Attention is currently required from: Arne Schwabe, Răzvan Cojocaru. Antonio Quartulli has posted comments on this change by Răzvan Cojocaru. ( https://gerrit.openvpn.net/c/openvpn/+/2159?usp=email )
Change subject: openvpnserv: accept a lone config file that passes validation ...................................................................... Patch Set 1: (2 comments) Patchset: PS1: Thanks! The missing `ret` assignment is a real bug, but making this branch return TRUE has two side effects: 1. A lone *option* now skips the whitelist: `--foo` is only checked as a path (`<config_dir>\--foo` passes), while openvpn.exe parses it as an option. Please only take this branch for non-options (see inline). 2. A lone config file still doesn't work through the service: openvpn.exe gets `openvpn --msg-channel <h> foo.ovpn`, so `foo.ovpn` is taken as an extra parameter of `--msg-channel` and ignored (the "lone arg = config" rule only applies when argc == 2). Users would just see "You must define TUN/TAP device" instead of an empty error. To actually support it, I'd suggest building the command line as `openvpn --msg-channel <h> --config <arg>` when a single non-option is given, *before* validating, and dropping the special case in ValidateOptions(). That way we keep validating exactly what openvpn.exe gets (see c139e82d). A small cmocka test for ValidateOptions() would be great too (lone `foo.ovpn`, lone `..\evil.ovpn`, lone `--script-security`). File src/openvpnserv/interactive.c: https://gerrit.openvpn.net/c/openvpn/+/2159/comment/e32fe0df_f64b4e5c?usp=email : PS1, Line 402: if (argc == first + 1) `if (argc == first + 1 && !IsOption(argv[first]))` -- otherwise a lone `--option` is validated as a config path instead of against the whitelist. -- To view, visit https://gerrit.openvpn.net/c/openvpn/+/2159?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.openvpn.net/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I57469ca50c551ad475510690ecfa2d5e7cf9cfcf Gerrit-Change-Number: 2159 Gerrit-PatchSet: 1 Gerrit-Owner: Răzvan Cojocaru <[email protected]> Gerrit-Reviewer: Arne Schwabe <[email protected]> Gerrit-CC: Antonio Quartulli <[email protected]> Gerrit-CC: openvpn-devel <[email protected]> Gerrit-Attention: Răzvan Cojocaru <[email protected]> Gerrit-Attention: Arne Schwabe <[email protected]> Gerrit-Comment-Date: Wed, 11 Nov 2026 10:03:04 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No
_______________________________________________ Openvpn-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-devel
