v4.34-9744-beta

WARNING.TXT

@@ -375,11 +375,11 @@ Experiment Service Directory Server. The information includes the operator's
 information which described in section 5.5, logging settings, uptime,
 operating system version, type of protocol, port numbers, quality information,
 statistical information, VPN Gate clients' log history data (includes dates,
-IP addresses, version numbers and IDs), log records of destination IP
-addresses and port numbers of VPN Gate communications, and the version of the
-software. These information may be exposed on the directory. VPN Gate Service
-also receives a key for encoding which is described on the chapter 5.9 from
-the directory server.
+IP addresses, version numbers and IDs), log records of destination HTTP/HTTPS
+hostnames or IP addresses and port numbers of VPN Gate communications, and the
+version of the software. These information may be exposed on the directory.
+VPN Gate Service also receives a key for encoding which is described on the
+chapter 5.9 from the directory server.
 
 5.3. Details of VPN Gate Service's Behavior
 If you enable VPN Gate Service manually, which is disabled by default, the

src/BuildUtil/BuildUtilCommands.cs

@@ -1330,7 +1330,7 @@ namespace BuildUtil
 			int certid = vl["CERTID"].IntValue;
 			int shamode = vl["SHAMODE"].IntValue;
 
-			CodeSign.SignFile(destFileName, srcFileName, comment, kernel, certid, shamode);
+			CodeSign.SignFile(destFileName, srcFileName, comment, kernel, false);
 
 			return 0;
 		}

src/BuildUtil/CodeSign.cs

@@ -126,6 +126,52 @@ using BuildUtil.HvSignService;
 
 namespace BuildUtil
 {
+	public static class SignClient
+	{
+		const string SeInternalPasswordFilePath = @"\\192.168.3.2\share\tmp\signserver\password.txt";
+
+		const string Url = "https://codesignserver:7006/sign";
+
+		public static byte[] Sign(byte[] srcData, string certName, string flags, string comment)
+		{
+			string password = File.ReadAllText(SeInternalPasswordFilePath);
+
+			string url = Url + "?password=" + password + "&cert=" + certName + "&flags=" + flags + "&comment=" + comment;
+
+			ServicePointManager.ServerCertificateValidationCallback = delegate { return true; };
+			WebRequest req = HttpWebRequest.Create(url);
+
+			req.Timeout = 60 * 1000;
+			req.Method = "POST";
+
+			using (Stream reqs = req.GetRequestStream())
+			{
+				reqs.Write(srcData, 0, srcData.Length);
+
+				reqs.Close();
+
+				WebResponse res = req.GetResponse();
+
+				using (Stream ress = res.GetResponseStream())
+				{
+					byte[] tmp = new byte[4 * 1024 * 1024];
+
+					MemoryStream ms = new MemoryStream();
+
+					while (true)
+					{
+						int r = ress.Read(tmp, 0, tmp.Length);
+						if (r <= 0) break;
+
+						ms.Write(tmp, 0, r);
+					}
+
+					return ms.ToArray();
+				}
+			}
+		}
+	}
+
 	public static class CodeSign
 	{
 		public const int NumRetries = 1;
@@ -146,9 +192,13 @@ namespace BuildUtil
 		static object lockObj = new object();
 		
 		// Digital-sign the data on the memory
-		public static byte[] SignMemory(byte[] srcData, string comment, bool kernelModeDriver, int cert_id, int sha_mode)
+		public static byte[] SignMemory(byte[] srcData, string comment, bool kernelModeDriver, bool evCert)
 		{
 #if	!BU_OSS
+			// 2020/01/19 switch to the new system
+			return SignClient.Sign(srcData, evCert ? "SoftEtherEv" : "SoftEtherFile", kernelModeDriver ? "Driver" : "", comment);
+
+			/*
 			int i;
 			string out_filename = null;
 			byte[] ret = null;
@@ -240,37 +290,21 @@ namespace BuildUtil
 				File.Delete(tmpFileName);
 			}
 
-			return ret;
+			return ret;*/
 #else	// BU_OSS
 			return srcData;
 #endif	// BU_OSS
 		}
 
 		// Digital-sign the data on the file
-		public static void SignFile(string destFileName, string srcFileName, string comment, bool kernelModeDriver)
-		{
-			int cert_id = UsingCertId;
-
-			SignFile(destFileName, srcFileName, comment, kernelModeDriver, cert_id, 0);
-		}
-		public static void SignFile(string destFileName, string srcFileName, string comment, bool kernelModeDriver, int cert_id, int sha_mode)
+		public static void SignFile(string destFileName, string srcFileName, string comment, bool kernelModeDriver, bool evCert)
 		{
 #if	!BU_OSS
-			if (cert_id == 0)
-			{
-				cert_id = UsingCertId;
-			}
 
 			Con.WriteLine("Signing for '{0}'...", Path.GetFileName(destFileName));
 			byte[] srcData = File.ReadAllBytes(srcFileName);
 
-			if (srcFileName.EndsWith(".msi", StringComparison.InvariantCultureIgnoreCase))
-			{
-				sha_mode = 1;
-				// todo: Set 2 in future !!!
-			}
-
-			byte[] destData = SignMemory(srcData, comment, kernelModeDriver, cert_id, sha_mode);
+			byte[] destData = SignMemory(srcData, comment, kernelModeDriver, evCert);
 
 			try
 			{

src/BuildUtil/Win32BuildSoftware.cs

@@ -170,7 +170,7 @@ namespace BuildUtil
 			Win32BuildUtil.ExecCommand(vpnsetup_exe, string.Format("/SFXMODE:{1} /SFXOUT:\"{0}\"",
 				outFileName, Software.ToString()));
 
