USAGE ,"--ifconfig-pool-persist must be used with --ifconfig-pool" );if (options->ifconfig_ipv6_pool_defined && !options->ifconfig_ipv6_local )msg (M_USAGE ,"--ifconfig-ipv6-pool needs --ifconfig-ipv6" ); -if (options->ifconfig_ipv6_local && !options->tun_ipv6 ) -msg (M_INFO ,"Warning: --ifconfig-ipv6 without --tun-ipv6 will not do IPv6" ); -if (options->auth_user_pass_file)msg (M_USAGE ,"--auth-user-pass cannot be used with --mode server (it should be used on the client side only)" );if (options->ccd_exclusive && !options->client_config_dir)
@@ -3077,7 +3069,7 @@ options_string (const struct options *o,/* send tun_ipv6 only in peer2peer mode - in client/server mode, it * is usually pushed by the server, triggering a non-helpful warning */ -if (o->tun_ipv6 && o->mode ==MODE_POINT_TO_POINT && !PULL_DEFINED (o)) +if (o->ifconfig_ipv6_local && o->mode ==MODE_POINT_TO_POINT && !PULL_DEFINED (o))buf_printf (&out,",tun-ipv6" );/*
@@ -4578,7 +4570,6 @@ add_option (struct options *options,else if (streq (p[0 ],"tun-ipv6" ) && !p[1 ]) {VERIFY_PERMISSION (OPT_P_UP ); - options->tun_ipv6 = true; }#ifdef ENABLE_IPROUTE else if (streq (p[0], "iproute") && p[1] && !p[2])
src/openvpn/options.h +0 -1
@@ -251,7 +251,6 @@ struct optionsint ping_send_timeout;/* Send a TCP/UDP ping to remote every n seconds */ int ping_rec_timeout;/* Expect a TCP/UDP ping from remote at least once every n seconds */ bool ping_timer_remote;/* Run ping timer only if we have a remote address */ -bool tun_ipv6;/* Build tun dev that supports IPv6 */ # define PING_UNDEF 0# define PING_EXIT 1
src/openvpn/route.c +3 -10
@@ -1729,10 +1729,10 @@ add_route_ipv6 (struct route_ipv6 *r6, const struct tuntap *tt, unsigned int fla }#endif -if ( !tt->ipv6 ) +if (!tt->did_ifconfig_ipv6_setup) { -msg (M_INFO ,"add_route_ipv6(): not adding %s/%d, no IPv6 on if %s" , - network, r6->netbits, device ); +msg (M_INFO ,"add_route_ipv6(): not adding %s/%d, no IPv6 ifconfig on if %s" , + network, r6->netbits, device);return ; }
@@ -2159,13 +2159,6 @@ delete_route_ipv6 (const struct route_ipv6 *r6, const struct tuntap *tt, unsigne }#endif -if ( !tt->ipv6 ) - { -msg (M_INFO ,"delete_route_ipv6(): not deleting %s/%d, no IPv6 on if %s" , - network, r6->netbits, device ); -return ; - } -msg (M_INFO ,"delete_route_ipv6(%s/%d)" , network, r6->netbits );/* if we used a gateway on "add route", we also need to specify it on
src/openvpn/tun.c +21 -89
240 lines not on this page · raw message
src/openvpn/tun.h +0 -2
@@ -139,8 +139,6 @@ struct tuntapbool did_ifconfig_ipv6_setup;bool did_ifconfig; -bool ipv6; -bool persistent_if;/* if existed before, keep on program end */ struct tuntap_options options;/* options set on command line */
Signature · 1 line
2.8.4 (Apple Git-73)
PATCH v4 1/1 Remove tun-ipv6 Option. Instead assume that IPv6 is always supported.
In reply to Gert DoeringThis option was useful when Ipv6 tun support was non standard and was an internal/user specified flag that tracked the Ipv6 capability of the tun device.
All supported OS support IPv6. Also tun-ipv6 is pushable by the remote so not putting tun-ipv6 does not forbid ipv6 addresses.
This commit also clean up a bit of the ipv6 related tun.c. Changes for most platforms are minimal.
For linux a bit more cleanup is done:
- Remove compatibility defines that were added 2008
- Always use IFF_NO_PI for the linux tun and not only for IPv4 only tun setups (Android also always IFF_NO_PI works fine with Ipv6).
This commit also remove a non ipv6 fallback for tap driver from OpenVPN 2.2-beta or earlier and only warns.
Patch V2: Integrate Gert's comments
Patch V3: Remove tun_ipv4 option. It only used for MTU discovery and there it was wrong since it should on the transport protocol if at all Patch V4: do not send V3 as V2
--- Changes.rst | 3 ++ src/openvpn/forward.c | 2 +- src/openvpn/helper.c | 2 - src/openvpn/init.c | 6 --- src/openvpn/multi.c | 8 ++-- src/openvpn/openvpn.h | 5 --- src/openvpn/options.c | 11 +---- src/openvpn/options.h | 1 - src/openvpn/route.c | 13 ++---- src/openvpn/tun.c | 110 ++++++++++---------------------------------------- src/openvpn/tun.h | 2 - 11 files changed, 32 insertions(+), 131 deletions(-)
Changes.rst +3 -0
@@ -135,6 +135,9 @@ User-visible Changes ciphers configured in the config file. Use --ncp-disable if you don't want that. +- ALl tun devices on all platforms are considered always IPv6 capable. The --tun-ipv6 + option is ignored (behaves like it is always on). + Maintainer-visible changes --------------------------
src/openvpn/forward.c +1 -1
@@ -391,7 +391,7 @@ check_fragment_dowork (struct context *c)struct link_socket_info *lsi =get_link_socket_info (c);/* OS MTU Hint? */ -if (lsi->mtu_changed && c->c2.ipv4_tun) +if (lsi->mtu_changed) {frame_adjust_path_mtu (&c->c2.frame_fragment, c->c2.link_socket->mtu, c->options.ce.proto);
src/openvpn/helper.c +0 -2
@@ -200,8 +200,6 @@ helper_client_server (struct options *o)add_in6_addr ( o->server_network_ipv6,0x1000 ); o->ifconfig_ipv6_pool_netbits = o->server_netbits_ipv6; - o->tun_ipv6 = true; -push_option ( o,"tun-ipv6" ,M_USAGE ); }
src/openvpn/init.c +0 -6
@@ -1400,9 +1400,6 @@ do_init_tun (struct context *c) !c->options.ifconfig_nowarn, c->c2.es); -/* flag tunnel for IPv6 config if --tun-ipv6 is set */ - c->c1.tuntap->ipv6 = c->options.tun_ipv6; -init_tun_post (c->c1.tuntap, &c->c2.frame, &c->options.tuntap_options);
@@ -1420,9 +1417,6 @@ do_open_tun (struct context *c)struct gc_arena gc =gc_new ();bool ret = false; - c->c2.ipv4_tun = (!c->options.tun_ipv6 - &&is_dev_type (c->options.dev, c->options.dev_type,"tun" )); -#ifndef TARGET_ANDROID if (!c->c1.tuntap) {
src/openvpn/multi.c +3 -5
@@ -1377,8 +1377,7 @@ multi_select_virtual_addr (struct multi_context *m, struct multi_instance *mi)* (see below) so issue a warning if that happens - don't break the * session, though, as we don't even know if this client WANTS IPv6 */ -if ( mi->context.c1.tuntap->ipv6 && - mi->context.options.ifconfig_ipv6_pool_defined && +if ( mi->context.options.ifconfig_ipv6_pool_defined && ! mi->context.options.push_ifconfig_ipv6_defined ) {msg (M_INFO ,"MULTI_sva: WARNING: if --ifconfig-push is used for IPv4, automatic IPv6 assignment from --ifconfig-ipv6-pool does not work. Use --ifconfig-ipv6-push for IPv6 then." );
@@ -1451,8 +1450,7 @@ multi_select_virtual_addr (struct multi_context *m, struct multi_instance *mi)* way round ("dynamic IPv4, static IPv6") or "both static" makes sense * -> and so it's implemented right now */ -if ( mi->context.c1.tuntap->ipv6 && - mi->context.options.push_ifconfig_ipv6_defined ) +if ( mi->context.options.push_ifconfig_ipv6_defined ) { mi->context.c2.push_ifconfig_ipv6_local = mi->context.options.push_ifconfig_ipv6_local;
@@ -1510,7 +1508,7 @@ multi_set_virtual_addr_env (struct multi_context *m, struct multi_instance *mi)setenv_del (mi->context.c2.es,"ifconfig_pool_remote_ip6" );setenv_del (mi->context.c2.es,"ifconfig_pool_ip6_netbits" ); -if (mi->context.c1.tuntap->ipv6 && mi->context.c2.push_ifconfig_ipv6_defined) +if (mi->context.c2.push_ifconfig_ipv6_defined) { setenv_in6_addr (mi->context.c2.es, "ifconfig_pool_remote",
src/openvpn/openvpn.h +0 -5
@@ -390,11 +390,6 @@ struct context_2struct buffer to_tun;struct buffer to_link; -/* -* IPv4 TUN device? -*/ -bool ipv4_tun; -/* should we print R|W|r|w to console on packet transfers? */ bool log_rw;
src/openvpn/options.c +1 -10
@@ -1496,7 +1496,6 @@ show_settings (const struct options *o)SHOW_STR (dev_node);SHOW_STR (lladdr);SHOW_INT (topology); -SHOW_BOOL (tun_ipv6);SHOW_STR (ifconfig_local);SHOW_STR (ifconfig_remote_netmask);SHOW_BOOL (ifconfig_noexec);
