Attention is currently required from: Arne Schwabe.
Hello Arne Schwabe,
I'd like you to do a code review.
Please visit
https://gerrit.openvpn.net/c/openvpn/+/2015?usp=email
to review the following change.
Change subject: win: remove --register-dns
......................................................................
win: remove --register-dns
The option ran "ipconfig /flushdns" and "ipconfig /registerdns" on
connection initiation to make Windows pick up pushed DNS servers. This
is no longer needed, since the interactive service configures DNS
directly and takes care of everything that is required and the code
to deal with DNS will be removed from openvpn.exe.
Remove the implementation in openvpn and the interactive service,
including msg_register_dns. The option is still accepted, but
ignored with a warning, like it is done for others already.
Change-Id: I27dce67069704b445dd1e59794f435edffb5eb56
Signed-off-by: Heiko Hund <[email protected]>
---
M Changes.md
M doc/man-sections/unsupported-options.rst
M doc/man-sections/windows-options.rst
M include/openvpn-msg.h
M src/openvpn/init.c
M src/openvpn/options.c
M src/openvpn/tun.c
M src/openvpn/tun.h
M src/openvpn/win32.h
M src/openvpnserv/interactive.c
10 files changed, 16 insertions(+), 199 deletions(-)
git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/15/2015/1
diff --git a/Changes.md b/Changes.md
index 5c3270b..ba4491c 100644
--- a/Changes.md
+++ b/Changes.md
@@ -23,6 +23,12 @@
the characters mentioned above were already escaped. However, the behavior of
Mbed TLS is slightly different from OpenSSL in that it also escapes "=".
+* **Removed `--register-dns`**
+
+ The Windows-only option `--register-dns` is now ignored with a warning.
+ Running `ipconfig /flushdns` and `ipconfig /registerdns` on connection
+ initiation is no longer needed for Windows to pick up pushed DNS servers.
+
## Maintainer-visible changes
- The configure-time option `--enable-debug` is no longer available
diff --git a/doc/man-sections/unsupported-options.rst
b/doc/man-sections/unsupported-options.rst
index c273905..00dc7dd 100644
--- a/doc/man-sections/unsupported-options.rst
+++ b/doc/man-sections/unsupported-options.rst
@@ -58,6 +58,11 @@
Removed in OpenVPN 2.7. This option does not make sense anymore as option
strings may not match due to the introduction of parameters negotiation.
+--register-dns
+ Ignored since OpenVPN 2.8. Running ``ipconfig /flushdns`` and
+ ``ipconfig /registerdns`` is no longer needed for Windows to pick up
+ pushed DNS servers.
+
--socks-proxy-retry
Removed in OpenVPN 2.4. All retries are controlled by
``--max-connect-retry``.
diff --git a/doc/man-sections/windows-options.rst
b/doc/man-sections/windows-options.rst
index 8d7dcbb..04610c7 100644
--- a/doc/man-sections/windows-options.rst
+++ b/doc/man-sections/windows-options.rst
@@ -161,11 +161,6 @@
explorer when OpenVPN is run on a configuration file using the
right-click explorer menu.
---register-dns
- Run :code:`ipconfig /flushdns` and :code:`ipconfig /registerdns` on
- connection initiation. This is known to kick Windows into recognizing
- pushed DNS servers.
-
--route-method m
Which method ``m`` to use for adding routes on Windows?
