Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package dsvpn for openSUSE:Factory checked in at 2026-10-08 11:56:33 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/dsvpn (Old) and /work/SRC/openSUSE:Factory/.dsvpn.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "dsvpn" Thu Oct 8 11:56:33 2026 rev:2 rq:1383092 version:0.1.5 Changes: -------- --- /work/SRC/openSUSE:Factory/dsvpn/dsvpn.changes 2020-04-22 20:51:15.275188110 +0200 +++ /work/SRC/openSUSE:Factory/.dsvpn.new.3698736/dsvpn.changes 2026-10-08 11:58:56.775875958 +0200 @@ -1,0 +2,9 @@ +Wed Oct 7 16:34:08 UTC 2026 - Dirk Müller <[email protected]> + +- update to 0.1.5: + * Replaced deprecated -Ofast with standard optimization flags + * Improved documentation + * No major changes, since `dsvpn` remains secure and rock + solid. + +------------------------------------------------------------------- Old: ---- dsvpn-0.1.4.tar.gz New: ---- dsvpn-0.1.5.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ dsvpn.spec ++++++ --- /var/tmp/diff_new_pack.ah18v7/_old 2026-10-08 11:58:57.856921158 +0200 +++ /var/tmp/diff_new_pack.ah18v7/_new 2026-10-08 11:58:57.859921284 +0200 @@ -1,7 +1,7 @@ # # spec file for package dsvpn # -# Copyright (c) 2020, Martin Hauke <[email protected]> +# Copyright (c) 2026 SUSE LLC and contributors # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -14,9 +14,20 @@ # Please submit bugfixes or comments via https://bugs.opensuse.org/ # +# Copyright (c) 2020, Martin Hauke <[email protected]> +# +# All modifications and additions to the file contributed by third parties +# remain the property of their copyright owners, unless otherwise agreed +# upon. The license for this file, and modifications and additions to the +# file, is the same license as for the pristine package itself (unless the +# license for the pristine package is not an Open Source License, in which +# case the license is the MIT License). An "Open Source License" is a +# license that conforms to the Open Source Definition (Version 1.9) +# published by the Open Source Initiative. + Name: dsvpn -Version: 0.1.4 +Version: 0.1.5 Release: 0 Summary: A Dead Simple VPN License: MIT ++++++ dsvpn-0.1.4.tar.gz -> dsvpn-0.1.5.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/dsvpn-0.1.4/.github/workflows/codeql-analysis.yml new/dsvpn-0.1.5/.github/workflows/codeql-analysis.yml --- old/dsvpn-0.1.4/.github/workflows/codeql-analysis.yml 1970-01-01 01:00:00.000000000 +0100 +++ new/dsvpn-0.1.5/.github/workflows/codeql-analysis.yml 2025-12-19 15:13:01.000000000 +0100 @@ -0,0 +1,51 @@ +name: "CodeQL scan" + +on: + push: + pull_request: + schedule: + - cron: '0 21 * * 6' + +jobs: + CodeQL-Build: + + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v2 + with: + # We must fetch at least the immediate parents so that if this is + # a pull request then we can checkout the head. + fetch-depth: 2 + + # If this run was triggered by a pull request event, then checkout + # the head of the pull request instead of the merge commit. + - run: git checkout HEAD^2 + if: ${{ github.event_name == 'pull_request' }} + + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + uses: github/codeql-action/init@v1 + # Override language selection by uncommenting this and choosing your languages + # with: + # languages: go, javascript, csharp, python, cpp, java + + # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). + # If this step fails, then you should remove it and run the build manually (see below) + - name: Autobuild + uses: github/codeql-action/autobuild@v1 + + # ℹ️ Command-line programs