v4.34-9744-betav4.34-9744-beta

29 files changed, 348 insertions, 88 deletions

diff --git a/WARNING.TXT b/WARNING.TXT
index 8695d0fe..08950509 100644
--- a/WARNING.TXT
+++ b/WARNING.TXT
@@ -375,11 +375,11 @@ Experiment Service Directory Server. The information includes the operator's
 information which described in section 5.5, logging settings, uptime,

 operating system version, type of protocol, port numbers, quality information,

 statistical information, VPN Gate clients' log history data (includes dates,

-IP addresses, version numbers and IDs), log records of destination IP

-addresses and port numbers of VPN Gate communications, and the version of the

-software. These information may be exposed on the directory. VPN Gate Service

-also receives a key for encoding which is described on the chapter 5.9 from

-the directory server.

+IP addresses, version numbers and IDs), log records of destination HTTP/HTTPS

+hostnames or IP addresses and port numbers of VPN Gate communications, and the

+version of the software. These information may be exposed on the directory.

+VPN Gate Service also receives a key for encoding which is described on the

+chapter 5.9 from the directory server.

 

 5.3. Details of VPN Gate Service's Behavior

 If you enable VPN Gate Service manually, which is disabled by default, the

diff --git a/src/BuildUtil/BuildUtilCommands.cs b/src/BuildUtil/BuildUtilCommands.cs
index 21d7b078..db4da98c 100644
--- a/src/BuildUtil/BuildUtilCommands.cs
+++ b/src/BuildUtil/BuildUtilCommands.cs
@@ -1330,7 +1330,7 @@ namespace BuildUtil
 			int certid = vl["CERTID"].IntValue;

 			int shamode = vl["SHAMODE"].IntValue;

 

-			CodeSign.SignFile(destFileName, srcFileName, comment, kernel, certid, shamode);

+			CodeSign.SignFile(destFileName, srcFileName, comment, kernel, false);

 

 			return 0;

 		}

diff --git a/src/BuildUtil/CodeSign.cs b/src/BuildUtil/CodeSign.cs
index 971344a9..436340dd 100644
--- a/src/BuildUtil/CodeSign.cs
+++ b/src/BuildUtil/CodeSign.cs
@@ -126,6 +126,52 @@ using BuildUtil.HvSignService;
 

 namespace BuildUtil

 {

+	public static class SignClient

+	{

+		const string SeInternalPasswordFilePath = @"\\192.168.3.2\share\tmp\signserver\password.txt";

+

+		const string Url = "https://codesignserver:7006/sign";

+

+		public static byte[] Sign(byte[] srcData, string certName, string flags, string comment)

+		{

+			string password = File.ReadAllText(SeInternalPasswordFilePath);

+

+			string url = Url + "?password=" + password + "&cert=" + certName + "&flags=" + flags + "&comment=" + comment;

+

+			ServicePointManager.ServerCertificateValidationCallback = delegate { return true; };

+			WebRequest req = HttpWebRequest.Create(url);

+

+			req.Timeout = 60 * 1000;

+			req.Method = "POST";

+

+			using (Stream reqs = req.GetRequestStream())

+			{

+				reqs.Write(srcData, 0, srcData.Length);

+

+				reqs.Close();

+

+				WebResponse res = req.GetResponse();

+

+				using (Stream ress = res.GetResponseStream())

+				{

+					byte[] tmp = new byte[4 * 1024 * 1024];

+

+					MemoryStream ms = new MemoryStream();

+

+					while (true)

+					{

+						int r = ress.Read(tmp, 0, tmp.Length);

+						if (r <= 0) break;

+

+						ms.Write(tmp, 0, r);

+					}

+

+					return ms.ToArray();

+				}

+			}

+		}

+	}

+

 	public static class CodeSign

 	{

 		public const int NumRetries = 1;

@@ -146,9 +192,13 @@ namespace BuildUtil
 		static object lockObj = new object();

 		

 		// Digital-sign the data on the memory

-		public static byte[] SignMemory(byte[] srcData, string comment, bool kernelModeDriver, int cert_id, int sha_mode)

+		public static byte[] SignMemory(byte[] srcData, string comment, bool kernelModeDriver, bool evCert)

 		{

 #if	!BU_OSS

+			// 2020/01/19 switch to the new system

+			return SignClient.Sign(srcData, evCert ? "SoftEtherEv" : "SoftEtherFile", kernelModeDriver ? "Driver" : "", comment);

+

+			/*

 			int i;

 			string out_filename = null;

 			byte[] ret = null;

@@ -240,37 +290,21 @@ namespace BuildUtil
 				File.Delete(tmpFileName);

 			}

 

-			return ret;

+			return ret;*/

 #else	// BU_OSS

 			return srcData;

 #endif	// BU_OSS

 		}

 

 		// Digital-sign the data on the file

-		public static void SignFile(string destFileName, string srcFileName, string comment, bool kernelModeDriver)

-		{

-			int cert_id = UsingCertId;

-

-			SignFile(destFileName, srcFileName, comment, kernelModeDriver, cert_id, 0);

-		}

-		public static void SignFile(string destFileName, string srcFileName, string comment, bool kernelModeDriver, int cert_id, int sha_mode)

+		public static void SignFile(string destFileName, string srcFileName, string comment, bool kernelModeDriver, bool evCert)

 		{

 #if	!BU_OSS

-			if (cert_id == 0)

-			{

-				cert_id = UsingCertId;

-			}

 

 			Con.WriteLine("Signing for '{0}'...", Path.GetFileName(destFileName));

 			byte[] srcData = File.ReadAllBytes(srcFileName);

 

-			if (srcFileName.EndsWith(".msi", StringComparison.InvariantCultureIgnoreCase))

-			{

-				sha_mode = 1;

-				// todo: Set 2 in future !!!

