1
0
mirror of https://github.com/SoftEtherVPN/SoftEtherVPN.git synced 2024-11-09 19:20:41 +03:00
Commit Graph

891 Commits

Author SHA1 Message Date
Koichiro IWAO
b4817fd27a hamdore(ja): translate OpenVPN timeout and ping transmission interval 2021-06-06 23:35:46 +09:00
Koichiro IWAO
89ca29f259 hamcore(ja): translate WireGuard log messages 2021-06-06 23:35:46 +09:00
Koichiro IWAO
7a208d6114 hamcore(ja): translate SetStaticNetwork command 2021-06-06 23:35:45 +09:00
Koichiro IWAO
5b910322a7 hamcore(ja): translate Wgk* commands 2021-06-06 23:35:45 +09:00
Davide Beatrici
2923b5500a Mayaqua/FileIO: Fix typo causing segmentation fault on Hamcore cache expiration 2021-05-26 20:46:21 +02:00
domosekai
8c12e79448 Cedar/Proto_PPP: Fix EAP identifier duplication 2021-05-26 09:26:22 +00:00
Davide Beatrici
81c71d309a Read hamcore.se2 using libhamcore, set arbitrary path through HAMCORE_FILE_PATH 2021-05-26 07:44:45 +02:00
Davide Beatrici
e0182ca3d9 src: Update "libhamcore" submodule 2021-05-26 04:18:08 +02:00
sl077
f9a1d72ce7 Fix IPv6 Neighbor Discovery for PPP based protocols 2021-05-09 13:55:31 +02:00
Davide Beatrici
2f801f30de Fix compile errors on OpenBSD
- <pthread.h> included for the "pthread_t" type definition.
- <net/ethernet.h> include removed as the header doesn't exist.
- AI_ALL and AI_V4MAPPED defined to 0 as the options don't exist.
2021-05-03 19:58:12 +02:00
dependabot[bot]
515d823ef8
Bump ssri from 6.0.1 to 6.0.2 in /src/bin/hamcore/wwwroot/admin/default
Bumps [ssri](https://github.com/npm/ssri) from 6.0.1 to 6.0.2.
- [Release notes](https://github.com/npm/ssri/releases)
- [Changelog](https://github.com/npm/ssri/blob/v6.0.2/CHANGELOG.md)
- [Commits](https://github.com/npm/ssri/compare/v6.0.1...v6.0.2)

Signed-off-by: dependabot[bot] <support@github.com>
2021-04-29 19:34:47 +00:00
domosekai
c20bcb2e60 Mayaqua/Network: Skip IPv6 nameservers for SecureNAT 2021-04-27 07:30:38 +00:00
Ilya Shipitsin
cf318d7219 src/Mayaqua/TcpIp.c: remove redundant condition
src/Mayaqua/TcpIp.c	4236	warn	V560 A part of conditional expression is always true: o2 == NULL.
2021-04-24 12:47:29 +05:00
Davide Beatrici
285e322171
Merge PR #1337: Cedar/IPC: Fix MAC address for IPv4 multicast 2021-04-24 04:01:58 +02:00
domosekai
cca769e2e6 Cedar/IPC: Fix MAC address for IPv4 multicast 2021-04-24 01:46:31 +00:00
Ilya Shipitsin
92f41341d9 src/Mayaqua/TcpIp.c: remove redundant check
src/Mayaqua/TcpIp.c	1811	warn	V560 A part of conditional expression is always false: udp->Checksum == 0.
2021-04-23 15:39:11 +05:00
Davide Beatrici
3a595b4a46 Mayaqua/DNS.c: Fix memory leaks
52 bytes in 2 blocks are definitely lost in loss record 5 of 13
   at 0x483877F: malloc (vg_replace_malloc.c:307)
   by 0x4ABB1BB: UnixMemoryAlloc (Unix.c:2033)
   by 0x4A7FABF: InternalMalloc (Memory.c:3819)
   by 0x4A7B769: MallocEx (Memory.c:3650)
   by 0x4A7B769: Malloc (Memory.c:3641)
   by 0x4AA71A9: CopyStr (Str.c:1884)
   by 0x4A61A9C: DnsCacheReverseUpdate (DNS.c:257)
   by 0x4A62123: DnsResolveReverse (DNS.c:506)
   by 0x4A93EB3: GetHostName (Network.c:15023)
   by 0x4A93EB3: AcceptInitEx (Network.c:12589)
   by 0x4934659: TCPAcceptedThread (Listener.c:172)
   by 0x4A76469: ThreadPoolProc (Kernel.c:872)
   by 0x4ABD159: UnixDefaultThreadProc (Unix.c:1589)
   by 0x51C2EA6: start_thread (pthread_create.c:477)