@@ -2099,10 +2098,6 @@ options_postprocess_verify_ce (const struct options *options, const struct conne options->connection_list->array[0]->remote)msg (M_USAGE ,"<connection> cannot be used with --mode server" ); -#if 0 -if (options->tun_ipv6) -msg (M_USAGE ,"--tun-ipv6 cannot be used with --mode server" ); -#endif if (options->shaper)msg (M_USAGE ,"--shaper cannot be used with --mode server" );if (options->inetd)
@@ -2126,9 +2121,6 @@ options_postprocess_verify_ce (const struct options *options, const struct connemsg (M_USAGE ,"--ifconfig-pool-persist must be used with --ifconfig-pool" );if (options->ifconfig_ipv6_pool_defined && !options->ifconfig_ipv6_local )msg (M_USAGE ,"--ifconfig-ipv6-pool needs --ifconfig-ipv6" ); -if (options->ifconfig_ipv6_local && !options->tun_ipv6 ) -msg (M_INFO ,"Warning: --ifconfig-ipv6 without --tun-ipv6 will not do IPv6" ); -if (options->auth_user_pass_file)msg (M_USAGE ,"--auth-user-pass cannot be used with --mode server (it should be used on the client side only)" );if (options->ccd_exclusive && !options->client_config_dir)
@@ -3077,7 +3069,7 @@ options_string (const struct options *o,/* send tun_ipv6 only in peer2peer mode - in client/server mode, it * is usually pushed by the server, triggering a non-helpful warning */ -if (o->tun_ipv6 && o->mode ==MODE_POINT_TO_POINT && !PULL_DEFINED (o)) +if (o->ifconfig_ipv6_local && o->mode ==MODE_POINT_TO_POINT && !PULL_DEFINED (o))buf_printf (&out,",tun-ipv6" );/*
@@ -4578,7 +4570,6 @@ add_option (struct options *options,else if (streq (p[0 ],"tun-ipv6" ) && !p[1 ]) {VERIFY_PERMISSION (OPT_P_UP ); - options->tun_ipv6 = true; }#ifdef ENABLE_IPROUTE else if (streq (p[0], "iproute") && p[1] && !p[2])
src/openvpn/options.h +0 -1
@@ -251,7 +251,6 @@ struct optionsint ping_send_timeout;/* Send a TCP/UDP ping to remote every n seconds */ int ping_rec_timeout;/* Expect a TCP/UDP ping from remote at least once every n seconds */ bool ping_timer_remote;/* Run ping timer only if we have a remote address */ -bool tun_ipv6;/* Build tun dev that supports IPv6 */ # define PING_UNDEF 0# define PING_EXIT 1
src/openvpn/route.c +3 -10
@@ -1729,10 +1729,10 @@ add_route_ipv6 (struct route_ipv6 *r6, const struct tuntap *tt, unsigned int fla }#endif -if ( !tt->ipv6 ) +if (!tt->did_ifconfig_ipv6_setup) { -msg (M_INFO ,"add_route_ipv6(): not adding %s/%d, no IPv6 on if %s" , - network, r6->netbits, device ); +msg (M_INFO ,"add_route_ipv6(): not adding %s/%d, no IPv6 ifconfig on if %s" , + network, r6->netbits, device);return ; }
@@ -2159,13 +2159,6 @@ delete_route_ipv6 (const struct route_ipv6 *r6, const struct tuntap *tt, unsigne }#endif -if ( !tt->ipv6 ) - { -msg (M_INFO ,"delete_route_ipv6(): not deleting %s/%d, no IPv6 on if %s" , - network, r6->netbits, device ); -return ; - } -msg (M_INFO ,"delete_route_ipv6(%s/%d)" , network, r6->netbits );/* if we used a gateway on "add route", we also need to specify it on
src/openvpn/tun.c +21 -89
240 lines not on this page · raw message
src/openvpn/tun.h +0 -2
@@ -139,8 +139,6 @@ struct tuntapbool did_ifconfig_ipv6_setup;bool did_ifconfig; -bool ipv6; -bool persistent_if;/* if existed before, keep on program end */ struct tuntap_options options;/* options set on command line */
Signature · 1 line
2.8.4 (Apple Git-73)
Hi,
src/openvpn/tun.c do_ifconfig (struct tuntap *tt, · line 1131
Quoted 6 lines · Arne Schwabe
src/openvpn/tun.c +2
-0@@ -1127,6 +1127,8 @@ do_ifconfig (struct tuntap *tt,if ( do_ipv6 ) {#ifdef NETBSD_MULTI_AF +#error no IPv6 support for tun interfaces on NetBSD before 4.0, upgrade your system. +#endif
If we keep this, this needs to be an #ifndef (you change the if/else branches). But I think this could also just go - 4.0 has been released 9 years ago. It will fail at compile time, and then people can either use 2.3 or upgrade their NetBSD.
Besides that, I think it mostly looks good. Needs explicit testing on those platforms where tun.c got changed (which I did not do yet).
gert
Signature · 4 lines
USENET is *not* the non-clickable part of WWW!
//www.muc.de/~gert/
Gert Doering - Munich, Germany [email protected]...
fax: +49-89-35655025 [email protected]...PATCH v4 1/1 Remove tun-ipv6 Option. Instead assume that IPv6 is always supported.
In reply to Gert DoeringThis option was useful when Ipv6 tun support was non standard and was an internal/user specified flag that tracked the Ipv6 capability of the tun device.
All supported OS support IPv6. Also tun-ipv6 is pushable by the remote so not putting tun-ipv6 does not forbid ipv6 addresses.
This commit also clean up a bit of the ipv6 related tun.c. Changes for most platforms are minimal.
For linux a bit more cleanup is done:
- Remove compatibility defines that were added 2008
- Always use IFF_NO_PI for the linux tun and not only for IPv4 only tun setups (Android also always IFF_NO_PI works fine with Ipv6).
This commit also remove a non ipv6 fallback for tap driver from OpenVPN 2.2-beta or earlier and only warns.
Patch V2: Integrate Gert's comments
Patch V3: Remove tun_ipv4 option. It only used for MTU discovery and there it was wrong since it should on the transport protocol if at all Patch V4: Completely remove support for NetBSD <= 4.0 and remove NETBSD_MULTI_AF defines
--- Changes.rst | 3 ++ src/openvpn/forward.c | 2 +- src/openvpn/helper.c | 2 - src/openvpn/init.c | 6 --- src/openvpn/multi.c | 8 ++- src/openvpn/openvpn.h | 5 -- src/openvpn/options.c | 11 +--- src/openvpn/options.h | 1 - src/openvpn/route.c | 13 ++--- src/openvpn/tun.c | 139 +++++++------------------------------------------- src/openvpn/tun.h | 2 - 11 files changed, 30 insertions(+), 162 deletions(-)
Changes.rst +3 -0
@@ -135,6 +135,9 @@ User-visible Changes ciphers configured in the config file. Use --ncp-disable if you don't want that. +- ALl tun devices on all platforms are considered always IPv6 capable. The --tun-ipv6 + option is ignored (behaves like it is always on). + Maintainer-visible changes --------------------------
src/openvpn/forward.c +1 -1
@@ -391,7 +391,7 @@ check_fragment_dowork (struct context *c)struct link_socket_info *lsi =get_link_socket_info (c);/* OS MTU Hint? */ -if (lsi->mtu_changed && c->c2.ipv4_tun) +if (lsi->mtu_changed) {frame_adjust_path_mtu (&c->c2.frame_fragment, c->c2.link_socket->mtu, c->options.ce.proto);
src/openvpn/helper.c +0 -2
@@ -200,8 +200,6 @@ helper_client_server (struct options *o)add_in6_addr ( o->server_network_ipv6,0x1000 ); o->ifconfig_ipv6_pool_netbits = o->server_netbits_ipv6; - o->tun_ipv6 = true; -push_option ( o,"tun-ipv6" ,M_USAGE ); }
src/openvpn/init.c +0 -6
@@ -1400,9 +1400,6 @@ do_init_tun (struct context *c) !c->options.ifconfig_nowarn, c->c2.es); -/* flag tunnel for IPv6 config if --tun-ipv6 is set */ - c->c1.tuntap->ipv6 = c->options.tun_ipv6; -init_tun_post (c->c1.tuntap, &c->c2.frame, &c->options.tuntap_options);
@@ -1420,9 +1417,6 @@ do_open_tun (struct context *c)struct gc_arena gc =gc_new ();bool ret = false; - c->c2.ipv4_tun = (!c->options.tun_ipv6 - &&is_dev_type (c->options.dev, c->options.dev_type,"tun" )); -#ifndef TARGET_ANDROID if (!c->c1.tuntap) {
src/openvpn/multi.c +3 -5
@@ -1378,8 +1378,7 @@ multi_select_virtual_addr (struct multi_context *m, struct multi_instance *mi)* (see below) so issue a warning if that happens - don't break the * session, though, as we don't even know if this client WANTS IPv6 */ -if ( mi->context.c1.tuntap->ipv6 && - mi->context.options.ifconfig_ipv6_pool_defined && +if ( mi->context.options.ifconfig_ipv6_pool_defined && ! mi->context.options.push_ifconfig_ipv6_defined ) {msg (M_INFO ,"MULTI_sva: WARNING: if --ifconfig-push is used for IPv4, automatic IPv6 assignment from --ifconfig-ipv6-pool does not work. Use --ifconfig-ipv6-push for IPv6 then." );
