1
0
mirror of https://github.com/SoftEtherVPN/SoftEtherVPN.git synced 2025-04-03 18:00:08 +03:00
Commit Graph

83 Commits

Author SHA1 Message Date
icy17
e2017772c7 Fix potential NULL pointer dereference 2024-08-01 15:43:34 +08:00
Ilya Shipitsin
a836b3bd5e
Merge pull request #2022 from siddharth-narayan/built-in-post-quantum
Add built in post quantum functionality
2024-07-19 20:05:47 +02:00
Siddharth
a45219bb78 Revert "Fix engine include errors on Fedora Rawhide"
This reverts commit 1d57ccf94a.
2024-07-04 13:15:50 -04:00
siddharth-narayan
25585a1e3d
Guard engine.h include 2024-07-04 13:05:30 -04:00
Siddharth
1d57ccf94a Fix engine include errors on Fedora Rawhide 2024-07-04 06:55:06 -04:00
Siddharth
28ded982a7 Remove empty OpenSSL version guard 2024-06-28 14:18:48 -04:00
Siddharth
eb66e7d360 That's not how you comment in C! 2024-06-21 15:16:27 -04:00
Siddharth
102485a4b8 Add oqsprovider statically (built in) by default 2024-06-20 22:08:38 -04:00
Siddharth
a50d8910ba Add PQ Groups and the provider for them 2024-05-20 19:48:23 -04:00
Daiyuu Nobori
f4bbe476be Fix Vulnerability: CVE-2023-32275 TALOS-2023-1753
SoftEther VPN CtEnumCa () information disclosure vulnerability
https://www.softether.org/9-about/News/904-SEVPN202301
https://jvn.jp/en/jp/JVN64316789/
2023-10-07 04:42:41 +02:00
Yihong Wu
b3afbe37e9 Load legacy provider under OpenSSL 3.0 2022-04-26 22:00:15 +08:00
Yihong Wu
2d1c8765aa
Merge pull request #1433 from domosekai/chain
Support user-specified server trust chain
2021-11-25 17:15:53 +08:00
Rosen Penev
ee3bf7f507 fix compilation without OpenSSL engines
Signed-off-by: Rosen Penev <rosenp@gmail.com>
2021-08-07 20:05:04 -07:00
domosekai
2761c1ca42 Support user-specified server trust chain 2021-07-21 07:02:42 +00:00
Davide Beatrici
a6ba9b8788 Include headers properly 2021-04-05 04:48:25 +02:00
mcallist
2e0c24f6c8 Add english translation to each language for openssl engine auth 2020-10-09 10:22:23 +02:00
mcallist
d1ad4196bb Change from unix only implementation to all os and skip ENGINE_load_dynamic if oss is 1.1.0 or later 2020-10-09 09:58:34 +02:00
mcallist
20b84f3928 Change openssl version checking to api compat 2020-10-09 04:58:25 +02:00
mcallist
dec532a8eb Increase required openssl version for openssl engines implementation 2020-10-09 03:32:53 +02:00
mcallist
ff3910eb86 Openssl engine certificate authentication
TODO cert get, call finish engine, call init engine in another step, handle authentication, internatiolazion (help is needed)
2020-10-09 02:56:51 +02:00
Daiyuu Nobori
bf4667cfce Fix several compile warnings on MS VC++ 2008. 2019-08-04 10:35:16 +09:00
Rosen Penev
d57fc3524c
Fix LibreSSL support
My previous patch used a wrong if directive, which disabled removed
(de)initialization and threading for LibreSSL. This most likely causes
issues at runtime.
2019-07-22 11:35:19 -07:00
Rosen Penev
a9f707c813
Switch to OpenSSL THREADID API
The old threading API was deprecated in OpenSSL 1.0.
2019-07-22 11:28:12 -07:00
Rosen Penev
1bd39485cf
Mayaqua: Fix compilation without deprecated OpenSSL APIs
Initialization and deinitialization are deprecated.

Missing headers were added.