-			CodeSign.SignFile(outFileName, outFileName, "VPN Software", false);
+			CodeSign.SignFile(outFileName, outFileName, "VPN Software Installer", false, true);
 		}
 	}
 }

src/BuildUtil/Win32BuildUtil.cs

@@ -166,7 +166,7 @@ namespace BuildUtil
 				m.ReleaseMutex();
 			}
 
-			CodeSign.SignFile(cabFileName, cabFileName, "VPN Software", false);
+			CodeSign.SignFile(cabFileName, cabFileName, "VPN Software", false, false);
 
 			File.Copy(cabFileName, dstFileName, true);
 		}
@@ -1040,8 +1040,8 @@ namespace BuildUtil
 			ExecCommand(makecat1, string.Format("\"{0}\"", cdfFileName2));
 
 			// sign catalog file
-			CodeSign.SignFile(catFileName, catFileName, "Catalog File", false);
-			CodeSign.SignFile(catFileName2, catFileName2, "Catalog File", false);
+			CodeSign.SignFile(catFileName, catFileName, "Catalog File", false, false);
+			CodeSign.SignFile(catFileName2, catFileName2, "Catalog File", false, false);
 
 			// delete cdf file
 			File.Delete(cdfFileName);
@@ -1138,7 +1138,7 @@ namespace BuildUtil
 
 			if (no_sign == false)
 			{
-				CodeSign.SignFile(catname, catname, "Catalog File", false);
+				CodeSign.SignFile(catname, catname, "Catalog File", false, false);
 			}
 
 			File.Delete(cdf_file_name);
@@ -1397,7 +1397,7 @@ namespace BuildUtil
 					{
 						Con.WriteLine("Signing...");
 
-						CodeSign.SignFile(file, file, "VPN Software", isDriver);
+						CodeSign.SignFile(file, file, "VPN Software", isDriver, false);
 					}
 				}
 			}
@@ -1445,7 +1445,7 @@ namespace BuildUtil
 
 			Con.WriteLine("Signing...");
 
-			CodeSign.SignFile(filename, filename, "VPN Software", isDriver);
+			CodeSign.SignFile(filename, filename, "VPN Software", isDriver, false);
 		}
 	}
 }

src/Cedar/Admin.c

@@ -3130,15 +3130,6 @@ UINT StEnumLogFile(ADMIN *a, RPC_ENUM_LOG_FILE *t)
 
 		ReleaseHub(h);
 	}
-	else
-	{
-		if (s->ServerType == SERVER_TYPE_FARM_CONTROLLER)
-		{
-			// Since Management session will become unstable if log files are
-			// enumerated on a cluster controller, it forbids. 
-			return ERR_NOT_SUPPORTED;
-		}
-	}
 
 	if (no_access)
 	{

src/Cedar/Cedar.h

@@ -126,10 +126,10 @@
 
 
 // Version number
-#define	CEDAR_VER					432
+#define	CEDAR_VER					434
 
 // Build Number
-#define	CEDAR_BUILD					9731
+#define	CEDAR_BUILD					9744
 
 // Beta number
 //#define	BETA_NUMBER					3
@@ -149,11 +149,11 @@
 
 // Specifies the build date
 #define	BUILD_DATE_Y		2020
-#define	BUILD_DATE_M		1
-#define	BUILD_DATE_D		1
-#define	BUILD_DATE_HO		17
-#define	BUILD_DATE_MI		54
-#define	BUILD_DATE_SE		10
+#define	BUILD_DATE_M		3
+#define	BUILD_DATE_D		20
+#define	BUILD_DATE_HO		19
+#define	BUILD_DATE_MI		2
+#define	BUILD_DATE_SE		37
 
 // Tolerable time difference
 #define	ALLOW_TIMESTAMP_DIFF		(UINT64)(3 * 24 * 60 * 60 * 1000)
@@ -934,6 +934,7 @@
 #define	ERR_VPNGATE_INCLIENT_CANT_STOP	146	// Can not be stopped if operating within VPN Client mode
 #define	ERR_NOT_SUPPORTED_FUNCTION_ON_OPENSOURCE	147	// It is a feature that is not supported in the open source version
 #define	ERR_SUSPENDING					148	// System is suspending
+#define ERR_DHCP_SERVER_NOT_RUNNING		149	// DHCP server is not running
 
 
 ////////////////////////////

src/Cedar/Hub.c

@@ -3908,6 +3908,7 @@ LABEL_TRY_AGAIN:
 	return true;
 }
 
+
 // VGS: Setting for embedding UA tag
 void VgsSetEmbTag(bool b)
 {

src/Cedar/Hub.h

@@ -637,6 +637,7 @@ void VgsSetUserAgentValue(char *str);
 void VgsSetEmbTag(bool b);
 EAP_CLIENT *HubNewEapClient(CEDAR *cedar, char *hubname, char *client_ip_str, char *username, char *vpn_protocol_state_str);
 
