[Openvpn-devel] [PATCH applied] Re: cleanup: merge packet_id_alloc_outgoing() into packet_id_write()

2017-06-13 Thread Gert Doering
ACK. Same patch as in 2.3 Diffing the two *patches* shows differences like this one: - else if (cipher_kt_mode_ofb_cfb(cipher_kt)) + else if (mode == EVP_CIPH_CFB_MODE || mode == EVP_CIPH_OFB_MODE) .. but's not a patch change, but different context (old 2.2 crypto style). Your

[Openvpn-devel] [PATCH applied] Re: Drop packets instead of assert out if packet id rolls over (CVE-2017-7479)

2017-06-13 Thread Gert Doering
ACK, same patch as in 2.3 (minus the obvious differences in context, Changes.rst, cmocka). Your patch has been applied to the release/2.2 branch. commit 66576f9903cc166072901673ff1e673fa2e29611 Author: Steffan Karger Date: Thu May 11 23:13:41 2017 +0200 Drop packets instead of assert out

[Openvpn-devel] [PATCH applied] Re: Drop packets instead of assert out if packet id rolls over (CVE-2017-7479)

2017-06-13 Thread Gert Doering
ACK, same patch as in 2.3 (minus the obvious differences in context, Changes.rst, cmocka). Your patch has been applied to the release/2.2 branch. commit 66576f9903cc166072901673ff1e673fa2e29611 Author: Steffan Karger Date: Thu May 11 23:13:41 2017 +0200 Drop packets instead of assert out

[Openvpn-devel] [PATCH applied] Re: openssl: fix overflow check for long --tls-cipher option

2017-06-13 Thread Gert Doering
ACK ("stared at code"). Have no ASAN setup here so replicating the original problem involved a bit of extra msg()'ing and then scratching my head, but I can confirm that the original math ended up with an integer underflow / unsigned, and the comarison not firing... Your patch has been applied

Re: [Openvpn-devel] W10 Client assigns old AND new IPv6 address to TAP with GUI+Service but not with cmd prompt

2017-06-13 Thread debbie10t
Hi Selva, thanks for your answer. On 12/06/17 20:23, Selva Nair wrote: On Wed, Jun 7, 2017 at 12:41 PM, debbie10t wrote: Hi, I have a basic setup and discovered that my W10 client was assigning a second IPv6 address to TAP even though it is *not* being pushed by the server. The second addre

Re: [Openvpn-devel] W10 Client assigns old AND new IPv6 address to TAP with GUI+Service but not with cmd prompt

2017-06-13 Thread Илья Шипицин
13 июн. 2017 г. 7:29 ПП пользователь "debbie10t" написал: Hi Selva, thanks for your answer. On 12/06/17 20:23, Selva Nair wrote: > On Wed, Jun 7, 2017 at 12:41 PM, debbie10t wrote: > > Hi, >> >> I have a basic setup and discovered that my W10 client was assigning a >> second IPv6 address to T

Re: [Openvpn-devel] W10 Client assigns old AND new IPv6 address to TAP with GUI+Service but not with cmd prompt

2017-06-13 Thread Selva Nair
On Tue, Jun 13, 2017 at 1:25 PM, Илья Шипицин wrote: > I decided to try some tests .. in fact I only did one test. > I rebooted the PC and now the second IP address has gone. > (Windows Fast shutdown/reboot disabled .. so full reboot) > > I also tried to recreate the problem but so far cannot ..

Re: [Openvpn-devel] W10 Client assigns old AND new IPv6 address to TAP with GUI+Service but not with cmd prompt

2017-06-13 Thread debbie10t
Rather astonishingly .. I can now reliably recreate the problem !! As client: Config-1 assigns 12fc:1918::10:36:101:110/112 to TAP (in tun mode) Config-2 assigns 12fc:1918::10:8:0:110/112 to TAP (in tun mode) Following: 1. Administrator command prompt - execute openvp config-1.ovpn TAP

Re: [Openvpn-devel] W10 Client assigns old AND new IPv6 address to TAP with GUI+Service but not with cmd prompt

2017-06-13 Thread Илья Шипицин
2017-06-13 23:00 GMT+05:00 Selva Nair : > > On Tue, Jun 13, 2017 at 1:25 PM, Илья Шипицин > wrote: > >> I decided to try some tests .. in fact I only did one test. >> I rebooted the PC and now the second IP address has gone. >> (Windows Fast shutdown/reboot disabled .. so full reboot) >> >> I als

Re: [Openvpn-devel] W10 Client assigns old AND new IPv6 address to TAP with GUI+Service but not with cmd prompt

2017-06-13 Thread Gert Doering
HI, On Tue, Jun 13, 2017 at 07:01:22PM +0100, debbie10t wrote: > Rather astonishingly .. I can now reliably recreate the problem !! > > As client: > Config-1 assigns 12fc:1918::10:36:101:110/112 to TAP (in tun mode) > Config-2 assigns 12fc:1918::10:8:0:110/112 to TAP (in tun mode) > > Fo

Re: [Openvpn-devel] W10 Client assigns old AND new IPv6 address to TAP with GUI+Service but not with cmd prompt

