1
0
mirror of https://github.com/SoftEtherVPN/SoftEtherVPN.git synced 2025-07-07 16:25:01 +03:00
Commit Graph

74 Commits

Author SHA1 Message Date
f4bbe476be Fix Vulnerability: CVE-2023-32275 TALOS-2023-1753
SoftEther VPN CtEnumCa () information disclosure vulnerability
https://www.softether.org/9-about/News/904-SEVPN202301
https://jvn.jp/en/jp/JVN64316789/
2023-10-07 04:42:41 +02:00
b3afbe37e9 Load legacy provider under OpenSSL 3.0 2022-04-26 22:00:15 +08:00
2d1c8765aa Merge pull request #1433 from domosekai/chain
Support user-specified server trust chain
2021-11-25 17:15:53 +08:00
ee3bf7f507 fix compilation without OpenSSL engines
Signed-off-by: Rosen Penev <rosenp@gmail.com>
2021-08-07 20:05:04 -07:00
2761c1ca42 Support user-specified server trust chain 2021-07-21 07:02:42 +00:00
a6ba9b8788 Include headers properly 2021-04-05 04:48:25 +02:00
2e0c24f6c8 Add english translation to each language for openssl engine auth 2020-10-09 10:22:23 +02:00
d1ad4196bb Change from unix only implementation to all os and skip ENGINE_load_dynamic if oss is 1.1.0 or later 2020-10-09 09:58:34 +02:00
20b84f3928 Change openssl version checking to api compat 2020-10-09 04:58:25 +02:00
dec532a8eb Increase required openssl version for openssl engines implementation 2020-10-09 03:32:53 +02:00
ff3910eb86 Openssl engine certificate authentication
TODO cert get, call finish engine, call init engine in another step, handle authentication, internatiolazion (help is needed)
2020-10-09 02:56:51 +02:00
bf4667cfce Fix several compile warnings on MS VC++ 2008. 2019-08-04 10:35:16 +09:00
d57fc3524c Fix LibreSSL support
My previous patch used a wrong if directive, which disabled removed
(de)initialization and threading for LibreSSL. This most likely causes
issues at runtime.
2019-07-22 11:35:19 -07:00
a9f707c813 Switch to OpenSSL THREADID API
The old threading API was deprecated in OpenSSL 1.0.
2019-07-22 11:28:12 -07:00
1bd39485cf Mayaqua: Fix compilation without deprecated OpenSSL APIs
Initialization and deinitialization are deprecated.

Missing headers were added.

Explicit threading is also deprecated.
2019-07-11 12:42:26 -07:00
98443715d9 Fixed the vulnerability that a malformed packet will cause the buffer overflow at the receive path. This vulnerability may occur abnormal process exit with the buffer security check mechanism built-in with SoftEther VPN binary. Although this buffer overflow can theoretically bypass the security check in theory, in the actual binary it is detected by the buffer security check inserted by the C compiler and the process is forcibly terminated. Therefore, as a result, it can be abused by a DoS attacker. Acknowledgments: The last problems is discovered and reported by Fabrizio Steiner. 2019-02-28 20:40:23 +09:00
vvd
372e8aa031 Fixed memory leak in OpenSSL deinitialization function 2019-02-27 21:41:20 +01:00
26261236ba Fix compilation without OpenSSL ENGINE 2019-02-25 14:24:31 -08:00
881f34ac56 Compacting headers, updating trivial texts to fit to the license change from GPLv2 to Apache License 2.0. 2019-01-14 12:25:53 +09:00
c407f35322 SHA-0 Implementation replacement from GPLv3 to Apache License 2018-12-02 10:30:22 +09:00
aae9ec0492 Mayaqua/Encrypt: add CipherProcessAead() function to encrypt/decrypt with AEAD ciphers 2018-11-03 15:14:56 +01:00
5e75a1fb99 src/Mayaqua/Encrypt.c: fix memory leak occasionally found by valgrind 2018-10-29 10:52:56 +05:00
ec09309aa8 gitlab-ci: enable ubuntu 12.04 builds 2018-10-12 01:03:12 +05:00
53c8abfd80 Encrypt.c: fix MdProcess()'s HMAC implementation 2018-09-27 20:28:48 +02:00
50b42070e2 Encrypt: reorder digest functions 2018-09-22 06:47:03 +02:00
3f5f716357 Revamp digest functions
- Hash() has been removed because it was ambiguous, Md5() and Sha0() are proper replacements.
- HMacMd5() and HMacSha1() now share a common implementation handled by the new Internal_HMac() function.
- NewMd() and MdProcess() now support plain hashing (without the key).
- NewMd(), SetMdKey() and MdProcess() now check the OpenSSL functions' return value and in case of failure a debug message is printed along with the error string, if available.
- SetMdKey()'s return value has been changed from void to bool, so that it's possible to know whether the function succeeded or not.
- MdProcess()' return value has been changed from void to UINT (unsigned int) and the function now returns the number of bytes written by HMAC_Final() or EVP_DigestFinal_ex().
2018-09-22 06:36:09 +02:00
d6c8231ff0 Mayaqua/Encrypt.c: fix invalid features.aes for mips, ppc
* fix invalid features.aes for mips, ppc

Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>
2018-08-13 16:23:54 +02:00
c9b56bf590 Merge PR #639: Encrypt: support NULL message digest 2018-08-12 12:19:30 +02:00
3d13f56314 Encrypt: support NULL message digest 2018-08-12 01:53:30 +02:00
9bac21b52e Encrypt.c: add warning for when EVP_get_cipherbyname() fails 2018-08-12 01:09:10 +02:00
4da4fbeca0 Encrypt.c: don't use deprecated OpenSSL functions
/builds/SoftEther/SoftEtherVPN/src/Mayaqua/Encrypt.c: In function 'RsaCheck':
/builds/SoftEther/SoftEtherVPN/src/Mayaqua/Encrypt.c:2307:3: warning: 'RSA_generate_key' is deprecated [-Wdeprecated-declarations]
   rsa = RSA_generate_key(bit, RSA_F4, NULL, NULL);
   ^~~
In file included from /usr/include/openssl/rsa.h:13:0,
                 from /usr/include/openssl/x509.h:31,
                 from /usr/include/openssl/ssl.h:50,
                 from /builds/SoftEther/SoftEtherVPN/src/Mayaqua/Encrypt.c:127:
/usr/include/openssl/rsa.h:193:1: note: declared here
 DEPRECATEDIN_0_9_8(RSA *RSA_generate_key(int bits, unsigned long e, void
 ^

/builds/SoftEther/SoftEtherVPN/src/Mayaqua/Encrypt.c: In function 'RsaGen':
/builds/SoftEther/SoftEtherVPN/src/Mayaqua/Encrypt.c:2377:3: warning: 'RSA_generate_key' is deprecated [-Wdeprecated-declarations]
   rsa = RSA_generate_key(bit, RSA_F4, NULL, NULL);
   ^~~
In file included from /usr/include/openssl/rsa.h:13:0,
                 from /usr/include/openssl/x509.h:31,
                 from /usr/include/openssl/ssl.h:50,
                 from /builds/SoftEther/SoftEtherVPN/src/Mayaqua/Encrypt.c:127:
/usr/include/openssl/rsa.h:193:1: note: declared here
 DEPRECATEDIN_0_9_8(RSA *RSA_generate_key(int bits, unsigned long e, void
 ^

/builds/SoftEther/SoftEtherVPN/src/Mayaqua/Encrypt.c: In function 'X509ToX':
/builds/SoftEther/SoftEtherVPN/src/Mayaqua/Encrypt.c:3435:7: warning: 'ASN1_STRING_data' is deprecated [-Wdeprecated-declarations]
       char *uri = (char *)ASN1_STRING_data(ad->location->d.uniformResourceIdentifier);
       ^~~~
In file included from /usr/include/openssl/bn.h:31:0,
                 from /usr/include/openssl/asn1.h:24,
                 from /usr/include/openssl/objects.h:916,
                 from /usr/include/openssl/evp.h:27,
                 from /usr/include/openssl/x509.h:23,
                 from /usr/include/openssl/ssl.h:50,
                 from /builds/SoftEther/SoftEtherVPN/src/Mayaqua/Encrypt.c:127:
/usr/include/openssl/asn1.h:553:1: note: declared here
 DEPRECATEDIN_1_1_0(unsigned char *ASN1_STRING_data(ASN1_STRING *x))
 ^