diff --git a/include/openvpn-msg.h b/include/openvpn-msg.h
index ca3267e8..bc3f534a 100644
--- a/include/openvpn-msg.h
+++ b/include/openvpn-msg.h
@@ -42,7 +42,6 @@
msg_flush_neighbors,
msg_add_wfp_block,
msg_del_wfp_block,
- msg_register_dns,
msg_enable_dhcp,
deprecated_msg_register_ring_buffers,
msg_set_mtu,
diff --git a/src/openvpn/init.c b/src/openvpn/init.c
index 3c2ebf9..1cf8dd4 100644
--- a/src/openvpn/init.c
+++ b/src/openvpn/init.c
@@ -1549,10 +1549,6 @@
c->options.no_advance = true;
}
-#ifdef _WIN32
- fork_register_dns_action(c->c1.tuntap);
-#endif
-
#ifdef ENABLE_MANAGEMENT
/* Tell management interface that we initialized */
if (management)
diff --git a/src/openvpn/options.c b/src/openvpn/options.c
index 7fc8614..3f92f6e 100644
--- a/src/openvpn/options.c
+++ b/src/openvpn/options.c
@@ -745,8 +745,6 @@
"--dhcp-renew : Ask Windows to renew the TAP adapter lease on
startup.\n"
"--dhcp-pre-release : Ask Windows to release the previous TAP adapter
lease on\n"
" startup.\n"
- "--register-dns : Run ipconfig /flushdns and ipconfig /registerdns\n"
- " on connection initiation.\n"
"--tap-sleep n : Sleep for n seconds after TAP adapter open before\n"
" attempting to set adapter properties.\n"
"--pause-exit : When run from a console window, pause before
exiting.\n"
@@ -6736,30 +6734,13 @@
}
else if (streq(p[0], "register-dns") && !p[1])
{
- VERIFY_PERMISSION(OPT_P_DHCPDNS);
- options->tuntap_options.register_dns = true;
+ msg(M_WARN, "DEPRECATED OPTION: --register-dns option ignored.");
}
else if (streq(p[0], "block-outside-dns") && !p[1])
{
VERIFY_PERMISSION(OPT_P_DHCPDNS);
options->block_outside_dns = true;
}
- else if (streq(p[0], "rdns-internal") && !p[1])
- /* standalone method for internal use
- *
- * (if --register-dns is set, openvpn needs to call itself in a
- * sub-process to execute the required functions in a non-blocking
- * way, and uses --rdns-internal to signal that to itself)
- */
- {
- VERIFY_PERMISSION(OPT_P_GENERAL);
- set_debug_level(options->verbosity, SDL_CONSTRAIN);
- if (options->tuntap_options.register_dns)
- {
- ipconfig_register_dns(NULL);
- }
- openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
- }
else if (streq(p[0], "show-valid-subnets") && !p[1])
{
VERIFY_PERMISSION(OPT_P_GENERAL);
diff --git a/src/openvpn/tun.c b/src/openvpn/tun.c
index 2c2766f..e8527f2 100644
--- a/src/openvpn/tun.c
+++ b/src/openvpn/tun.c
@@ -4871,28 +4871,6 @@
exec_command("NETSH", a, n, msglevel);
}
-void
-ipconfig_register_dns(const struct env_set *es)
-{
- struct argv argv = argv_new();
- const char err[] = "ERROR: Windows ipconfig command failed";
-
- msg(D_TUNTAP_INFO, "Start ipconfig commands for register-dns...");
- netcmd_semaphore_lock();
-
- argv_printf(&argv, "%s%s /flushdns", get_win_sys_path(),
WIN_IPCONFIG_PATH_SUFFIX);
- argv_msg(D_TUNTAP_INFO, &argv);
- openvpn_execve_check(&argv, es, 0, err);
-
- argv_printf(&argv, "%s%s /registerdns", get_win_sys_path(),
WIN_IPCONFIG_PATH_SUFFIX);
- argv_msg(D_TUNTAP_INFO, &argv);
- openvpn_execve_check(&argv, es, 0, err);
- argv_free(&argv);
-
- netcmd_semaphore_release();
- msg(D_TUNTAP_INFO, "End ipconfig commands for register-dns...");
-}
-
static void
ip_addr_string_to_array(in_addr_t *dest, unsigned int *dest_len, const
IP_ADDR_STRING *src)
{
@@ -5339,54 +5317,6 @@
}
}
