Merge 2f80d7f511 into 31fed5a28f

Fix potential NULL pointer dereference

.github/workflows/build_source_release.yml

@@ -8,15 +8,16 @@ on:
 
 jobs:
   build:
-    name: build
+    name: Build
     runs-on: ubuntu-latest
     steps:
 
-    - uses: actions/checkout@v1
+    - name: Checkout
+      uses: actions/checkout@v4
       with:
         submodules: true
 
-    - name: archive
+    - name: Archive
       id: archive
       run: |
         VERSION=${{ github.event.release.tag_name }}
@@ -28,12 +29,8 @@ jobs:
         tar cJf $TARBALL $PKGNAME
         echo "tarball=$TARBALL" >> $GITHUB_OUTPUT
 
-    - name: upload tarball
-      uses: actions/upload-release-asset@v1
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    - name: Upload tarball
+      uses: softprops/action-gh-release@v2
       with:
-        upload_url: ${{ github.event.release.upload_url }}
-        asset_path: ./${{ steps.archive.outputs.tarball }}
-        asset_name: ${{ steps.archive.outputs.tarball }}
-        asset_content_type: application/gzip
+        files: ./${{ steps.archive.outputs.tarball }}
+        name: ${{ steps.archive.outputs.tarball }}

.github/workflows/coverity.yml

@@ -1,4 +1,3 @@
-
 name: Coverity
 
 on:
@@ -10,28 +9,36 @@ permissions:
 
 jobs:
   scan:
+    name: Scan
     runs-on: ubuntu-latest
-    if: ${{ github.repository_owner == 'SoftEtherVPN' }}
+    if: github.repository_owner == 'SoftEtherVPN'
     steps:
-    - uses: actions/checkout@v2
+
+    - name: Checkout
+      uses: actions/checkout@v4
       with:
         submodules: true
+
     - name: Install apt dependencies
       run: |
         sudo apt-get update
         sudo apt-get install -y cmake gcc g++ libncurses5-dev libreadline-dev libssl-dev make zlib1g-dev libsodium-dev
+
     - name: Download Coverity build tool
       run: |
         wget -c -N https://scan.coverity.com/download/linux64 --post-data "token=${{ secrets.COVERITY_SCAN_TOKEN }}&project=SoftEtherVPN%2FSoftEtherVPN" -O coverity_tool.tar.gz
         mkdir coverity_tool
         tar xzf coverity_tool.tar.gz --strip 1 -C coverity_tool
+
     - name: Configure
       run: |
         ./configure
+
     - name: Build with Coverity build tool
       run: |
         export PATH=`pwd`/coverity_tool/bin:$PATH
         cov-build --dir cov-int make -C build
+
     - name: Submit build result to Coverity Scan
       run: |
         tar czvf cov.tar.gz cov-int

.github/workflows/fedora-rawhide.yml

@@ -4,6 +4,7 @@ on:
   schedule:
     - cron: "0 0 25 * *"
   push:
+  pull_request:
   workflow_dispatch:
 
 permissions:
@@ -19,15 +20,18 @@ jobs:
     container:
       image: fedora:rawhide
     steps:
-    - uses: actions/checkout@v1
-      with:
-        submodules: true
+
     - name: Install dependencies
       run: |
-        dnf -y install git cmake ncurses-devel openssl-devel libsodium-devel readline-devel zlib-devel gcc-c++ clang
+        dnf -y install git cmake ncurses-devel openssl-devel-engine libsodium-devel readline-devel zlib-devel gcc-c++ clang
+
+    - name: Checkout
+      uses: actions/checkout@v4
+      with:
+        submodules: true
+
     - name: Compile with ${{ matrix.cc }}
       run: |
         export CC=${{ matrix.cc }}
         ./configure
         make -C build
-

.github/workflows/linux.yml

@@ -1,3 +1,4 @@
+name: Linux
 on: [push, pull_request]
 
 permissions:
@@ -5,14 +6,16 @@ permissions:
 
 jobs:
   build_and_test:
+    name: Build
     runs-on: ubuntu-latest
     steps:
+
     - uses: actions/checkout@v4
       with:
         submodules: true
 