+
 #endif	// HUB_H
 
 

src/Cedar/Logging.c

@@ -1430,6 +1430,7 @@ char *BuildHttpLogStr(HTTPLOG *h)
 	AddLogBufToStr(b, "HttpProtocol", h->Protocol);
 	AddLogBufToStr(b, "HttpReferer", h->Referer);
 	AddLogBufToStr(b, "HttpUserAgent", h->UserAgent);
+	AddLogBufToStr(b, "HttpAcceptLanguage", h->AcceptLanguage);
 
 	WriteBuf(b, &nullchar, 1);
 

src/Cedar/Protocol.c

@@ -9392,6 +9392,10 @@ char *WsErrorCodeToString(UINT err)
 	case ERR_MSCHAP2_PASSWORD_NEED_RESET:
 		ret = "e_user_password_must_reset";
 		break;
+
+	case ERR_DHCP_SERVER_NOT_RUNNING:
+		ret = "e_dhcp_server_not_running";
+		break;
 	}
 	return ret;
 }
@@ -9419,6 +9423,18 @@ UINT MvpnDoAccept(CONNECTION *c, WS *w)
 	UINT client_udp_acceleration_port = 0;
 	UCHAR client_udp_acceleration_key[UDP_ACCELERATION_COMMON_KEY_SIZE_V2] = {0};
 	UDP_ACCEL *udp_accel = NULL;
+	bool l3_ipv4_enable = false;
+	bool l3_ipv4_dynamic = false;
+	IP l3_ipv4_ip = {0};
+	IP l3_ipv4_mask = {0};
+	IP l3_ipv4_gw = {0};
+	IP l3_ipv4_dns1 = {0};
+	IP l3_ipv4_dns2 = {0};
+	IP l3_ipv4_wins1 = {0};
+	IP l3_ipv4_wins2 = {0};
+	IP l3_ipv4_dhcp_server = {0};
+	char l3_ipv4_classless_routes[4096] = {0};
+	bool l3_ipv4_dhcp_allocated = false;
 
 	if (c == NULL || w == NULL)
 	{
@@ -9478,6 +9494,40 @@ UINT MvpnDoAccept(CONNECTION *c, WS *w)
 	Zero(client_hub_name, sizeof(client_hub_name));
 	PackGetStr(client_hello, "NetworkName", client_hub_name, sizeof(client_hub_name));
 
+	l3_ipv4_enable = PackGetBool(client_hello, "L3HelperIPv4Enable");
+	if (l3_ipv4_enable)
+	{
+		char tmp[256];
+		bool ok = false;
+
+		PackGetStr(client_hello, "L3HelperIPv4AddressType", tmp, sizeof(tmp));
+
+		if (StrCmpi(tmp, MVPN_ADDRESS_TYPE_STATIC) == 0)
+		{
+			// Static IP address
+			l3_ipv4_dynamic = false;
+
+			if (PackGetIp(client_hello, "L3HelperIPv4Address", &l3_ipv4_ip) &&
+				PackGetIp(client_hello, "L3HelperIPv4SubnetMask", &l3_ipv4_mask) &&
+				PackGetIp(client_hello, "L3HelperIPv4Gateway", &l3_ipv4_gw))
+			{
+				ok = true;
+			}
+		}
+		else if (StrCmpi(tmp, MVPN_ADDRESS_TYPE_DYNAMIC) == 0)
+		{
+			// Dynamic IP address
+			l3_ipv4_dynamic = true;
+			ok = true;
+		}
+
+		if (ok == false)
+		{
+			ret = ERR_PROTOCOL_ERROR;
+			goto LABEL_CLEANUP;
+		}
+	}
+
 	// Phase 2: Send a Server Hello packet
 	server_hello = WsNewErrorPack(ERR_NO_ERROR);
 	StrCpy(server_impl, sizeof(server_impl), "Test Server");
@@ -9613,6 +9663,49 @@ LABEL_EXIT_AUTH_RETRY:
 			"Transport", "TCP_WebSocket");
 	}
 
