1
0
mirror of https://github.com/SoftEtherVPN/SoftEtherVPN.git synced 2026-04-26 00:39:25 +03:00
Commit Graph

66 Commits

Author SHA1 Message Date
Daiyuu Nobori 3b932f5fee Fix Vulnerability: CVE-2023-27516 TALOS-2023-1754 and CVE-2023-32634 TALOS-2023-1755
SoftEther VPN CiRpcAccepted () authentication bypass vulnerability
and SoftEther VPN CiRpcServerThread () MitM authentication bypass vulnerability
https://www.softether.org/9-about/News/904-SEVPN202301
https://jvn.jp/en/jp/JVN64316789/
2023-10-07 04:42:41 +02:00
Ilya Shipitsin 205a94cda2 Merge pull request #1867 from hiura2023/master
Bind outgoing connection to a specific IP address
2023-09-10 17:18:31 +02:00
hiura c2fe874865 Bind outgoing connection to a specific IP address No.2 2023-08-08 18:14:22 +09:00
hiura e4330ca71a bind outgoing connection 2023-06-28 23:18:09 +09:00
Koichiro IWAO 0ab5199272 Fix build when NO_VLAN
Occurred at:	 #670
Closes:		#1864

Tested build on FreeBSD with NO_VLAN by modifying CMakeLists.txt like this:

```diff
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index c49a3c78..1dad3691 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -93,6 +93,7 @@ if(UNIX)
if(${CMAKE_SYSTEM_NAME} STREQUAL "FreeBSD")
     add_definitions(-DUNIX_BSD -DBRIDGE_BPF)
+    add_definitions(-DNO_VLAN)
     include_directories(SYSTEM /usr/local/include)
     link_directories(SYSTEM /usr/local/lib)
   endif()
```
2023-06-17 02:18:04 +09:00
Koichiro IWAO 939eb3130e Cedar/Client: Enable CtVLans{Up,Down} on FreeBSD
The same trick also works on FreeBSD. There's no reason to limit it to
Linux.
2023-05-31 17:48:31 +09:00
Yihong Wu ca996ed89a Merge pull request #1522 from domosekai/tls
Implement complete server certificate verification
2022-05-12 23:38:38 +08:00
Yihong Wu d86cf181bf Fix UDP bulk v2 and protocol display 2022-03-20 16:48:15 +08:00
Yihong Wu 0a4455ac40 Add more TLS negotiation info in logging and UI 2021-12-29 17:41:29 +08:00
Yihong Wu f94ac6351e Implement complete server certificate verification 2021-12-29 17:41:29 +08:00
Yihong Wu 68dc4e23d8 Improve NAT-T hint string handling 2021-12-26 12:11:51 +08:00
Yihong Wu d95d8ddefa Fix account name in wrong case after editing 2021-12-26 12:03:59 +08:00
Yihong Wu 582a739179 Fix auto refreshing of client manager 2021-09-28 20:15:41 +08:00
Yihong Wu 2853337b81 Allow ECDSA certificates on server side 2021-09-20 08:18:36 +00:00
Davide Beatrici 1708998a11 Change IP structure so that IPv4 addresses are stored in RFC3493 format
In addition to saving 4 bytes for each instantiation, this change makes IP-related operations faster and clearer.

https://tools.ietf.org/html/rfc3493.html#section-3.7
2021-04-07 21:24:55 +02:00
Davide Beatrici a6ba9b8788 Include headers properly 2021-04-05 04:48:25 +02:00
Davide Beatrici 5cab279a8c Cedar, Mayaqua: Set minimum Windows version to Vista 2021-04-03 02:25:19 +02:00
mcallist ff3910eb86 Openssl engine certificate authentication
TODO cert get, call finish engine, call init engine in another step, handle authentication, internatiolazion (help is needed)
2020-10-09 02:56:51 +02:00
Davide Beatrici a3eb115b0a Cedar: remove all references to binaries with "_x64" and "_ia64" suffix
BuildUtil compiles the project as 32 bit and 64 bit, before building the installer package.

64 bit binaries have the "_x64" suffix and are added to the package alongside the 32 bit ones (that have no suffix).

The CMake project compiles the binaries for a single architecture and they have no suffix.

We decided that providing two separate installers is the best solution.

As for the binaries with the "_ia64" suffix: they never existed during the this repository's lifespan.
2020-07-27 20:59:40 +02:00
Davide Beatrici 235bd07e67 Cedar: remove "NicDownOnDisconnect" option
SoftEther VPN originally created the NIC in the UP state and never changed it, even when the the client was not connected.

The behavior was changed in 59e1483dbf, which also added the NicDownOnDisconnect option

The option was disabled by default for backwards compatibility with scripts that don't check whether the NIC is down, but it's not ideal.

This commit forces the correct behavior and removes the commands "TUNDownOnDisconnectEnable", "TUNDownOnDisconnectDisable" and "TUNDownOnDisconnectGet".
2020-06-27 22:47:04 +02:00
dnobori 1d2a58b172 Cedar: handle UDP acceleration and R-UDP versions 2019-11-23 04:38:27 +01:00
dnobori 9aaa9a7f15 Cedar: implement detailed protocol info 2019-11-23 04:23:56 +01:00
Daiyuu Nobori 98b08c2ad1 Implementation of the JSON-RPC API and the Web Admin interface. (dnobori's internal note: 7579 - 7682) 2019-05-28 12:51:51 +09:00
Daiyuu Nobori 881f34ac56 Compacting headers, updating trivial texts to fit to the license change from GPLv2 to Apache License 2.0. 2019-01-14 12:25:53 +09:00
Davide Beatrici aefbd2e903 Add custom HTTP header feature for HTTP proxy
A custom HTTP header can be used to bypass certain restrictions imposed on the network or to avoid speed limitations applied by the QoS.
2018-11-29 20:32:21 +01:00
Daiyuu Nobori ee9990317b Fix bugs reported by Coverity Scan. 2018-09-28 22:39:38 +09:00
Ilya Shipitsin 1fdc712e66 src/Cedar/Client.c: silence coverity regarding dead code 2018-09-24 11:19:54 +05:00
Davide Beatrici 3f5f716357 Revamp digest functions
- Hash() has been removed because it was ambiguous, Md5() and Sha0() are proper replacements.
- HMacMd5() and HMacSha1() now share a common implementation handled by the new Internal_HMac() function.
- NewMd() and MdProcess() now support plain hashing (without the key).
- NewMd(), SetMdKey() and MdProcess() now check the OpenSSL functions' return value and in case of failure a debug message is printed along with the error string, if available.
- SetMdKey()'s return value has been changed from void to bool, so that it's possible to know whether the function succeeded or not.
- MdProcess()' return value has been changed from void to UINT (unsigned int) and the function now returns the number of bytes written by HMAC_Final() or EVP_DigestFinal_ex().
2018-09-22 06:36:09 +02:00
Ilya Shipitsin f469e143fc src/Cedar/Client.c: remove not needed condition
inspired by coverity (however, coverity does not see an issue here)
2018-09-17 16:35:22 +05:00
Davide Beatrici c21f427fc6 Divide version in multiple macros and set default values 2018-08-27 05:44:32 +02:00
Davide Beatrici 7612c2bf5d Cedar: fix compilation on FreeBSD, broken by #337 2018-08-23 04:39:13 +02:00
Ilya Shipitsin a2d5fb7015 src/Cedar/Client.c: remove redundant "if" statement, unused variable
found by coverity, cppcheck

[src/Cedar/Client.c:9094]: (style) Unused variable: i
[src/Cedar/Client.c:500] -> [src/Cedar/Client.c:503]: (style) Variable 'ret' is reassigned a value before the old one has been used.
2018-08-22 20:58:03 +05:00
Ilya Shipitsin e8c6e2c1d9 src/Cedar/Client.c, src/Mayaqua/Network.c, src/Mayaqua/Unix.c: silence coverity 2018-08-22 10:40:13 +05:00
Ilya Shipitsin b0ebd1f1d5 src/Cedar/Client: remove dead code, unused functions, variables
found by coverity, cppcheck

[src/Cedar/Client.c:10486]: (style) The function 'CiFreeInnerVPNServer' is never used.
[src/Cedar/Client.c:10877]: (style) The function 'CiGetNumActiveSessions' is never used.
[src/Cedar/Client.c:2042]: (style) The function 'CiHasAccountSensitiveInformationFile' is never used.
[src/Cedar/Client.c:10469]: (style) The function 'CiNewInnerVPNServer' is never used.
[src/Cedar/Client.c:1128]: (style) The function 'CncGetSessionId' is never used.
[src/Cedar/Client.c:767]: (style) The function 'CncPasswordDlgHaltThread' is never used.
[src/Cedar/Client.c:10681]: (style) The function 'CompareInternetSetting' is never used.
[src/Cedar/Client.c:11060]: (style) The function 'CtGetClient' is never used.
[src/Cedar/Client.c:5128]: (style) The function 'InRpcClientNotify' is never used.
[src/Cedar/Client.c:4340]: (style) The function 'InRpcEnumObjectInSecure' is never used.
[src/Cedar/Client.c:5140]: (style) The function 'OutRpcClientNotify' is never used.
[src/Cedar/Client.c:5657]: (style) Condition 'reg_port!=0' is always false
[src/Cedar/Client.c:683]: (style) Variable 'ret' is assigned a value that is never used.
[src/Cedar/Client.c:725]: (style) Variable 'ret' is assigned a value that is never used.
[src/Cedar/Client.c:1013]: (style) Variable 'param' is assigned a value that is never used.
2018-08-18 19:24:12 +05:00
Davide Beatrici daed1ad8b3 Merge PR #594: Remove SSLv3 support 2018-08-18 07:38:05 +02:00
Ilya Shipitsin b8d5a85b0e src/Cedar/Client.c: Array compared against NULL is always false
found by coverity
2018-08-12 14:59:08 +05:00
Davide Beatrici 02db806181 Remove SSLv3 support 2018-08-09 00:25:40 +02:00
Davide Beatrici 59000e04cc Merge PR #335: Retry connection on untrusted server certificate 2018-08-05 21:15:52 +02:00
Joshua Perry 28e8d4bcce Retry connection on untrusted server certificate
With server certificate validation enabled, vpnclient unconditionally
stopped connection on untrusted server certificate. Added account
configuration parameter to retry connection if server certivicate failed
validation.
2018-08-05 20:48:16 +02:00
Joshua Perry 59e1483dbf Put TUN down on client disconnect.
On startup client creates TUN interface in UP state and kept it UP even
if connection to the server was lost. Creating interface in DOWN state,
turning it UP on successful (re-)connection to server and DOWN on either
disconnect or connection loss would enable DHCP client (say dhclient5)
to detect necessity for lease renewal.

Added a client configuration parameter to create TUN interface in DOWN
state and commands to enable, disable, and query the configuration
parameter.
Enabling the parameter causes client to put all unused TUN interfaces
DOWN, create new TUN interfaces in DOWN state, and turn TUN interfaces
corresponding to active sessions DOWN on connection loss or
disconnecting from server.
Disabling the parameter forces client to turn all TUN interfaces UP and
create new TUN interfaces in UP state.
Default value is 'Disable'.
2018-08-05 17:36:05 +02:00
Daiyuu Nobori ab54b73737 Merge pull request #511 from dnobori/b4_mac
Improving the compliance of Virtual Network Adapters with the local address bit of the MAC address rule.
2018-05-24 18:04:32 +09:00
Josh Soref ac865f04fc Correct Spelling (#458)
* spelling: accepts

* spelling: account

* spelling: accept

* spelling: accumulate

* spelling: adapter

* spelling: address

* spelling: additional

* spelling: aggressive

* spelling: adhered

* spelling: allowed

* spelling: ambiguous

* spelling: amount

* spelling: anonymous

* spelling: acquisition

* spelling: assemble

* spelling: associated

* spelling: assigns

* spelling: attach

* spelling: attempt

* spelling: attribute

* spelling: authenticate

* spelling: authentication

* spelling: available

* spelling: bridging

* spelling: cascade

* spelling: cancel

* spelling: check

* spelling: challenge

* spelling: changing

* spelling: characters

* spelling: cloud

* spelling: compare

* spelling: communication

* spelling: compatible

* spelling: compatibility

* spelling: completion

* spelling: complete

* spelling: computers

* spelling: configure

* spelling: configuration

* spelling: conformant

* spelling: connection

* spelling: contains

* spelling: continuously

* spelling: continue

* spelling: convert

* spelling: counters

* spelling: create

* spelling: created

* spelling: cumulate

* spelling: currently

* spelling: debugging

* spelling: decryption

* spelling: description

* spelling: default

* spelling: driver

* spelling: delete

* spelling: destination

* spelling: disabled

* spelling: different

* spelling: dynamically

* spelling: directory

* spelling: disappeared

* spelling: disable

* spelling: doesn't

* spelling: download

* spelling: dropped

* spelling: enable

* spelling: established

* spelling: ether

* spelling: except

* spelling: expired

* spelling: field

* spelling: following

* spelling: forever

* spelling: firewall

* spelling: first

* spelling: fragment

* spelling: function

* spelling: gateway

* spelling: identifier

* spelling: identify

* spelling: incoming

* spelling: information

* spelling: initialize

* spelling: injection

* spelling: inner

* spelling: instead

* spelling: installation

* spelling: inserted

* spelling: integer

* spelling: interrupt

* spelling: intuitive

* spelling: interval

* spelling: january

* spelling: keybytes

* spelling: know

* spelling: language

* spelling: length

* spelling: library

* spelling: listener

* spelling: maintain

* spelling: modified

* spelling: necessary

* spelling: number

* spelling: obsoleted

* spelling: occurred

* spelling: occurring

* spelling: occur

* spelling: original

* spelling: omittable

* spelling: omit

* spelling: opening

* spelling: operation

* spelling: packet

* spelling: parameters

* spelling: pointed

* spelling: popupmenuopen

* spelling: privilege

* spelling: product

* spelling: protection

* spelling: promiscuous

* spelling: prompt

* spelling: query

* spelling: random

* spelling: reconnection

* spelling: revocation

* spelling: received

* spelling: red hat

* spelling: registry

* spelling: release

* spelling: retrieve
2018-05-16 23:47:10 +02:00
Daiyuu Nobori 8230f16457 Fix a typo. 2018-04-23 10:09:34 +09:00
Daiyuu Nobori 683aecaaec Improving the compliance of Virtual Network Adapters with the local address bit of the MAC address rule.
When installing a new device driver of the Virtual Network Driver card, we changed the initial random MAC address from 00-AC-xx-xx-xx-xx to 5E-xx-xx-xx-xx-xx. This realizes the compliance with the local address bit of the MAC address rule.
2018-04-22 18:24:29 +09:00
Ilya Shipitsin 79c06146a4 remove unused functions (identified by cppcheck)
[src/Cedar/Account.c:854]: (style) The function 'AddGroupTraffic' is never used.
[src/Mayaqua/Secure.c:1455]: (style) The function 'AddSecObjToEnumCache' is never used.
[src/Mayaqua/Network.c:18445]: (style) The function 'AddSockList' is never used.
[src/Cedar/Account.c:870]: (style) The function 'AddUserTraffic' is never used.
[src/Cedar/Server.c:1045]: (style) The function 'AdjoinEnumLogFile' is never used.
[src/Cedar/Admin.c:13780]: (style) The function 'AdminConnect' is never used.
[src/Mayaqua/Encrypt.c:855]: (style) The function 'BigNumToStr' is never used.
[src/Mayaqua/Str.c:2113]: (style) The function 'Bit128ToStr' is never used.
[src/Mayaqua/Encrypt.c:898]: (style) The function 'BufToBigNum' is never used.
[src/Mayaqua/Internat.c:1874]: (style) The function 'CalcStrToUtf8' is never used.
[src/Cedar/Hub.c:6689]: (style) The function 'CalcTrafficDiff' is never used.
[src/Mayaqua/Internat.c:1819]: (style) The function 'CalcUtf8ToStr' is never used.
[src/Mayaqua/Network.c:6495]: (style) The function 'CanGetTcpProcessId' is never used.
[src/Cedar/WinUi.c:7226]: (style) The function 'CbInsertStrA' is never used.
[src/Cedar/Client.c:3035]: (style) The function 'CcEnumObjectInSecure' is never used.
[src/Cedar/Client.c:2826]: (style) The function 'CcGetCommonProxySetting' is never used.
[src/Cedar/Client.c:2857]: (style) The function 'CcSetCommonProxySetting' is never used.
[src/Cedar/Cedar.c:575]: (style) The function 'CedarLog' is never used.
[src/Cedar/WinUi.c:9841]: (style) The function 'Center2' is never used.
[src/Mayaqua/Encrypt.c:814]: (style) The function 'CertTest' is never used.
[src/Mayaqua/Encrypt.c:809]: (style) The function 'CertTest2' is never used.
[src/Mayaqua/Encrypt.c:819]: (style) The function 'CertTest_' is never used.
[src/Mayaqua/Cfg.c:1705]: (style) The function 'CfgIsFolder' is never used.
2018-02-08 00:20:07 +01:00
Daiyuu Nobori 9f9dc459a7 Preparing the development branch 2017-10-19 15:00:41 +09:00
dnobori faee11ff09 v4.23-9647-beta 2017-10-18 18:24:21 +09:00
Daiyuu Nobori b61882598f Merge pull request #256 from cm0x4D/master
Using client parameter in function CtConnect
2017-10-18 16:36:24 +09:00
dnobori 4df2eb4f9c v4.22-9634-beta 2016-11-27 17:43:14 +09:00
Michael Clausen 462840cf6e Using client parameter in function CtConnect
Using the global client variable might lead to strange behavoir if multiple clients are allocated and to crashes in the case the client was not initialized with CtStartClient()
2016-10-03 13:31:03 +02:00