     - name: Install dependencies
-      run: sudo apt update && sudo apt-get -y install cmake gcc g++ ninja-build libncurses5-dev libreadline-dev libsodium-dev libssl-dev make zlib1g-dev liblz4-dev libnl-genl-3-dev 
+      run: sudo apt-get update && sudo apt-get -y install cmake gcc g++ ninja-build libncurses5-dev libreadline-dev libsodium-dev libssl-dev make zlib1g-dev liblz4-dev libnl-genl-3-dev 
 
     - name: Build
       run: |

.github/workflows/macos.yml

@@ -1,3 +1,4 @@
+name: macOS
 on: [push, pull_request, workflow_dispatch]
 
 permissions:
@@ -11,18 +12,22 @@ jobs:
     name: ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v1
+
+    - name: Checkout
+      uses: actions/checkout@v4
       with:
         submodules: true
+
     - name: Install dependencies
       run: |
         brew install libsodium
+
     - name: Compile 
       run: |
         ./configure
         make -C build
+
     - name: Test 
       run: |
         otool -L build/vpnserver
         .ci/memory-leak-test.sh
-

.github/workflows/musl.yml

@@ -1,4 +1,4 @@
-name: alpine/musl
+name: Alpine/musl
 
 on: [push, pull_request]
 
@@ -7,17 +7,22 @@ permissions:
 
 jobs:
   musl:
-      name: gcc
-      runs-on: ubuntu-latest
-      container:
-        image: alpine:latest
-      steps:
-      - uses: actions/checkout@v1
-        with:
-          submodules: true
+    name: gcc
+    runs-on: ubuntu-latest
+    container:
+      image: alpine:latest
+    steps:
+
       - name: Install dependencies
         run: apk add binutils --no-cache build-base readline-dev openssl-dev ncurses-dev git cmake zlib-dev libsodium-dev gnu-libiconv 
+
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          submodules: true
+
       - name: Configure
         run: ./configure
+
       - name: make 
-        run: make -C build
+        run: make -C build

.github/workflows/stb_check.yml

@@ -1,3 +1,4 @@
+name: STB Check
 on: [push, pull_request]
 
 permissions:
@@ -5,12 +6,16 @@ permissions:
 
 jobs:
   check:
+      name: Check
       runs-on: ubuntu-latest
       steps:
-      - uses: actions/checkout@v1
+
+      - name: Checkout
+        uses: actions/checkout@v4
         with:
           submodules: true
+
       - name: Check
         run: |
           cd developer_tools/stbchecker
-          dotnet run ../../src/bin/hamcore
+          dotnet run ../../src/bin/hamcore

.github/workflows/windows.yml

@@ -1,3 +1,4 @@
+name: Windows
 on: [push, pull_request]
 
 permissions:
@@ -14,19 +15,24 @@ jobs:
     runs-on: windows-latest
     name: ${{ matrix.platform.ARCHITECTURE }}
     steps:
-    - uses: actions/checkout@v4
+
+    - name: Checkout
+      uses: actions/checkout@v4
       with:
         submodules: true
+
     - name: Cache vcpkg
       uses: actions/cache@v4
       with:
         path: 'build/vcpkg_installed/'
         key: vcpkg-${{ matrix.platform.VCPKG_TRIPLET }}
+
     - name: Set version variables
       run: |
         $v = python version.py
         echo "VERSION=$v" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append
       shell: pwsh
+
     - name: Build
       env:
         ARCHITECTURE: ${{ matrix.platform.ARCHITECTURE }}
@@ -44,11 +50,14 @@ jobs:
         vpnsetup /SFXMODE:vpnclient /SFXOUT:"installers\softether-vpnclient-%VERSION%.%BUILD_NUMBER%.%ARCHITECTURE%.exe"
         vpnsetup /SFXMODE:vpnserver_vpnbridge /SFXOUT:"installers\softether-vpnserver_vpnbridge-%VERSION%.%BUILD_NUMBER%.%ARCHITECTURE%.exe"
       shell: cmd
+
     - name: Test
       shell: powershell
       run: |
         . .ci/appveyor-vpntest.ps1
-    - uses: actions/upload-artifact@v4
+
+    - name: Upload built binaries
+      uses: actions/upload-artifact@v4
       with:
         if-no-files-found: error
         name: Binaries-${{ matrix.platform.ARCHITECTURE }}
@@ -56,8 +65,10 @@ jobs:
           build/*.exe
           build/*.pdb
           build/*.se2
-    - uses: actions/upload-artifact@v4
+
+    - name: Upload installers
+      uses: actions/upload-artifact@v4
       with:
         if-no-files-found: error
         name: Installers-${{ matrix.platform.ARCHITECTURE }}
-        path: build/installers
+        path: build/installers