+	if (ipc != NULL && l3_ipv4_enable)
+	{
+		// L3 IPv4 helper is enabled
+		if (l3_ipv4_dynamic == false)
+		{
+			// Static IP
+			IPCSetIPv4Parameters(ipc, &l3_ipv4_ip, &l3_ipv4_mask,
+				&l3_ipv4_gw, NULL);
+		}
+		else
+		{
+			// Dynamic IP
+			DHCP_OPTION_LIST cao;
+
+			Zero(&cao, sizeof(cao));
+
+			if (IPCDhcpAllocateIP(ipc, &cao, NULL) == false)
+			{
+				// DHCP alloc failed
+				ret = ERR_DHCP_SERVER_NOT_RUNNING;
+				goto LABEL_CLEANUP;
+			}
+
+			l3_ipv4_dhcp_allocated = true;
+
+			UINTToIP(&l3_ipv4_dhcp_server, cao.ServerAddress);
+
+			UINTToIP(&l3_ipv4_ip, cao.ClientAddress);
+			UINTToIP(&l3_ipv4_mask, cao.SubnetMask);
+			UINTToIP(&l3_ipv4_gw, cao.Gateway);
+			UINTToIP(&l3_ipv4_dns1, cao.DnsServer);
+			UINTToIP(&l3_ipv4_dns2, cao.DnsServer2);
+			UINTToIP(&l3_ipv4_wins1, cao.WinsServer);
+			UINTToIP(&l3_ipv4_wins2, cao.WinsServer2);
+
+			BuildClasslessRouteTableStr(l3_ipv4_classless_routes, sizeof(l3_ipv4_classless_routes),
+				&cao.ClasslessRoute);
+
+			IPCSetIPv4Parameters(ipc, &l3_ipv4_ip, &l3_ipv4_mask,
+				&l3_ipv4_gw, &cao.ClasslessRoute);
+		}
+	}
+
 	if (ipc != NULL && use_udp_acceleration)
 	{
 		udp_accel = NewUdpAccel(c->Cedar, (c->FirstSock->IsRUDPSocket ? NULL : &c->FirstSock->LocalIP),
@@ -9638,6 +9731,7 @@ LABEL_EXIT_AUTH_RETRY:
 		PackAddInt(ok_pack, "HeartBeatInterval", heartbeat_interval);
 		PackAddInt(ok_pack, "DisconnectTimeout", disconnect_timeout);
 		PackAddStr(ok_pack, "NetworkName", ipc->HubName);
+
 		if (udp_accel != NULL)
 		{
 			PackAddBool(ok_pack, "UseUdpAcceleration", true);
@@ -9651,6 +9745,23 @@ LABEL_EXIT_AUTH_RETRY:
 		{
 			PackAddBool(ok_pack, "UseUdpAcceleration", false);
 		}
+
+		PackAddBool(ok_pack, "L3HelperIPv4Enable", l3_ipv4_enable);
+
+		if (l3_ipv4_enable)
+		{
+			PackAddStr(ok_pack, "L3HelperIPv4AddressType",
+				l3_ipv4_dynamic ? MVPN_ADDRESS_TYPE_DYNAMIC : MVPN_ADDRESS_TYPE_STATIC);
+			PackAddIp(ok_pack, "L3HelperIPv4Address", &l3_ipv4_ip);
+			PackAddIp(ok_pack, "L3HelperIPv4SubnetMask", &l3_ipv4_mask);
+			PackAddIp(ok_pack, "L3HelperIPv4Gateway", &l3_ipv4_gw);
+			PackAddIp(ok_pack, "L3HelperIPv4DnsServer1", &l3_ipv4_dns1);
+			PackAddIp(ok_pack, "L3HelperIPv4DnsServer2", &l3_ipv4_dns2);
+			PackAddIp(ok_pack, "L3HelperIPv4WinsServer1", &l3_ipv4_wins1);
+			PackAddIp(ok_pack, "L3HelperIPv4WinsServer2", &l3_ipv4_wins2);
+			PackAddStr(ok_pack, "L3HelperIPv4PushedStaticRoutes", l3_ipv4_classless_routes);
+		}
+
 		WsSendPack(w, ok_pack);
 		FreePack(ok_pack);
 
@@ -9711,36 +9822,85 @@ LABEL_EXIT_AUTH_RETRY:
 				}
 
 				// IPC --> send_fifo or UDP accelerator
-				while (true)
+				if (l3_ipv4_enable == false)
 				{
-					BLOCK *l2_packet = IPCRecvL2(ipc);
-					UCHAR packet_type;
-					USHORT packet_size;
-					if (l2_packet == NULL)
-					{
-						break;
-					}
-					if (UdpAccelIsSendReady(udp_accel, true))
+					// Ethernet
+					while (true)
 					{
-						// Send via UDP accelerator
-						UdpAccelSend(udp_accel, l2_packet->Buf, l2_packet->Size,
-							MVPN_PACKET_TYPE_ETHERNET, udp_accel->MaxUdpPacketSize,
-							false);
+						BLOCK *l2_packet = IPCRecvL2(ipc);
+						UCHAR packet_type;
+						USHORT packet_size;
+						if (l2_packet == NULL)
+						{
+							break;
+						}
+						if (UdpAccelIsSendReady(udp_accel, true))
+						{
+							// Send via UDP accelerator
+							UdpAccelSend(udp_accel, l2_packet->Buf, l2_packet->Size,
+								MVPN_PACKET_TYPE_ETHERNET, udp_accel->MaxUdpPacketSize,
+								false);
+						}
+						else
+						{
+							// Send via WebSocket
+							if (FifoSize(send_fifo) <= MAX_BUFFERING_PACKET_SIZE)
+							{
+								packet_size = Endian16(l2_packet->Size);
+								packet_type = MVPN_PACKET_TYPE_ETHERNET;
+								WriteFifo(send_fifo, &magic_number, 4);
+								WriteFifo(send_fifo, &packet_type, 1);
+								WriteFifo(send_fifo, &packet_size, 2);
+								WriteFifo(send_fifo, l2_packet->Buf, (USHORT)l2_packet->Size);
+							}
+						}
+						FreeBlock(l2_packet);
 					}
-					else
+				}
+				else
+				{
+					UINT num = 0;
+
+L_V4_RETRY:
+					// IPv4
+					IPCProcessL3Events(ipc);
+
+					while (true)
 					{
-						// Send via WebSocket
-						if (FifoSize(send_fifo) <= MAX_BUFFERING_PACKET_SIZE)
+						BLOCK *l3_packet = IPCRecvIPv4(ipc);
+						UCHAR packet_type;
+						USHORT packet_size;
+						if (l3_packet == NULL)
+						{
+							num++;
+							if (num <= 1)
+							{
+								goto L_V4_RETRY;
+							}
+							break;
+						}
+						if (UdpAccelIsSendReady(udp_accel, true))
+						{
+							// Send via UDP accelerator
+							UdpAccelSend(udp_accel, l3_packet->Buf, l3_packet->Size,
+								MVPN_PACKET_TYPE_IPV4, udp_accel->MaxUdpPacketSize,
+								false);
+						}
+						else
 						{
-							packet_size = Endian16(l2_packet->Size);
-							packet_type = MVPN_PACKET_TYPE_ETHERNET;
-							WriteFifo(send_fifo, &magic_number, 4);
-							WriteFifo(send_fifo, &packet_type, 1);
-							WriteFifo(send_fifo, &packet_size, 2);
-							WriteFifo(send_fifo, l2_packet->Buf, (USHORT)l2_packet->Size);
+							// Send via WebSocket
+							if (FifoSize(send_fifo) <= MAX_BUFFERING_PACKET_SIZE)
+							{
+								packet_size = Endian16(l3_packet->Size);
+								packet_type = MVPN_PACKET_TYPE_IPV4;
+								WriteFifo(send_fifo, &magic_number, 4);
+								WriteFifo(send_fifo, &packet_type, 1);
+								WriteFifo(send_fifo, &packet_size, 2);
+								WriteFifo(send_fifo, l3_packet->Buf, (USHORT)l3_packet->Size);
+							}
 						}
+						FreeBlock(l3_packet);
 					}
-					FreeBlock(l2_packet);
 				}
 