2,280 (684 direct, 1,596 indirect) bytes in 9 blocks are definitely lost in loss record 11 of 13
   at 0x483877F: malloc (vg_replace_malloc.c:307)
   by 0x4C65AC5: gaih_inet.constprop.0 (getaddrinfo.c:1058)
   by 0x4C67224: getaddrinfo (getaddrinfo.c:2256)
   by 0x4A61E06: DnsResolver (DNS.c:404)
   by 0x4A76469: ThreadPoolProc (Kernel.c:872)
   by 0x4ABD159: UnixDefaultThreadProc (Unix.c:1589)
   by 0x51C2EA6: start_thread (pthread_create.c:477)
   by 0x4C7CDEE: clone (clone.S:95)
2021-04-21 22:35:45 +02:00
Davide Beatrici
2aaf9012a0 Cedar/Proto_OpenVPN: Make timeout and ping transmission interval configurable
Also, the default timeout value is set to 30000 (milliseconds) instead of 10000.

The change is made because it was reported that some routers failed to connect in time.
2021-04-21 08:29:30 +02:00
Davide Beatrici
4b05de1a93 Cedar: Add support for 32 bit unsigned integer Proto options
This commit also fixes a bug which caused the server to initialize all boolean options to false.

It was caused by SiLoadProtoCfg() not checking whether the item exists in the configuration file.

CfgGetBool() always returns false if the item doesn't exist.
2021-04-21 08:12:45 +02:00
Davide Beatrici
0472f9c286 Rewrite DNS API from scratch into dedicated file(s)
From a functional point of view, the main improvement is that GetIP() now always prioritizes IPv6 over IPv4.
The previous implementation always returned an IPv4 address, unless not available: in such case it failed.
This means that now connections to hostnames should be established via IPv6 if available.

From a programmer point of view, getting rid of the insane wrappers is enough to justify a complete rewrite.

As an extra, several unrelated unused global variables are removed.
2021-04-18 01:46:59 +02:00
Davide Beatrici
d4d15b66d3 Cedar: Make use of IP address reported by NAT-T server for UDP acceleration
Before this commit, the IP address reported by the NAT-T server was immediately discarded.
That's because the peer should be accessible via the IP address used to establish the TCP connection.

User "domosekai" (https://www.domosekai.com) pointed out that the NAT-T IP address should be taken into account.
In his case it's required due to his broadband carrier's NAT causing TCP and UDP to have different external IPs.

Co-authored-by: domosekai <54519668+domosekai@users.noreply.github.com>
2021-04-14 19:49:30 +02:00
Davide Beatrici
1708998a11 Change IP structure so that IPv4 addresses are stored in RFC3493 format
In addition to saving 4 bytes for each instantiation, this change makes IP-related operations faster and clearer.

https://tools.ietf.org/html/rfc3493.html#section-3.7
2021-04-07 21:24:55 +02:00
Davide Beatrici
a6ba9b8788 Include headers properly 2021-04-05 04:48:25 +02:00
Ilya Shipitsin
46b54f00be
Merge pull request #1318 from davidebeatrici/minimum-version-windows-vista
Cedar, Mayaqua: Set minimum Windows version to Vista
2021-04-03 22:02:50 +05:00
Davide Beatrici
5cab279a8c Cedar, Mayaqua: Set minimum Windows version to Vista 2021-04-03 02:25:19 +02:00
Davide Beatrici
84588095d5 Mayaqua/Network.c: Always use fcntl() to toggle socket non-blocking mode (UNIX)
O_NONBLOCK is standardized by POSIX, as opposed to FIONBIO.

This commit also fixes a bug: fcntl() was only called to disable the mode.
2021-04-01 08:04:27 +02:00
dependabot[bot]
ed6013affc
Bump y18n from 4.0.0 to 4.0.1 in /src/bin/hamcore/wwwroot/admin/default
Bumps [y18n](https://github.com/yargs/y18n) from 4.0.0 to 4.0.1.
- [Release notes](https://github.com/yargs/y18n/releases)
- [Changelog](https://github.com/yargs/y18n/blob/master/CHANGELOG.md)
- [Commits](https://github.com/yargs/y18n/commits)

Signed-off-by: dependabot[bot] <support@github.com>
2021-03-30 18:00:59 +00:00
Davide Beatrici
4db6247b80 Merge Windows manifest files into a single one 2021-03-27 00:33:20 +01:00
domosekai
934e49fea0 Mayaqua/Network.c: Fix UDP send error when used with reverse proxy 2021-03-23 11:59:23 +00:00
David Refoua
808f081e3a
update install dependencies (libsodium) 2021-03-13 05:45:30 +03:30
Davide Beatrici
9d29d8813b New vpndrvinst implementation, independent from Cedar and Mayaqua
This greatly improves performance and reduces the binary's size (~0.2 MB vs ~5 MB).

