Skip to contentSkip to conversation

Make block-outside-dns work with persist-tun

PATCH In review Selva Nair 2 participants 5 messages Jun 4, 2016 – Jun 5, 2016

lore
Share & tools
lore

Selva Nair

author
#0 lore raw

PATCH 1/1 Make block-outside-dns work with persist-tun

- Remove and recreate WFP filters during restart even when tun/tap is not re-opened. This is needed for resolving the remote.

See also: http://article.gmane.org/gmane.network.openvpn.user/36990

Signed-off-by Selva Nair <[email protected]...>
---
 src/openvpn/init.c |   18 ++++++++++++++++++
 1 file changed, 18 insertions(+)
src/openvpn/init.c +18 -0
index 2148777..593fbf4 100644
@@ -1522,6 +1522,15 @@ do_open_tun (struct context *c)
 		     NULL,
 		     "up",
 		     c->c2.es);
+#if defined(WIN32)
+      if (c->options.block_outside_dns)
+        {
+          dmsg (D_LOW, "Blocking outside DNS");
+          if (!win_wfp_block_dns(c->c1.tuntap->adapter_index))
+            msg (M_FATAL, "Blocking DNS failed!");
+        }
+#endif
+
     }
   gc_free (&gc);
   return ret;

@@ -1651,6 +1660,15 @@ do_close_tun (struct context *c, bool force)
 					     c->sig->signal_text),
 			 "down",
 			 c->c2.es);
+
+#if defined(WIN32)
+          if (c->options.block_outside_dns)
+            {
+              if (!win_wfp_uninit())
+                  msg (M_FATAL, "Uninitialising WFP failed!");
+            }
+#endif
+
 	}
     }
   gc_free (&gc);
Signature · 1 line
1.7.10.4
author
#1 lore raw

PATCH 1/1 Make block-outside-dns work with persist-tun

- Remove and recreate WFP filters during restart even when tun/tap is not re-opened. This is needed for resolving the remote. Patch same as for v2.3 except for passing 'msg_channel'.

See also: http://article.gmane.org/gmane.network.openvpn.user/36990

Signed-off-by Selva Nair <[email protected]...>
---
 src/openvpn/init.c |   18 ++++++++++++++++++
 1 file changed, 18 insertions(+)
src/openvpn/init.c +18 -0
index 42baf97..fb45bc1 100644
@@ -1556,6 +1556,15 @@ do_open_tun (struct context *c)
 		     NULL,
 		     "up",
 		     c->c2.es);
+#if defined(WIN32)
+      if (c->options.block_outside_dns)
+        {
+          dmsg (D_LOW, "Blocking outside DNS");
+          if (!win_wfp_block_dns(c->c1.tuntap->adapter_index, c->options.msg_channel))
+            msg (M_FATAL, "Blocking DNS failed!");
+        }
+#endif
+
     }
 #endif
   gc_free (&gc);

@@ -1686,6 +1695,15 @@ do_close_tun (struct context *c, bool force)
 					     c->sig->signal_text),
 			 "down",
 			 c->c2.es);
+
+#if defined(WIN32)
+          if (c->options.block_outside_dns)
+            {
+              if (!win_wfp_uninit(c->options.msg_channel))
+                  msg (M_FATAL, "Uninitialising WFP failed!");
+            }
+#endif
+
 	}
     }
   gc_free (&gc);
Signature · 1 line
1.7.10.4
#2 lore raw

Hi,

Quoted 18 lines · Selva Nair

- Remove and recreate WFP filters during restart even when tun/tap is not re-opened. This is needed for resolving the remote. Patch same as for v2.3 except for passing 'msg_channel'.

See also: http://article.gmane.org/gmane.network.openvpn.user/36990

Signed-off-by Selva Nair <[email protected]...>
---
 src/openvpn/init.c |   18 ++++++++++++++++++
 1 file changed, 18 insertions(+)
src/openvpn/init.c +0 -0
index 42baf97..fb45bc1 100644
@@ -1556,6 +1556,15 @@ do_open_tun (struct context *c)
 		     NULL,
 		     "up",

src/openvpn/init.c do_open_tun (struct context *c) · line 1567

Quoted 10 lines
src/openvpn/init.c +9 -0
 		     c->c2.es);
+#if defined(WIN32)
+      if (c->options.block_outside_dns)
+        {
+          dmsg (D_LOW, "Blocking outside DNS");
+          if (!win_wfp_block_dns(c->c1.tuntap->adapter_index, c->options.msg_channel))
+            msg (M_FATAL, "Blocking DNS failed!");
+        }
+#endif
+

I understand why this is needed, but the code is getting increasingly ugly here, with the else { } branch duplicating more and more code lines of the if () part (run_up_down(), win_wfp_block_nds())...

Looking at it, I think the patch itself is perfectly fine (so I'll apply later on) and not to blame for this - but for master at least, we might consider some refactoring here...

gert

Signature · 4 lines
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             [email protected]...
fax: +49-89-35655025                        [email protected]...
#3 lore raw
In reply to Selva Nair

Your patch has been applied to the master branch.

commit 451d2177d762e93677cad52bb2360a8dfb389ac7

Author: Selva Nair
Date:   Sat Jun 4 11:57:13 2016 -0400
     Make block-outside-dns work with persist-tun

     Signed-off-by: Selva Nair <[email protected]...>
     Acked-by: Gert Doering <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/11788
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering

#4 lore raw
In reply to Selva Nair

ACK. Same thing as for the master patch - fixes an obvious issue :-)

Your patch has been applied to the release/2.3 branch.

commit 1aa9d281052d45f20aaa9ff28255d19faee88eb9

Author: Selva Nair
Date:   Sat Jun 4 11:54:08 2016 -0400
     Make block-outside-dns work with persist-tun

     Signed-off-by: Selva Nair <[email protected]...>
     Acked-by: Gert Doering <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/11787
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering