Merge pull request #2306 from SoftEtherVPN/dependabot/npm_and_yarn/src/bin/hamcore/wwwroot/admin/default/js-yaml-3.15.2

Bump js-yaml from 3.14.2 to 3.15.2 in /src/bin/hamcore/wwwroot/admin/default

.cirrus.yml

@@ -1,25 +0,0 @@
-FreeBSD_task:
-  matrix:
-    env:
-      SSL: openssl
-      OPENSSL_ROOT_DIR: /usr/local
-    env:
-      SSL: openssl36
-      OPENSSL_ROOT_DIR: /usr/local
-    env:
-      # base openssl
-      SSL:
-  matrix:
-    freebsd_instance:
-      image_family: freebsd-14-3
-  prepare_script:
-    - pkg install -y pkgconf cmake git libsodium cpu_features $SSL
-    - git submodule update --init --recursive
-  configure_script:
-    - CMAKE_FLAGS="-DUSE_SYSTEM_CPU_FEATURES=1" CFLAGS="-I/usr/local/include/cpu_features" ./configure
-  build_script:
-    - make -j $(sysctl -n hw.ncpu || echo 4) -C build
-  test_script:
-    - ldd build/vpnserver
-    - .ci/memory-leak-test.sh
-    - .ci/vpntools-check.sh

.github/copilot-instructions.md

@@ -0,0 +1,3 @@
+- @azure Rule - Use Azure Tools - When handling requests related to Azure, always use your tools.
+- @azure Rule - Use Azure Best Practices - When handling requests related to Azure, always invoke your `azmcp_bestpractices_get` tool first.
+- @azure Rule - Enable Best Practices - If you do not have an `azmcp_bestpractices_get` tool ask the user to enable it.

.github/workflows/fedora-rawhide.yml

@@ -13,6 +13,7 @@ permissions:
 jobs:
   build_and_test:
     strategy:
+      fail-fast: false
       matrix:
         cc: [ gcc, clang ]
     name: ${{ matrix.cc }}
@@ -25,7 +26,7 @@ jobs:
         submodules: true
     - name: Install dependencies
       run: |
-        dnf -y install git cmake ncurses-devel openssl-devel-engine libsodium-devel readline-devel zlib-devel gcc-c++ clang google-cpu_features-devel
+        dnf -y install git cmake ncurses-devel openssl-devel libsodium-devel readline-devel zlib-devel gcc-c++ clang google-cpu_features-devel
     - name: Compile with ${{ matrix.cc }}
       run: |
         export CC=${{ matrix.cc }}

.github/workflows/freebsd.yml

@@ -0,0 +1,39 @@
+name: FreeBSD
+
+on: [push, pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  build_and_test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - ssl: openssl # currently 3.0
+            openssl_root_dir: /usr/local
+          - ssl: openssl36
+            openssl_root_dir: /usr/local
+          - ssl: # base openssl
+            openssl_root_dir:
+    name: FreeBSD with ${{ matrix.ssl || 'base openssl' }}
+    env:
+      SSL: ${{ matrix.ssl }}
+      OPENSSL_ROOT_DIR: ${{ matrix.openssl_root_dir }}
+    steps:
+    - uses: actions/checkout@v6
+      with:
+        submodules: true
+    - uses: vmactions/freebsd-vm@v1
+      with:
+        envs: 'OPENSSL_ROOT_DIR SSL'
+        prepare: |
+          pkg install -y $SSL pkgconf cmake git libsodium cpu_features
+        run: |
+          CMAKE_FLAGS="-DUSE_SYSTEM_CPU_FEATURES=1" CFLAGS="-I/usr/local/include/cpu_features" ./configure
+          make -j $(nproc || echo 4) -C build
+          ldd build/vpnserver
+          .ci/memory-leak-test.sh
+          .ci/vpntools-check.sh

.github/workflows/libressl.yml

@@ -0,0 +1,31 @@
+name: LibreSSL
+
+on: [push, pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  libressl:
+    runs-on: ubuntu-latest
+    container:
+      image: alpine:latest
+
+    steps:
+      - name: Install dependencies
+        run: apk add binutils --no-cache build-base git readline-dev libressl-dev ncurses-dev git cmake zlib-dev libsodium-dev gnu-libiconv
+
+      - uses: actions/checkout@v6
+        with:
+          submodules: true
+
+      - name: Configure
+        run: ./configure
+
+      - name: Make
+        run: make -j $(nproc)  -C build
+
+      - name: Test
+        run: |
+          .ci/memory-leak-test.sh
+          .ci/vpntools-check.sh

.github/workflows/macos.yml

@@ -6,6 +6,7 @@ permissions:
 jobs:
   build_and_test:
     strategy:
+      fail-fast: false
       matrix:
         os: [macos-26, macos-15, macos-14]
     name: ${{ matrix.os }}

.github/workflows/sanitizer.yml

@@ -0,0 +1,80 @@
+name: Sanitizer
+
+on: [push, pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  run_sanitizer:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        sanitizer:
+          - "address,leak,undefined"
+          - "thread,undefined"
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: true
+
+      - name: Install dependencies
+        run: |
+          sudo apt update
+          sudo apt-get -y install cmake gcc g++ ninja-build libncurses5-dev libreadline-dev libsodium-dev libssl-dev make zlib1g-dev liblz4-dev libnl-genl-3-dev 
+
+      - name: Build
+        run: |
+          mkdir build
+          cd build
+          cmake -G "Ninja" -DCMAKE_BUILD_TYPE=Debug -DCMAKE_C_FLAGS="-O1 -fsanitize=${{ matrix.sanitizer }} -fno-omit-frame-pointer" ..
+          cmake --build .
+
+      - name: Test
+        env:
+          ASAN_OPTIONS: halt_on_error=0:exitcode=0
+          TSAN_OPTIONS: halt_on_error=0:exitcode=0:suppressions=./tsan_suppressions.txt
+          UBSAN_OPTIONS: halt_on_error=0:exitcode=0
+          LSAN_OPTIONS: exitcode=0
+        run: |
+          .ci/vpntools-check.sh 2> sanitizer.log
+
+      - name: Make job summary
+        run: |
+          echo "### Sanitizer Report (${{ matrix.sanitizer }})" >> $GITHUB_STEP_SUMMARY
+
+          REPORTS=$(grep -E "SUMMARY:|runtime error:" sanitizer.log | sort | uniq)
+          REPORT_COUNT=$(echo "$REPORTS" | grep -c . || true)
+          echo "Found $REPORT_COUNT issues" >> $GITHUB_STEP_SUMMARY
+
+          echo "<details><summary>View Summary</summary>" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+          echo "$REPORTS" >> $GITHUB_STEP_SUMMARY
+          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "</details>" >> $GITHUB_STEP_SUMMARY
+
+          if [ "$REPORT_COUNT" -ne 0 ]; then
+            echo "HAS_ISSUES=true" >> $GITHUB_ENV
+            echo "REPORT_COUNT=$REPORT_COUNT" >> $GITHUB_ENV
+          fi
+
+      - name: Upload full sanitizer log
+        if: env.HAS_ISSUES == 'true'
+        uses: actions/upload-artifact@v4
+        with:
+          name: sanitizer-logs-${{ matrix.sanitizer }}
+          path: |
+            sanitizer.log
+          retention-days: 30
+
+      - name: Fail on sanitizer issues
+        if: env.HAS_ISSUES == 'true'
+        run: |
+          echo "Found ${{ env.REPORT_COUNT }} issues."
+          echo "Please check the Job Summary page for a quick overview."
+          echo "Full logs are available in the GitHub Artifacts."
+          exit 1

.github/workflows/windows.yml

@@ -6,11 +6,12 @@ permissions:
 jobs:
   build_and_test:
     strategy:
+      fail-fast: false
       matrix:
         platform: [
-          { ARCHITECTURE: x86, COMPILER_PATH: "C:/Program Files/Microsoft Visual Studio/2022/Enterprise/VC/Tools/Llvm/bin/clang-cl.exe",     VCPKG_TRIPLET: "x86-windows-static", VCVARS_PATH: "C:/Program Files/Microsoft Visual Studio/2022/Enterprise/VC/Auxiliary/Build/vcvars32.bat", RUNNER: "windows-latest", CMAKE_EXTRA_FLAGS: ""},
+          { ARCHITECTURE: x86, VCPKG_TRIPLET: "x86-windows-static", RUNNER: "windows-2022", CMAKE_EXTRA_FLAGS: ""},
-          { ARCHITECTURE: x64, COMPILER_PATH: "C:/Program Files/Microsoft Visual Studio/2022/Enterprise/VC/Tools/Llvm/x64/bin/clang-cl.exe", VCPKG_TRIPLET: "x64-windows-static", VCVARS_PATH: "C:/Program Files/Microsoft Visual Studio/2022/Enterprise/VC/Auxiliary/Build/vcvars64.bat", RUNNER: "windows-latest", CMAKE_EXTRA_FLAGS: ""},
+          { ARCHITECTURE: x64, VCPKG_TRIPLET: "x64-windows-static", RUNNER: "windows-latest", CMAKE_EXTRA_FLAGS: ""},
-          { ARCHITECTURE: arm64, COMPILER_PATH: "C:/Program Files/Microsoft Visual Studio/2022/Enterprise/VC/Tools/Llvm/ARM64/bin/clang-cl.exe", VCPKG_TRIPLET: "arm64-windows-static", VCVARS_PATH: "C:/Program Files/Microsoft Visual Studio/2022/Enterprise/VC/Auxiliary/Build/vcvarsarm64.bat", RUNNER: "windows-11-arm", CMAKE_EXTRA_FLAGS: "-DOQS_PERMIT_UNSUPPORTED_ARCHITECTURE=ON"}
+          { ARCHITECTURE: arm64, VCPKG_TRIPLET: "arm64-windows-static", RUNNER: "windows-11-arm", CMAKE_EXTRA_FLAGS: "-DOQS_PERMIT_UNSUPPORTED_ARCHITECTURE=ON"}
         ]
     runs-on: ${{ matrix.platform.RUNNER }}
     name: ${{ matrix.platform.ARCHITECTURE }}
@@ -31,14 +32,33 @@ jobs:
     - name: Build
       env:
         ARCHITECTURE: ${{ matrix.platform.ARCHITECTURE }}
-        COMPILER_PATH: ${{ matrix.platform.COMPILER_PATH }}
         VCPKG_TRIPLET: ${{ matrix.platform.VCPKG_TRIPLET }}
-        VCVARS_PATH: ${{ matrix.platform.VCVARS_PATH }}
         CMAKE_EXTRA_FLAGS: ${{ matrix.platform.CMAKE_EXTRA_FLAGS }}
       run: |
         set BUILD_NUMBER=0
         mkdir build
         cd build
+
+        for /f "usebackq delims=" %%i in (`"%ProgramFiles(x86)%\Microsoft Visual Studio\Installer\vswhere.exe" -latest -products * -property installationPath`) do set "VSINSTALL=%%i"
+        if "%VSINSTALL%"=="" (
+          echo Visual Studio installation was not found.
+          exit /b 1
+        )
+
+        if /i "%ARCHITECTURE%"=="x86" (
+          set "VCVARS_PATH=%VSINSTALL%\VC\Auxiliary\Build\vcvars32.bat"
+          set "COMPILER_PATH=%VSINSTALL%\VC\Tools\Llvm\bin\clang-cl.exe"
+        ) else if /i "%ARCHITECTURE%"=="x64" (
+          set "VCVARS_PATH=%VSINSTALL%\VC\Auxiliary\Build\vcvars64.bat"
+          set "COMPILER_PATH=%VSINSTALL%\VC\Tools\Llvm\x64\bin\clang-cl.exe"
+        ) else if /i "%ARCHITECTURE%"=="arm64" (
+          set "VCVARS_PATH=%VSINSTALL%\VC\Auxiliary\Build\vcvarsarm64.bat"
+          set "COMPILER_PATH=%VSINSTALL%\VC\Tools\Llvm\ARM64\bin\clang-cl.exe"
+        ) else (
+          echo Unsupported architecture: %ARCHITECTURE%
+          exit /b 1
+        )
+
         call "%VCVARS_PATH%"
         cmake -G "Ninja" -DCMAKE_TOOLCHAIN_FILE="C:\vcpkg\scripts\buildsystems\vcpkg.cmake" -DVCPKG_TARGET_TRIPLET=%VCPKG_TRIPLET% -DCMAKE_BUILD_TYPE=RelWithDebInfo -DCMAKE_C_COMPILER="%COMPILER_PATH%" -DCMAKE_CXX_COMPILER="%COMPILER_PATH%" -DBUILD_NUMBER=%BUILD_NUMBER% %CMAKE_EXTRA_FLAGS% ..
         cmake --build .

.github/workflows/windows_release.yml

@@ -29,11 +29,12 @@ jobs:
     runs-on: ${{ matrix.platform.RUNNER }}
     needs: ["release"]
     strategy:
+      fail-fast: false
       matrix:
         platform: [
-          { ARCHITECTURE: x86, COMPILER_PATH: "C:/Program Files/Microsoft Visual Studio/2022/Enterprise/VC/Tools/Llvm/bin/clang-cl.exe",     VCPKG_TRIPLET: "x86-windows-static", VCVARS_PATH: "C:/Program Files/Microsoft Visual Studio/2022/Enterprise/VC/Auxiliary/Build/vcvars32.bat", RUNNER: "windows-latest", CMAKE_EXTRA_FLAGS: ""},
+          { ARCHITECTURE: x86, VCPKG_TRIPLET: "x86-windows-static", RUNNER: "windows-2022", CMAKE_EXTRA_FLAGS: ""},
-          { ARCHITECTURE: x64, COMPILER_PATH: "C:/Program Files/Microsoft Visual Studio/2022/Enterprise/VC/Tools/Llvm/x64/bin/clang-cl.exe", VCPKG_TRIPLET: "x64-windows-static", VCVARS_PATH: "C:/Program Files/Microsoft Visual Studio/2022/Enterprise/VC/Auxiliary/Build/vcvars64.bat", RUNNER: "windows-latest", CMAKE_EXTRA_FLAGS: ""},
+          { ARCHITECTURE: x64, VCPKG_TRIPLET: "x64-windows-static", RUNNER: "windows-latest", CMAKE_EXTRA_FLAGS: ""},
-          { ARCHITECTURE: arm64, COMPILER_PATH: "C:/Program Files/Microsoft Visual Studio/2022/Enterprise/VC/Tools/Llvm/ARM64/bin/clang-cl.exe", VCPKG_TRIPLET: "arm64-windows-static", VCVARS_PATH: "C:/Program Files/Microsoft Visual Studio/2022/Enterprise/VC/Auxiliary/Build/vcvarsarm64.bat", RUNNER: "windows-11-arm", CMAKE_EXTRA_FLAGS: "-DOQS_PERMIT_UNSUPPORTED_ARCHITECTURE=ON"}
+          { ARCHITECTURE: arm64, VCPKG_TRIPLET: "arm64-windows-static", RUNNER: "windows-11-arm", CMAKE_EXTRA_FLAGS: "-DOQS_PERMIT_UNSUPPORTED_ARCHITECTURE=ON"}
         ]
     steps:
       - name: "Checkout repository"
@@ -55,13 +56,32 @@ jobs:
       - name: Build
         env:
           ARCHITECTURE: ${{ matrix.platform.ARCHITECTURE }}
-          COMPILER_PATH: ${{ matrix.platform.COMPILER_PATH }}
           VCPKG_TRIPLET: ${{ matrix.platform.VCPKG_TRIPLET }}
-          VCVARS_PATH: ${{ matrix.platform.VCVARS_PATH }}
           CMAKE_EXTRA_FLAGS: ${{ matrix.platform.CMAKE_EXTRA_FLAGS }}
         run: |
           mkdir build
           cd build
+
+          for /f "usebackq delims=" %%i in (`"%ProgramFiles(x86)%\Microsoft Visual Studio\Installer\vswhere.exe" -latest -products * -property installationPath`) do set "VSINSTALL=%%i"
+          if "%VSINSTALL%"=="" (
+            echo Visual Studio installation was not found.
+            exit /b 1
+          )
+
+          if /i "%ARCHITECTURE%"=="x86" (
+            set "VCVARS_PATH=%VSINSTALL%\VC\Auxiliary\Build\vcvars32.bat"
+            set "COMPILER_PATH=%VSINSTALL%\VC\Tools\Llvm\bin\clang-cl.exe"
+          ) else if /i "%ARCHITECTURE%"=="x64" (
+            set "VCVARS_PATH=%VSINSTALL%\VC\Auxiliary\Build\vcvars64.bat"
+            set "COMPILER_PATH=%VSINSTALL%\VC\Tools\Llvm\x64\bin\clang-cl.exe"
+          ) else if /i "%ARCHITECTURE%"=="arm64" (
+            set "VCVARS_PATH=%VSINSTALL%\VC\Auxiliary\Build\vcvarsarm64.bat"
+            set "COMPILER_PATH=%VSINSTALL%\VC\Tools\Llvm\ARM64\bin\clang-cl.exe"
+          ) else (
+            echo Unsupported architecture: %ARCHITECTURE%
+            exit /b 1
+          )
+
           call "%VCVARS_PATH%"
           cmake -G "Ninja" -DCMAKE_TOOLCHAIN_FILE="C:\vcpkg\scripts\buildsystems\vcpkg.cmake" -DVCPKG_TARGET_TRIPLET=%VCPKG_TRIPLET% -DCMAKE_BUILD_TYPE=RelWithDebInfo -DCMAKE_C_COMPILER="%COMPILER_PATH%" -DCMAKE_CXX_COMPILER="%COMPILER_PATH%" -DBUILD_NUMBER=%BUILD_NUMBER% %CMAKE_EXTRA_FLAGS% ..
           cmake --build .