-static void
-register_dns_service(const struct tuntap *tt)
-{
- HANDLE msg_channel = tt->options.msg_channel;
- ack_message_t ack;
- struct gc_arena gc = gc_new();
-
- message_header_t rdns = { msg_register_dns, sizeof(message_header_t), 0 };
-
- if (!send_msg_iservice(msg_channel, &rdns, sizeof(rdns), &ack,
"Register_dns"))
- {
- gc_free(&gc);
- return;
- }
-
- else if (ack.error_number != NO_ERROR)
- {
- msg(M_WARN, "Register_dns failed using service: %s [status=0x%x]",
- strerror_win32(ack.error_number, &gc), ack.error_number);
- }
-
- else
- {
- msg(M_INFO, "Register_dns request sent to the service");
- }
-
- gc_free(&gc);
-}
-
-void
-fork_register_dns_action(const struct tuntap *tt)
-{
- if (tt && tt->options.register_dns && tt->options.msg_channel)
- {
- register_dns_service(tt);
- }
- else if (tt && tt->options.register_dns)
- {
- struct gc_arena gc = gc_new();
- struct buffer cmd = alloc_buf_gc(256, &gc);
- const int verb = 3;
-
- buf_printf(&cmd, "openvpn --verb %d --register-dns --rdns-internal",
verb);
- fork_to_self(BSTR(&cmd));
- gc_free(&gc);
- }
-}
-
static uint32_t
dhcp_masq_addr(const in_addr_t local, const in_addr_t netmask, const int
offset)
{
diff --git a/src/openvpn/tun.h b/src/openvpn/tun.h
index 61fe943..b658db2 100644
--- a/src/openvpn/tun.h
+++ b/src/openvpn/tun.h
@@ -135,8 +135,6 @@
bool dhcp_renew;
bool dhcp_pre_release;
- bool register_dns;
-
struct in6_addr dns6[N_DHCP_ADDR];
unsigned int dns6_len;
#if defined(TARGET_ANDROID)
@@ -460,10 +458,6 @@
bool dhcp_renew_by_adapter_index(const DWORD adapter_index);
-void fork_register_dns_action(const struct tuntap *tt);
-
-void ipconfig_register_dns(const struct env_set *es);
-
void tun_standby_init(struct tuntap *tt);
bool tun_standby(struct tuntap *tt);
diff --git a/src/openvpn/win32.h b/src/openvpn/win32.h
index 39ff7d8..5f29ea7 100644
--- a/src/openvpn/win32.h
+++ b/src/openvpn/win32.h
@@ -36,11 +36,10 @@
/* location of executables */
#define SYS_PATH_ENV_VAR_NAME \
"SystemRoot" /* environmental variable name that normally contains the
system path */
-#define NETSH_PATH_SUFFIX "\\system32\\netsh.exe"
-#define WIN_ROUTE_PATH_SUFFIX "\\system32\\route.exe"
-#define WIN_IPCONFIG_PATH_SUFFIX "\\system32\\ipconfig.exe"
-#define WIN_NET_PATH_SUFFIX "\\system32\\net.exe"
-#define POWERSHELL_PATH_SUFFIX
"\\system32\\WindowsPowerShell\\v1.0\\powershell.exe"
+#define NETSH_PATH_SUFFIX "\\system32\\netsh.exe"
+#define WIN_ROUTE_PATH_SUFFIX "\\system32\\route.exe"
+#define WIN_NET_PATH_SUFFIX "\\system32\\net.exe"
+#define POWERSHELL_PATH_SUFFIX
"\\system32\\WindowsPowerShell\\v1.0\\powershell.exe"
/*
* Win32-specific OpenVPN code, targeted at the mingw
diff --git a/src/openvpnserv/interactive.c b/src/openvpnserv/interactive.c
index ed163a4..f4b2d39 100644
--- a/src/openvpnserv/interactive.c
+++ b/src/openvpnserv/interactive.c
@@ -52,8 +52,6 @@
static SERVICE_STATUS status = { .dwServiceType = SERVICE_WIN32_SHARE_PROCESS
};
static HANDLE exit_event = NULL;
static settings_t settings;
-static HANDLE rdns_semaphore = NULL;
-#define RDNS_TIMEOUT 600 /* seconds to wait for the semaphore */
#define TUN_IOCTL_REGISTER_RINGS \
CTL_CODE(51820U, 0x970U, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
@@ -926,80 +924,6 @@
return exit_code;
}
-/*
- * Entry point for register-dns thread.