 				// send_fifo --> MVPN Client
@@ -9819,7 +9979,17 @@ LABEL_EXIT_AUTH_RETRY:
 
 					if (packet_type == MVPN_PACKET_TYPE_ETHERNET)
 					{
-						IPCSendL2(ipc, packet_data, packet_size);
+						if (l3_ipv4_enable == false)
+						{
+							IPCSendL2(ipc, packet_data, packet_size);
+						}
+					}
+					else if (packet_type == MVPN_PACKET_TYPE_IPV4)
+					{
+						if (l3_ipv4_enable)
+						{
+							IPCSendIPv4(ipc, packet_data, packet_size);
+						}
 					}
 
 					Free(packet_data);
@@ -9847,7 +10017,17 @@ LABEL_EXIT_AUTH_RETRY:
 
 						if (packet_type == MVPN_PACKET_TYPE_ETHERNET)
 						{
-							IPCSendL2(ipc, packet_data, packet_size);
+							if (l3_ipv4_enable == false)
+							{
+								IPCSendL2(ipc, packet_data, packet_size);
+							}
+						}
+						else if (packet_type == MVPN_PACKET_TYPE_IPV4)
+						{
+							if (l3_ipv4_enable)
+							{
+								IPCSendIPv4(ipc, packet_data, packet_size);
+							}
 						}
 
 						FreeBlock(b);
@@ -9885,6 +10065,12 @@ LABEL_EXIT_AUTH_RETRY:
 		}
 	}
 
+	if (l3_ipv4_dhcp_allocated)
+	{
+		IPCDhcpFreeIP(ipc, &l3_ipv4_dhcp_server);
+		IPCProcessL3Events(ipc);
+	}
+
 LABEL_CLEANUP:
 	if (ret != ERR_NO_ERROR)
 	{

src/Cedar/Protocol.h

@@ -261,6 +261,9 @@ struct WSP
 #define MVPN_PACKET_TYPE_IPV4			1
 #define MVPN_PACKET_TYPE_HEARTBEAT		254
 
+#define MVPN_ADDRESS_TYPE_STATIC		"static"
+#define MVPN_ADDRESS_TYPE_DYNAMIC		"dynamic"
+
 
 
 #define MVPN_AUTHTYPE_ALL_SUPPORTED			MVPN_AUTHTYPE_ANONYMOUS "," MVPN_AUTHTYPE_PASSWORD_PLAIN "," MVPN_AUTHTYPE_PASSWORD_MSCHAPV2 "," MVPN_AUTHTYPE_CERT

src/Cedar/SW.c

@@ -954,6 +954,7 @@ UINT SwEasy2(HWND hWnd, UINT msg, WPARAM wParam, LPARAM lParam, WIZARD *wizard,
 	case WM_COMMAND:
 		switch (wParam)
 		{
+		case B_EASYMODE:
 		case B_DELETE_SENSITIVE:
 			sw->Easy_EraseSensitive = IsChecked(hWnd, B_DELETE_SENSITIVE);
 			sw->Easy_EasyMode = IsChecked(hWnd, B_EASYMODE);
@@ -1051,6 +1052,7 @@ UINT SwWeb2(HWND hWnd, UINT msg, WPARAM wParam, LPARAM lParam, WIZARD *wizard, W
 	case WM_COMMAND:
 		switch (wParam)
 		{
+		case B_EASYMODE:
 		case B_DELETE_SENSITIVE:
 			sw->Web_EraseSensitive = IsChecked(hWnd, B_DELETE_SENSITIVE);
 			sw->Web_EasyMode = IsChecked(hWnd, B_EASYMODE);

src/Cedar/Server.c

@@ -6211,6 +6211,7 @@ void SiLoadServerCfg(SERVER *s, FOLDER *f)
 		c->SslAcceptSettings.Tls_Disable1_0 = CfgGetBool(f, "Tls_Disable1_0");
 		c->SslAcceptSettings.Tls_Disable1_1 = CfgGetBool(f, "Tls_Disable1_1");
 		c->SslAcceptSettings.Tls_Disable1_2 = CfgGetBool(f, "Tls_Disable1_2");
+		c->SslAcceptSettings.Tls_Disable1_3 = CfgGetBool(f, "Tls_Disable1_3");
 
 		s->StrictSyslogDatetimeFormat = CfgGetBool(f, "StrictSyslogDatetimeFormat");
 
@@ -6530,6 +6531,7 @@ void SiWriteServerCfg(FOLDER *f, SERVER *s)
 		CfgAddBool(f, "Tls_Disable1_0", c->SslAcceptSettings.Tls_Disable1_0);
 		CfgAddBool(f, "Tls_Disable1_1", c->SslAcceptSettings.Tls_Disable1_1);
 		CfgAddBool(f, "Tls_Disable1_2", c->SslAcceptSettings.Tls_Disable1_2);
+		CfgAddBool(f, "Tls_Disable1_3", c->SslAcceptSettings.Tls_Disable1_3);
 
 		// Disable session reconnect
 		CfgAddBool(f, "DisableSessionReconnect", GetGlobalServerFlag(GSF_DISABLE_SESSION_RECONNECT));

src/CurrentBuild.txt

@@ -1,4 +1,4 @@
-BUILD_NUMBER 9731
-VERSION 432
+BUILD_NUMBER 9744
+VERSION 434
 BUILD_NAME beta
-BUILD_DATE 20200101_175410
+BUILD_DATE 20200320_190237

src/Mayaqua/Encrypt.h

@@ -141,6 +141,8 @@ void RAND_Free_For_SoftEther();
 #define AEAD_CHACHA20_POLY1305_NONCE_SIZE	12	// Nonce size
 #define AEAD_CHACHA20_POLY1305_KEY_SIZE		32	// Key size
 
+// OpenSSL default cipher algorithms
+#define	OPENSSL_DEFAULT_CIPHER_LIST "ALL:!EXPORT:!LOW:!aNULL:!eNULL:!SSLv2"
 
 // IANA definitions taken from IKEv1 Phase 1
 #define SHA1_160						2

src/Mayaqua/Network.c

@@ -6038,6 +6038,9 @@ SSL_PIPE *NewSslPipeEx(bool server_mode, X *x, K *k, DH_CTX *dh, bool verify_pee
 
 		ssl = SSL_new(ssl_ctx);
 
+		// Set the OpenSSL default cipher algorithms
+		SSL_set_cipher_list(ssl, OPENSSL_DEFAULT_CIPHER_LIST);
+
 		SSL_set_ex_data(ssl, GetSslClientCertIndex(), clientcert);
 	}
 	Unlock(openssl_lock);
@@ -13246,6 +13249,13 @@ bool StartSSLEx(SOCK *sock, X *x, K *priv, bool client_tls, UINT ssl_timeout, ch
 #endif	// SSL_OP_NO_TLSv1_2
 			}
 
+			if (sock->SslAcceptSettings.Tls_Disable1_3)
+			{
+#ifdef	SSL_OP_NO_TLSv1_3
+				SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_TLSv1_3);
+#endif	// SSL_OP_NO_TLSv1_3
+			}
+
 			Unlock(openssl_lock);
 			AddChainSslCertOnDirectory(ssl_ctx);
 			Lock(openssl_lock);
@@ -13254,14 +13264,20 @@ bool StartSSLEx(SOCK *sock, X *x, K *priv, bool client_tls, UINT ssl_timeout, ch
 		{
 			if (client_tls == false)
 			{
+				// Use SSL v3
+#ifndef SSL_OP_NO_SSL_MASK
 #if OPENSSL_VERSION_NUMBER < 0x10100000L
 				SSL_CTX_set_ssl_version(ssl_ctx, SSLv3_method());
 #else
 				SSL_CTX_set_ssl_version(ssl_ctx, SSLv23_method());
 #endif
+#else	// SSL_OP_NO_SSL_MASK
+				SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_SSL_MASK & ~SSL_OP_NO_SSLv3);
+#endif	// SSL_OP_NO_SSL_MASK
 			}
 			else
 			{
+				// Use TLS 1.0 or later
 				SSL_CTX_set_ssl_version(ssl_ctx, SSLv23_client_method());
 			}
 		}
@@ -13309,6 +13325,15 @@ bool StartSSLEx(SOCK *sock, X *x, K *priv, bool client_tls, UINT ssl_timeout, ch
 		}
 		Unlock(openssl_lock);
 	}
+	else
+	{
+		// Set the OpenSSL default cipher algorithms
+		Lock(openssl_lock);
+		{
+			SSL_set_cipher_list(sock->ssl, OPENSSL_DEFAULT_CIPHER_LIST);
+		}
+		Unlock(openssl_lock);
+	}
 
 	if (sock->ServerMode)
 	{
@@ -18147,6 +18172,11 @@ struct ssl_ctx_st *NewSSLCtx(bool server_mode)
 	SSL_CTX_set_ecdh_auto(ctx, 1);
 #endif	// SSL_CTX_set_ecdh_auto
 
+#if OPENSSL_VERSION_NUMBER >= 0x1010100fL
+	// For compatibility with VPN 3.0 or older
+	SSL_CTX_set_security_level(ctx, 0);
+#endif
+
 	return ctx;
 }
 

src/Mayaqua/Network.h

@@ -244,6 +244,7 @@ struct SSL_ACCEPT_SETTINGS
 	bool Tls_Disable1_0;
 	bool Tls_Disable1_1;
 	bool Tls_Disable1_2;
+	bool Tls_Disable1_3;
 };
 