@@ -1452,8 +1451,7 @@ multi_select_virtual_addr (struct multi_context *m, struct multi_instance *mi)* way round ("dynamic IPv4, static IPv6") or "both static" makes sense * -> and so it's implemented right now */ -if ( mi->context.c1.tuntap->ipv6 && - mi->context.options.push_ifconfig_ipv6_defined ) +if ( mi->context.options.push_ifconfig_ipv6_defined ) { mi->context.c2.push_ifconfig_ipv6_local = mi->context.options.push_ifconfig_ipv6_local;
@@ -1511,7 +1509,7 @@ multi_set_virtual_addr_env (struct multi_context *m, struct multi_instance *mi)setenv_del (mi->context.c2.es,"ifconfig_pool_remote_ip6" );setenv_del (mi->context.c2.es,"ifconfig_pool_ip6_netbits" ); -if (mi->context.c1.tuntap->ipv6 && mi->context.c2.push_ifconfig_ipv6_defined) +if (mi->context.c2.push_ifconfig_ipv6_defined) { setenv_in6_addr (mi->context.c2.es, "ifconfig_pool_remote",
src/openvpn/openvpn.h +0 -5
@@ -390,11 +390,6 @@ struct context_2struct buffer to_tun;struct buffer to_link; -/* -* IPv4 TUN device? -*/ -bool ipv4_tun; -/* should we print R|W|r|w to console on packet transfers? */ bool log_rw;
src/openvpn/options.c +1 -10
@@ -1500,7 +1500,6 @@ show_settings (const struct options *o)SHOW_STR (dev_node);SHOW_STR (lladdr);SHOW_INT (topology); -SHOW_BOOL (tun_ipv6);SHOW_STR (ifconfig_local);SHOW_STR (ifconfig_remote_netmask);SHOW_BOOL (ifconfig_noexec);
@@ -2103,10 +2102,6 @@ options_postprocess_verify_ce (const struct options *options, const struct conne options->connection_list->array[0]->remote)msg (M_USAGE ,"<connection> cannot be used with --mode server" ); -#if 0 -if (options->tun_ipv6) -msg (M_USAGE ,"--tun-ipv6 cannot be used with --mode server" ); -#endif if (options->shaper)msg (M_USAGE ,"--shaper cannot be used with --mode server" );if (options->inetd)
@@ -2130,9 +2125,6 @@ options_postprocess_verify_ce (const struct options *options, const struct connemsg (M_USAGE ,"--ifconfig-pool-persist must be used with --ifconfig-pool" );if (options->ifconfig_ipv6_pool_defined && !options->ifconfig_ipv6_local )msg (M_USAGE ,"--ifconfig-ipv6-pool needs --ifconfig-ipv6" ); -if (options->ifconfig_ipv6_local && !options->tun_ipv6 ) -msg (M_INFO ,"Warning: --ifconfig-ipv6 without --tun-ipv6 will not do IPv6" ); -if (options->auth_user_pass_file)msg (M_USAGE ,"--auth-user-pass cannot be used with --mode server (it should be used on the client side only)" );if (options->ccd_exclusive && !options->client_config_dir)
@@ -3076,7 +3068,7 @@ options_string (const struct options *o,/* send tun_ipv6 only in peer2peer mode - in client/server mode, it * is usually pushed by the server, triggering a non-helpful warning */ -if (o->tun_ipv6 && o->mode ==MODE_POINT_TO_POINT && !PULL_DEFINED (o)) +if (o->ifconfig_ipv6_local && o->mode ==MODE_POINT_TO_POINT && !PULL_DEFINED (o))buf_printf (&out,",tun-ipv6" );/*
@@ -4577,7 +4569,6 @@ add_option (struct options *options,else if (streq (p[0 ],"tun-ipv6" ) && !p[1 ]) {VERIFY_PERMISSION (OPT_P_UP ); - options->tun_ipv6 = true; }#ifdef ENABLE_IPROUTE else if (streq (p[0], "iproute") && p[1] && !p[2])
src/openvpn/options.h +0 -1
@@ -251,7 +251,6 @@ struct optionsint ping_send_timeout;/* Send a TCP/UDP ping to remote every n seconds */ int ping_rec_timeout;/* Expect a TCP/UDP ping from remote at least once every n seconds */ bool ping_timer_remote;/* Run ping timer only if we have a remote address */ -bool tun_ipv6;/* Build tun dev that supports IPv6 */ # define PING_UNDEF 0# define PING_EXIT 1
src/openvpn/route.c +3 -10
@@ -1729,10 +1729,10 @@ add_route_ipv6 (struct route_ipv6 *r6, const struct tuntap *tt, unsigned int fla }#endif -if ( !tt->ipv6 ) +if (!tt->did_ifconfig_ipv6_setup) { -msg (M_INFO ,"add_route_ipv6(): not adding %s/%d, no IPv6 on if %s" , - network, r6->netbits, device ); +msg (M_INFO ,"add_route_ipv6(): not adding %s/%d, no IPv6 ifconfig on if %s" , + network, r6->netbits, device);return ; }
@@ -2159,13 +2159,6 @@ delete_route_ipv6 (const struct route_ipv6 *r6, const struct tuntap *tt, unsigne }#endif -if ( !tt->ipv6 ) - { -msg (M_INFO ,"delete_route_ipv6(): not deleting %s/%d, no IPv6 on if %s" , - network, r6->netbits, device ); -return ; - } -msg (M_INFO ,"delete_route_ipv6(%s/%d)" , network, r6->netbits );/* if we used a gateway on "add route", we also need to specify it on
src/openvpn/tun.c +19 -120
306 lines not on this page · raw message
src/openvpn/tun.h +0 -2
@@ -139,8 +139,6 @@ struct tuntapbool did_ifconfig_ipv6_setup;bool did_ifconfig; -bool ipv6; -bool persistent_if;/* if existed before, keep on program end */ struct tuntap_options options;/* options set on command line */
Signature · 1 line
2.8.4 (Apple Git-73)
Hi.
Quoted 8 lines · Arne Schwabe
This option was useful when Ipv6 tun support was non standard and was an internal/user specified flag that tracked the Ipv6 capability of the tun device.
All supported OS support IPv6. Also tun-ipv6 is pushable by the remote so not putting tun-ipv6 does not forbid ipv6 addresses.
How will this patch affect a VPN on a system that has IPv6 disabled?
To prevent information leakage, Tunnelblick has an option in tun mode that forces the OS to disable IPv6 (via a "networksetup -setv6off" OS X command.)
The information leakage when using IPv6 in a VPN is described in [1]. As of the date of the article (June 2015), the problem was common among VPN service providers. The "disable IPv6" feature was added to Tunnelblick because disabling IPv6 was the only way that a user of such services could protect themselves. It isn't clear if all VPN service providers have fixed their configurations yet (or will ever fix their configurations).
Best regards,
Jon Bullard
[1] http://www.eecs.qmul.ac.uk/~hamed/papers/PETS2015VPN.pdf
Am 12.10.16 um 13:17 schrieb Jonathan K. Bullard:
Quoted 13 lines
Hi.
Quoted 7 lines · Arne Schwabe
This option was useful when Ipv6 tun support was non standard and was an internal/user specified flag that tracked the Ipv6 capability of the tun device.
All supported OS support IPv6. Also tun-ipv6 is pushable by the remote so not putting tun-ipv6 does not forbid ipv6 addresses.
How will this patch affect a VPN on a system that has IPv6 disabled?
Short version: Fail as miserable as before.
tun-ipv6 is not saying "My OS can do IPv6" but more "My OS has the required calls to configure a IPv6 tun". It came from a time when configuring/sending IPv6 packets into a non IPv6 prepared tun screwed things ups. You might think that leaving out tun-ipv6 might fix your problem but tun-ipv6 is a pushable option and the server-ipv6 macro will push it, so you end up with tun-ipv6 without having it in the client config.
You can do pull-filter tun-ipv6 or disable pulling all together but then again you can do also pull-filter ifconfig-ipv6 and pull-filter route-ipv6 which is a cleaner way then letting those commands fails (and probably also the connection attempt).
The option really serves no good purposse anymore. If someone really wants a disable IPv6 option this option isn't it.
Arne
Thanks, Arne. Sorry if I wasn't a clear as I should have been.
Quoted 9 lines · Arne Schwabe
Am 12.10.16 um 13:17 schrieb Jonathan K. Bullard:
Quoted 7 lines
Hi.
Quoted 4 lines · Arne Schwabe
This option was useful when Ipv6 tun support was non standard and was an internal/user specified flag that tracked the Ipv6 capability of the tun device.
Quoted 7 lines
Quoted 6 lines
Quoted 3 lines
All supported OS support IPv6. Also tun-ipv6 is pushable by the remote so not putting tun-ipv6 does not forbid ipv6 addresses.
How will this patch affect a VPN on a system that has IPv6 disabled?