- */
-static DWORD WINAPI
-RegisterDNS(LPVOID unused)
-{
- DWORD err;
- DWORD timeout = RDNS_TIMEOUT * 1000; /* in milliseconds */
-
- /* path of ipconfig command */
- WCHAR ipcfg[MAX_PATH];
-
- struct
- {
- WCHAR *argv0;
- WCHAR *cmdline;
- DWORD timeout;
- } cmds[] = {
- { ipcfg, L"ipconfig /flushdns", timeout },
- { ipcfg, L"ipconfig /registerdns", timeout },
- };
-
- HANDLE wait_handles[2] = { rdns_semaphore, exit_event };
-
- swprintf(ipcfg, MAX_PATH, L"%ls\\%ls", get_win_sys_path(),
L"ipconfig.exe");
-
- if (WaitForMultipleObjects(2, wait_handles, FALSE, timeout) ==
WAIT_OBJECT_0)
- {
- /* Semaphore locked */
- for (size_t i = 0; i < _countof(cmds); ++i)
- {
- ExecCommand(cmds[i].argv0, cmds[i].cmdline, cmds[i].timeout);
- }
- err = 0;
- if (!ReleaseSemaphore(rdns_semaphore, 1, NULL))
- {
- err =
- MsgToEventLog(M_SYSERR, L"RegisterDNS: Failed to release
regsiter-dns semaphore:");
- }
- }
- else
- {
- MsgToEventLog(M_ERR, L"RegisterDNS: Failed to lock register-dns
semaphore");
- err = ERROR_SEM_TIMEOUT; /* Windows error code 0x79 */
- }
- return err;
-}
-
-static DWORD
-HandleRegisterDNSMessage(void)
-{
- DWORD err;
- HANDLE thread = NULL;
-
- /* Delegate this job to a sub-thread */
- thread = CreateThread(NULL, 0, RegisterDNS, NULL, 0, NULL);
-
- /*
- * We don't add these thread handles to the undo list -- the thread and
- * processes it spawns are all supposed to terminate or timeout by
themselves.
- */
- if (thread)
- {
- err = 0;
- CloseHandle(thread);
- }
- else
- {
- err = GetLastError();
- }
-
- return err;
-}
-
/**
* Run the command: netsh interface ip $action wins $if_index [static] $addr
* @param action "delete", "add" or "set"
@@ -3280,10 +3204,6 @@
}
break;
- case msg_register_dns:
- ack.error_number = HandleRegisterDNSMessage();
- break;
-
case msg_add_dns_cfg:
case msg_del_dns_cfg:
ack.error_number = HandleDNSConfigMessage(&msg.dns, lists);
@@ -3991,13 +3911,6 @@
goto out;
}
- rdns_semaphore = CreateSemaphoreW(NULL, 1, 1, NULL);
- if (!rdns_semaphore)
- {
- error = MsgToEventLog(M_SYSERR, L"Could not create semaphore for
register-dns");
- goto out;
- }
-
error = UpdateWaitHandles(&handles, &handle_count, io_event, threads);
if (error != NO_ERROR)
{
@@ -4122,7 +4035,6 @@
FreeWaitHandles(handles);
CloseHandleEx(&io_event);
CloseHandleEx(&exit_event);
- CloseHandleEx(&rdns_semaphore);
status.dwCurrentState = SERVICE_STOPPED;
status.dwWin32ExitCode = error;
--
To view, visit https://gerrit.openvpn.net/c/openvpn/+/2015?usp=email
To unsubscribe, or for help writing mail filters, visit
https://gerrit.openvpn.net/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: I27dce67069704b445dd1e59794f435edffb5eb56
Gerrit-Change-Number: 2015
Gerrit-PatchSet: 1
Gerrit-Owner: Heiko Hund <[email protected]>
Gerrit-Reviewer: Arne Schwabe <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>
Gerrit-Attention: Arne Schwabe <[email protected]>
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