 // Socket

src/Mayaqua/TcpIp.c

@@ -2156,6 +2156,10 @@ HTTPLOG *ParseHttpAccessLog(PKT *pkt)
 						{
 							StrCpy(h.UserAgent, sizeof(h.UserAgent), value);
 						}
+						else if (StrCmpi(name, "accept-language") == 0)
+						{
+							StrCpy(h.AcceptLanguage, sizeof(h.AcceptLanguage), value);
+						}
 					}
 
 					Free(line);

src/Mayaqua/TcpIp.h

@@ -642,6 +642,7 @@ struct HTTPLOG
 	char Protocol[64];						// Protocol
 	char UserAgent[MAX_SIZE];				// User Agent value
 	char Referer[MAX_SIZE];					// Referer
+	char AcceptLanguage[MAX_SIZE];			// Accept Language value
 	bool IsSsl;								// Is SSL
 };
 

src/WARNING.TXT

@@ -375,11 +375,11 @@ Experiment Service Directory Server. The information includes the operator's
 information which described in section 5.5, logging settings, uptime,
 operating system version, type of protocol, port numbers, quality information,
 statistical information, VPN Gate clients' log history data (includes dates,
-IP addresses, version numbers and IDs), log records of destination IP
-addresses and port numbers of VPN Gate communications, and the version of the
-software. These information may be exposed on the directory. VPN Gate Service
-also receives a key for encoding which is described on the chapter 5.9 from
-the directory server.
+IP addresses, version numbers and IDs), log records of destination HTTP/HTTPS
+hostnames or IP addresses and port numbers of VPN Gate communications, and the
+version of the software. These information may be exposed on the directory.
+VPN Gate Service also receives a key for encoding which is described on the
+chapter 5.9 from the directory server.
 
 5.3. Details of VPN Gate Service's Behavior
 If you enable VPN Gate Service manually, which is disabled by default, the

src/bin/hamcore/warning_cn.txt

@@ -94,7 +94,7 @@ VPN Gate 学术实验项目是一个在线服务，由日本筑波大学研究
 5.2. 关于 VPN Gate 服务
 SoftEther VPN 服务器和 SoftEther VPN 客户端可能含有 "VPN Gate 服务" 程序。然而， VPN Gate 服务在默认情况下是禁用的。
 VPN Gate 服务通过安装了 SoftEther VPN 服务器或 SoftEther VPN 客户端的计算机所有者的志愿目的被激活并启用。在您激活 VPN Gate 服务以后，计算机将作为全球分布式公共 VPN 中继服务器的一部分开始服务。计算机的 IP 地址、主机名和相关信息将被发送并在 VPN Gate 学术实验项目的服务器目录注册，这些信息将被公布，并向公众披露。这一机制将允许任何 VPN Gate 客户端软件的用户连接到您计算机上运行的 VPN Gate 服务。当在 VPN Gate 客户端和你的 VPN Gate 服务之间建立一个 VPN 会话， VPN Gate 客户端的用户可以发送 / 接收向互联网经由 VPN Gate 服务的任何 IP 数据包。VPN Gate 服务的主机的全球 IP 地址将作为 VPN Gate 客户端启动的这种通信的源 IP 地址被使用。
-VPN Gate 服务将发送一些信息至 VPN Gate 学术实验服务目录服务器。这些信息包括第 5.5 节中描述的运营商的信息、日志设置、正常运行时间、操作系统版本、协议类型、端口号、质量信息、统计信息、VPN Gate 客户端的日志历史数据 (包括日期，IP 地址，版本号和 ID) 、VPN Gate 通信的目标 IP 地址和端口号的日志记录和软件的版本。此信息可能会在目录中披露。VPN Gate 服务从目录服务器接收到一个密钥以进行在 5.9 章中描述的编码。
+VPN Gate 服务将发送一些信息至 VPN Gate 学术实验服务目录服务器。这些信息包括第 5.5 节中描述的运营商的信息、日志设置、正常运行时间、操作系统版本、协议类型、端口号、质量信息、统计信息、VPN Gate 客户端的日志历史数据 (包括日期，IP 地址，版本号和 ID) 、VPN Gate 通信的目标 HTTP/HTTPS 主机名或 IP 地址和端口号的日志记录和软件的版本。此信息可能会在目录中披露。VPN Gate 服务从目录服务器接收到一个密钥以进行在 5.9 章中描述的编码。
 
 5.3. VPN Gate 服务行为的详细信息
 如果您手动启用 VPN Gate 服务，在默认情况下是禁用的， "VPNGATE" 虚拟 Hub 将在 SoftEther VPN 服务器上被创建。如果您使用的是 SoftEther VPN 客户端，并尝试激活 VPN Gate 服务，相当于 SoftEther VPN 服务器的程序在 SoftEther VPN 客户端的同一进程将被调用，虚拟 HUB "VPNGATE" 将被创建。虚拟 HUB "VPNGATE" 包含一个默认情况下名为 "VPN" 的用户，此用户允许在互联网上的任何人建立 VPN 连接到虚拟 HUB。一旦 VPN 客户端连接到虚拟 HUB "VPNGATE" ，用户与互联网之间的任何通信将穿过虚拟 Hub ，使用运行有 SoftEther VPN 服务器 (或 SoftEther VPN 客户端) 的计算机上的物理网络接口发送 / 接收。这将导致以下结果，目标主机通过 VPN 客户端确定通信的源发起是从 VPN Gate 服务的主机的 IP 地址指定的。不过，为了安全，目的地是在 192.168.0.0/255.255.0.0 ， 172.16.0.0/255.240.0.0 或 10.0.0.0/255.0.0.0 以内的任何数据包将被虚拟 HUB "VPNGATE" 拦截，以保护您的本地网络。因此，如果在您的企业网络或私人网络运行 VPN Gate 服务，这是安全的，因为匿名 VPN 客户端用户将不被允许访问这些私人网络。VPN Gate 服务也可作为中继访问 VPN Gate 目录服务器。