Short version: Fail as miserable as before.
Connections don't fail in the situation I describe (IPv6 disabled at the OS level). At least not when there are no IPv6 options enabled in the OpenVPN configuration or pushed from the server, which is the setup that many VPN service providers use.
Quoted 3 lines
You might think that leaving out tun-ipv6 might fix your
problem but tun-ipv6 is a pushable option and the server-ipv6 macro will push it, so you end up with tun-ipv6 without having it in the client config.
The problem was not that the server was pushing tun-ipv6 (the configurations and server pushes did not have any IPv6 references). The problem was that the OS prefers IPv6 over IPv4 when both were available. So the OS was sending out IPv6 packets, which caused information leakage. The solution was not leaving out the tun-ipv6 option, but disabling IPv6 in the OS.
What I should have asked is: with this patch will an OpenVPN client still send out IPv4 packets if there are no IPv6 options specified or pulled from the server?
If yes, the connection will succeed. If no, then disabling IPv6 in the OS will cause failed connections. (Unless with IPv6 disabled the OS translates IPv6 packets to IPv4 and sends them, which seems unlikely to me.)
Hi,
Quoted 3 lines · Jonathan K. Bullard
What I should have asked is: with this patch will an OpenVPN client still send out IPv4 packets if there are no IPv6 options specified or pulled from the server?
Yes. Basically, the tun interface is now always in "dual-stack mode"
on those platforms where it matters (some, like NetBSD, can have "IPv4 only mode" or "dual stack mode", and the latter was "newly added" some 10 years ago...).
IPv4 is not going to be broken :-)
The only user visible change *expected* by this change is that previously, "ifconfig-ipv6" would be rejected unless "tun-ipv6" was also configured, and now this dependency is gone - if you configure (or push) ifconfig-ipv6, you get dual-stack v4+v6, if not, you get a dual-stacked tun interface with only IPv4 active.
gert
Signature · 4 lines
USENET is *not* the non-clickable part of WWW!
//www.muc.de/~gert/
Gert Doering - Munich, Germany [email protected]...
fax: +49-89-35655025 [email protected]...Thanks to both Gert and Arne for their answers.
Quoted 3 lines · Arne Schwabe
Quoted 3 lines
What I should have asked is: with this patch will an OpenVPN client still send out IPv4 packets if there are no IPv6 options specified or pulled from the server?
Quoted 4 lines
What I should have asked is: with this patch will an OpenVPN client still send out IPv4 packets if there are no IPv6 options specified or pulled from the server?
In short: Behave exactly as before.
Longer explaination:
Without the patch OpenVPN refuses ifconfig-ipv6 and route-ipv6 without tun-ipv6 option because the tun device has not been configured in a IPv6 safe way. With patch it does not refuse the commands.
The problem that tun-ipv6 solved was "Method A works with IPv6/IPv4 but might break on old versions of Linux(?) and Method B always works but only IPv4".
On Linux the tun device has been opend/configured in different ways for tun-ipv6 and non tun-ipv6 which are both IPv4/IPv6 capable (prepend a header to packet/do not prepend a header) for reasons that are probably lost in history. The patch unifies that to never prepends headers (IPv4 behaviour and Android behaviour).
For OS X tun (and utun) has always been opened in the same way no matter if tun-ipv6 was specifiied. So only change for OS X is no longer refusing ifconfig-ipv6 and route-ipv6 without tun-ipv6 option.
Arne
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Quoted 36 lines · Arne Schwabe
This option was useful when Ipv6 tun support was non standard and was an internal/user specified flag that tracked the Ipv6 capability of the tun device.
All supported OS support IPv6. Also tun-ipv6 is pushable by the remote so not putting tun-ipv6 does not forbid ipv6 addresses.
This commit also clean up a bit of the ipv6 related
tun.c. Changes for most platforms are minimal.For linux a bit more cleanup is done: - Remove compatibility defines that were added 2008 - Always use
IFF_NO_PIfor the linux tun and not only for IPv4 only tun setups (Android also alwaysIFF_NO_PIworks fine with Ipv6).This commit also remove a non ipv6 fallback for tap driver from OpenVPN 2.2-beta or earlier and only warns.
Patch V2: Integrate Gert's comments Patch V3: Remove
tun_ipv4option. It only used for MTU discovery and there it was wrong since it should on the transport protocol if at all Patch V4: Completely remove support for NetBSD <= 4.0 and removeNETBSD_MULTI_AF
defines ---Changes.rst| 3 ++src/openvpn/forward.c|
2 +-src/openvpn/helper.c| 2 -src/openvpn/init.c| 6 ---src/openvpn/multi.c | 8 ++- src/openvpn/openvpn.h | 5 -- src/openvpn/options.c | 11 +--- src/openvpn/options.h | 1 - src/openvpn/route.c | 13 ++--- src/openvpn/tun.c | 139+++++++-------------------------------------------
src/openvpn/tun.h| 2 - 11 files changed, 30 insertions(+),
162 deletions(-)Changes.rst index 9fcba75..2956003 renamed from Changes.rst +0
-0100644 ---
a/Changes.rst+++b/Changes.rst@@ -135,6 +135,9 @@ User-visible Changes ciphers configured in the config file. Use --ncp-disable if you don't want that.
Quoted 2 lines
+- ALl tun devices on all platforms are considered always IPv6 capable. The --tun-ipv6
Silly typo. (I would have done this one in-flight, hadn't it been for a few other minor things).
[...snip...]
Quoted 3 lines
Changes.rst index 9fcba75..2956003 renamed from Changes.rst +0
-0@@ -4577,7 +4569,6 @@ add_option (struct options *options, else if(streq (p[0], "tun-ipv6") && !p[1]) {
VERIFY_PERMISSION
(OPT_P_UP); -options->tun_ipv6= true; }
Should we add a "Deprecated/NO-OP option used." message?
[...snip....]
Quoted 9 lines
+++
b/src/openvpn/route.c@@ -1729,10 +1729,10 @@add_route_ipv6(structroute_ipv6*r6, const struct tuntap *tt, unsigned int fla } #endif- if ( !tt->ipv6 ) + if (!tt->did_ifconfig_ipv6_setup) { - msg(
M_INFO, "add_route_ipv6(): not adding %s/%d, no IPv6 on if
%s", - network,r6->netbits, device ); + msg(M_INFO,
"add_route_ipv6(): not adding %s/%d, no IPv6 ifconfig on if %s", + network,r6->netbits, device);
Wouldn't it be nicer we said "no IPv6 address configured on interface %s" ? Just trying to be slightly more user friendly in the logs.
Quoted 10 lines
---
a/src/openvpn/tun.c+++b/src/openvpn/tun.c@@ -741,8 +741,8 @@do_ifconfig(struct tuntap *tt,
argv_init(&argv);- msg(
M_INFO, "do_ifconfig, tt->ipv6=%d,
tt->did_ifconfig_ipv6_setup=%d", -tt->ipv6,tt->did_ifconfig_ipv6_setup); + msg(M_INFO, "do_ifconfig,
tt->did_ifconfig_ipv6_setup=%d", +tt->did_ifconfig_ipv6_setup);
While we're changing log lines ... could we make this one a bit less technical, or at least increase the verb level if we want it to be so technical? Again, just to be more user friendly
[...snip...]
Quoted 7 lines
Changes.rst index 9fcba75..2956003 renamed from Changes.rst +0
-1@@ -1526,7 +1513,7 @@ open_tun_generic (const char *dev, const char *dev_type, const char *dev_node, bool dynamic_opened = false; - if ( tt->ipv6 && ! ipv6_explicitly_supported ) + if ( !
ipv6_explicitly_supported) msg (M_WARN, "NOTE: explicit support for IPv6 tun devices is not provided for this OS");
Isn't this if() block a NOOP?
$ git grep -Hni ipv6_explicitly_supported src/openvpn/tun.c:1521: bool ipv6_explicitly_supported, bool dynamic, src/openvpn/tun.c:1529: if ( tt->ipv6 && ! ipv6_explicitly_supported )
Could we kill this as well?
[...snip...0
Quoted 11 lines
Changes.rst index 9fcba75..2956003 renamed from Changes.rst +0
-0@@ -1977,53 +1940,13 @@ close_tun (struct tuntap *tt) int write_tun(struct tuntap* tt,
uint8_t*buf, int len) { - if (tt->ipv6) -
{ - structtun_pipi; - struct iphdr *iph; - struct
iovec vect[2]; - int ret; - - iph = (struct iphdr *)buf;
- - pi.flags = 0; - -if(iph->version == 6)- pi.proto =htons(OPENVPN_ETH_P_IPV6); - else - pi.proto =htons(OPENVPN_ETH_P_IPV4); - - vect[0].iov_len = sizeof(pi); -
vect[0].iov_base = π - vect[1].iov_len = len; -
vect[1].iov_base = buf; - - ret =writev(tt->fd, vect, 2); -
return(ret - sizeof(pi)); - } - else - return write (tt->fd,
buf, len); + return write (tt->fd, buf, len);
whitespace issue.
Quoted 9 lines
}
int
read_tun(struct tuntap* tt,uint8_t*buf, int len) { - if
(tt->ipv6) - { - struct iovec vect[2]; - structtun_pi
pi; - int ret; - - vect[0].iov_len = sizeof(pi); -
vect[0].iov_base = π - vect[1].iov_len = len; -
vect[1].iov_base = buf; - - ret =readv(tt->fd, vect, 2); -
return(ret - sizeof(pi)); - } - else - return read (tt->fd,
buf, len); + return read (tt->fd, buf, len);
whitespace issue.
[....snip....]
Quoted 5 lines
Changes.rst index 9fcba75..2956003 renamed from Changes.rst +0
-0@@ -5308,11 +5208,10 @@ open_tun (const char *dev, const char *dev_type, const char *dev_node, struct tu /* usage of numericconstants is ugly, but this is really tied to * *this* version of
the driver */ - if (tt->ipv6&&tt->type==DEV_TYPE_TUN&& +
if (tt->type==DEV_TYPE_TUN&& info[0] == 9 && info[1] < 8) { -
Quoted 8 lines
msg(
M_INFO, "WARNING: Tap-Win32 driver version %d.%d does not support IPv6 in TUN mode. IPv6 will be disabled. Upgrade to Tap-Win32 9.8 (2.2-beta3 release or later) or use TAP mode to get
IPv6", (int) info[0], (int) info[1] ); -tt->ipv6= false; + msg(M_INFO, "WARNING: Tap-Win32 driver version %d.%d does not support IPv6 in TUN mode. IPv6 will not work. Upgrade to Tap-Win32 9.8 (2.2-beta3 release or later) or use TAP mode to get IPv6", (int) info[0], (int) info[1] );
Maybe we should review the contents of this log line as well? Can at least point at the latest 2.3 release instead of a beta release.
I see that a few of my comments are not directly related to removing
- --tun-ipv6. But I'm not convinced there's any benefit in having them in a separate patch. I'm okay with either approach.
- --
kind regards,
David Sommerseth
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
iQIcBAEBAgAGBQJX/62wAAoJEIbPlEyWcf3yhJ8QALz7l0FSvhKlVqza+35D8jXL t8rAGFEgmqXa2rQxUeJ5sB7KR41OyOuCMNwyfb1gB1wuzAhkWjtwM+bhtPqYc2rl g9KsfXnEYOqUUyUPBZb+1AQtAoR5m3jly+KTkoUjkVPw0nNiXAYa8YceZaP9GFTp bksEymcHx3wOJi9ulZY8CNSTfverfAZvoqnmL0rgqsoWPaz70brSLCOFE8V/3PUC hDFpHGHyGiRcvqmWuPYwD3v5wUipWvESoxbItj5K72mrsc1B3tk1LkAwdyeXO95c AOL9bVYPLxycGIEm6oUgFQ+gNJ/VAV7MORwD0HZCR9A0xrlfxsE+7ziXq8+++z1L +nw8oIjgEAfwjBCcxU4vyyR+WhLfR/mPoP05qNFVVhTzYWceLW/OjiA51ejS8bN8 XHtwWsgHXHdeEg/cCHTUaEK3XNfJGKLVGEsNzjmZGtYymcTS3h7jLl4ljEpUJVni ewLsR2Z/+rAj6Fub75HVky4Fwkjo2BvsXJlfHLu623G2x30x+j83zSDdIoII2Koh c/nCMcheMPBRM4O9mLy2y9UnxipPU4MU8e058G3Cf1TWAv2GF3lBHyuiSH+JeMeR v2I3i7xUUEinOvM692gzMdDFk5X4f3KeFvE6aKxmTc3sIFdpMRZ5F0YmpONQ/ikd wqLFGz29sG4OVI3LtgTu
=yPA4
-----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Please disregard this mail. I will resent it again without getting it destroyed by Engimail's text wrapping.
David S.
Quoted 151 lines · David Sommerseth
Quoted 37 lines · Arne Schwabe
This option was useful when Ipv6 tun support was non standard and was an internal/user specified flag that tracked the Ipv6 capability of the tun device.
All supported OS support IPv6. Also tun-ipv6 is pushable by the remote so not putting tun-ipv6 does not forbid ipv6 addresses.
This commit also clean up a bit of the ipv6 related
tun.c. Changes for most platforms are minimal.For linux a bit more cleanup is done: - Remove compatibility defines that were added 2008 - Always use
IFF_NO_PIfor the linux tun and not only for IPv4 only tun setups (Android also alwaysIFF_NO_PIworks fine with Ipv6).This commit also remove a non ipv6 fallback for tap driver from OpenVPN 2.2-beta or earlier and only warns.
Patch V2: Integrate Gert's comments Patch V3: Remove
tun_ipv4option. It only used for MTU discovery and there it was wrong since it should on the transport protocol if at all Patch V4:
Completely remove support for NetBSD <= 4.0 and removeNETBSD_MULTI_AFdefines ---Changes.rst| 3 ++src/openvpn/forward.c | 2 +- src/openvpn/helper.c | 2 - src/openvpn/init.c | 6 --- src/openvpn/multi.c | 8 ++- src/openvpn/openvpn.h | 5 -- src/openvpn/options.c | 11 +--- src/openvpn/options.h | 1 - src/openvpn/route.c | 13 ++--- src/openvpn/tun.c | 139+++++++-------------------------------------------
src/openvpn/tun.h| 2 - 11 files changed, 30
insertions(+), 162 deletions(-)Changes.rst index 9fcba75..2956003 renamed from Changes.rst +0
-0100644 ---
a/Changes.rst+++b/Changes.rst@@ -135,6 +135,9 @@ User-visible Changes ciphers configured in the config file. Use --ncp-disable if you don't want that.Quoted 2 lines
+- ALl tun devices on all platforms are considered always IPv6 capable. The --tun-ipv6
Silly typo. (I would have done this one in-flight, hadn't it been for a few other minor things).
[...snip...]
Quoted 3 lines
Changes.rst index 9fcba75..2956003 renamed from Changes.rst +0
-0@@ -4577,7 +4569,6 @@ add_option (struct options *options, elseif (streq (p[0], "tun-ipv6") && !p[1]) {
VERIFY_PERMISSION
(OPT_P_UP); -options->tun_ipv6= true; }Should we add a "Deprecated/NO-OP option used." message?
[...snip....]
Quoted 9 lines
+++
b/src/openvpn/route.c@@ -1729,10 +1729,10 @@add_route_ipv6(structroute_ipv6*r6, const struct tuntap *tt, unsigned int fla
} #endif- if ( !tt->ipv6 ) + if (!tt->did_ifconfig_ipv6_setup) { - msg(
M_INFO, "add_route_ipv6(): not adding %s/%d, no IPv6 on if %s", -
network,r6->netbits, device ); + msg(M_INFO,
"add_route_ipv6(): not adding %s/%d, no IPv6 ifconfig on if %s",
+ network,r6->netbits, device);Wouldn't it be nicer we said "no IPv6 address configured on interface %s" ? Just trying to be slightly more user friendly in the logs.
Quoted 10 lines
---
a/src/openvpn/tun.c+++b/src/openvpn/tun.c@@ -741,8 +741,8 @@do_ifconfig(struct tuntap *tt,
argv_init(&argv);- msg(
M_INFO, "do_ifconfig, tt->ipv6=%d,
tt->did_ifconfig_ipv6_setup=%d", -tt->ipv6,tt->did_ifconfig_ipv6_setup); + msg(M_INFO, "do_ifconfig,
tt->did_ifconfig_ipv6_setup=%d", +tt->did_ifconfig_ipv6_setup);While we're changing log lines ... could we make this one a bit less technical, or at least increase the verb level if we want it to be so technical? Again, just to be more user friendly
[...snip...]
Quoted 8 lines
Changes.rst index 9fcba75..2956003 renamed from Changes.rst +0
-0@@ -1526,7 +1513,7 @@ open_tun_generic (const char *dev, constchar
*dev_type, const char*dev_node, booldynamic_opened= false;- if (
tt->ipv6&& !ipv6_explicitly_supported) + if ( !ipv6_explicitly_supported) msg (M_WARN, "NOTE: explicit support for IPv6 tun devices is not provided for this OS");Isn't this
if()block a NOOP?$ git grep -Hni ipv6_explicitly_supported src/openvpn/tun.c:1521: bool ipv6_explicitly_supported, bool dynamic, src/openvpn/tun.c:1529: if ( tt->ipv6 && ! ipv6_explicitly_supported )Could we kill this as well?
[...snip...0
Quoted 4 lines
Changes.rst index 9fcba75..2956003 renamed from Changes.rst +0
-0@@ -1977,53 +1940,13 @@ close_tun (struct tuntap *tt) int
write_tun(struct tuntap* tt,uint8_t*buf, int len) { - if
(tt->ipv6) - { - structtun_pipi; - struct iphdr *iph;
- struct iovec vect[2]; - int ret; - - iph =Quoted 8 lines
(struct iphdr *)buf; - - pi.flags = 0; - -
if(iph->version == 6)- pi.proto =htons(OPENVPN_ETH_P_IPV6); -
else - pi.proto =htons(OPENVPN_ETH_P_IPV4); - -
vect[0].iov_len = sizeof(pi); - vect[0].iov_base = π -
vect[1].iov_len = len; - vect[1].iov_base = buf; - - ret =writev(tt->fd, vect, 2); - return(ret - sizeof(pi)); - } -
else - return write (tt->fd, buf, len); + return write
(tt->fd, buf, len);whitespace issue.