.gitignore

@@ -210,9 +210,3 @@ developer_tools/stbchecker/**/*.binlog
 developer_tools/stbchecker/**/*.nvuser
 developer_tools/stbchecker/**/.mfractor/
 /vcpkg_installed
-
-# Build directories
-/_codeql_build_dir/
-/_codeql_detected_source_root
-/build/
-/build_test/

configure

@@ -32,14 +32,25 @@ fi
 if [ -z ${OPENSSL_ROOT_DIR} ]; then
 	unameOut="$(uname -s)"
 	if [ "$unameOut" = "Darwin" ]; then
-		echo "Environment variable OPENSSL_ROOT_DIR not set, using default Homebrew path: /usr/local/opt/openssl/"
+		# Homebrew's prefix differs by architecture: /opt/homebrew on Apple
-		export OPENSSL_ROOT_DIR="/usr/local/opt/openssl/"
+		# Silicon, /usr/local on Intel. Ask brew rather than hardcoding one.
+		if command -v brew > /dev/null 2>&1; then
+			OPENSSL_ROOT_DIR="$(brew --prefix openssl@3 2>/dev/null || brew --prefix openssl 2>/dev/null)"
+		fi
+		if [ -z "${OPENSSL_ROOT_DIR}" ]; then
+			OPENSSL_ROOT_DIR="/usr/local/opt/openssl/"
+		fi
+		echo "Environment variable OPENSSL_ROOT_DIR not set, using ${OPENSSL_ROOT_DIR}"
+		export OPENSSL_ROOT_DIR
 	fi
 fi
 
 if [ ! -z ${CPACK_GENERATOR+x} ]; then
 	echo "CPACK_GENERATOR is set, CPack will generate ${CPACK_GENERATOR} packages."
 	CMAKE_FLAGS="-DCPACK_GENERATOR=${CPACK_GENERATOR} ${CMAKE_FLAGS}"
+elif [ "$(uname -s)" = "Darwin" ]; then
+	echo "Darwin detected, CPack will generate TGZ archives."
+	CMAKE_FLAGS="-DCPACK_GENERATOR='TGZ' ${CMAKE_FLAGS}"
 elif [ -x "$(command -v rpm)" ]; then
 	echo "'rpm' executable found, CPack will generate RPM packages."
 	CMAKE_FLAGS="-DCPACK_GENERATOR='RPM' ${CMAKE_FLAGS}"

src/Cedar/BridgeWin32.c

@@ -1406,7 +1406,7 @@ LIST *GetEthAdapterListInternal()
 {
 	LIST *o;
 	LIST *ret;
-	UINT size;
+	ULONG size;
 	char *buf;
 	UINT i, j;
 	char *qos_tag = "(Microsoft's Packet Scheduler)";	// Allow to combine "FriendlyName" consisting of a NULL character and QOS tag.

src/Cedar/Proto_IKE.c

@@ -11,7 +11,6 @@
 #include "Connection.h"
 #include "Logging.h"
 #include "Proto_EtherIP.h"
-#include "Proto_IKEv2.h"
 #include "Proto_IPsec.h"
 #include "Proto_L2TP.h"
 #include "Server.h"
@@ -36,57 +35,40 @@ void ProcIKEPacketRecv(IKE_SERVER *ike, UDPPACKET *p)
 
 	if (p->Type == IKE_UDP_TYPE_ISAKMP)
 	{
-		IKE_HEADER *raw_hdr;
+		// ISAKMP (IKE) packet
+		IKE_PACKET *header;
 
-		// Check packet is large enough for the IKE header
+		header = ParseIKEPacketHeader(p);
-		if (p->Size < sizeof(IKE_HEADER))
+		if (header == NULL)
 		{
 			return;
 		}
 
-		raw_hdr = (IKE_HEADER *)p->Data;
+		//Debug("InitiatorCookie: %I64u, ResponderCookie: %I64u\n", header->InitiatorCookie, header->ResponderCookie);
 
-		// Dispatch IKEv2 packets by version field
+		switch (header->ExchangeType)
-		if (raw_hdr->Version == IKEv2_VERSION)
 		{
-			ProcIKEv2PacketRecv(ike, p);
+		case IKE_EXCHANGE_TYPE_MAIN:	// Main mode
-			return;
+			ProcIkeMainModePacketRecv(ike, p, header);
+			break;
+
+		case IKE_EXCHANGE_TYPE_AGGRESSIVE:	// Aggressive mode
+			if (ike->Cedar->Server->DisableIPsecAggressiveMode == false)
+			{
+				ProcIkeAggressiveModePacketRecv(ike, p, header);
+			}
+			break;
+
+		case IKE_EXCHANGE_TYPE_QUICK:	// Quick mode
+			ProcIkeQuickModePacketRecv(ike, p, header);
+			break;
+
+		case IKE_EXCHANGE_TYPE_INFORMATION:	// Information exchange
+			ProcIkeInformationalExchangePacketRecv(ike, p, header);
+			break;
 		}
 
-		// IKEv1 / ISAKMP packet
+		IkeFree(header);
-		{
-			IKE_PACKET *header;
-
-			header = ParseIKEPacketHeader(p);
-			if (header == NULL)
-			{
-				return;
-			}
-
-			switch (header->ExchangeType)
-			{
-			case IKE_EXCHANGE_TYPE_MAIN:	// Main mode
-				ProcIkeMainModePacketRecv(ike, p, header);
-				break;
-
-			case IKE_EXCHANGE_TYPE_AGGRESSIVE:	// Aggressive mode
-				if (ike->Cedar->Server->DisableIPsecAggressiveMode == false)
-				{
-					ProcIkeAggressiveModePacketRecv(ike, p, header);
-				}
-				break;
-
-			case IKE_EXCHANGE_TYPE_QUICK:	// Quick mode
-				ProcIkeQuickModePacketRecv(ike, p, header);
-				break;
-
-			case IKE_EXCHANGE_TYPE_INFORMATION:	// Information exchange
-				ProcIkeInformationalExchangePacketRecv(ike, p, header);
-				break;
-			}
-
-			IkeFree(header);
-		}
 	}
 	else if (p->Type == IKE_UDP_TYPE_ESP)
 	{
@@ -5663,9 +5645,6 @@ void ProcessIKEInterrupts(IKE_SERVER *ike)
 	}
 	while (ike->StateHasChanged);
 