Explicit threading is also deprecated.
2019-07-11 12:42:26 -07:00
Daiyuu Nobori
98443715d9 Fixed the vulnerability that a malformed packet will cause the buffer overflow at the receive path. This vulnerability may occur abnormal process exit with the buffer security check mechanism built-in with SoftEther VPN binary. Although this buffer overflow can theoretically bypass the security check in theory, in the actual binary it is detected by the buffer security check inserted by the C compiler and the process is forcibly terminated. Therefore, as a result, it can be abused by a DoS attacker. Acknowledgments: The last problems is discovered and reported by Fabrizio Steiner. 2019-02-28 20:40:23 +09:00
vvd
372e8aa031 Fixed memory leak in OpenSSL deinitialization function 2019-02-27 21:41:20 +01:00
Rosen Penev
26261236ba
Fix compilation without OpenSSL ENGINE 2019-02-25 14:24:31 -08:00
Daiyuu Nobori
881f34ac56 Compacting headers, updating trivial texts to fit to the license change from GPLv2 to Apache License 2.0. 2019-01-14 12:25:53 +09:00
Daiyuu Nobori
c407f35322 SHA-0 Implementation replacement from GPLv3 to Apache License 2018-12-02 10:30:22 +09:00
Davide Beatrici
aae9ec0492 Mayaqua/Encrypt: add CipherProcessAead() function to encrypt/decrypt with AEAD ciphers 2018-11-03 15:14:56 +01:00
Ilya Shipitsin
5e75a1fb99 src/Mayaqua/Encrypt.c: fix memory leak occasionally found by valgrind 2018-10-29 10:52:56 +05:00
Ilya Shipitsin
ec09309aa8 gitlab-ci: enable ubuntu 12.04 builds 2018-10-12 01:03:12 +05:00
Davide Beatrici
53c8abfd80 Encrypt.c: fix MdProcess()'s HMAC implementation 2018-09-27 20:28:48 +02:00
Davide Beatrici
50b42070e2 Encrypt: reorder digest functions 2018-09-22 06:47:03 +02:00
Davide Beatrici
3f5f716357 Revamp digest functions
- Hash() has been removed because it was ambiguous, Md5() and Sha0() are proper replacements.
- HMacMd5() and HMacSha1() now share a common implementation handled by the new Internal_HMac() function.
- NewMd() and MdProcess() now support plain hashing (without the key).
- NewMd(), SetMdKey() and MdProcess() now check the OpenSSL functions' return value and in case of failure a debug message is printed along with the error string, if available.
- SetMdKey()'s return value has been changed from void to bool, so that it's possible to know whether the function succeeded or not.
- MdProcess()' return value has been changed from void to UINT (unsigned int) and the function now returns the number of bytes written by HMAC_Final() or EVP_DigestFinal_ex().
2018-09-22 06:36:09 +02:00
Andy Walsh
d6c8231ff0 Mayaqua/Encrypt.c: fix invalid features.aes for mips, ppc
* fix invalid features.aes for mips, ppc

Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>
2018-08-13 16:23:54 +02:00
Davide Beatrici
c9b56bf590
Merge PR #639: Encrypt: support NULL message digest 2018-08-12 12:19:30 +02:00
Davide Beatrici
3d13f56314 Encrypt: support NULL message digest 2018-08-12 01:53:30 +02:00
Davide Beatrici
9bac21b52e Encrypt.c: add warning for when EVP_get_cipherbyname() fails 2018-08-12 01:09:10 +02:00
Davide Beatrici
4da4fbeca0 Encrypt.c: don't use deprecated OpenSSL functions
/builds/SoftEther/SoftEtherVPN/src/Mayaqua/Encrypt.c: In function 'RsaCheck':
/builds/SoftEther/SoftEtherVPN/src/Mayaqua/Encrypt.c:2307:3: warning: 'RSA_generate_key' is deprecated [-Wdeprecated-declarations]
   rsa = RSA_generate_key(bit, RSA_F4, NULL, NULL);
   ^~~
In file included from /usr/include/openssl/rsa.h:13:0,
                 from /usr/include/openssl/x509.h:31,
                 from /usr/include/openssl/ssl.h:50,
                 from /builds/SoftEther/SoftEtherVPN/src/Mayaqua/Encrypt.c:127:
/usr/include/openssl/rsa.h:193:1: note: declared here
 DEPRECATEDIN_0_9_8(RSA *RSA_generate_key(int bits, unsigned long e, void
 ^

