The BN_bn2dec() can return NULL if the input is not parseable.
This would cause the conversion of char* to std::string to throw
an exception. Instead check the result and return an empty string
on errors.
Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com>
This causes only warnings with -Wpedantic, which we don't
intend to use. But doesn't hurt to fix anyway.
Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com>
- Set CXX_STANDARD_REQUIRED ON so that we error out early
if CMake thinks that the compiler does not support the
used standard.
- Set CXX_EXTENSIONS OFF so that we get less compiler
specific behavior.
Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com>
Using the <max> argument to cmake_minimum_required will
set all policies up to <max> to NEW. We might need to
fix some issues arising from that, but this means that
modern CMake can already behave like it wants even with
leaving <min> so that we can support old distros (currently
Debian 10).
Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com>
On modern CMake this gets us swig dependency management,
which should reduce problems for incremental builds.
Also it is just cleaner.
Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com>
Fixed one issue while at it, with parse() not clearing
the username and password arguments.
The general issue that overflow doesn't throw is reflected in
a disabled test. This will need to be fixed in SplitLines,
probably.
Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com>
This really has very different implications than the
others overloads. So make it distinct.
I would also rename the others to parse_opt, but feel
that causes too much churn in the code. parse_file has
only one use in our own code base.
Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com>
This adds two routines:
AWS::Route::create_route_table
This creates route table in given VPC and
assigns "Name" tag to it with provided value.
AWS::Route::get_route_table_by_name
This searches for route table with given "Name"
tag and either returns route table id or empty string
if route table doesn't exist.
These routines are used by Linux client AWS addon.
Signed-off-by: Lev Stipakov <lev@openvpn.net>
Also this is a very rare option to be used today as it was for compatibility
with OpenVPN 1.x we should still not error out when it is present.
Signed-off-by: Arne Schwabe <arne@openvpn.net>
-- Instantiate the PsidCookieImpl and spot check it's correctness
-- Check for client replies within and outside of the allowable time
window
Signed-off-by: Mark Deric <jmark@openvpn.net>
Makes it easier to test with -Wconversion, e.g. in Jenkins.
For now disable -Wsign-conversion. That is the default in g++,
but not clang++. Once we have fixed all -Wsign-conversion
warnings, we can enable it for both.
For now disable -Wenum-enum-conversion. Only present in clang++.
Not clear whether cleaning those up will be worth the effort.
Disable -ferror-limit in clang++. This ensures that it always
displays all errors.
Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com>
Conversion fixes:
-- use the protocol op field as a byte, not an int
-- fix the valid time hmac component calculation to avoid implicit
64-to-32 narrowing.
Signed-off-by: Mark Deric <jmark@openvpn.net>
The intent of the offset argument to the calculate_session_id_hmac()
function was to allow the server to accept hmac values calculated for
the previous time interval even as the server's clock moved into a new
time interval.
The bug was that the implementation checked for a match with the
server's current time interval and its _future_ time interval, and not
it's immediate past time interval.
This bug was pointed out during code review by Frank Lichtenheld. The
code review subject was numeric conversions, in this case signed vs
unsigned. This author changed the offset to unsigned, arguing that the
code would never need to check the client hmac cookie based on both
sides of the server's current time. The check only needed to be in
one direction, hence unsigned was the solution to the conversion
warning. That was when Frank pointed out that implementation with the
"+ offset" snippet checked to see if the client provided a psid from
the future time interval and what was needed was to check for the past
interval, i.e., "- offset".
Hence, the change implements the unsigned offset, change add to
subtract from the time range computed for the server's currrent time
window.
Signed-off-by: Mark Deric <jmark@openvpn.net>
-- disambiguate new_obj(): new_man_obj(), new_tun_obj
-- remove obfuscatory typedef <class> Base; use <class>
-- in servproto.hpp typedef ProtoContext::ProtoConfig to ProtoConfig
since Arne's already disambiguated Config
-- disambiguate Link<>: TCPLink<>, UDPLink<>
Added TODO comment on unneeded version of control_net_recv()
Signed-off-by: Mark Deric <jmark@openvpn.net>
When setting IP address with "gateway" option,
Windows by some reasons creates 0.0.0.0/0 route
which we later remove. However for a few seconds
while this route exists it might interfer with routing.
To work around that, we initially set tun interface metric to
very high, which makes Windows create a rougue route with
high metric. After a few seconds we delete that route and
set metric to a lowest value.
Fixes https://github.com/OpenVPN/openvpn3/issues/281
Signed-off-by: Lev Stipakov <lev@openvpn.net>
Instead of magic constant say what we want to say.
So that randrange also produces the correct output
type.
Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com>
For some reason RouteBase uses unsigned char for prefix_length
while all other code uses int or unsigned int. For now just
cast it, prefix_length should be <= 128 anyway.
Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com>
The psid cookie defense is designed to thwart resource exhaustion and
amplification attacks wherein a malicious client sends the server a
flood of CONTROL_HARD_RESET_CLIENT_V2 packets with spooofed source
addresses. This patch allows the server to defer client tracking
state creation until the client responds to the server's
CONTROL_HARD_RESET_SERVER_V2 message.
Signed-off-by: Mark Deric <jmark@openvpn.net>