.github/workflows/windows_release.yml

@@ -14,16 +14,19 @@ permissions:
 
 jobs:
   release:
+    name: Release
     runs-on: windows-latest
     outputs:
       upload_url: "${{ steps.create_release.outputs.upload_url }}"
     steps:
+
       - name: "Checkout repository"
         uses: actions/checkout@v4
 
       - name: "Create GitHub release"
         id: create_release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v2
+
   build-windows:
     name: ${{ matrix.platform.ARCHITECTURE }}
     runs-on: windows-latest
@@ -35,15 +38,18 @@ jobs:
           { ARCHITECTURE: x64, COMPILER_PATH: "C:/Program Files/Microsoft Visual Studio/2022/Enterprise/VC/Tools/Llvm/x64/bin/clang-cl.exe", VCPKG_TRIPLET: "x64-windows-static", VCVARS_PATH: "C:/Program Files/Microsoft Visual Studio/2022/Enterprise/VC/Auxiliary/Build/vcvars64.bat"}
         ]
     steps:
+
       - name: "Checkout repository"
         uses: actions/checkout@v4
         with:
           submodules: true
+
       - name: Cache vcpkg
         uses: actions/cache@v4
         with:
           path: 'build/vcpkg_installed/'
           key: vcpkg-release-${{ matrix.platform.VCPKG_TRIPLET }}
+ 
       - name: Set version variables
         run: |
           $b=(Get-Content CMakeSettings.json | Out-String | ConvertFrom-Json).environments.BuildNumber		
@@ -51,6 +57,7 @@ jobs:
           $v = python version.py
           echo "VERSION=$v" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append
         shell: pwsh
+
       - name: Build
         env:
           ARCHITECTURE: ${{ matrix.platform.ARCHITECTURE }}
@@ -68,27 +75,19 @@ jobs:
           vpnsetup /SFXMODE:vpnserver_vpnbridge /SFXOUT:"installers\softether-vpnserver_vpnbridge-%VERSION%.%BUILD_NUMBER%.%ARCHITECTURE%.exe"
         shell: cmd
 
-      - name: dir
+      - name: Show directory items
         run: |
           Get-ChildItem -Recurse build/installers
         shell: pwsh
 
       - name: "Upload softether-vpnclient"
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: "${{ github.token }}"
+        uses: softprops/action-gh-release@v2
         with:
-          upload_url: "${{ needs.release.outputs.upload_url }}"
-          asset_path: "build/installers/softether-vpnclient-${{ env.VERSION }}.${{ env.BUILD_NUMBER }}.${{ matrix.platform.ARCHITECTURE }}.exe"
-          asset_name: "softether-vpnclient-${{ env.VERSION }}.${{ env.BUILD_NUMBER }}.${{ matrix.platform.ARCHITECTURE }}.exe"
-          asset_content_type: "application/octet-stream"
+          files: "build/installers/softether-vpnclient-${{ env.VERSION }}.${{ env.BUILD_NUMBER }}.${{ matrix.platform.ARCHITECTURE }}.exe"
+          name: "softether-vpnclient-${{ env.VERSION }}.${{ env.BUILD_NUMBER }}.${{ matrix.platform.ARCHITECTURE }}.exe"
+          
       - name: "Upload softether-vpnserver_vpnbridge"
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: "${{ github.token }}"
+        uses: softprops/action-gh-release@v2
         with:
-          upload_url: "${{ needs.release.outputs.upload_url }}"
-          asset_path: "build/installers/softether-vpnserver_vpnbridge-${{ env.VERSION }}.${{ env.BUILD_NUMBER }}.${{ matrix.platform.ARCHITECTURE }}.exe"
-          asset_name: "softether-vpnserver_vpnbridge-${{ env.VERSION }}.${{ env.BUILD_NUMBER }}.${{ matrix.platform.ARCHITECTURE }}.exe"
-          asset_content_type: "application/octet-stream"
-
+          files: "build/installers/softether-vpnserver_vpnbridge-${{ env.VERSION }}.${{ env.BUILD_NUMBER }}.${{ matrix.platform.ARCHITECTURE }}.exe"
+          name: "softether-vpnserver_vpnbridge-${{ env.VERSION }}.${{ env.BUILD_NUMBER }}.${{ matrix.platform.ARCHITECTURE }}.exe"