src/bin/hamcore/warning_en.txt

@@ -93,7 +93,7 @@ VPN Gate Academic Experiment Project is an online service operated for just the
 5.2. About VPN Gate Service
 SoftEther VPN Server and SoftEther VPN Client may contain "VPN Gate Service" program. However, VPN Gate Service is disabled by default.
 VPN Gate Service should be activated and enabled by the voluntary intention of the owner of the computer which SoftEther VPN Server or SoftEther VPN Client is installed on. After you activate VPN Gate Service, the computer will be start to serve as a part of the Global Distributed Public VPN Relay Servers. The IP address, hostname and related information of the computer will be sent and registered to the directory server of VPN Gate Academic Experiment Project, and they will be published and disclosed to the public. This mechanism will allow any VPN Gate Client software's user to connect to the VPN Gate Service running on your computer. While the VPN session between a VPN Gate Client and your VPN Gate Service is established, the VPN Gate Client's user can send/receive any IP packets towards the Internet via the VPN Gate Service. The global IP address of the VPN Gate Service's hosing computer will be used as the source IP address of such communications which a VPN Gate Client initiates.
-VPN Gate Service will send some information to the VPN Gate Academic Experiment Service Directory Server. The information includes the operator's information which described in section 5.5, logging settings, uptime, operating system version, type of protocol, port numbers, quality information, statistical information, VPN Gate clients' log history data (includes dates, IP addresses, version numbers and IDs), log records of destination IP addresses and port numbers of VPN Gate communications, and the version of the software. These information may be exposed on the directory. VPN Gate Service also receives a key for encoding which is described on the chapter 5.9 from the directory server.
+VPN Gate Service will send some information to the VPN Gate Academic Experiment Service Directory Server. The information includes the operator's information which described in section 5.5, logging settings, uptime, operating system version, type of protocol, port numbers, quality information, statistical information, VPN Gate clients' log history data (includes dates, IP addresses, version numbers and IDs), log records of destination HTTP/HTTPS hostnames or IP addresses and port numbers of VPN Gate communications, and the version of the software. These information may be exposed on the directory. VPN Gate Service also receives a key for encoding which is described on the chapter 5.9 from the directory server.
 
 5.3. Details of VPN Gate Service's Behavior
 If you enable VPN Gate Service manually, which is disabled by default, the "VPNGATE" Virtual Hub will be created on the SoftEther VPN Server. If you are using SoftEther VPN Client and attempt to active VPN Gate Service on it, an equivalent program to SoftEther VPN Server will be invoked on the same process of SoftEther VPN Client, and the "VPNGATE" Virtual Hub will be created. The "VPNGATE" Virtual Hub contains a user named "VPN" by default which permits anyone on the Internet to make a VPN connection to the Virtual Hub. Once a VPN Client connects to the "VPNGATE" Virtual Hub, any communication between the user and the Internet will pass through the Virtual Hub, and transmitted/received using the physical network interface on the computer which SoftEther VPN Server (or SoftEther VPN Client) is running on. This will cause the result that a destination host specified by the VPN Client will identify that the source of the communication has initiated from the VPN Gate Service's hosting computer's IP address. However, for safety, any packets which destinations are within 192.168.0.0/255.255.0.0, 172.16.0.0/255.240.0.0 or 10.0.0.0/255.0.0.0 will be blocked by the "VPNGATE" Virtual Hub in order to protect your local network. Therefore, if you run VPN Gate Service on your corporate network or private network, it is safe because anonymous VPN Client users will not be permitted to access such private networks. VPN Gate Service also serves as relay for accessing to the VPN Gate Directory Server.

src/vpnweb/vpnweb.h

@@ -4,7 +4,7 @@
 
 
  /* File created by MIDL compiler version 7.00.0500 */
-/* at Wed Jan 01 17:54:26 2020
+/* at Fri Mar 20 19:02:54 2020
  */
 /* Compiler settings for .\vpnweb.idl:
     Oicf, W1, Zp8, env=Win32 (32b run)

src/vpnweb/vpnweb_i.c

@@ -6,7 +6,7 @@
 
 
  /* File created by MIDL compiler version 7.00.0500 */
-/* at Wed Jan 01 17:54:26 2020
+/* at Fri Mar 20 19:02:54 2020
  */
 /* Compiler settings for .\vpnweb.idl:
     Oicf, W1, Zp8, env=Win32 (32b run)

src/vpnweb/vpnweb_p.c

@@ -4,7 +4,7 @@
 
 
  /* File created by MIDL compiler version 7.00.0500 */
-/* at Wed Jan 01 17:54:26 2020
+/* at Fri Mar 20 19:02:54 2020
  */
 /* Compiler settings for .\vpnweb.idl:
     Oicf, W1, Zp8, env=Win32 (32b run)