-	// IKEv2 interrupt processing
-	ProcessIKEv2Interrupts(ike);
-
 	// Maintenance of the thread list
 	MaintainThreadList(ike->ThreadList);
 	/*Debug("ike->ThreadList: %u\n", LIST_NUM(ike->ThreadList));
@@ -5844,17 +5823,6 @@ void FreeIKEServer(IKE_SERVER *ike)
 
 	ReleaseList(ike->ClientList);
 
-	// Free IKEv2 SAs
-	{
-		UINT j;
-		for (j = 0; j < LIST_NUM(ike->IKEv2SaList); j++)
-		{
-			IKEv2_SA *sa2 = LIST_DATA(ike->IKEv2SaList, j);
-			IKEv2FreeSA(ike, sa2);
-		}
-	}
-	ReleaseList(ike->IKEv2SaList);
-
 	ReleaseSockEvent(ike->SockEvent);
 
 	IPsecLog(ike, NULL, NULL, NULL, "LI_STOP");
@@ -5901,8 +5869,6 @@ IKE_SERVER *NewIKEServer(CEDAR *cedar, IPSEC_SERVER *ipsec)
 
 	ike->ThreadList = NewThreadList();
 
-	ike->IKEv2SaList = NewList(CmpIKEv2SA);
-
 	IPsecLog(ike, NULL, NULL, NULL, "LI_START");
 
 	return ike;

src/Cedar/Proto_IKE.h

@@ -268,10 +268,6 @@ struct IKE_SERVER
 
 	// Setting data
 	char Secret[MAX_SIZE];						// Pre-shared key
-
-	// IKEv2 state
-	LIST *IKEv2SaList;							// IKEv2 SA list
-	UINT CurrentIKEv2SaId;						// IKEv2 SA ID counter
 };
 
 