.gitmodules

@@ -10,3 +10,9 @@
 [submodule "src/libhamcore"]
 	path = src/libhamcore
 	url = https://github.com/SoftEtherVPN/libhamcore.git
+[submodule "src/Mayaqua/3rdparty/oqs-provider"]
+	path = src/Mayaqua/3rdparty/oqs-provider
+	url = https://github.com/open-quantum-safe/oqs-provider.git
+[submodule "src/Mayaqua/3rdparty/liboqs"]
+	path = src/Mayaqua/3rdparty/liboqs
+	url = https://github.com/open-quantum-safe/liboqs.git

CMakeLists.txt

@@ -1,9 +1,9 @@
-cmake_minimum_required(VERSION 3.10)
+cmake_minimum_required(VERSION 3.15)
 
 set(BUILD_NUMBER CACHE STRING "The number of the current build.")
 
 if ("${BUILD_NUMBER}" STREQUAL "")
-	set(BUILD_NUMBER "5185")
+	set(BUILD_NUMBER "5186")
 endif()
 
 if (BUILD_NUMBER LESS 5180)

CMakeSettings.json

@@ -1,5 +1,5 @@
 {
-  "environments": [ { "BuildNumber": "5185" } ],
+  "environments": [ { "BuildNumber": "5186" } ],
   "configurations": [
     {
       "name": "x64-native",

README.md

@@ -201,7 +201,9 @@ Also SoftEther VPN [Stable Edition](https://www.freshports.org/security/softethe
 
 ## For Windows
 
-[Nightly builds](https://dev.azure.com/SoftEther-VPN/SoftEther%20VPN/_build?definitionId=6)
+[Releases](https://github.com/SoftEtherVPN/SoftEtherVPN/releases)
+
+[Nightly builds](https://github.com/SoftEtherVPN/SoftEtherVPN/actions/workflows/windows.yml)
 (choose appropriate platform, then find binaries or installers as artifacts)
 
 ## From binary installers (stable channel)

src/Mayaqua/3rdparty/Findliboqs.cmake

@@ -0,0 +1,2 @@
+set(oqs_FOUND TRUE)
+add_library(OQS::oqs ALIAS oqs)

src/Mayaqua/CMakeLists.txt

@@ -18,6 +18,22 @@ set_target_properties(mayaqua
 
 find_package(OpenSSL REQUIRED)
 
+if(OPENSSL_VERSION VERSION_LESS "3") # Disable oqsprovider when OpenSSL version < 3
+  add_definitions(-DSKIP_OQS_PROVIDER)
+else()
+  set(OQS_BUILD_ONLY_LIB ON CACHE BOOL "Set liboqs to build only the library (no tests)")
+  set(BUILD_TESTING OFF CACHE BOOL "By setting this to OFF, no tests or examples will be compiled.")
+  set(OQS_PROVIDER_BUILD_STATIC ON CACHE BOOL "Build a static library instead of a shared library") # Build oqsprovider as a static library (defaults to shared)
+  list(PREPEND CMAKE_MODULE_PATH "${CMAKE_SOURCE_DIR}/src/Mayaqua/3rdparty/")
+
+  add_subdirectory(3rdparty/liboqs)
+  add_subdirectory(3rdparty/oqs-provider)
+
+  target_include_directories(oqsprovider PUBLIC ${CMAKE_CURRENT_BINARY_DIR}/3rdparty/liboqs/include)
+  set_property(TARGET oqsprovider PROPERTY POSITION_INDEPENDENT_CODE ON)
+  target_link_libraries(mayaqua PRIVATE oqsprovider)
+endif()
+
 include(CheckSymbolExists)
 