to run using the OS shell. + # 📚 https://git.io/JvXDl + + # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines + # and modify them (or add more) to build your code if your project + # uses a compiled language + + #- run: | + # make bootstrap + # make release + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v1 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/dsvpn-0.1.4/.gitignore new/dsvpn-0.1.5/.gitignore --- old/dsvpn-0.1.4/.gitignore 2019-12-06 00:35:15.000000000 +0100 +++ new/dsvpn-0.1.5/.gitignore 2025-12-19 15:13:01.000000000 +0100 @@ -30,6 +30,8 @@ *.su *.x86_64 *~ +.cflags +.test.c .tmp_versions/ .vscode Mkfile.old @@ -38,3 +40,5 @@ dsvpn key modules.order +zig-out +.zig-cache diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/dsvpn-0.1.4/.travis.yml new/dsvpn-0.1.5/.travis.yml --- old/dsvpn-0.1.4/.travis.yml 2019-12-06 00:35:15.000000000 +0100 +++ new/dsvpn-0.1.5/.travis.yml 1970-01-01 01:00:00.000000000 +0100 @@ -1,24 +0,0 @@ -language: c -sudo: false -dist: bionic - -os: - - linux - -compiler: - - gcc - - clang - -arch: - - arm64 - - amd64 - - s390x - - ppc64le - -matrix: - include: - - os: osx - arch: amd64 - compiler: clang - -script: make diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/dsvpn-0.1.4/LICENSE new/dsvpn-0.1.5/LICENSE --- old/dsvpn-0.1.4/LICENSE 2019-12-06 00:35:15.000000000 +0100 +++ new/dsvpn-0.1.5/LICENSE 2025-12-19 15:13:01.000000000 +0100 @@ -1,6 +1,6 @@ MIT License -Copyright (c) 2019 Frank Denis +Copyright (c) 2019-2025 Frank Denis Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/dsvpn-0.1.4/Makefile new/dsvpn-0.1.5/Makefile --- old/dsvpn-0.1.4/Makefile 2019-12-06 00:35:15.000000000 +0100 +++ new/dsvpn-0.1.5/Makefile 2025-12-19 15:13:01.000000000 +0100 @@ -9,22 +9,24 @@ strip $@ install: dsvpn + install -d $(PREFIX)/sbin install -m 0755 dsvpn $(PREFIX)/sbin uninstall: - rm $(PREFIX)/sbin/dsvpn + rm -f $(PREFIX)/sbin/dsvpn clean: rm -f dsvpn *~ $(CFLAGS_FILE) $(COMPILE_TEST_FILE) $(CFLAGS_FILE): - @CFLAGS="$(CFLAGS)" - @if [ -z "$$CFLAGS" ]; then \ + @CFLAGS="$(CFLAGS)"; \ + if [ -z "$$CFLAGS" ]; then \ if [ ! -r "$(CFLAGS_FILE)" ]; then \ echo "int main(void) { return 0; }" > "$(COMPILE_TEST_FILE)"; \ - for flag in -march=native -mcpu=native -Ofast -Wno-unused-command-line-argument; do \ + for flag in -march=native -mtune=native -O3 -Wno-unused-command-line-argument; do \ $(CC) $${CFLAGS} $${flag} "$(COMPILE_TEST_FILE)" >/dev/null 2>&1 && CFLAGS="$$CFLAGS $$flag"; \ done; \ + rm -f a.out; \ CFLAGS="$${CFLAGS} -Wall -W -Wshadow -Wmissing-prototypes"; \ fi \ fi; \ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/dsvpn-0.1.4/README.md new/dsvpn-0.1.5/README.md --- old/dsvpn-0.1.4/README.md 2019-12-06 00:35:15.000000000 +0100 +++ new/dsvpn-0.1.5/README.md 2025-12-19 15:13:01.000000000 +0100 @@ -1,7 +1,7 @@ #  [](https://github.com/jedisct1/dsvpn/actions) -[](https://travis-ci.org/jedisct1/dsvpn) + DSVPN is a Dead Simple VPN, designed to address the most common use case for using a VPN: @@ -31,7 +31,13 @@ env OPTFLAGS=-mfpu=neon make ``` -On macOS, it can be installed using Homebrew: `brew install nnathan/dsvpn/dsvpn`. +Alternatively, if you have [zig](https://ziglang.org) installed, it can be used to compile DSVPN: + +```sh +zig build -Drelease +``` + +On macOS, DSVPN can be installed using Homebrew: `brew install dsvpn`. ## Secret key @@ -89,7 +95,7 @@ <vpn server port>|"auto" <tun interface>|"auto" <local tun ip>|"auto" - <remote tun ip>"auto" + <remote tun ip>|"auto" <external ip>|"auto" dsvpn "client" @@ -117,7 +123,7 @@ ## Related projects * Robert Debock maintains [an Ansible role for DSVPN](https://github.com/robertdebock/ansible-role-dsvpn) -* [OpenMPTCProuter](http://www.openmptcprouter.com/) is an OpenWRT-based router OS that supports DSVPN +* [OpenMPTCProuter](http://www.openmptcprouter.com/) is an OpenWrt-based router OS that supports DSVPN * Yecheng Fu maintains a [Docker image for DSVPN](https://github.com/cofyc/dsvpn-docker) ## Why @@ -146,4 +152,4 @@ None. -This is not intended to be a replacement for GloryTun or WireGuard. This is what I use, because it solves a problem I had. Extending it to solve different problems is not planned, but feel free to fork it and tailor it to your needs! +This is what I use, because it solves a problem I had. Extending it to solve different problems is not planned, but feel free to fork it and tailor it to your needs! diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/dsvpn-0.1.4/build.zig new/dsvpn-0.1.5/build.zig --- old/dsvpn-0.1.4/build.zig 1970-01-01 01:00:00.000000000 +0100 +++ new/dsvpn-0.1.5/build.zig 2025-12-19 15:13:01.000000000 +0100 @@ -0,0 +1,31 @@ +const std = @import("std"); + +pub fn build(b: *std.Build) !void { + const target = b.standardTargetOptions(.{}); + const optimize = b.standardOptimizeOption(.{ .preferred_optimize_mode = .ReleaseSmall }); + + const root_module = b.createModule(.{ + .target = target, + .optimize = optimize, + .link_libc = true, + .strip = true, + }); + root_module.addIncludePath(b.path("include")); + root_module.addCMacro("_GNU_SOURCE", "1"); + const source_files = &.{ "src/charm.c", "src/os.c", "src/vpn.c" }; + root_module.addCSourceFiles(.{ .files = source_files }); + + const dsvpn = b.addExecutable(.{ + .name = "dsvpn", + .root_module = root_module, + }); + b.installArtifact(dsvpn); + + const run_cmd = b.addRunArtifact(dsvpn); + run_cmd.step.dependOn(b.getInstallStep()); + if (b.args) |args| { + run_cmd.addArgs(args); + } + const run_step = b.step("run", "Run the app"); + run_step.dependOn(&run_cmd.step); +} diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/dsvpn-0.1.4/include/vpn.h new/dsvpn-0.1.5/include/vpn.h --- old/dsvpn-0.1.4/include/vpn.h 2019-12-06 00:35:15.000000000 +0100 +++ new/dsvpn-0.1.5/include/vpn.h 2025-12-19 15:13:01.000000000 +0100 @@ -35,7 +35,7 @@ #include <sys/sys_domain.h> #endif -#define VERSION_STRING "0.1.4" +#define VERSION_STRING "0.1.5" #ifdef __NetBSD__ #define DEFAULT_MTU 1500 Binary files old/dsvpn-0.1.4/logo.png and new/dsvpn-0.1.5/logo.png differ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/dsvpn-0.1.4/src/charm.c new/dsvpn-0.1.5/src/charm.c --- old/dsvpn-0.1.4/src/charm.c 2019-12-06 00:35:15.000000000 +0100 +++ new/dsvpn-0.1.5/src/charm.c 2025-12-19 15:13:01.000000000 +0100 @@ -113,7 +113,7 @@ vst1q_u32((uint32_t *) (void *) &st[8], c); } #else -#define ROTR32(x, b) (uint32_t)(((x) >> (b)) | ((x) << (32 - (b)))) +#define ROTR32(x, b) (uint32_t) (((x) >> (b)) | ((x) << (32 - (b)))) #define SWAP32(s, u, v) \ do { \ t = (s)[u]; \ @@ -179,7 +179,7 @@ _mm_xor_si128(_mm_loadu_si128((const __m128i *) out), _mm_loadu_si128((const __m128i *) in))); #else - unsigned char * out_ = (unsigned char *) out; + unsigned char *out_ = (unsigned char *) out; const unsigned char *in_ = (const unsigned char *) in; size_t i; @@ -189,15 +189,18 @@ #endif } +static volatile unsigned char optblocker; + static inline int equals(const unsigned char a[16], const unsigned char b[16], size_t len) { unsigned char d = 0; size_t i; + len &= 15; for (i = 0; i < len; i++) { d |= a[i] ^ b[i]; } - return 1 & ((d - 1) >> 8); + return (1 ^ optblocker) & ((d - 1 ^ optblocker) >> 8); } static inline void squeeze_permute(uint32_t st[12], unsigned char dst[16]) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/dsvpn-0.1.4/src/os.c new/dsvpn-0.1.5/src/os.c --- old/dsvpn-0.1.4/src/os.c 2019-12-06 00:35:15.000000000 +0100 +++ new/dsvpn-0.1.5/src/os.c 2025-12-19 15:13:01.000000000 +0100 @@ -22,13 +22,13 @@ count -= readnb; buf += readnb; } - return (ssize_t)(buf - (unsigned char *) buf_); + return (ssize_t) (buf - (unsigned char *) buf_); } ssize_t safe_write(const int fd, const void *const buf_, size_t count, const int timeout) { struct pollfd pfd; - const char * buf = (const char *) buf_; + const char *buf = (const char *) buf_; ssize_t written; while (count > (size_t) 0) { @@ -46,7 +46,7 @@ buf += written; count -= written; } - return (ssize_t)(buf - (const char *) buf_); + return (ssize_t) (buf - (const char *) buf_); } ssize_t safe_read_partial(const int fd, void *const buf_, const size_t max_count) @@ -115,7 +115,7 @@ return -1; } memset(&sc, 0, sizeof sc); - sc = (struct sockaddr_ctl){ + sc = (struct sockaddr_ctl) { .sc_id = ci.ctl_id, .sc_len = sizeof sc, .sc_family = AF_SYSTEM, @@ -355,14 +355,14 @@ #endif #if BUFFERBLOAT_CONTROL && defined(TCP_NOTSENT_LOWAT) (void) setsockopt(fd, IPPROTO_TCP, TCP_NOTSENT_LOWAT, - (char *) (unsigned int[]){ NOTSENT_LOWAT }, sizeof(unsigned int)); + (char *) (unsigned int[]) { NOTSENT_LOWAT }, sizeof(unsigned int)); #endif #ifdef TCP_USER_TIMEOUT - (void) setsockopt(fd, IPPROTO_TCP, TCP_USER_TIMEOUT, (char *) (unsigned int[]){ TIMEOUT }, + (void) setsockopt(fd, IPPROTO_TCP, TCP_USER_TIMEOUT, (char *) (unsigned int[]) { TIMEOUT }, sizeof(unsigned int)); #endif #ifdef SO_MARK - (void) setsockopt(fd, SOL_SOCKET, SO_MARK, (char *) (unsigned int[]){ 42069U }, + (void) setsockopt(fd, SOL_SOCKET, SO_MARK, (char *) (unsigned int[]) { 42069U }, sizeof(unsigned int)); #endif return 0; @@ -370,7 +370,7 @@ int shell_cmd(const char *substs[][2], const char *args_str, int silent) { - char * args[64]; + char *args[64]; char cmdbuf[4096]; pid_t child; size_t args_i = 0, cmdbuf_i = 0, args_str_i, i; @@ -421,7 +421,7 @@ } cmdbuf[cmdbuf_i++] = 0; } - if (args_i >= sizeof args / sizeof args[0]) { + if (args_i >= sizeof args / sizeof args[0] || args_i == 0) { return -1; } args[args_i] = NULL; @@ -443,95 +443,94 @@ { if (is_server) { #ifdef __linux__ - static const char - *set_cmds[] = - { "sysctl net.ipv4.ip_forward=1", - "ip addr add $LOCAL_TUN_IP peer $REMOTE_TUN_IP dev $IF_NAME", - "ip -6 addr add $LOCAL_TUN_IP6 peer $REMOTE_TUN_IP6/96 dev $IF_NAME", - "ip link set dev $IF_NAME up", - "iptables -t raw -I PREROUTING ! -i $IF_NAME -d $LOCAL_TUN_IP -m addrtype ! " - "--src-type LOCAL -j DROP", - "iptables -t nat -A POSTROUTING -o $EXT_IF_NAME -s $REMOTE_TUN_IP -j MASQUERADE", - "iptables -t filter -A FORWARD -i $EXT_IF_NAME -o $IF_NAME -m state --state " - "RELATED,ESTABLISHED -j ACCEPT", - "iptables -t filter -A FORWARD -i $IF_NAME -o $EXT_IF_NAME -j ACCEPT", - NULL }, - *unset_cmds[] = { - "iptables -t nat -D POSTROUTING -o $EXT_IF_NAME -s $REMOTE_TUN_IP -j MASQUERADE", - "iptables -t filter -D FORWARD -i $EXT_IF_NAME -o $IF_NAME -m state --state " - "RELATED,ESTABLISHED -j ACCEPT", - "iptables -t filter -D FORWARD -i $IF_NAME -o $EXT_IF_NAME -j ACCEPT", - "iptables -t raw -D PREROUTING ! -i $IF_NAME -d $LOCAL_TUN_IP -m addrtype ! " - "--src-type LOCAL -j DROP", - NULL - }; + static const char *set_cmds + [] = { "sysctl net.ipv4.ip_forward=1", + "ip addr add $LOCAL_TUN_IP peer $REMOTE_TUN_IP dev $IF_NAME", + "ip -6 addr add $LOCAL_TUN_IP6 