/builds/SoftEther/SoftEtherVPN/src/Mayaqua/Encrypt.c: In function 'FreeOpenSSLThreadState':
/builds/SoftEther/SoftEtherVPN/src/Mayaqua/Encrypt.c:3643:2: warning: 'ERR_remove_state' is deprecated [-Wdeprecated-declarations]
  ERR_remove_state(0);
  ^~~~~~~~~~~~~~~~
In file included from /usr/include/openssl/ct.h:13:0,
                 from /usr/include/openssl/ssl.h:61,
                 from /builds/SoftEther/SoftEtherVPN/src/Mayaqua/Encrypt.c:127:
/usr/include/openssl/err.h:248:1: note: declared here
 DEPRECATEDIN_1_0_0(void ERR_remove_state(unsigned long pid))
 ^
2018-08-10 22:37:05 +02:00
d3af4d6f26 Mayaqua: use "cpu_features" to check whether AES-NI is supported 2018-08-03 14:17:26 +02:00
8b244ce660 Encrypt: remove unused functions detected by Cppcheck 2018-08-02 23:44:39 +02:00
1b3f969fb0 add OPENSSL_NO_COMP feature check
Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>
2018-07-26 13:21:10 +02:00
ed5ae4a8fe fix missing openssl feature checks
* add OPENSSL_FIPS feature check

Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>
2018-07-26 13:18:47 +02:00
8f3a4cc3b3 Merge PR #481: Encrypt: set default RSA key size to 1024 everywhere, using the RSA_KEY_SIZE macro 2018-07-26 07:29:28 +02:00
65bda6a44d Merge pull request #484 from davidebeatrici/openssl
Encrypt: improve FreeOpenSSLThreadState() and FreeCryptLibrary(), in order to clean up the library correctly
2018-07-26 02:50:55 +05:00
879dc8f6b8 Mayaqua.c: fix code style broken by #560 2018-07-21 10:27:21 +02:00
1b4cc1fb8d Merge pull request #560 from jbwdevries/certificate_date_fixes
Certificate date fixes
2018-07-21 10:45:09 +05:00
3d0e87cf57 src/Mayaqua/Encrypt.c: Add support for certificates with full year 2018-06-21 10:03:23 +02:00
4029f3ae8d Rename IsIntelAesNiSupported() to IsAesNiSupported() 2018-06-09 20:31:27 +02:00
a7be140f85 Encrypt: use OpenSSL's EVP interface, which supports AES-NI without the need of another library 2018-06-09 19:57:45 +02:00
2da755135a Encrypt: improve FreeOpenSSLThreadState() and FreeCryptLibrary(), in order to clean up the library correctly
https://wiki.openssl.org/index.php/Library_Initialization#Cleanup
2018-06-09 19:57:18 +02:00
1fad008e1a Encrypt: set default RSA key size to 1024 everywhere, using the RSA_KEY_SIZE macro
This commit also fixes the problem described in #31, which was caused by the test key generated in RsaCheck() being too small for newer OpenSSL versions.
2018-06-09 19:56:51 +02:00
13cadf6492 src/Mayaqua/Encrypt.c: remove unused functions (#506)
[src/Mayaqua/Encrypt.c:1524]: (style) The function 'ByteToStr' is never used.
[src/Mayaqua/Encrypt.c:2762]: (style) The function 'CheckX' is never used.
[src/Mayaqua/Encrypt.c:4346]: (style) The function 'Des3Decrypt' is never used.
[src/Mayaqua/Encrypt.c:4290]: (style) The function 'Des3Encrypt' is never used.
[src/Mayaqua/Encrypt.c:4434]: (style) The function 'Des3RandKey' is never used.
[src/Mayaqua/Encrypt.c:4474]: (style) The function 'DesFreeKey' is never used.
[src/Mayaqua/Encrypt.c:4499]: (style) The function 'DesNewKey' is never used.
[src/Mayaqua/Encrypt.c:4446]: (style) The function 'DesRandKey' is never used.
[src/Mayaqua/Encrypt.c:4892]: (style) The function 'DhToBuf' is never used.
[src/Mayaqua/Encrypt.c:293]: (style) The function 'EasyDecrypt' is never used.
[src/Mayaqua/Encrypt.c:259]: (style) The function 'EasyEncrypt' is never used.
[src/Mayaqua/Encrypt.c:3144]: (style) The function 'FileToK' is never used.
[src/Mayaqua/Encrypt.c:1358]: (style) The function 'FileToP12' is never used.
[src/Mayaqua/Encrypt.c:1061]: (style) The function 'GetAllNameFromA' is never used.
[src/Mayaqua/Encrypt.c:973]: (style) The function 'GetAllNameFromXExA' is never used.
[src/Mayaqua/Encrypt.c:4182]: (style) The function 'HashSha256' is never used.
[src/Mayaqua/Encrypt.c:3192]: (style) The function 'KToFile' is never used.
[src/Mayaqua/Encrypt.c:4721]: (style) The function 'MacSha196' is never used.
[src/Mayaqua/Encrypt.c:1324]: (style) The function 'P12ToFile' is never used.
[src/Mayaqua/Encrypt.c:3983]: (style) The function 'Rand128' is never used.
[src/Mayaqua/Encrypt.c:670]: (style) The function 'RsaBinToPublic' is never used.
[src/Mayaqua/Encrypt.c:2556]: (style) The function 'RsaPrivateDecrypt' is never used.
[src/Mayaqua/Encrypt.c:2525]: (style) The function 'RsaPrivateEncrypt' is never used.
[src/Mayaqua/Encrypt.c:2494]: (style) The function 'RsaPublicDecrypt' is never used.
[src/Mayaqua/Encrypt.c:2584]: (style) The function 'RsaPublicEncrypt' is never used.
[src/Mayaqua/Encrypt.c:771]: (style) The function 'RsaPublicToBin' is never used.
[src/Mayaqua/Encrypt.c:4263]: (style) The function 'Sha1__' is never used.
[src/Mayaqua/Encrypt.c:3672]: (style) The function 'SkipBufBeforeString' is never used.
2018-05-02 23:48:47 +02:00
478270efba Revert "Cleanup ssl library. No memory leaks. (#143)". Build failing using OpenSSL 1.1.0f
This reverts commit 227842f89c.
2018-04-11 23:25:21 +02:00
227842f89c Cleanup ssl library. No memory leaks. (#143) 2018-04-11 23:18:16 +02:00
83295bb736 OpenVPN client certificate authentication (Individual Certificate Authentication) (#327)
* Implement OpenVPN certificate authentication, fixes #55