All recent Windows versions are supported, starting with Vista.

No dialogs are created, aside from error/warning ones in case of failure.

The only dependency (aside from Windows libraries) is libhamcore.
2021-03-12 05:46:20 +01:00
Davide Beatrici
68367fa2fb hamcore: Restore warning_*.txt files
They were accidentally removed in 8e2616ef7d.
2021-03-11 20:15:20 +01:00
Davide Beatrici
68574e9af9 hamcorebuilder: Use libhamcore to build archive
https://github.com/SoftEtherVPN/libhamcore
2021-03-10 02:13:00 +01:00
dependabot[bot]
9e7f26395a
Bump elliptic in /src/bin/hamcore/wwwroot/admin/default
Bumps [elliptic](https://github.com/indutny/elliptic) from 6.5.3 to 6.5.4.
- [Release notes](https://github.com/indutny/elliptic/releases)
- [Commits](https://github.com/indutny/elliptic/compare/v6.5.3...v6.5.4)

Signed-off-by: dependabot[bot] <support@github.com>
2021-03-09 08:28:13 +00:00
Davide Beatrici
2d82d84fd5 CMake: Fix regular expression for BLAKE2 SSE2 source files selection
The comparison was being made against the variable's name instead of its value, causing the result to always be true.
For reference: https://cmake.org/cmake/help/v3.10/manual/cmake-generator-expressions.7.html#genex:BOOL

In addition to that, this commit also fixes the source file name of the non-SSE2 code.
2021-03-01 23:24:34 +01:00
Davide Beatrici
65483499bf Cedar/WinUi.c: Remove reference to "vpncmd_x64.exe" and "vpncmd_ia64.exe"
It was missed in a3eb115b0a.
2021-03-01 04:27:43 +01:00
Davide Beatrici
3d69a71d9b
Merge PR #1200: Implement support for WireGuard 2021-03-01 03:59:35 +01:00
Davide Beatrici
b6b692046c Cedar/CMInner.h: Fix wrong signature for CmPolicyDlgPrintEx2() 2021-03-01 03:01:34 +01:00
Davide Beatrici
56a19d7651 Cedar/Win32Com.cpp: Fix wrong signature for SetupCopyOEMInfW() and SetupUninstallOEMInfW()
https://docs.microsoft.com/en-us/windows/win32/api/setupapi/nf-setupapi-setupcopyoeminfw
https://docs.microsoft.com/en-us/windows/win32/api/setupapi/nf-setupapi-setupuninstalloeminfw
2021-03-01 03:01:34 +01:00
Davide Beatrici
2078a069de Cedar/Hub: Properly set value for hub admin options
Same deal as with the previous commit: worked fine as long as bool was 4-bytes wide.
2021-03-01 03:01:34 +01:00
Davide Beatrici
562ffe8945 Mayaqua/Pack: Fix PackGetStrSize() and PackGetStrSizeEx()'s return data type
The bug caused ProtoOptionsGet and ProtoOptionsSet not to work anymore after c90617e0e86dedf78e0e3c8a71263a80eec29caa.

The functions were introduced in aa65327e73, but the issue went unnoticed because bool was the same as UINT.
2021-03-01 03:01:34 +01:00
Davide Beatrici
914bfe7d44 Use bool from stdbool.h, get rid of BOOL
BOOL was just an alias for bool, this commit replaces all instances of it for consistency.

For some reason bool was defined as a 4-byte integer instead of a 1-byte one, presumably to match WinAPI's definition: https://docs.microsoft.com/en-us/windows/win32/winprog/windows-data-types
Nothing should break now that bool is 1-byte, as no protocol code appears to be relying on the size of the data type.
PACK, for example, explicitly stores boolean values as 4-byte integers.

This commit can be seen as a follow-up to 61ccaed4f6.
2021-03-01 03:01:34 +01:00
Davide Beatrici
ef24ff74c8 Cedar/Admin.c: Restrict StGetProtoOptions() access to server administrators
This is in order to protect the WireGuard private key.
2021-03-01 02:49:59 +01:00
Davide Beatrici
a8580458c4 Cedar/Command: Add WgkAdd, WgkDelete and WgkEnum commands
WgkAdd command - Add a WireGuard key
Help for command "WgkAdd"

Purpose:
  Add a WireGuard key

Description:
  This command can be used to add a WireGuard key to the allowed key list.
  To execute this command, you must have VPN Server administrator privileges.

Usage:
  WgkAdd [key] [/HUB:hub] [/USER:user]

Parameters:
  key   - WireGuard key. Make sure it is the public one!
  /HUB  - Hub the key will be associated to.
  /USER - User the key will be associated to, in the specified hub.