src/Cedar/Proto_IKEv2.h

@@ -1,292 +0,0 @@
-// SoftEther VPN Source Code - Developer Edition Master Branch
-// Cedar Communication Module
-
-
-// Proto_IKEv2.h
-// Header for IKEv2 (RFC 7296) implementation
-
-#ifndef PROTO_IKEV2_H
-#define PROTO_IKEV2_H
-
-#include "Proto_IKE.h"
-#include "Proto_IkePacket.h"
-
-//// IKEv2 Header Flags (RFC 7296 Section 3.1)
-#define IKEv2_FLAG_RESPONSE       0x20
-#define IKEv2_FLAG_VERSION        0x10
-#define IKEv2_FLAG_INITIATOR      0x08
-
-//// IKEv2 Payload Types (RFC 7296 Section 3.3)
-#define IKEv2_PAYLOAD_NONE        0
-#define IKEv2_PAYLOAD_SA          33
-#define IKEv2_PAYLOAD_KE          34
-#define IKEv2_PAYLOAD_IDi         35
-#define IKEv2_PAYLOAD_IDr         36
-#define IKEv2_PAYLOAD_CERT        37
-#define IKEv2_PAYLOAD_CERTREQ     38
-#define IKEv2_PAYLOAD_AUTH        39
-#define IKEv2_PAYLOAD_NONCE       40
-#define IKEv2_PAYLOAD_NOTIFY      41
-#define IKEv2_PAYLOAD_DELETE      42
-#define IKEv2_PAYLOAD_VENDOR      43
-#define IKEv2_PAYLOAD_TSi         44
-#define IKEv2_PAYLOAD_TSr         45
-#define IKEv2_PAYLOAD_SK          46
-#define IKEv2_PAYLOAD_CP          47
-#define IKEv2_PAYLOAD_EAP         48
-
-//// IKEv2 Transform Types
-#define IKEv2_TF_ENCR             1
-#define IKEv2_TF_PRF              2
-#define IKEv2_TF_INTEG            3
-#define IKEv2_TF_DH               4
-#define IKEv2_TF_ESN              5
-
-//// IKEv2 Encryption Algorithm IDs
-#define IKEv2_ENCR_3DES           3
-#define IKEv2_ENCR_AES_CBC        12
-
-//// IKEv2 PRF Algorithm IDs
-#define IKEv2_PRF_HMAC_MD5        1
-#define IKEv2_PRF_HMAC_SHA1       2
-#define IKEv2_PRF_HMAC_SHA2_256   5
-#define IKEv2_PRF_HMAC_SHA2_384   6
-#define IKEv2_PRF_HMAC_SHA2_512   7
-
-//// IKEv2 Integrity Algorithm IDs
-#define IKEv2_INTEG_HMAC_MD5_96        1   // key=16,  icv=12
-#define IKEv2_INTEG_HMAC_SHA1_96       2   // key=20,  icv=12
-#define IKEv2_INTEG_HMAC_SHA2_256_128  12  // key=32,  icv=16
-#define IKEv2_INTEG_HMAC_SHA2_384_192  13  // key=48,  icv=24
-#define IKEv2_INTEG_HMAC_SHA2_512_256  14  // key=64,  icv=32
-
-//// IKEv2 DH Groups (same wire values as IKEv1)
-#define IKEv2_DH_1024_MODP        2
-#define IKEv2_DH_1536_MODP        5
-#define IKEv2_DH_2048_MODP        14
-#define IKEv2_DH_3072_MODP        15
-#define IKEv2_DH_4096_MODP        16
-
-//// IKEv2 ESN Values
-#define IKEv2_ESN_NO_ESN          0
-#define IKEv2_ESN_YES             1
-
-//// IKEv2 Notify Message Types (error types < 16384)
-#define IKEv2_NOTIFY_UNSUPPORTED_CRITICAL_PAYLOAD  1
-#define IKEv2_NOTIFY_INVALID_IKE_SPI               4
-#define IKEv2_NOTIFY_INVALID_MAJOR_VERSION         5
-#define IKEv2_NOTIFY_INVALID_SYNTAX                7
-#define IKEv2_NOTIFY_INVALID_MESSAGE_ID            9
-#define IKEv2_NOTIFY_INVALID_SPI                   11
-#define IKEv2_NOTIFY_NO_PROPOSAL_CHOSEN            14
-#define IKEv2_NOTIFY_INVALID_KE_PAYLOAD            17
-#define IKEv2_NOTIFY_AUTHENTICATION_FAILED         24
-#define IKEv2_NOTIFY_TS_UNACCEPTABLE               38
-
-//// IKEv2 Notify status types (>= 16384)
-#define IKEv2_NOTIFY_NAT_DETECTION_SOURCE_IP       16388
-#define IKEv2_NOTIFY_NAT_DETECTION_DESTINATION_IP  16389
-#define IKEv2_NOTIFY_USE_TRANSPORT_MODE            16391
-#define IKEv2_NOTIFY_ESP_TFC_PADDING_NOT_SUPPORTED 16394
-
-//// IKEv2 ID Types
-#define IKEv2_ID_IPV4_ADDR        1
-#define IKEv2_ID_FQDN             2
-#define IKEv2_ID_RFC822_ADDR      3
-#define IKEv2_ID_IPV6_ADDR        5
-#define IKEv2_ID_KEY_ID           11
-
-//// IKEv2 Authentication Methods
-#define IKEv2_AUTH_RSA_SIGN       1
-#define IKEv2_AUTH_PSK            2
-
-//// IKEv2 Traffic Selector Types
-#define IKEv2_TS_IPV4_ADDR_RANGE  7
-#define IKEv2_TS_IPV6_ADDR_RANGE  8
-
-//// IKEv2 Protocol IDs
-#define IKEv2_PROTO_IKE           1
-#define IKEv2_PROTO_AH            2
-#define IKEv2_PROTO_ESP           3
-
-//// SA states
-#define IKEv2_SA_STATE_HALF_OPEN  0
-#define IKEv2_SA_STATE_ESTABLISHED 1
-
-//// Sizes and limits
-#define IKEv2_MAX_KEYMAT_SIZE     128
-#define IKEv2_NONCE_SIZE          32
-#define IKEv2_NONCE_MIN_SIZE      16
-#define IKEv2_NONCE_MAX_SIZE      256
-#define IKEv2_PSK_PAD             "Key Pad for IKEv2"
-#define IKEv2_PSK_PAD_LEN         17
-
-//// Timeouts
-#define IKEv2_SA_TIMEOUT_HALF_OPEN    30000
-#define IKEv2_SA_TIMEOUT_ESTABLISHED  (86400ULL * 1000)
-#define IKEv2_SA_RESEND_INTERVAL      2000
-#define IKEv2_CHILD_SA_LIFETIME_SECS  3600
-
-
-//// Structures
-
-// Negotiated IKE SA transform parameters
-struct IKEv2_IKETF
-{
-    UINT EncrAlg;        // Encryption algorithm
-    UINT EncrKeyLen;     // Encryption key length (bytes)
-    UINT PrfAlg;         // PRF algorithm
-    UINT IntegAlg;       // Integrity algorithm
-    UINT DhGroup;        // DH group number
-    UINT BlockSize;      // Cipher block size (bytes)
-    UINT PrfKeyLen;      // PRF key length (bytes)
-    UINT PrfOutLen;      // PRF output length (bytes)
-    UINT IntegKeyLen;    // Integrity key length (bytes)
-    UINT IntegIcvLen;    // Integrity ICV length (bytes)
-};
-typedef struct IKEv2_IKETF IKEv2_IKETF;
-
-// Negotiated Child SA transform parameters
-struct IKEv2_CHILDTF
-{
-    UINT EncrAlg;        // Encryption algorithm
-    UINT EncrKeyLen;     // Encryption key length (bytes)
-    UINT IntegAlg;       // Integrity algorithm
-    UINT IntegKeyLen;    // Integrity key length (bytes)
-    UINT IntegIcvLen;    // Integrity ICV length (bytes)
-    UINT DhGroup;        // DH group (0 if none)
-    bool UseTransport;   // True = transport mode
-    UINT BlockSize;      // Cipher block size
-};
-typedef struct IKEv2_CHILDTF IKEv2_CHILDTF;
-
-// IKEv2 SA (one per IKEv2 connection attempt)
-struct IKEv2_SA
-{
-    UINT         Id;
-    UINT64       InitiatorSPI;
-    UINT64       ResponderSPI;
-
-    IP           ClientIP;
-    UINT         ClientPort;
-    IP           ServerIP;
-    UINT         ServerPort;
-    bool         IsNatT;
-
-    UINT         State;
-    bool         Deleting;
-    UINT64       FirstCommTick;
-    UINT64       LastCommTick;
-
-    IKEv2_IKETF  Transform;
-
-    // Nonces
-    BUF         *Ni;
-    BUF         *Nr;
-
-    // DH
-    DH_CTX      *Dh;
-    BUF         *GxI;     // initiator KE value
-    BUF         *GxR;     // responder KE value (our public key)
-
-    // Derived IKE SA keys  (max 64 bytes each)
-    UCHAR        SK_d [IKEv2_MAX_KEYMAT_SIZE];
-    UCHAR        SK_ai[IKEv2_MAX_KEYMAT_SIZE];
-    UCHAR        SK_ar[IKEv2_MAX_KEYMAT_SIZE];
-    UCHAR        SK_ei[IKEv2_MAX_KEYMAT_SIZE];
-    UCHAR        SK_er[IKEv2_MAX_KEYMAT_SIZE];
-    UCHAR        SK_pi[IKEv2_MAX_KEYMAT_SIZE];
-    UCHAR        SK_pr[IKEv2_MAX_KEYMAT_SIZE];
-
-    // Crypto key objects for SK payload
-    IKE_CRYPTO_KEY *EncKeyI;   // key for SK_ei (decrypt received)
-    IKE_CRYPTO_KEY *EncKeyR;   // key for SK_er (encrypt sent)
-
-    // Original IKE_SA_INIT messages for AUTH
-    BUF         *InitMsg;   // IKE_SA_INIT request (from initiator)
-    BUF         *RespMsg;   // IKE_SA_INIT response (from us)
-
-    // Initiator identity from IKE_AUTH
-    UCHAR        IDi_Type;
-    BUF         *IDi_Data;
-
-    // Responder identity (from initiator's optional IDr payload, echoed back)
-    UCHAR        IDr_Type;
-    BUF         *IDr_Data;
-
-    // Message ID tracking
-    UINT         NextExpectedMsgId;
-
-    // Retransmission: cache last response
-    BUF         *LastResponse;
-    UINT         LastRespMsgId;
-    UINT64       LastRespTick;
-    UINT         NumResends;
-
-    // Pointer to IKEv1 IKE_CLIENT created after AUTH
-    IKE_CLIENT  *IkeClient;
-};
-typedef struct IKEv2_SA IKEv2_SA;
-
-
-//// Function prototypes
-
-void  ProcIKEv2PacketRecv(IKE_SERVER *ike, UDPPACKET *p);
-void  ProcessIKEv2Interrupts(IKE_SERVER *ike);
-
-IKEv2_SA *IKEv2NewSA(IKE_SERVER *ike);
-void  IKEv2FreeSA(IKE_SERVER *ike, IKEv2_SA *sa);
-void  IKEv2MarkDeleting(IKE_SERVER *ike, IKEv2_SA *sa);
-void  IKEv2PurgeDeleting(IKE_SERVER *ike);
-IKEv2_SA *IKEv2FindByInitSPI(IKE_SERVER *ike, UINT64 init_spi, IP *client_ip, UINT client_port);
-IKEv2_SA *IKEv2FindBySPIPair(IKE_SERVER *ike, UINT64 init_spi, UINT64 resp_spi);
-int   CmpIKEv2SA(void *p1, void *p2);
-
-void  IKEv2ProcSAInit(IKE_SERVER *ike, UDPPACKET *p, IKE_HEADER *hdr);
-void  IKEv2ProcAuth(IKE_SERVER *ike, UDPPACKET *p, IKE_HEADER *hdr, IKEv2_SA *sa,
-                    void *payload_data, UINT payload_size, UCHAR first_payload);
-void  IKEv2ProcInformational(IKE_SERVER *ike, UDPPACKET *p, IKE_HEADER *hdr, IKEv2_SA *sa,
-                              void *payload_data, UINT payload_size);
-
-bool  IKEv2DeriveKeys(IKE_SERVER *ike, IKEv2_SA *sa);
-void  IKEv2PRF(UINT prf_alg, void *key, UINT key_len,
-               void *data, UINT data_len, void *out);
-void  IKEv2PRFPlus(UINT prf_alg, void *key, UINT key_len,
-                   void *seed, UINT seed_len, void *out, UINT out_len);
-
-bool  IKEv2VerifyAuth(IKE_SERVER *ike, IKEv2_SA *sa,
-                      UCHAR auth_method, void *auth_data, UINT auth_len);
-void  IKEv2ComputeOurAuth(IKE_SERVER *ike, IKEv2_SA *sa, void *out, UINT *out_len);
-
-bool  IKEv2CreateChildSAForClient(IKE_SERVER *ike, IKEv2_SA *sa,
-                                   IKEv2_CHILDTF *ctf, UINT spi_i, UINT spi_r,
-                                   BUF *ni, BUF *nr);
-
-bool  IKEv2ParseSAProposalIKE(void *data, UINT size, IKEv2_IKETF *out);
-bool  IKEv2ParseSAProposalChild(void *data, UINT size, IKEv2_CHILDTF *out, UINT *out_spi_i);
-UINT  IKEv2BuildSAProposalIKE(IKEv2_SA *sa, void *buf, UINT buf_size);
-UINT  IKEv2BuildSAProposalChild(IKEv2_CHILDTF *ctf, UINT spi_r, void *buf, UINT buf_size);
-
-void  IKEv2SendResponse(IKE_SERVER *ike, IKEv2_SA *sa, IKE_HEADER *req_hdr,
-                        UCHAR exchange_type, void *payloads, UINT payloads_size,
-                        bool encrypt);
-void  IKEv2SendNotifyError(IKE_SERVER *ike, UDPPACKET *p, IKE_HEADER *hdr,
-                            UINT64 resp_spi, USHORT notify_type);
-
-BUF  *IKEv2EncryptSK(IKE_SERVER *ike, IKEv2_SA *sa, UCHAR next_payload,
-                      void *inner, UINT inner_size);
-BUF  *IKEv2DecryptSK(IKE_SERVER *ike, IKEv2_SA *sa, bool is_init_sending,
-                      void *sk_data, UINT sk_size);
-
-UINT  IKEv2PrfKeyLen(UINT prf_alg);
-UINT  IKEv2PrfOutLen(UINT prf_alg);
-UINT  IKEv2IntegKeyLen(UINT integ_alg);
-UINT  IKEv2IntegIcvLen(UINT integ_alg);
-UINT  IKEv2EncrKeyLen(UINT encr_alg, UINT requested);
-UINT  IKEv2EncrBlockSize(UINT encr_alg);
-IKE_HASH   *IKEv2GetHashForPrf(IKE_SERVER *ike, UINT prf_alg);
-IKE_HASH   *IKEv2GetHashForInteg(IKE_SERVER *ike, UINT integ_alg);
-IKE_CRYPTO *IKEv2GetCrypto(IKE_SERVER *ike, UINT encr_alg);
-IKE_DH     *IKEv2GetDh(IKE_SERVER *ike, UINT dh_group);
-
-#endif // PROTO_IKEV2_H