* fixup! Implement OpenVPN certificate authentication, fixes #55
2018-04-05 23:04:58 +02:00
8c0c4396b7 Add the Alternative subject name field on the new X.509 certificate creation. 2018-02-12 23:56:14 +01:00
79c06146a4 remove unused functions (identified by cppcheck)
[src/Cedar/Account.c:854]: (style) The function 'AddGroupTraffic' is never used.
[src/Mayaqua/Secure.c:1455]: (style) The function 'AddSecObjToEnumCache' is never used.
[src/Mayaqua/Network.c:18445]: (style) The function 'AddSockList' is never used.
[src/Cedar/Account.c:870]: (style) The function 'AddUserTraffic' is never used.
[src/Cedar/Server.c:1045]: (style) The function 'AdjoinEnumLogFile' is never used.
[src/Cedar/Admin.c:13780]: (style) The function 'AdminConnect' is never used.
[src/Mayaqua/Encrypt.c:855]: (style) The function 'BigNumToStr' is never used.
[src/Mayaqua/Str.c:2113]: (style) The function 'Bit128ToStr' is never used.
[src/Mayaqua/Encrypt.c:898]: (style) The function 'BufToBigNum' is never used.
[src/Mayaqua/Internat.c:1874]: (style) The function 'CalcStrToUtf8' is never used.
[src/Cedar/Hub.c:6689]: (style) The function 'CalcTrafficDiff' is never used.
[src/Mayaqua/Internat.c:1819]: (style) The function 'CalcUtf8ToStr' is never used.
[src/Mayaqua/Network.c:6495]: (style) The function 'CanGetTcpProcessId' is never used.
[src/Cedar/WinUi.c:7226]: (style) The function 'CbInsertStrA' is never used.
[src/Cedar/Client.c:3035]: (style) The function 'CcEnumObjectInSecure' is never used.
[src/Cedar/Client.c:2826]: (style) The function 'CcGetCommonProxySetting' is never used.
[src/Cedar/Client.c:2857]: (style) The function 'CcSetCommonProxySetting' is never used.
[src/Cedar/Cedar.c:575]: (style) The function 'CedarLog' is never used.
[src/Cedar/WinUi.c:9841]: (style) The function 'Center2' is never used.
[src/Mayaqua/Encrypt.c:814]: (style) The function 'CertTest' is never used.
[src/Mayaqua/Encrypt.c:809]: (style) The function 'CertTest2' is never used.
[src/Mayaqua/Encrypt.c:819]: (style) The function 'CertTest_' is never used.
[src/Mayaqua/Cfg.c:1705]: (style) The function 'CfgIsFolder' is never used.
2018-02-08 00:20:07 +01:00