================================================================================

WgkDelete command - Delete a WireGuard key
Help for command "WgkDelete"

Purpose:
  Delete a WireGuard key

Description:
  This command can be used to delete a WireGuard key from the allowed key list.
  To execute this command, you must have VPN Server administrator privileges.

Usage:
  WgkDelete [key]

Parameters:
  key - WireGuard key.

================================================================================

WgkEnum command - List the WireGuard keys
Help for command "WgkEnum"

Purpose:
  List the WireGuard keys

Description:
  This command retrieves the WireGuard keys that are allowed to connect to the server, along with the associated Virtual Hub and user.
  You can add a key with the WgkAdd command.
  You can delete a key with the WgkDelete command.
  To execute this command, you must have VPN Server administrator privileges.

Usage:
  WgkEnum
2021-03-01 02:49:59 +01:00
Davide Beatrici
6115f1c713 Cedar/Admin: Implement RPC methods to add/delete/list WireGuard keys 2021-03-01 02:49:59 +01:00
Davide Beatrici
dd1eebdbed Cedar: Implement support for WireGuard
Please note that the implementation is not 100% conformant to the protocol whitepaper (https://www.wireguard.com/papers/wireguard.pdf).
More specifically: all peers are expected to send a handshake initiation once the current keypair is about to expire or is expired.
I decided not to do that because our implementation is meant to act as a server only. A true WireGuard peer acts, instead, as both a client and a server.
Once the keypair is expired, we immediately delete the session.

The cookie mechanism can be implemented in future.

As for authentication: unfortunately using the already existing methods is not possible due to the protocol not providing a way to send strings to a peer.
That's because WireGuard doesn't have a concept of "users": it identifies a peer through the public key, which is determined using the source address.
As a solution, this commit adds a special authentication method: once we receive the handshake initiation message and decrypt the peer's public key, we check whether it's in the allowed key list.
If it is, we retrieve the associated Virtual Hub and user; if the hub exists and the user is in it, the authentication is successful.

The allowed key list is stored in the configuration file like this:

declare WireGuardKeyList
{
	declare 96oA7iMvjn7oXiG3ghBDPaSUytT75uXceLV+Fx3XMlM=
	{
		string Hub DEFAULT
		string User user
	}
}
2021-03-01 02:49:59 +01:00
Davide Beatrici
8495388933 Cedar/IPC: Remove unused "UserName" and "Password" variables and assignment code
This commit also removes "HubName"'s first assignment, because the value is retrieved from PACK later (identifier: "IpcHubName").
2021-03-01 02:49:59 +01:00
Davide Beatrici
afe576dcdc Cedar: Add "DefaultGateway" and "DefaultSubnet" virtual hub options
WireGuard does not provide any configuration messages, meaning that we cannot push the IP address we receive from the DHCP server to the client.

In order to overcome the limitation we don't perform any DHCP operations and instead just extract the source IP address from the first IPv4 packet we receive in the tunnel.

The gateway address and the subnet mask can be set using the new "SetStaticNetwork" command. The values can be retrieved using "OptionsGet".

In future we will add a "allowed source IP addresses" function, similar to what the original WireGuard implementation provides.

================================================================================

SetStaticNetwork command - Set Virtual Hub static IPv4 network parameters
Help for command "SetStaticNetwork"

Purpose:
  Set Virtual Hub static IPv4 network parameters

Description:
  Set the static IPv4 network parameters for the Virtual Hub. They are used when DHCP is not available (e.g. WireGuard sessions).
  You can get the current settings by using the OptionsGet command.

Usage:
  SetStaticNetwork [/GATEWAY:gateway] [/SUBNET:subnet]

Parameters:
  /GATEWAY - Specify the IP address of the gateway that will be used for internet communication.
  /SUBNET  - Specify the subnet mask, required to determine the size of the local VPN network.
2021-03-01 02:49:59 +01:00
Davide Beatrici
decfcecc97 Cedar: Add ProtoOptionString() in PROTO_IMPL, to generate default option values
The WireGuard implementation will have two options that should not have a fixed default value, because they represent two keys (one is preshared, the other is private).

Instead of handling these two options differently in ProtoNewContainer(), this commit adds a new function to PROTO_IMPL: ProtoOptionString().

ProtoOptionString() takes the option's name as argument and returns a heap-allocated string that will be used as value. The function returns NULL when the option doesn't need a randomized value.
2021-03-01 02:49:59 +01:00
Davide Beatrici
d8aa470192 Cedar: Improve IsPacketForMe()'s "data" argumment in PROTO_IMPL
This allows a protocol implementation to implicitly cast the variable to the type it prefers.
2021-03-01 02:49:59 +01:00