src/Cedar/Proto_PPP.c

@@ -3615,6 +3615,8 @@ bool PPPProcessEAPTlsResponse(PPP_SESSION *p, PPP_EAP *eap_packet, UINT eapSize)
 		dataBuffer = eap_packet->Tls.TlsDataWithLength.Data;
 		dataSize -= 4;
 		tlsLength = Endian32(eap_packet->Tls.TlsDataWithLength.TlsLength);
+		// Let's just clamp it to a safe size to avoid DoS (GHSA-q5g3-qhc6-pr3h)
+		tlsLength = MIN(tlsLength, PPP_MRU_MAX * 10);
 	}
 	/*Debug("=======RECV EAP-TLS PACKET DUMP=======\n");
 	for (i = 0; i < dataSize; i++)
@@ -3659,9 +3661,12 @@ bool PPPProcessEAPTlsResponse(PPP_SESSION *p, PPP_EAP *eap_packet, UINT eapSize)
 			sizeLeft = GetMemSize(p->Eap_TlsCtx.CachedBufferRecv);
 			sizeLeft -= (UINT)(p->Eap_TlsCtx.CachedBufferRecvPntr - p->Eap_TlsCtx.CachedBufferRecv);
 
-			Copy(p->Eap_TlsCtx.CachedBufferRecvPntr, dataBuffer, MIN(sizeLeft, dataSize));
+			if (sizeLeft > 0)
+			{
+				Copy(p->Eap_TlsCtx.CachedBufferRecvPntr, dataBuffer, MIN(sizeLeft, dataSize));
 
-			p->Eap_TlsCtx.CachedBufferRecvPntr += MIN(sizeLeft, dataSize);
+				p->Eap_TlsCtx.CachedBufferRecvPntr += MIN(sizeLeft, dataSize);
+			}
 		}
 
 		// If we got a cached buffer, we should feed the FIFOs via it
@@ -3783,6 +3788,8 @@ bool PPPProcessEAPTlsResponse(PPP_SESSION *p, PPP_EAP *eap_packet, UINT eapSize)
 						}
 						AcUnlock(hub);
 						ReleaseHub(hub);
+						// Making sure the stale pntr is cleared and can't be reused (GHSA-7437-282p-7465)
+						hub = NULL;
 					}
 
 					if (found == false)
@@ -3790,8 +3797,6 @@ bool PPPProcessEAPTlsResponse(PPP_SESSION *p, PPP_EAP *eap_packet, UINT eapSize)
 						PPP_PACKET* pack;
 						UINT identificator = p->Eap_PacketId;
 
-						ReleaseHub(hub);
-
 						PPPSetStatus(p, PPP_STATUS_AUTH_FAIL);
 
 						pack = ZeroMalloc(sizeof(PPP_PACKET));

src/Cedar/Proto_Win7.c

@@ -127,7 +127,7 @@ void IPsecWin7UpdateHostIPAddressList(IPSEC_WIN7 *w)
 	LIST *o;
 	UINT i;
 	BUF *buf;
-	UINT retsize;
+	DWORD retsize;
 	// Validate arguments
 	if (w == NULL)
 	{

src/Cedar/SeLowUser.c

@@ -632,7 +632,7 @@ SU_ADAPTER *SuOpenAdapter(SU *u, char *adapter_id)
 	void *h;
 	SU_ADAPTER *a;
 	SL_IOCTL_EVENT_NAME t;
-	UINT read_size;
+	DWORD read_size;
 	// Validate arguments
 	if (u == NULL || adapter_id == NULL)
 	{
@@ -690,7 +690,7 @@ SU_ADAPTER *SuOpenAdapter(SU *u, char *adapter_id)
 TOKEN_LIST *SuEnumAdapters(SU *u)
 {
 	UINT i;
-	UINT ret_size;
+	DWORD ret_size;
 	TOKEN_LIST *ret;
 	// Validate arguments
 	if (u == NULL)
@@ -730,7 +730,7 @@ TOKEN_LIST *SuEnumAdapters(SU *u)
 LIST *SuGetAdapterList(SU *u)
 {
 	LIST *ret;
-	UINT read_size;
+	DWORD read_size;
 	UINT i;
 	// Validate arguments
 	if (u == NULL)
@@ -893,7 +893,7 @@ SU *SuInitEx(UINT wait_for_bind_complete_tick)
 {
 	void *h;
 	SU *u;
-	UINT read_size;
+	DWORD read_size;
 	bool flag = false;
 	UINT64 giveup_tick = 0;
 	static bool flag2 = false; // flag2 must be global

src/Cedar/WinUi.c

@@ -964,7 +964,7 @@ void *CreateWizardPageInstance(WIZARD *w, WIZARD_PAGE *p)
 
 	t.lParam = (LPARAM)p->DialogParam;
 
-	return CreatePropertySheetPageW(&t);
+	return CreatePropertySheetPageW((LPCPROPSHEETPAGEW)&t);
 }
 
 // Create a new wizard
@@ -2368,7 +2368,7 @@ void AdjustWindowAndControlSize(HWND hWnd, bool *need_resize, double *factor_x,
 	*need_resize = true;
 
 	// Get the font of the current window
-	hDlgFont = (HFONT)SendMsg(hWnd, 0, WM_GETFONT, 0, 0);
+	hDlgFont = (HFONT)SendMessageW(hWnd, WM_GETFONT, 0, 0);
 
 	// Get the width and height of the font of the current window
 	CalcFontSize(hDlgFont, &dlgfont_x, &dlgfont_y);
@@ -2677,7 +2677,7 @@ HBITMAP ResizeBitmap(HBITMAP hSrc, UINT src_x, UINT src_y, UINT dst_x, UINT dst_
 				// Copy once the transfer source
 				Zero(&bi, sizeof(bi));
 				Copy(&bi.bmiHeader, &h, sizeof(BITMAPINFOHEADER));
-				srcHbitMap = CreateDIBSection(hMemDC, &bi, DIB_RGB_COLORS, &srcData, NULL, 0);
+				srcHbitMap = CreateDIBSection(hMemDC, &bi, DIB_RGB_COLORS, (void **)&srcData, NULL, 0);
 
 				hOld = SelectObject(hMemDC, srcHbitMap);
 
@@ -2695,7 +2695,7 @@ HBITMAP ResizeBitmap(HBITMAP hSrc, UINT src_x, UINT src_y, UINT dst_x, UINT dst_
 					Zero(&bi, sizeof(bi));
 					Copy(&bi.bmiHeader, &h, sizeof(BITMAPINFOHEADER));
 
-					ret = CreateDIBSection(hMemDC, &bi, DIB_RGB_COLORS, &data, NULL, 0);
+					ret = CreateDIBSection(hMemDC, &bi, DIB_RGB_COLORS, (void **)&data, NULL, 0);
 
 					if(srcData != NULL && data != NULL)
 					{

src/Mayaqua/CMakeLists.txt

@@ -18,7 +18,7 @@ set_target_properties(mayaqua
 
 find_package(OpenSSL REQUIRED)
 