 set(CMAKE_REQUIRED_INCLUDES ${OPENSSL_INCLUDE_DIR})

src/Mayaqua/Encrypt.c

@@ -20,7 +20,9 @@
 #include <openssl/ssl.h>
 #include <openssl/err.h>
 #include <openssl/rand.h>
+#ifndef OPENSSL_NO_ENGINE
 #include <openssl/engine.h>
+#endif
 #include <openssl/bio.h>
 #include <openssl/x509.h>
 #include <openssl/pkcs7.h>
@@ -40,6 +42,10 @@
 #include <openssl/x509v3.h>
 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
 #include <openssl/provider.h>
+// Static oqsprovider initialization function
+#ifndef SKIP_OQS_PROVIDER
+	extern OSSL_provider_init_fn oqs_provider_init;
+#endif
 #endif
 
 #ifdef _MSC_VER
@@ -345,6 +351,11 @@ MD *NewMdEx(char *name, bool hmac)
 #else
 		m->Ctx = EVP_MD_CTX_create();
 #endif
+		if (m->Ctx == NULL)
+		{
+			return NULL;
+		}
+
 		if (EVP_DigestInit_ex(m->Ctx, m->Md, NULL) == false)
 		{
 			Debug("NewMdEx(): EVP_DigestInit_ex() failed with error: %s\n", OpenSSL_Error());
@@ -4003,7 +4014,13 @@ void InitCryptLibrary()
 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
 	ossl_provider_default = OSSL_PROVIDER_load(NULL, "legacy");
 	ossl_provider_legacy = OSSL_PROVIDER_load(NULL, "default");
-	ossl_provider_oqsprovider = OSSL_PROVIDER_load(NULL, "oqsprovider");
+
+	char *oqs_provider_name = "oqsprovider";
+	#ifndef SKIP_OQS_PROVIDER
+		// Registers "oqsprovider" as a provider -- necessary because oqsprovider is built in now.
+		OSSL_PROVIDER_add_builtin(NULL, oqs_provider_name, oqs_provider_init); 
+	#endif
+	ossl_provider_oqsprovider = OSSL_PROVIDER_load(NULL, oqs_provider_name);
 #endif
 
 	ssl_clientcert_index = SSL_get_ex_new_index(0, "struct SslClientCertInfo *", NULL, NULL, NULL);
@@ -4592,6 +4609,11 @@ DH_CTX *DhNew(char *prime, UINT g)
 	dh = ZeroMalloc(sizeof(DH_CTX));
 
 	dh->dh = DH_new();
+	if (dh->dh == NULL)
+	{
+		return NULL;
+	}
+	
 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
 	dhp = BinToBigNum(buf->Buf, buf->Size);
 	dhg = BN_new();

src/Mayaqua/Network.c

@@ -11860,6 +11860,12 @@ bool StartSSLEx3(SOCK *sock, X *x, K *priv, LIST *chain, UINT ssl_timeout, char
 #endif
 
 		sock->ssl = SSL_new(ssl_ctx);
+
+		if (sock->ssl == NULL)
+		{
+			return false;
+		}
+
 		SSL_set_fd(sock->ssl, (int)sock->socket);
 
 #ifdef	SSL_CTRL_SET_TLSEXT_HOSTNAME
@@ -16250,6 +16256,12 @@ UINT GetOSSecurityLevel()
 	UINT security_level_new = 0, security_level_set_ssl_version = 0;
 	struct ssl_ctx_st *ctx = SSL_CTX_new(SSLv23_method());
 
+	if (ctx == NULL)
+	{
+		return security_level_new;
+	}
+
+
 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
 	security_level_new = SSL_CTX_get_security_level(ctx);
 #endif