peer $REMOTE_TUN_IP6/96 dev $IF_NAME", + "ip link set dev $IF_NAME up", + "iptables -t raw -I PREROUTING ! -i $IF_NAME -d $LOCAL_TUN_IP -m addrtype ! " + "--src-type LOCAL -j DROP", + "iptables -t nat -A POSTROUTING -o $EXT_IF_NAME -s $REMOTE_TUN_IP -j MASQUERADE", + "iptables -t filter -A FORWARD -i $EXT_IF_NAME -o $IF_NAME -m state --state " + "RELATED,ESTABLISHED -j ACCEPT", + "iptables -t filter -A FORWARD -i $IF_NAME -o $EXT_IF_NAME -j ACCEPT", + NULL }, + *unset_cmds[] = { + "iptables -t nat -D POSTROUTING -o $EXT_IF_NAME -s $REMOTE_TUN_IP -j MASQUERADE", + "iptables -t filter -D FORWARD -i $EXT_IF_NAME -o $IF_NAME -m state --state " + "RELATED,ESTABLISHED -j ACCEPT", + "iptables -t filter -D FORWARD -i $IF_NAME -o $EXT_IF_NAME -j ACCEPT", + "iptables -t raw -D PREROUTING ! -i $IF_NAME -d $LOCAL_TUN_IP -m addrtype ! " + "--src-type LOCAL -j DROP", + NULL + }; #elif defined(__APPLE__) || defined(__OpenBSD__) || defined(__FreeBSD__) || \ defined(__DragonFly__) || defined(__NetBSD__) - static const char *set_cmds[] = - { "sysctl -w net.inet.ip.forwarding=1", - "ifconfig $IF_NAME $LOCAL_TUN_IP $REMOTE_TUN_IP up", - "ifconfig $IF_NAME inet6 $LOCAL_TUN_IP6 $REMOTE_TUN_IP6 prefixlen 128 up", NULL }, - *unset_cmds[] = { NULL, NULL }; + static const char *set_cmds + [] = { "sysctl -w net.inet.ip.forwarding=1", + "ifconfig $IF_NAME $LOCAL_TUN_IP $REMOTE_TUN_IP up", + "ifconfig $IF_NAME inet6 $LOCAL_TUN_IP6 $REMOTE_TUN_IP6 prefixlen 128 up", + NULL }, + *unset_cmds[] = { NULL, NULL }; #else static const char *const *set_cmds = NULL, *const *unset_cmds = NULL; #endif - return (Cmds){ set_cmds, unset_cmds }; + return (Cmds) { set_cmds, unset_cmds }; } else { #if defined(__APPLE__) || defined(__OpenBSD__) || defined(__FreeBSD__) || \ defined(__DragonFly__) || defined(__NetBSD__) - static const char *set_cmds[] = - { "ifconfig $IF_NAME $LOCAL_TUN_IP $REMOTE_TUN_IP up", - "ifconfig $IF_NAME inet6 $LOCAL_TUN_IP6 $REMOTE_TUN_IP6 prefixlen 128 up", + static const char *set_cmds + [] = { "ifconfig $IF_NAME $LOCAL_TUN_IP $REMOTE_TUN_IP up", + "ifconfig $IF_NAME inet6 $LOCAL_TUN_IP6 $REMOTE_TUN_IP6 prefixlen 128 up", #ifndef NO_DEFAULT_ROUTES - "route add $EXT_IP $EXT_GW_IP", - "route add 0/1 $REMOTE_TUN_IP", - "route add 128/1 $REMOTE_TUN_IP", - "route add -inet6 -blackhole 0000::/1 $REMOTE_TUN_IP6", - "route add -inet6 -blackhole 8000::/1 $REMOTE_TUN_IP6", + "route add $EXT_IP $EXT_GW_IP", + "route add 0/1 $REMOTE_TUN_IP", + "route add 128/1 $REMOTE_TUN_IP", + "route add -inet6 -blackhole 0000::/1 $REMOTE_TUN_IP6", + "route add -inet6 -blackhole 8000::/1 $REMOTE_TUN_IP6", #endif - NULL }, - *unset_cmds[] = { + NULL }, + *unset_cmds[] = { #ifndef NO_DEFAULT_ROUTES - "route delete $EXT_IP", - "route delete 0/1", - "route delete 128/1", - "route delete -inet6 0000::/1", - "route delete -inet6 8000::/1", + "route delete $EXT_IP", + "route delete 0/1", + "route delete 128/1", + "route delete -inet6 0000::/1", + "route delete -inet6 8000::/1", #endif - NULL - }; + NULL + }; #elif defined(__linux__) - static const char - *set_cmds[] = - { "sysctl net.ipv4.tcp_congestion_control=bbr", - "ip link set dev $IF_NAME up", - "iptables -t raw -I PREROUTING ! -i $IF_NAME -d $LOCAL_TUN_IP -m addrtype ! " - "--src-type LOCAL -j DROP", - "ip addr add $LOCAL_TUN_IP peer $REMOTE_TUN_IP dev $IF_NAME", - "ip -6 addr add $LOCAL_TUN_IP6 peer $REMOTE_TUN_IP6/96 dev $IF_NAME", + static const char *set_cmds + [] = { "sysctl net.ipv4.tcp_congestion_control=bbr", + "ip link set dev $IF_NAME up", + "iptables -t raw -I PREROUTING ! -i $IF_NAME -d $LOCAL_TUN_IP -m addrtype ! " + "--src-type LOCAL -j DROP", + "ip addr add $LOCAL_TUN_IP peer $REMOTE_TUN_IP dev $IF_NAME", + "ip -6 addr add $LOCAL_TUN_IP6 peer $REMOTE_TUN_IP6/96 dev $IF_NAME", #ifndef NO_DEFAULT_ROUTES - "ip route add default dev $IF_NAME table 42069", - "ip -6 route add default dev $IF_NAME table 42069", - "ip rule add not fwmark 42069 table 42069", - "ip -6 rule add not fwmark 42069 table 42069", - "ip rule add table main suppress_prefixlength 0", - "ip -6 rule add table main suppress_prefixlength 0", + "ip route add default dev $IF_NAME table 42069", + "ip -6 route add default dev $IF_NAME table 42069", + "ip rule add not fwmark 42069 table 42069", + "ip -6 rule add not fwmark 42069 table 42069", + "ip rule add table main suppress_prefixlength 0", + "ip -6 rule add table main suppress_prefixlength 0", #endif - NULL }, - *unset_cmds[] = { + NULL }, + *unset_cmds[] = { #ifndef NO_DEFAULT_ROUTES - "ip rule delete table 42069", - "ip -6 rule delete table 42069", - "ip rule delete table main suppress_prefixlength 0", - "ip -6 rule delete table main suppress_prefixlength 0", -#endif - "iptables -t raw -D PREROUTING ! -i $IF_NAME -d $LOCAL_TUN_IP -m addrtype ! " - "--src-type LOCAL -j DROP", - NULL - }; + "ip rule delete table 42069", + "ip -6 rule delete table 42069", + "ip rule delete table main suppress_prefixlength 0", + "ip -6 rule delete table main suppress_prefixlength 0", +#endif + "iptables -t raw -D PREROUTING ! -i $IF_NAME -d $LOCAL_TUN_IP -m addrtype ! " + "--src-type LOCAL -j DROP", + NULL + }; #else static const char *const *set_cmds = NULL, *const *unset_cmds = NULL; #endif - return (Cmds){ set_cmds, unset_cmds }; + return (Cmds) { set_cmds, unset_cmds }; } } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/dsvpn-0.1.4/src/vpn.c new/dsvpn-0.1.5/src/vpn.c --- old/dsvpn-0.1.4/src/vpn.c 2019-12-06 00:35:15.000000000 +0100 +++ new/dsvpn-0.1.5/src/vpn.c 2025-12-19 15:13:01.000000000 +0100 @@ -15,15 +15,15 @@ } Buf; typedef struct Context_ { - const char * wanted_if_name; - const char * local_tun_ip; - const char * remote_tun_ip; - const char * local_tun_ip6; - const char * remote_tun_ip6; - const char * server_ip_or_name; - const char * server_port; - const char * ext_if_name; - const char * wanted_ext_gw_ip; + const char *wanted_if_name; + const char *local_tun_ip; + const char *remote_tun_ip; + const char *local_tun_ip6; + const char *remote_tun_ip6; + const char *server_ip_or_name; + const char *server_port; + const char *ext_if_name; + const char *wanted_ext_gw_ip; char client_ip[NI_MAXHOST]; char ext_gw_ip[64]; char server_ip[64]; @@ -50,16 +50,16 @@ static int firewall_rules(Context *context, int set, int silent) { - const char * substs[][2] = { { "$LOCAL_TUN_IP6", context->local_tun_ip6 }, - { "$REMOTE_TUN_IP6", context->remote_tun_ip6 }, - { "$LOCAL_TUN_IP", context->local_tun_ip }, - { "$REMOTE_TUN_IP", context->remote_tun_ip }, - { "$EXT_IP", context->server_ip }, - { "$EXT_PORT", context->server_port }, - { "$EXT_IF_NAME", context->ext_if_name }, - { "$EXT_GW_IP", context->ext_gw_ip }, - { "$IF_NAME", context->if_name }, - { NULL, NULL } }; + const char *substs[][2] = { { "$LOCAL_TUN_IP6", context->local_tun_ip6 }, + { "$REMOTE_TUN_IP6", context->remote_tun_ip6 }, + { "$LOCAL_TUN_IP", context->local_tun_ip }, + { "$REMOTE_TUN_IP", context->remote_tun_ip }, + { "$EXT_IP", context->server_ip }, + { "$EXT_PORT", context->server_port }, + { "$EXT_IF_NAME", context->ext_if_name }, + { "$EXT_GW_IP", context->ext_gw_ip }, + { "$IF_NAME", context->if_name }, + { NULL, NULL } }; const char *const *cmds; size_t i; @@ -139,7 +139,7 @@ return -1; } if ((listen_fd = socket(res->ai_family, SOCK_STREAM, IPPROTO_TCP)) == -1 || - setsockopt(listen_fd, SOL_SOCKET, SO_REUSEADDR, (char *) (int[]){ 1 }, sizeof(int)) != 0) { + setsockopt(listen_fd, SOL_SOCKET, SO_REUSEADDR, (char *) (int[]) { 1 }, sizeof(int)) != 0) { err = errno; (void) close(listen_fd); freeaddrinfo(res); @@ -147,11 +147,11 @@ return -1; } #if defined(IPPROTO_IPV6) && defined(IPV6_V6ONLY) - (void) setsockopt(listen_fd, IPPROTO_IPV6, IPV6_V6ONLY, (char *) (int[]){ 0 }, sizeof(int)); + (void) setsockopt(listen_fd, IPPROTO_IPV6, IPV6_V6ONLY, (char *) (int[]) { 0 }, sizeof(int)); #endif #ifdef TCP_DEFER_ACCEPT (void) setsockopt(listen_fd, SOL_TCP, TCP_DEFER_ACCEPT, - (char *) (int[]){ ACCEPT_TIMEOUT / 1000 }, sizeof(int)); + (char *) (int[]) { ACCEPT_TIMEOUT / 1000 }, sizeof(int)); #endif printf("Listening to %s:%s\n", address == NULL ? "*" : address, port); if (bind(listen_fd, (struct sockaddr *) res->ai_addr, (socklen_t) res->ai_addrlen) != 0 || @@ -171,7 +171,7 @@ } (void) close(context->client_fd); context->client_fd = -1; - context->fds[POLLFD_CLIENT] = (struct pollfd){ .fd = -1, .events = 0 }; + context->fds[POLLFD_CLIENT] = (struct pollfd) { .fd = -1, .events = 0 }; memset(context->uc_st, 0, sizeof context->uc_st); } @@ -296,10 +296,11 @@ static int client_connect(Context *context) { - const char *ext_gw_ip; + const char *ext_gw_ip = NULL; context->client_buf.pos = 0; memset(context->client_buf.data, 0, sizeof context->client_buf.data); +#ifndef NO_DEFAULT_ROUTES if (context->wanted_ext_gw_ip == NULL && (ext_gw_ip = get_default_gw_ip()) != NULL && strcmp(ext_gw_ip, context->ext_gw_ip) != 0) { printf("Gateway changed from [%s] to [%s]\n", context->ext_gw_ip, ext_gw_ip); @@ -307,6 +308,7 @@ snprintf(context->ext_gw_ip, sizeof context->ext_gw_ip, "%s", ext_gw_ip); firewall_rules(context, 1, 0); } +#endif memset(context->uc_st, 0, sizeof context->uc_st); context->uc_st[context->is_server][0] ^= 1; context->client_fd = tcp_client(context->server_ip, context->server_port); @@ -324,7 +326,7 @@ } firewall_rules(context, 1, 0); context->fds[POLLFD_CLIENT] = - (struct pollfd){ .fd = context->client_fd, .events = POLLIN, .revents = 0 }; + (struct pollfd) { .fd = context->client_fd, .events = POLLIN, .revents = 0 }; puts("Connected"); return 0; @@ -352,7 +354,7 @@ { struct pollfd *const fds = context->fds; Buf tun_buf; - Buf * client_buf = &context->client_buf; + Buf *client_buf = &context->client_buf; ssize_t len; int found_fds; int new_client_fd; @@ -377,7 +379,7 @@ client_buf->pos = 0; memset(client_buf->data, 0, sizeof client_buf->data); puts("Session established"); - fds[POLLFD_CLIENT] = (struct pollfd){ .fd = context->client_fd, .events = POLLIN }; + fds[POLLFD_CLIENT] = (struct pollfd) { .fd = context->client_fd, .events = POLLIN }; } if ((fds[POLLFD_TUN].revents & POLLERR) || (fds[POLLFD_TUN].revents & POLLHUP)) { puts("HUP (tun)"); @@ -408,7 +410,7 @@ context->congestion = 1; writenb = (ssize_t) 0; } - if (writenb != (ssize_t)(2U + TAG_LEN + len)) { + if (writenb != (ssize_t) (2U + TAG_LEN + len)) { writenb = safe_write(context->client_fd, tun_buf.len + writenb, 2U + TAG_LEN + len - writenb, TIMEOUT); } @@ -439,21 +441,20 @@ if (client_buf->pos < (len_with_header = 2 + TAG_LEN + (size_t) len)) { break; } - if (uc_decrypt(context->uc_st[1], client_buf->data, len, client_buf->tag, TAG_LEN) != - 0) { + if ((size_t) len > sizeof client_buf->data || + uc_decrypt(context->uc_st[1], client_buf->data, (size_t) len, client_buf->tag, + TAG_LEN) != 