Quoted 9 lines
}
int
read_tun(struct tuntap* tt,uint8_t*buf, int len) { - if
(tt->ipv6) - { - struct iovec vect[2]; - structtun_pipi; - int ret; - - vect[0].iov_len = sizeof(pi);
- vect[0].iov_base = π - vect[1].iov_len = len; -
vect[1].iov_base = buf; - - ret =readv(tt->fd, vect, 2); -
return(ret - sizeof(pi)); - } - else - return read
(tt->fd, buf, len); + return read (tt->fd, buf, len);whitespace issue.
[....snip....]
Quoted 5 lines
Changes.rst index 9fcba75..2956003 renamed from Changes.rst +0
-0@@ -5308,11 +5208,10 @@ open_tun (const char *dev, const char *dev_type, const char *dev_node, struct tu /* usage of numericconstants is ugly, but this is really tied to * *this* version
of the driver */ - if (tt->ipv6&&tt->type==DEV_TYPE_TUN
&& + if (tt->type==DEV_TYPE_TUN&& info[0] == 9 && info[1] < 8)Quoted 8 lines
{ - msg(
M_INFO, "WARNING: Tap-Win32 driver version %d.%d does not support IPv6 in TUN mode. IPv6 will be disabled. Upgrade to Tap-Win32 9.8 (2.2-beta3 release or later) or use TAP mode to
get IPv6", (int) info[0], (int) info[1] ); -tt->ipv6= false; +
msg(M_INFO, "WARNING: Tap-Win32 driver version %d.%d does not support IPv6 in TUN mode. IPv6 will not work. Upgrade to Tap-Win32 9.8 (2.2-beta3 release or later) or use TAP mode to get IPv6", (int) info[0], (int) info[1] );Maybe we should review the contents of this log line as well? Can at least point at the latest 2.3 release instead of a beta release.
Quoted 9 lines
I see that a few of my comments are not directly related to removing --tun-ipv6. But I'm not convinced there's any benefit in having them in a separate patch. I'm okay with either approach.
-- kind regards,
David Sommerseth
- --
kind regards,
David Sommerseth
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
iQIcBAEBAgAGBQJX/64zAAoJEIbPlEyWcf3yOdgP/2xcR+dYM1VQLHEPhKCoFrZ1 +gl9py6z124K0jswkFjCbm4l1EfJyPmxDZt9GfvBr+j+3lT/yZoEPMNhQG7F6LM3 czYAx0vFuI51/8s6GSXfh/APoJTTQhOSprzEbkluPjeVa46fUZ8XeXeTHoJbaujD ilF1XengPHp671yJVlEPPAL2rnNrMaNi7NMA3Fy1/K83I0fK8D7dxSVtcVrIWjIG qlV68YbIxyYbxelM0AdLAcKsiCffZIe3Ojy+UoGjnLBKjnbbvkqMbzdHk7982Fp0 QNAwe+WwCw4Q5kl2W2DGPdZY88aU9v4EBWdEa3JF3QMwj1b1F0KY7E/9r3iHYDNe cNBNwN4D2sjd1SdTCL1sAV2Iih+i1T8/gLYPNdXp8Zkf6HaI3nWtyCF8BEB7CeO6 zsmMBMeWc+ld6zjhaOL2JYRj94qkmuCgGtNa4khd34Ih5OAlk1E/GyrkCWdSCTAS T7eD7V5AfGzBfx4Hu2XJVAEOpzjU6NKVtqHBCecni3PUk2Uyjj5v6Zcl1vzoiyye AHSeYmazB5h24ywA5k0JukCLblaKP1bciStXPlGByAHtOHA7ZTPR7SUvsV1VIBOA BMPJaEabUhYIvhK82bqA1DxUpBngPaNxFvesMkJTQgS7zE9gj1C3ATd6vuLMYHIY E1q3yTuEYIDwaJUN0wr/
=+AHi
-----END PGP SIGNATURE-----
Quoted 41 lines · Arne Schwabe
This option was useful when Ipv6 tun support was non standard and was an internal/user specified flag that tracked the Ipv6 capability of the tun device.
All supported OS support IPv6. Also tun-ipv6 is pushable by the remote so not putting tun-ipv6 does not forbid ipv6 addresses.
This commit also clean up a bit of the ipv6 related
tun.c. Changes for most platforms are minimal.For linux a bit more cleanup is done: - Remove compatibility defines that were added 2008 - Always use
IFF_NO_PIfor the linux tun and not only for IPv4 only tun setups (Android also alwaysIFF_NO_PIworks fine with Ipv6).This commit also remove a non ipv6 fallback for tap driver from OpenVPN 2.2-beta or earlier and only warns.
Patch V2: Integrate Gert's comments Patch V3: Remove
tun_ipv4option. It only used for MTU discovery and there it was wrong since it should on the transport protocol if at all Patch V4: Completely remove support for NetBSD <= 4.0 and removeNETBSD_MULTI_AFdefines--- Changes.rst | 3 ++ src/openvpn/forward.c | 2 +- src/openvpn/helper.c | 2 - src/openvpn/init.c | 6 --- src/openvpn/multi.c | 8 ++- src/openvpn/openvpn.h | 5 -- src/openvpn/options.c | 11 +--- src/openvpn/options.h | 1 - src/openvpn/route.c | 13 ++--- src/openvpn/tun.c | 139 +++++++------------------------------------------- src/openvpn/tun.h | 2 - 11 files changed, 30 insertions(+), 162 deletions(-)Changes.rst +0
-0
Changes.rst User-visible Changes · line 138
Quoted 4 lines
Changes.rst +1
-0@@ -135,6 +135,9 @@ User-visible Changes ciphers configured in the config file. Use --ncp-disable if you don't want that. +- ALl tun devices on all platforms are considered always IPv6 capable. The --tun-ipv6
Silly typo. (I would have done this one in-flight, hadn't it been for a few other minor things).
[...snip...]
src/openvpn/options.c add_option (struct options *options, · line 4580
Quoted 9 lines
src/openvpn/options.c +0
-1@@ -4577,7 +4569,6 @@ add_option (struct options *options,else if (streq (p[0 ],"tun-ipv6" ) && !p[1 ]) {VERIFY_PERMISSION (OPT_P_UP ); - options->tun_ipv6 = true;
Should we add a "Deprecated/NO-OP option used." message?
[...snip....]
aace2af..8a3bbba 100644
Quoted 5 lines
src/openvpn/route.c +0
-0@@ -1729,10 +1729,10 @@ add_route_ipv6 (struct route_ipv6 *r6, const struct tuntap *tt, unsigned int fla }#endif
src/openvpn/route.c add_route_ipv6 (struct route_ipv6 *r6, const struct tuntap *tt, unsigned int fla · line 1737
Quoted 10 lines
src/openvpn/route.c +3
-3-if ( !tt->ipv6 ) +if (!tt->did_ifconfig_ipv6_setup) { -msg (M_INFO ,"add_route_ipv6(): not adding %s/%d, no IPv6 on if %s" , - network, r6->netbits, device ); +msg (M_INFO ,"add_route_ipv6(): not adding %s/%d, no IPv6 ifconfig on if %s" , + network, r6->netbits, device);
Wouldn't it be nicer we said "no IPv6 address configured on interface %s" ? Just trying to be slightly more user friendly in the logs.
[...snip...]
src/openvpn/tun.c do_ifconfig (struct tuntap *tt, · line 745
Quoted 12 lines
src/openvpn/tun.c +2
-2@@ -741,8 +741,8 @@ do_ifconfig (struct tuntap *tt,argv_init (&argv); -msg (M_INFO ,"do_ifconfig, tt->ipv6=%d, tt->did_ifconfig_ipv6_setup=%d" , - tt->ipv6, tt->did_ifconfig_ipv6_setup ); +msg (M_INFO ,"do_ifconfig, tt->did_ifconfig_ipv6_setup=%d" , + tt->did_ifconfig_ipv6_setup );
While we're changing log lines ... could we make this one a bit less technical, or at least increase the verb level if we want it to be so technical? Again, just to be more user friendly
[...snip...]
src/openvpn/tun.c open_tun_generic (const char *dev, const char *dev_type, const char *dev_node, · line 1517
Quoted 7 lines
src/openvpn/tun.c +1
-1@@ -1526,7 +1513,7 @@ open_tun_generic (const char *dev, const char *dev_type, const char *dev_node,bool dynamic_opened = false; -if ( tt->ipv6 && ! ipv6_explicitly_supported ) +if ( ! ipv6_explicitly_supported )msg (M_WARN ,"NOTE: explicit support for IPv6 tun devices is not provided for this OS" );
Isn't this if() block a NOOP?
$ git grep -Hni ipv6_explicitly_supported src/openvpn/tun.c:1521: bool ipv6_explicitly_supported, bool dynamic, src/openvpn/tun.c:1529: if ( tt->ipv6 && ! ipv6_explicitly_supported )
Could we kill this as well?
[...snip...]