/builds/SoftEther/SoftEtherVPN/src/Mayaqua/Encrypt.c: In function 'RsaGen':
/builds/SoftEther/SoftEtherVPN/src/Mayaqua/Encrypt.c:2377:3: warning: 'RSA_generate_key' is deprecated [-Wdeprecated-declarations]
   rsa = RSA_generate_key(bit, RSA_F4, NULL, NULL);
   ^~~
In file included from /usr/include/openssl/rsa.h:13:0,
                 from /usr/include/openssl/x509.h:31,
                 from /usr/include/openssl/ssl.h:50,
                 from /builds/SoftEther/SoftEtherVPN/src/Mayaqua/Encrypt.c:127:
/usr/include/openssl/rsa.h:193:1: note: declared here
 DEPRECATEDIN_0_9_8(RSA *RSA_generate_key(int bits, unsigned long e, void
 ^

/builds/SoftEther/SoftEtherVPN/src/Mayaqua/Encrypt.c: In function 'X509ToX':
/builds/SoftEther/SoftEtherVPN/src/Mayaqua/Encrypt.c:3435:7: warning: 'ASN1_STRING_data' is deprecated [-Wdeprecated-declarations]
       char *uri = (char *)ASN1_STRING_data(ad->location->d.uniformResourceIdentifier);
       ^~~~
In file included from /usr/include/openssl/bn.h:31:0,
                 from /usr/include/openssl/asn1.h:24,
                 from /usr/include/openssl/objects.h:916,
                 from /usr/include/openssl/evp.h:27,
                 from /usr/include/openssl/x509.h:23,
                 from /usr/include/openssl/ssl.h:50,
                 from /builds/SoftEther/SoftEtherVPN/src/Mayaqua/Encrypt.c:127:
/usr/include/openssl/asn1.h:553:1: note: declared here
 DEPRECATEDIN_1_1_0(unsigned char *ASN1_STRING_data(ASN1_STRING *x))
 ^

/builds/SoftEther/SoftEtherVPN/src/Mayaqua/Encrypt.c: In function 'FreeOpenSSLThreadState':
/builds/SoftEther/SoftEtherVPN/src/Mayaqua/Encrypt.c:3643:2: warning: 'ERR_remove_state' is deprecated [-Wdeprecated-declarations]
  ERR_remove_state(0);
  ^~~~~~~~~~~~~~~~
In file included from /usr/include/openssl/ct.h:13:0,
                 from /usr/include/openssl/ssl.h:61,
                 from /builds/SoftEther/SoftEtherVPN/src/Mayaqua/Encrypt.c:127:
/usr/include/openssl/err.h:248:1: note: declared here
 DEPRECATEDIN_1_0_0(void ERR_remove_state(unsigned long pid))
 ^
2018-08-10 22:37:05 +02:00
Davide Beatrici
d3af4d6f26 Mayaqua: use "cpu_features" to check whether AES-NI is supported 2018-08-03 14:17:26 +02:00
Davide Beatrici
8b244ce660 Encrypt: remove unused functions detected by Cppcheck 2018-08-02 23:44:39 +02:00
Andy Walsh
1b3f969fb0 add OPENSSL_NO_COMP feature check
Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>
2018-07-26 13:21:10 +02:00
Andy Walsh
ed5ae4a8fe fix missing openssl feature checks
* add OPENSSL_FIPS feature check

Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>
2018-07-26 13:18:47 +02:00
Davide Beatrici
8f3a4cc3b3
Merge PR #481: Encrypt: set default RSA key size to 1024 everywhere, using the RSA_KEY_SIZE macro 2018-07-26 07:29:28 +02:00
Ilya Shipitsin
65bda6a44d
Merge pull request #484 from davidebeatrici/openssl
Encrypt: improve FreeOpenSSLThreadState() and FreeCryptLibrary(), in order to clean up the library correctly
2018-07-26 02:50:55 +05:00
Davide Beatrici
879dc8f6b8 Mayaqua.c: fix code style broken by #560 2018-07-21 10:27:21 +02:00
Ilya Shipitsin
1b4cc1fb8d
Merge pull request #560 from jbwdevries/certificate_date_fixes
Certificate date fixes
2018-07-21 10:45:09 +05:00
Johan de Vries
3d0e87cf57 src/Mayaqua/Encrypt.c: Add support for certificates with full year 2018-06-21 10:03:23 +02:00
Davide Beatrici
4029f3ae8d Rename IsIntelAesNiSupported() to IsAesNiSupported() 2018-06-09 20:31:27 +02:00