0) { fprintf(stderr, "Corrupted stream\n"); sleep(1); return client_reconnect(context); } - if (tun_write(context->tun_fd, client_buf->data, len) != len) { + if (tun_write(context->tun_fd, client_buf->data, (size_t) len) != len) { perror("tun_write"); } if (2 + TAG_LEN + MAX_PACKET_LEN != len_with_header) { unsigned char *rbuf = client_buf->len; - size_t remaining = client_buf->pos - len_with_header, i; - for (i = 0; i < remaining; i++) { - rbuf[i] = rbuf[len_with_header + i]; - } + size_t remaining = client_buf->pos - len_with_header; + memmove(rbuf, rbuf + len_with_header, remaining); } client_buf->pos -= len_with_header; } @@ -466,14 +467,14 @@ context->client_fd = context->listen_fd = -1; memset(context->fds, 0, sizeof *context->fds); context->fds[POLLFD_TUN] = - (struct pollfd){ .fd = context->tun_fd, .events = POLLIN, .revents = 0 }; + (struct pollfd) { .fd = context->tun_fd, .events = POLLIN, .revents = 0 }; if (context->is_server) { if ((context->listen_fd = tcp_listener(context->server_ip_or_name, context->server_port)) == -1) { perror("Unable to set up a TCP server"); return -1; } - context->fds[POLLFD_LISTENER] = (struct pollfd){ + context->fds[POLLFD_LISTENER] = (struct pollfd) { .fd = context->listen_fd, .events = POLLIN, }; @@ -512,7 +513,7 @@ "\n" "dsvpn\t\"server\"\n\t<key file>\n\t<vpn server ip or name>|\"auto\"\n\t<vpn " "server port>|\"auto\"\n\t<tun interface>|\"auto\"\n\t<local tun " - "ip>|\"auto\"\n\t<remote tun ip>\"auto\"\n\t<external ip>|\"auto\"" + "ip>|\"auto\"\n\t<remote tun ip>|\"auto\"\n\t<external ip>|\"auto\"" "\n\n" "dsvpn\t\"client\"\n\t<key file>\n\t<vpn server ip or name>\n\t<vpn server " "port>|\"auto\"\n\t<tun interface>|\"auto\"\n\t<local tun " @@ -536,7 +537,7 @@ static int resolve_ip(char *ip, size_t sizeof_ip, const char *ip_or_name) { - struct addrinfo hints, *res; + struct addrinfo hints, *res = NULL; int eai; memset(&hints, 0, sizeof hints); @@ -549,8 +550,12 @@ (eai = getnameinfo(res->ai_addr, res->ai_addrlen, ip, (socklen_t) sizeof_ip, NULL, 0, NI_NUMERICHOST | NI_NUMERICSERV)) != 0) { fprintf(stderr, "Unable to resolve [%s]: [%s]\n", ip_or_name, gai_strerror(eai)); + if (res != NULL) { + freeaddrinfo(res); + } return -1; } + freeaddrinfo(res); return 0; } @@ -572,14 +577,14 @@ if (context.server_ip_or_name == NULL && !context.is_server) { usage(); } - context.server_port = (argc <= 4 || strcmp(argv[4], "auto") == 0) ? DEFAULT_PORT : argv[4]; - context.wanted_if_name = (argc <= 5 || strcmp(argv[5], "auto") == 0) ? NULL : argv[5]; - context.local_tun_ip = (argc <= 6 || strcmp(argv[6], "auto") == 0) - ? (context.is_server ? DEFAULT_SERVER_IP : DEFAULT_CLIENT_IP) - : argv[6]; - context.remote_tun_ip = (argc <= 7 || strcmp(argv[7], "auto") == 0) - ? (context.is_server ? DEFAULT_CLIENT_IP : DEFAULT_SERVER_IP) - : argv[7]; + context.server_port = (argc <= 4 || strcmp(argv[4], "auto") == 0) ? DEFAULT_PORT : argv[4]; + context.wanted_if_name = (argc <= 5 || strcmp(argv[5], "auto") == 0) ? NULL : argv[5]; + context.local_tun_ip = (argc <= 6 || strcmp(argv[6], "auto") == 0) + ? (context.is_server ? DEFAULT_SERVER_IP : DEFAULT_CLIENT_IP) + : argv[6]; + context.remote_tun_ip = (argc <= 7 || strcmp(argv[7], "auto") == 0) + ? (context.is_server ? DEFAULT_CLIENT_IP : DEFAULT_SERVER_IP) + : argv[7]; context.wanted_ext_gw_ip = (argc <= 8 || strcmp(argv[8], "auto") == 0) ? NULL : argv[8]; ext_gw_ip = context.wanted_ext_gw_ip ? context.wanted_ext_gw_ip : get_default_gw_ip(); snprintf(context.ext_gw_ip, sizeof context.ext_gw_ip, "%s", ext_gw_ip == NULL ? "" : ext_gw_ip);