2017-06-13 Thread Selva Nair
On Tue, Jun 13, 2017 at 2:01 PM, debbie10t wrote: > As client: >Config-1 assigns 12fc:1918::10:36:101:110/112 to TAP (in tun mode) >Config-2 assigns 12fc:1918::10:8:0:110/112 to TAP (in tun mode) > > Following: > > 1. Administrator command prompt - execute openvp config-1.ovpn >TAP is

Re: [Openvpn-devel] W10 Client assigns old AND new IPv6 address to TAP with GUI+Service but not with cmd prompt

2017-06-13 Thread Gert Doering
Hi, On Tue, Jun 13, 2017 at 03:19:59PM -0400, Selva Nair wrote: > > 1. Administrator command prompt - execute openvp config-1.ovpn > >TAP is assigned 12fc:1918::10:36:101:110/112 > > 2. Terminate by closing [X] the command prompt [..] > > I haven't tested this, but if both connections use the

Re: [Openvpn-devel] W10 Client assigns old AND new IPv6 address to TAP with GUI+Service but not with cmd prompt

2017-06-13 Thread Selva Nair
On Tue, Jun 13, 2017 at 3:25 PM, Gert Doering wrote: > > I haven't tested this, but if both connections use the same adapter, this > > looks possible as you kill the first process without giving it a chance > to > > remove the IP first. Addresses are added with store=active so would > > disappear

Re: [Openvpn-devel] W10 Client assigns old AND new IPv6 address to TAP with GUI+Service but not with cmd prompt

2017-06-13 Thread Gert Doering
Hi, On Tue, Jun 13, 2017 at 03:33:35PM -0400, Selva Nair wrote: > Right :) But we could probably do better using Set instead of Add while > the address is set using the service. I'm not that familiar with ipapi, but > looks like SetUnicastIpAddressEnrty instead of AddUnicastIpAddressEntry > may b

Re: [Openvpn-devel] W10 Client assigns old AND new IPv6 address to TAP with GUI+Service but not with cmd prompt

2017-06-13 Thread Samuli Seppänen
On 13/06/2017 22:37, Gert Doering wrote: > Hi, > > On Tue, Jun 13, 2017 at 03:33:35PM -0400, Selva Nair wrote: >> Right :) But we could probably do better using Set instead of Add while >> the address is set using the service. I'm not that familiar with ipapi, but >> looks like SetUnicastIpAddres

Re: [Openvpn-devel] W10 Client assigns old AND new IPv6 address to TAP with GUI+Service but not with cmd prompt

2017-06-13 Thread Arne Schwabe
> > > if user is administrator, interactive service is not used. > well, I did miss that about interactive service. > I wonder we should always use the interactive service if available and add (dont-use-interactive) option, so behaviour is always the same. Arne

Re: [Openvpn-devel] W10 Client assigns old AND new IPv6 address to TAP with GUI+Service but not with cmd prompt

2017-06-13 Thread Selva Nair
On Tue, Jun 13, 2017 at 3:54 PM, Arne Schwabe wrote: > > > > > > if user is administrator, interactive service is not used. > > well, I did miss that about interactive service. > > > > I wonder we should always use the interactive service if available and > add (dont-use-interactive) option, so b

Re: [Openvpn-devel] W10 Client assigns old AND new IPv6 address to TAP with GUI+Service but not with cmd prompt

2017-06-13 Thread Selva Nair
On Tue, Jun 13, 2017 at 3:37 PM, Gert Doering wrote: > On Tue, Jun 13, 2017 at 03:33:35PM -0400, Selva Nair wrote: > > Right :) But we could probably do better using Set instead of Add while > > the address is set using the service. I'm not that familiar with ipapi, > but > > looks like SetUnica

Re: [Openvpn-devel] W10 Client assigns old AND new IPv6 address to TAP with GUI+Service but not with cmd prompt

2017-06-13 Thread Илья Шипицин
2017-06-14 1:05 GMT+05:00 Selva Nair : > > On Tue, Jun 13, 2017 at 3:54 PM, Arne Schwabe wrote: > >> > >> > >> > if user is administrator, interactive service is not used. >> > well, I did miss that about interactive service. >> > >> >> I wonder we should always use the interactive service if ava

Re: [Openvpn-devel] W10 Client assigns old AND new IPv6 address to TAP with GUI+Service but not with cmd prompt

2017-06-13 Thread Selva Nair
On Tue, Jun 13, 2017 at 4:30 PM, Илья Шипицин wrote: > 2017-06-14 1:05 GMT+05:00 Selva Nair : > >> >> On Tue, Jun 13, 2017 at 3:54 PM, Arne Schwabe wrote: >> >>> > >>> > >>> > if user is administrator, interactive service is not used. >>> > well, I did miss that about interactive service. >>> >

Re: [Openvpn-devel] W10 Client assigns old AND new IPv6 address to TAP with GUI+Service but not with cmd prompt

2017-06-13 Thread Илья Шипицин
2017-06-14 1:51 GMT+05:00 Selva Nair : > > On Tue, Jun 13, 2017 at 4:30 PM, Илья Шипицин > wrote: > >> 2017-06-14 1:05 GMT+05:00 Selva Nair : >> >>> >>> On Tue, Jun 13, 2017 at 3:54 PM, Arne Schwabe wrote: >>> > > > if user is administrator, interactive service is not used. >