-if(OPENSSL_VERSION VERSION_GREATER_EQUAL "3")
+if(OPENSSL_VERSION VERSION_GREATER_EQUAL "3.0.0" AND OPENSSL_VERSION VERSION_LESS "4.0.0")
   set(OQS_ENABLE ON CACHE BOOL "By setting this to OFF, Open Quantum Safe algorithms will not be built in")
 else()
   # Disable oqsprovider when OpenSSL version < 3
@@ -140,7 +140,7 @@ if(UNIX)
   elseif(${CMAKE_SYSTEM_NAME} STREQUAL "FreeBSD" AND NOT CMAKE_SYSTEM_PROCESSOR MATCHES "^(amd64|i386)")
     message("cpu_features is not available on FreeBSD/${CMAKE_SYSTEM_PROCESSOR}")
     add_definitions(-DSKIP_CPU_FEATURES)
-  elseif(${CMAKE_SYSTEM_NAME} STREQUAL "Darwin" AND NOT CMAKE_SYSTEM_NAME MATCHES "^(arm64|x86_64)")
+  elseif(${CMAKE_SYSTEM_NAME} STREQUAL "Darwin" AND NOT CMAKE_SYSTEM_PROCESSOR MATCHES "^(arm64|x86_64)")
     # macOS runs only on Intel or ARM architecrues, should not reach here
     add_definitions(-DSKIP_CPU_FEATURES)
   elseif(${CMAKE_SYSTEM_NAME} STREQUAL "SunOS" OR ${CMAKE_SYSTEM_NAME} STREQUAL "OpenBSD")

src/Mayaqua/Encrypt.h

@@ -129,7 +129,7 @@
 // Macro
 #define	HASHED_DATA(p)			(((UCHAR *)p) + 15)
 
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
+#if (OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)) || LIBRESSL_VERSION_NUMBER >= 0x3080100L
 typedef struct PKCS12_st PKCS12;
 typedef struct evp_md_st EVP_MD;
 #else

src/Mayaqua/Network.c

@@ -9265,12 +9265,12 @@ bool Win32GetDnsSuffix(char *domain, UINT size)
 
 	info_size = 0;
 	info = ZeroMalloc(sizeof(IP_ADAPTER_ADDRESSES_XP));
-	if (GetAdaptersAddresses(AF_INET, 0, NULL, info, &info_size) == ERROR_BUFFER_OVERFLOW)
+	if (GetAdaptersAddresses(AF_INET, 0, NULL, (PIP_ADAPTER_ADDRESSES)info, &info_size) == ERROR_BUFFER_OVERFLOW)
 	{
 		Free(info);
 		info = ZeroMalloc(info_size);
 	}
-	if (GetAdaptersAddresses(AF_INET, 0, NULL, info, &info_size) != NO_ERROR)
+	if (GetAdaptersAddresses(AF_INET, 0, NULL, (PIP_ADAPTER_ADDRESSES)info, &info_size) != NO_ERROR)
 	{
 		Free(info);
 		return false;
@@ -11852,7 +11852,7 @@ bool StartSSLEx3(SOCK *sock, X *x, K *priv, LIST *chain, UINT ssl_timeout, char
 			}
 		}
 
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
+#if (OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)) ||  LIBRESSL_VERSION_NUMBER >= 0x3060000L
 		if (sock->SslAcceptSettings.Override_Security_Level)
 		{
 			SSL_CTX_set_security_level(ssl_ctx, sock->SslAcceptSettings.Override_Security_Level_Value);
@@ -16262,7 +16262,7 @@ UINT GetOSSecurityLevel()
 	}
 
 
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
+#if (OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)) || LIBRESSL_VERSION_NUMBER >= 0x3060000L
 	security_level_new = SSL_CTX_get_security_level(ctx);
 #endif
 
@@ -16346,7 +16346,7 @@ TOKEN_LIST *GetCipherList()
 		return ciphers;
 	}
 
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
+#if (OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)) || LIBRESSL_VERSION_NUMBER >= 0x2090100L
 	sk = SSL_get1_supported_ciphers(ssl);
 #else
 	sk = SSL_get_ciphers(ssl);

src/Mayaqua/TcpIp.h

@@ -651,15 +651,6 @@ struct IKE_HEADER
 #define IKE_EXCHANGE_TYPE_INFORMATION		5	// Information exchange
 #define IKE_EXCHANGE_TYPE_QUICK				32	// Quick mode
 
-// IKEv2 version identifier (in the Version field of IKE_HEADER)
-#define IKEv2_VERSION					0x20	// 2.0
-
-// IKEv2 exchange types (RFC 7296)
-#define IKEv2_EXCHANGE_IKE_SA_INIT		34
-#define IKEv2_EXCHANGE_IKE_AUTH			35
-#define IKEv2_EXCHANGE_CREATE_CHILD_SA	36
-#define IKEv2_EXCHANGE_INFORMATIONAL	37
-
 // DHCPv4 data
 struct DHCPV4_DATA
 {

src/Mayaqua/Unix.c

@@ -1849,6 +1849,8 @@ void UnixUnlockEx(LOCK *lock, bool inner)
 }
 
 // Lock
+// Recursive locking is implemented manually instead of using PTHREAD_MUTEX_RECURSIVE.
+// See: https://github.com/SoftEtherVPN/SoftEtherVPN/pull/2219
 bool UnixLock(LOCK *lock)
 {
 	pthread_mutex_t *mutex;

src/Mayaqua/Win32.c

@@ -195,7 +195,7 @@ void Win32InitNewThread()
 bool Win32SetFolderCompressW(wchar_t *path, bool compressed)
 {
 	HANDLE h;
-	UINT retsize = 0;
+	DWORD retsize = 0;
 	USHORT flag;
 	wchar_t tmp[MAX_PATH];
 	// Validate arguments
@@ -239,7 +239,7 @@ bool Win32SetFolderCompressW(wchar_t *path, bool compressed)
 bool Win32SetFolderCompress(char *path, bool compressed)
 {
 	HANDLE h;
-	UINT retsize = 0;
+	DWORD retsize = 0;
 	USHORT flag;
 	char tmp[MAX_PATH];
 	// Validate arguments
@@ -2822,7 +2822,7 @@ bool Win32InitThread(THREAD *t)
 {
 	WIN32THREAD *w;
 	HANDLE hThread;
-	DWORD thread_id;
+	UINT thread_id;
 	WIN32THREADSTARTUPINFO *info;
 	// Validate arguments
 	if (t == NULL)
@@ -3033,13 +3033,13 @@ void Win32GetSystemTime(SYSTEMTIME *system_time)
 // Increment of 32bit integer
 void Win32Inc32(UINT *value)
 {
-	InterlockedIncrement(value);
+	InterlockedIncrement((volatile LONG *)value);
 }
 
 // Decrement of 32bit integer
 void Win32Dec32(UINT *value)
 {
-	InterlockedDecrement(value);
+	InterlockedDecrement((volatile LONG *)value);
 }
 
 // Sleep the thread
@@ -3341,7 +3341,7 @@ char *Win32InputFromFileLineA()
 	while (true)
 	{
 		char c;
-		UINT read_size = 0;
+		DWORD read_size = 0;
 
