Attention is currently required from: cron2, flichtenheld, plaisthos.

d12fk has posted comments on this change. ( )

Change subject: Windows: enforce 'block-local' with WFP filters

Patch Set 3:


File doc/man-sections/vpn-network-options.rst: :
PS1, Line 357:       Push this flag to defend against the TunnelCrack attacks.
> Most terminals handle links sensibly these days. Also we publish this as HTML 
> documentation. […]

File src/openvpn/init.c: :
PS1, Line 1971:         /* Fortify 'redirect-gateway block-local' with firewall 
rules? */
> Okay there's not much to gain with respect to breaking out run_up_down, as 
> that one requires too muc […]

File src/openvpn/route.c: :
PS1, Line 78: static bool add_route(struct route_ipv4 *r, const struct tuntap 
*tt, unsigned int flags,
> Right, failed to spot this. The build results speak for themselves. […]

File src/openvpn/wfp_block.c: :
PS1, Line 197:     FWPM_FILTER_CONDITION0 Condition[2];
> because the filters are zeroed right below, and than copied into [0] and/or 
> [1] below as needed, so  […]

File src/openvpn/win32.c: :
PS1, Line 1225:     if (ret == false)
> Right, but you could just replace the "got out" with "return false" anyway.
Yes, but no. The function has a single point of return, let's keep it that way. 
There's not enough to gain by changing this.

To view, visit
To unsubscribe, or for help writing mail filters, visit

Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Ic9bf797bfc7e2d471998a84cb0f071db3e4832ba
Gerrit-Change-Number: 489
Gerrit-PatchSet: 3
Gerrit-Owner: d12fk <>
Gerrit-Reviewer: flichtenheld <>
Gerrit-Reviewer: plaisthos <>
Gerrit-CC: cron2 <>
Gerrit-CC: openvpn-devel <>
Gerrit-Attention: plaisthos <>
Gerrit-Attention: cron2 <>
Gerrit-Attention: flichtenheld <>
Gerrit-Comment-Date: Tue, 09 Jan 2024 14:53:24 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: cron2 <>
Comment-In-Reply-To: flichtenheld <>
Comment-In-Reply-To: d12fk <>
Gerrit-MessageType: comment
Openvpn-devel mailing list

Reply via email to