Quoted 9 lines
src/openvpn/tun.c +0
-5@@ -1977,53 +1940,13 @@ close_tun (struct tuntap *tt)int write_tun (struct tuntap * tt,uint8_t *buf,int len) { -if (tt->ipv6) - { -struct tun_pi pi; -struct iphdr *iph; -struct iovec vect[2 ];
src/openvpn/tun.c close_tun (struct tuntap *tt) · line 1994
Quoted 10 lines
src/openvpn/tun.c +0
-10-int ret; - - iph = (struct iphdr *)buf; - - pi.flags =0 ; - -if (iph->version ==6 ) - pi.proto =htons (OPENVPN_ETH_P_IPV6 ); -else - pi.proto =htons (OPENVPN_ETH_P_IPV4 );
whitespace issues.
[...snip...]
src/openvpn/tun.c open_tun (const char *dev, const char *dev_type, const char *dev_node, struct tu · line 5214
Quoted 11 lines
src/openvpn/tun.c +2
-3@@ -5308,11 +5208,10 @@ open_tun (const char *dev, const char *dev_type, const char *dev_node, struct tu/* usage of numeric constants is ugly, but this is really tied to * *this* version of the driver */ -if ( tt->ipv6 && tt->type ==DEV_TYPE_TUN && +if (tt->type ==DEV_TYPE_TUN && info[0 ] ==9 && info[1 ] <8 ) { -msg (M_INFO ,"WARNING: Tap-Win32 driver version %d.%d does not support IPv6 in TUN mode. IPv6 will be disabled. Upgrade to Tap-Win32 9.8 (2.2-beta3 release or later) or use TAP mode to get IPv6" , (int ) info[0 ], (int ) info[1 ] ); - tt->ipv6 = false; +msg (M_INFO ,"WARNING: Tap-Win32 driver version %d.%d does not support IPv6 in TUN mode. IPv6 will not work. Upgrade to Tap-Win32 9.8 (2.2-beta3 release or later) or use TAP mode to get IPv6" , (int ) info[0 ], (int ) info[1 ] );
Maybe we should review the contents of this log line as well? Can at least point at the latest 2.3 release instead of a beta release.
I see that a few of my comments are not directly related to removing --tun-ipv6. But I'm not convinced there's any benefit in having them in a separate patch. I'm okay with either approach.
--
kind regards,
David Sommerseth
PATCH v5 1/1 Remove tun-ipv6 Option. Instead assume that IPv6 is always supported.
This option was useful when Ipv6 tun support was non standard and was an internal/user specified flag that tracked the Ipv6 capability of the tun device.
All supported OS support IPv6. Also tun-ipv6 is pushable by the remote so not putting tun-ipv6 does not forbid ipv6 addresses.
This commit also clean up a bit of the ipv6 related tun.c. Changes for most platforms are minimal.
For linux a bit more cleanup is done:
- Remove compatibility defines that were added 2008
- Always use IFF_NO_PI for the linux tun and not only for IPv4 only tun setups (Android also always IFF_NO_PI works fine with Ipv6).
This commit also remove a non ipv6 fallback for tap driver from OpenVPN 2.2-beta or earlier and only warns.
Patch V2: Integrate Gert's comments
Patch V3: Remove tun_ipv4 option. It only used for MTU discovery and there it was wrong since it should on the transport protocol if at all Patch V4: Completely remove support for NetBSD <= 4.0 and remove NETBSD_MULTI_AF defines
Patch V5: Assume generic OS in tun.c is also IPv6 capable. Add changes to man page. Fix typos/change message as suggest by David.
--- Changes.rst | 4 ++ doc/openvpn.8 | 21 ++----- src/openvpn/forward.c | 2 +- src/openvpn/helper.c | 2 - src/openvpn/init.c | 6 -- src/openvpn/multi.c | 8 +-- src/openvpn/openvpn.h | 5 -- src/openvpn/options.c | 13 +--- src/openvpn/options.h | 1 - src/openvpn/route.c | 14 ++--- src/openvpn/tun.c | 160 +++++++++----------------------------------------- src/openvpn/tun.h | 2 - 12 files changed, 47 insertions(+), 191 deletions(-)
Changes.rst +4 -0
@@ -135,6 +135,10 @@ User-visible Changes ciphers configured in the config file. Use --ncp-disable if you don't want that. +- All tun devices on all platforms are always considered to be IPv6 + capable. The --tun-ipv6 option is ignored (behaves like it is always + on). + Maintainer-visible changes --------------------------
doc/openvpn.8 +6 -15
@@ -797,18 +797,6 @@ changes the interpretation of the arguments of to mean "address netmask", no longer "local remote". .\"********************************************************* .TP -.B \-\-tun\-ipv6 -Build a tun link capable of forwarding IPv6 traffic. -Should be used in conjunction with -.B \-\-dev tun -or -.B \-\-dev tunX. -A warning will be displayed -if no specific IPv6 TUN support for your OS has been compiled into OpenVPN. - -See below for further IPv6-related configuration options. -.\"********************************************************* -.TP .B \-\-dev\-node node Explicitly set the device node rather than using /dev/net/tun, /dev/tun, /dev/tap, etc. If OpenVPN
@@ -3600,7 +3588,7 @@ Clients that connect with options that are incompatible with those of the server will be disconnected. Options that will be compared for compatibility include -dev\-type, link\-mtu, tun\-mtu, proto, tun\-ipv6, ifconfig, +dev\-type, link\-mtu, tun\-mtu, proto, ifconfig, comp\-lzo, fragment, keydir, cipher, auth, keysize, secret, no\-replay, no\-iv, tls\-auth, key\-method, tls\-server, and tls\-client.
@@ -5870,10 +5858,13 @@ is used. .B \-\-server\-ipv6 ipv6addr/bits convenience-function to enable a number of IPv6 related options at once, namely -.B \-\-ifconfig\-ipv6, \-\-ifconfig\-ipv6\-pool, \-\-tun\-ipv6 +.B \-\-ifconfig\-ipv6, \-\-ifconfig\-ipv6\-pool and .B \-\-push tun\-ipv6 -Is only accepted if ``\-\-mode server'' or ``\-\-server'' is set. +Is only accepted if ``\-\-mode server'' or ``\-\-server'' is set. Pushing of the +.B \-\-tun\-ipv6 +directive is done for older clients which require an explicit +``\-\-tun\-ipv6'' in their configuration. .TP .B \-\-ifconfig\-ipv6\-pool ipv6addr/bits Specify an IPv6 address pool for dynamic assignment to clients. The
src/openvpn/forward.c +1 -1
@@ -391,7 +391,7 @@ check_fragment_dowork (struct context *c)struct link_socket_info *lsi =get_link_socket_info (c);/* OS MTU Hint? */ -if (lsi->mtu_changed && c->c2.ipv4_tun) +if (lsi->mtu_changed) {frame_adjust_path_mtu (&c->c2.frame_fragment, c->c2.link_socket->mtu, c->options.ce.proto);
src/openvpn/helper.c +0 -2
@@ -200,8 +200,6 @@ helper_client_server (struct options *o)add_in6_addr ( o->server_network_ipv6,0x1000 ); o->ifconfig_ipv6_pool_netbits = o->server_netbits_ipv6; - o->tun_ipv6 = true; -push_option ( o,"tun-ipv6" ,M_USAGE ); }
src/openvpn/init.c +0 -6
@@ -1400,9 +1400,6 @@ do_init_tun (struct context *c) !c->options.ifconfig_nowarn, c->c2.es); -/* flag tunnel for IPv6 config if --tun-ipv6 is set */ - c->c1.tuntap->ipv6 = c->options.tun_ipv6; -init_tun_post (c->c1.tuntap, &c->c2.frame, &c->options.tuntap_options);
@@ -1420,9 +1417,6 @@ do_open_tun (struct context *c)struct gc_arena gc =gc_new ();bool ret = false; - c->c2.ipv4_tun = (!c->options.tun_ipv6 - &&is_dev_type (c->options.dev, c->options.dev_type,"tun" )); -#ifndef TARGET_ANDROID if (!c->c1.tuntap) {
src/openvpn/multi.c +3 -5
@@ -1378,8 +1378,7 @@ multi_select_virtual_addr (struct multi_context *m, struct multi_instance *mi)* (see below) so issue a warning if that happens - don't break the * session, though, as we don't even know if this client WANTS IPv6 */ -if ( mi->context.c1.tuntap->ipv6 && - mi->context.options.ifconfig_ipv6_pool_defined && +if ( mi->context.options.ifconfig_ipv6_pool_defined && ! mi->context.options.push_ifconfig_ipv6_defined ) {msg (M_INFO ,"MULTI_sva: WARNING: if --ifconfig-push is used for IPv4, automatic IPv6 assignment from --ifconfig-ipv6-pool does not work. Use --ifconfig-ipv6-push for IPv6 then." );