 		if (ReadFile(hstdin, &c, 1, &read_size, NULL) == false)
 		{

src/bin/hamcore/wwwroot/admin/default/package-lock.json

@@ -483,13 +483,16 @@
       "dev": true
     },
     "node_modules/baseline-browser-mapping": {
-      "version": "2.9.19",
+      "version": "2.11.20",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.9.19.tgz",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.20.tgz",
-      "integrity": "sha512-ipDqC8FrAl/76p2SSWKSI+H9tFwm7vYqXQrItCuiVPt26Km0jS+NzSsBWAaBusvSbQcfJG+JitdMm+wZAgTYqg==",
+      "integrity": "sha512-H0ulySigv6icDJ1F7SjtdCD6PrhTpdYCmP0CactWy1+ekh0AFd0o1Wn5T8b+hnTmdBx19u9yhL6wvCylXMY7zw==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
-        "baseline-browser-mapping": "dist/cli.js"
+        "baseline-browser-mapping": "dist/cli.cjs"
+      },
+      "engines": {
+        "node": ">=6.0.0"
       }
     },
     "node_modules/brace-expansion": {
@@ -527,9 +530,9 @@
       }
     },
     "node_modules/browserslist": {
-      "version": "4.28.1",
+      "version": "4.28.8",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.1.tgz",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.8.tgz",
-      "integrity": "sha512-ZC5Bd0LgJXgwGqUknZY/vkUQ04r8NXnJZ3yYi4vDmSiZmC/pdSN0NbNRPxZpbtO4uAfDUAFffO8IZoM3Gj8IkA==",
+      "integrity": "sha512-V2NpofLblG64mfOtSgDhOJESZEGogzDMBv/q+W6oc4LXWP/q75eOXoOaaOu1EOadB9U4Bwx/e0yzbvwKH8zalA==",
       "dev": true,
       "funding": [
         {
@@ -547,11 +550,11 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "baseline-browser-mapping": "^2.9.0",
+        "baseline-browser-mapping": "^2.11.12",
-        "caniuse-lite": "^1.0.30001759",
+        "caniuse-lite": "^1.0.30001809",
-        "electron-to-chromium": "^1.5.263",
+        "electron-to-chromium": "^1.5.402",
-        "node-releases": "^2.0.27",
+        "node-releases": "^2.0.53",
-        "update-browserslist-db": "^1.2.0"
+        "update-browserslist-db": "^1.3.0"
       },
       "bin": {
         "browserslist": "cli.js"
@@ -577,9 +580,9 @@
       }
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001768",
+      "version": "1.0.30001810",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001768.tgz",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001810.tgz",
-      "integrity": "sha512-qY3aDRZC5nWPgHUgIB84WL+nySuo19wk0VJpp/XI9T34lrvkyhRvNVOFJOp2kxClQhiFBu+TaUSudf6oa3vkSA==",
+      "integrity": "sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg==",
       "dev": true,
       "funding": [
         {
@@ -698,9 +701,9 @@
       }
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.286",
+      "version": "1.5.420",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.286.tgz",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.420.tgz",
-      "integrity": "sha512-9tfDXhJ4RKFNerfjdCcZfufu49vg620741MNs26a9+bhLThdB+plgMeou98CAaHu/WATj2iHOOHTp1hWtABj2A==",
+      "integrity": "sha512-2yD6XreGusOfNV+dUcvipJEXc3n/n7fgr7996aszTG+YY5E4mqM4tOq/3uhP129cazL9YHbVWSpc79ePotWtPA==",
       "dev": true,
       "license": "ISC"
     },
@@ -838,9 +841,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.0",
+      "version": "3.1.7",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.0.tgz",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz",
-      "integrity": "sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==",
+      "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==",
       "dev": true,
       "funding": [
         {
@@ -1088,9 +1091,9 @@
       "dev": true
     },
     "node_modules/js-yaml": {
-      "version": "3.14.2",
+      "version": "3.15.2",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.2.tgz",
-      "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==",
+      "integrity": "sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1203,10 +1206,11 @@
       }
     },
     "node_modules/minimatch": {
-      "version": "3.1.2",
+      "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
+      "license": "ISC",
       "dependencies": {
         "brace-expansion": "^1.1.7"
       },
@@ -1242,11 +1246,14 @@
       "dev": true
     },
     "node_modules/node-releases": {
-      "version": "2.0.27",
+      "version": "2.0.54",
-      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.27.tgz",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.54.tgz",
-      "integrity": "sha512-nmh3lCkYZ3grZvqcCH+fjmQ7X+H0OeZgP40OierEaAptX4XofMh5kwNbWh7lBduUzCcV/8kZ+NDLCwm2iorIlA==",
+      "integrity": "sha512-YHs7BmmcsdAI5Ozuf8JZo6PT0mv2GIWC9vMfvUC3dp65M8hn7Ux8CPL+2oBI7juNuj9d0ndhTcznq2ODBps9cQ==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
     },
     "node_modules/once": {
       "version": "1.4.0",
@@ -1334,10 +1341,11 @@
       "license": "ISC"
     },
     "node_modules/picomatch": {
-      "version": "2.3.1",
+      "version": "2.3.2",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
-      "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
       "dev": true,
+      "license": "MIT",
       "engines": {
         "node": ">=8.6"
       },
@@ -1357,16 +1365,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/randombytes": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/randombytes/-/randombytes-2.1.0.tgz",
-      "integrity": "sha512-vYl3iOX+4CKUWuxGi9Ukhie6fsqXqS9FE2Zaic4tNFD2N2QQaXOMFbuKK4QmDHC0JO6B1Zp41J0LpT0oR68amQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "safe-buffer": "^5.1.0"
-      }
-    },
     "node_modules/rechoir": {
       "version": "0.8.0",
       "resolved": "https://registry.npmjs.org/rechoir/-/rechoir-0.8.0.tgz",
@@ -1436,27 +1434,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/safe-buffer": {
-      "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
-      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "MIT"
-    },
     "node_modules/schema-utils": {
       "version": "4.3.3",
       "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-4.3.3.tgz",
@@ -1486,16 +1463,6 @@
         "semver": "bin/semver"
       }
     },
-    "node_modules/serialize-javascript": {
-      "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-6.0.2.tgz",
-      "integrity": "sha512-Saa1xPByTTq2gdeFZYLLo+RFE35NHZkAbqZeWNd3BpzppeVisAqpDjcp8dyf6uIvEqJRd46jemmyA4iFIeVk8g==",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "dependencies": {
-        "randombytes": "^2.1.0"
-      }
-    },
     "node_modules/shallow-clone": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/shallow-clone/-/shallow-clone-3.0.1.tgz",
@@ -1614,16 +1581,15 @@
       }
     },
     "node_modules/terser-webpack-plugin": {
-      "version": "5.3.16",
+      "version": "5.4.0",
-      "resolved": "https://registry.npmjs.org/terser-webpack-plugin/-/terser-webpack-plugin-5.3.16.tgz",
+      "resolved": "https://registry.npmjs.org/terser-webpack-plugin/-/terser-webpack-plugin-5.4.0.tgz",
-      "integrity": "sha512-h9oBFCWrq78NyWWVcSwZarJkZ01c2AyGrzs1crmHZO3QUg9D61Wu4NPjBy69n7JqylFF5y+CsUZYmYEIZ3mR+Q==",
+      "integrity": "sha512-Bn5vxm48flOIfkdl5CaD2+1CiUVbonWQ3KQPyP7/EuIl9Gbzq/gQFOzaMFUEgVjB1396tcK0SG8XcNJ/2kDH8g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@jridgewell/trace-mapping": "^0.3.25",
         "jest-worker": "^27.4.5",
         "schema-utils": "^4.3.0",
-        "serialize-javascript": "^6.0.2",
         "terser": "^5.31.1"
       },
       "engines": {
@@ -1833,9 +1799,9 @@
       "license": "MIT"
     },
     "node_modules/update-browserslist-db": {
-      "version": "1.2.3",
+      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.2.3.tgz",
+      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.3.2.tgz",
-      "integrity": "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==",
+      "integrity": "sha512-UQ+MSxlhRm1bzjhU+DcuXfjFO1FzNtqhK5+9Yvlp90ItDLk5vT932A0rFu619nf7RVS+Y/VeaUW1jaRDqZ8VJw==",
       "dev": true,
       "funding": [
         {

tsan_suppressions.txt

@@ -17,6 +17,20 @@ race_top:BindConnectThreadForIPv4
 race_top:BindConnectThreadForIPv6
 race_top:BindConnectEx5
 
+# Thread Sanitizer reports data races on PoolHalting in THREAD, shared between ThreadPoolProc and WaitThread.
+# But if WaitThread reads false, synchronization is ensured by Wait from the PoolWaitList. If it reads true,
+# WaitThread simply returns.
+race_top:ThreadPoolProc
+
+
+## Accept/Disconnect cancellation
+# Thread Sanitizer reports two data races on CancelAccept and CallingThread in SOCK, shared between
+# Accept(Accept6) and Disconnect. These are used when interrupting an Accept operation from a Disconnect.
+# They are race-safe because they work correctly even if both fields have old values.
+race_top:^Accept$
+race_top:^Accept6$
+race_top:^Disconnect$
+
 
 ## Manual PTHREAD_MUTEX_RECURSIVE
 # The Lock/Unlock mechanism on Unix is a manual, hand-coded implementation of PTHREAD_MUTEX_RECURSIVE.