@@ -1452,8 +1451,7 @@ multi_select_virtual_addr (struct multi_context *m, struct multi_instance *mi)* way round ("dynamic IPv4, static IPv6") or "both static" makes sense * -> and so it's implemented right now */ -if ( mi->context.c1.tuntap->ipv6 && - mi->context.options.push_ifconfig_ipv6_defined ) +if ( mi->context.options.push_ifconfig_ipv6_defined ) { mi->context.c2.push_ifconfig_ipv6_local = mi->context.options.push_ifconfig_ipv6_local;
@@ -1511,7 +1509,7 @@ multi_set_virtual_addr_env (struct multi_context *m, struct multi_instance *mi)setenv_del (mi->context.c2.es,"ifconfig_pool_remote_ip6" );setenv_del (mi->context.c2.es,"ifconfig_pool_ip6_netbits" ); -if (mi->context.c1.tuntap->ipv6 && mi->context.c2.push_ifconfig_ipv6_defined) +if (mi->context.c2.push_ifconfig_ipv6_defined) { setenv_in6_addr (mi->context.c2.es, "ifconfig_pool_remote",
src/openvpn/openvpn.h +0 -5
@@ -390,11 +390,6 @@ struct context_2struct buffer to_tun;struct buffer to_link; -/* -* IPv4 TUN device? -*/ -bool ipv4_tun; -/* should we print R|W|r|w to console on packet transfers? */ bool log_rw;
src/openvpn/options.c +2 -11
@@ -175,7 +175,6 @@ static const char usage_message[] =" /dev/net/tun, /dev/tun, /dev/tap, etc.\n" "--lladdr hw : Set the link layer address of the tap device.\n" "--topology t : Set --dev tun topology: 'net30', 'p2p', or 'subnet'.\n" -"--tun-ipv6 : Build tun link capable of forwarding IPv6 traffic.\n" #ifdef ENABLE_IPROUTE"--iproute cmd : Use this command instead of default " IPROUTE_PATH ".\n" #endif
@@ -1500,7 +1499,6 @@ show_settings (const struct options *o)SHOW_STR (dev_node);SHOW_STR (lladdr);SHOW_INT (topology); -SHOW_BOOL (tun_ipv6);SHOW_STR (ifconfig_local);SHOW_STR (ifconfig_remote_netmask);SHOW_BOOL (ifconfig_noexec);
@@ -2103,10 +2101,6 @@ options_postprocess_verify_ce (const struct options *options, const struct conne options->connection_list->array[0]->remote)msg (M_USAGE ,"<connection> cannot be used with --mode server" ); -#if 0 -if (options->tun_ipv6) -msg (M_USAGE ,"--tun-ipv6 cannot be used with --mode server" ); -#endif if (options->shaper)msg (M_USAGE ,"--shaper cannot be used with --mode server" );if (options->inetd)
@@ -2130,9 +2124,6 @@ options_postprocess_verify_ce (const struct options *options, const struct connemsg (M_USAGE ,"--ifconfig-pool-persist must be used with --ifconfig-pool" );if (options->ifconfig_ipv6_pool_defined && !options->ifconfig_ipv6_local )msg (M_USAGE ,"--ifconfig-ipv6-pool needs --ifconfig-ipv6" ); -if (options->ifconfig_ipv6_local && !options->tun_ipv6 ) -msg (M_INFO ,"Warning: --ifconfig-ipv6 without --tun-ipv6 will not do IPv6" ); -if (options->auth_user_pass_file)msg (M_USAGE ,"--auth-user-pass cannot be used with --mode server (it should be used on the client side only)" );if (options->ccd_exclusive && !options->client_config_dir)
@@ -3081,7 +3072,7 @@ options_string (const struct options *o,/* send tun_ipv6 only in peer2peer mode - in client/server mode, it * is usually pushed by the server, triggering a non-helpful warning */ -if (o->tun_ipv6 && o->mode ==MODE_POINT_TO_POINT && !PULL_DEFINED (o)) +if (o->ifconfig_ipv6_local && o->mode ==MODE_POINT_TO_POINT && !PULL_DEFINED (o))buf_printf (&out,",tun-ipv6" );/*
@@ -4582,7 +4573,7 @@ add_option (struct options *options,else if (streq (p[0 ],"tun-ipv6" ) && !p[1 ]) {VERIFY_PERMISSION (OPT_P_UP ); - options->tun_ipv6 = true; +msg (M_WARN ,"Note: option tun-ipv6 is ignored because modern operating systems do not need special IPv6 tun handling anymore." ); }#ifdef ENABLE_IPROUTE else if (streq (p[0], "iproute") && p[1] && !p[2])
src/openvpn/options.h +0 -1
@@ -251,7 +251,6 @@ struct optionsint ping_send_timeout;/* Send a TCP/UDP ping to remote every n seconds */ int ping_rec_timeout;/* Expect a TCP/UDP ping from remote at least once every n seconds */ bool ping_timer_remote;/* Run ping timer only if we have a remote address */ -bool tun_ipv6;/* Build tun dev that supports IPv6 */ # define PING_UNDEF 0# define PING_EXIT 1
src/openvpn/route.c +4 -10
@@ -1729,10 +1729,11 @@ add_route_ipv6 (struct route_ipv6 *r6, const struct tuntap *tt, unsigned int fla }#endif -if ( !tt->ipv6 ) +if (!tt->did_ifconfig_ipv6_setup) { -msg (M_INFO ,"add_route_ipv6(): not adding %s/%d, no IPv6 on if %s" , - network, r6->netbits, device ); +msg (M_INFO ,"add_route_ipv6(): not adding %s/%d: " +"no IPv6 address been configured on interface %s" , + network, r6->netbits, device);return ; }
@@ -2159,13 +2160,6 @@ delete_route_ipv6 (const struct route_ipv6 *r6, const struct tuntap *tt, unsigne }#endif -if ( !tt->ipv6 ) - { -msg (M_INFO ,"delete_route_ipv6(): not deleting %s/%d, no IPv6 on if %s" , - network, r6->netbits, device ); -return ; - } -msg (M_INFO ,"delete_route_ipv6(%s/%d)" , network, r6->netbits );/* if we used a gateway on "add route", we also need to specify it on
src/openvpn/tun.c +27 -133
373 lines not on this page · raw message
src/openvpn/tun.h +0 -2
@@ -139,8 +139,6 @@ struct tuntapbool did_ifconfig_ipv6_setup;bool did_ifconfig; -bool ipv6; -bool persistent_if;/* if existed before, keep on program end */ struct tuntap_options options;/* options set on command line */
Signature · 1 line
2.8.4 (Apple Git-73)
Hi,
Quoted 1 line · Arne Schwabe
Patch V5: Assume generic OS in
tun.cis also IPv6 capable. Add changes to man page. Fix typos/change message as suggest by David.
Patch still looks reasonable. Since David tested Linux, I gave NetBSD 5.1 a run for the money (other platforms have no platform-specific code that might be broken).
What can I say? This stuff works :-)
Test sets succeded: 1 1a 2 2b 2c 3 4 5.
Test sets failed: 2a.
(That I actually ran 2a is an oversight - it's the IPv4 --multihome test which I know is broken on NetBSD, unrelated to this patch)
So, throw in an ACK from me, too.
gert
Signature · 4 lines
USENET is *not* the non-clickable part of WWW!
//www.muc.de/~gert/
Gert Doering - Munich, Germany [email protected]...
fax: +49-89-35655025 [email protected]...-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
ACK. This looks good now, testing looks fine on Linux (SL7.2 x86_64) too.
I've done some editorial changes to the commit message though, nothing changed except adding and removing whitespaces and fixing a few typos (Ipv6 -> IPv6, etc).
Your patch has been applied to the master branch
commit 86e2fa5597fd1ad8e0102f134c63d6bc8cb7c291
Author: Arne Schwabe Date: Thu Oct 13 18:54:16 2016 +0200
Remove tun-ipv6 Option. Instead assume that IPv6 is always supported.
Signed-off-by: Arne Schwabe <[email protected]...>
Acked-by: David Sommerseth <[email protected]...>
Acked-by: Gert Doering <[email protected]...>
Message-Id: <[email protected]...>
URL: https://www.mail-archive.com/[email protected]/msg12695.html
Signed-off-by: David Sommerseth <[email protected]...>- --
kind regards,
David Sommerseth
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
iQIcBAEBAgAGBQJYANQOAAoJEIbPlEyWcf3ye88P/RFci2mayFPpS9pnrXt7A8yT YXdp99eWH2gvKZNFaC4yg3FQyjeZ0pZBYHU+DHkyZjbWFtX7ctXGioiy7gw+tkgu UzU6ZUNWPb8c1lmMdftGS2Xgo8IrRaGLbfnVG1NJBK30xPRwc9qplss4qo+LVeU6 92f8477tbM+b1qpD1UP+2yTqubvhmPcPecS1w9qCW48T96friWWDZNx2FEjaee/k 37Xnc3Vqr9ae/uw2tLSt4yfMcC9gT2Gm9D3DehiW3d/VP/qlRGQwBtEmUmXYJbXe 62sD7kVDXAAmidrsFTI6+uo/ubZW8vVTwEYYRcf1GuUsMAlqxYWevuX2ONGSL4Hv 1LnU9ePv1IBno5IRLn5iWube+Ij7SLIZk+NpUx1c37yuawiqz/rYz/rozscGm7P0 W6fv+f2HzdCGxxI4ZMhKUsdnvWkKv6eAa7ce+uCYMUwwI5s8NtS9bOLy2RSdlbmS rxk88xpeKajgSOy3WVJArBStbp1pj1h4AVqZ8gKFnUBYIbMEz+uAsExB5D/x6Snk aE9a6Au2d1DDVNoAVAKMrLts9DI7P0LXq7Us7hwZJeDXJKTQlqLgzPoEyvcd3Hj5 GsHVuEBKk+Rlgy3sc9ocgHQNtq8wU09talsyVDwaaEF+TDGyV5XJyba91qKTMr+G fM/+WSOWHghUA9txU8AG
=zsQ8
-----END PGP SIGNATURE-----