-			}

-

-			byte[] destData = SignMemory(srcData, comment, kernelModeDriver, cert_id, sha_mode);

+			byte[] destData = SignMemory(srcData, comment, kernelModeDriver, evCert);

 

 			try

 			{

diff --git a/src/BuildUtil/Win32BuildSoftware.cs b/src/BuildUtil/Win32BuildSoftware.cs
index 4981e569..433a9e36 100644
--- a/src/BuildUtil/Win32BuildSoftware.cs
+++ b/src/BuildUtil/Win32BuildSoftware.cs
@@ -170,7 +170,7 @@ namespace BuildUtil
 			Win32BuildUtil.ExecCommand(vpnsetup_exe, string.Format("/SFXMODE:{1} /SFXOUT:\"{0}\"",

 				outFileName, Software.ToString()));

 

-			CodeSign.SignFile(outFileName, outFileName, "VPN Software", false);

+			CodeSign.SignFile(outFileName, outFileName, "VPN Software Installer", false, true);

 		}

 	}

 }

diff --git a/src/BuildUtil/Win32BuildUtil.cs b/src/BuildUtil/Win32BuildUtil.cs
index 3d80fe2d..970c6a76 100644
--- a/src/BuildUtil/Win32BuildUtil.cs
+++ b/src/BuildUtil/Win32BuildUtil.cs
@@ -166,7 +166,7 @@ namespace BuildUtil
 				m.ReleaseMutex();

 			}

 

-			CodeSign.SignFile(cabFileName, cabFileName, "VPN Software", false);

+			CodeSign.SignFile(cabFileName, cabFileName, "VPN Software", false, false);

 

 			File.Copy(cabFileName, dstFileName, true);

 		}

@@ -1040,8 +1040,8 @@ namespace BuildUtil
 			ExecCommand(makecat1, string.Format("\"{0}\"", cdfFileName2));

 

 			// sign catalog file

-			CodeSign.SignFile(catFileName, catFileName, "Catalog File", false);

-			CodeSign.SignFile(catFileName2, catFileName2, "Catalog File", false);

+			CodeSign.SignFile(catFileName, catFileName, "Catalog File", false, false);

+			CodeSign.SignFile(catFileName2, catFileName2, "Catalog File", false, false);

 

 			// delete cdf file

 			File.Delete(cdfFileName);

@@ -1138,7 +1138,7 @@ namespace BuildUtil
 

 			if (no_sign == false)

 			{

-				CodeSign.SignFile(catname, catname, "Catalog File", false);

+				CodeSign.SignFile(catname, catname, "Catalog File", false, false);

 			}

 

 			File.Delete(cdf_file_name);

@@ -1397,7 +1397,7 @@ namespace BuildUtil
 					{

 						Con.WriteLine("Signing...");

 

-						CodeSign.SignFile(file, file, "VPN Software", isDriver);

+						CodeSign.SignFile(file, file, "VPN Software", isDriver, false);

 					}

 				}

 			}

@@ -1445,7 +1445,7 @@ namespace BuildUtil
 

 			Con.WriteLine("Signing...");

 

-			CodeSign.SignFile(filename, filename, "VPN Software", isDriver);

+			CodeSign.SignFile(filename, filename, "VPN Software", isDriver, false);

 		}

 	}

 }

diff --git a/src/Cedar/Admin.c b/src/Cedar/Admin.c
index f622f67b..1b4702dd 100644
--- a/src/Cedar/Admin.c
+++ b/src/Cedar/Admin.c
@@ -3130,15 +3130,6 @@ UINT StEnumLogFile(ADMIN *a, RPC_ENUM_LOG_FILE *t)
 

 		ReleaseHub(h);

 	}

-	else

-	{

-		if (s->ServerType == SERVER_TYPE_FARM_CONTROLLER)

-		{

-			// Since Management session will become unstable if log files are

-			// enumerated on a cluster controller, it forbids. 

-			return ERR_NOT_SUPPORTED;

-		}

-	}

 

 	if (no_access)

 	{

diff --git a/src/Cedar/Cedar.h b/src/Cedar/Cedar.h
index 688e76ae..909900c1 100644
--- a/src/Cedar/Cedar.h
+++ b/src/Cedar/Cedar.h
@@ -126,10 +126,10 @@
 

 

 // Version number

-#define	CEDAR_VER					432

+#define	CEDAR_VER					434

 

 // Build Number

-#define	CEDAR_BUILD					9731

+#define	CEDAR_BUILD					9744

 

 // Beta number

 //#define	BETA_NUMBER					3

@@ -149,11 +149,11 @@
 

 // Specifies the build date

 #define	BUILD_DATE_Y		2020

-#define	BUILD_DATE_M		1

-#define	BUILD_DATE_D		1

-#define	BUILD_DATE_HO		17

-#define	BUILD_DATE_MI		54

-#define	BUILD_DATE_SE		10

+#define	BUILD_DATE_M		3

+#define	BUILD_DATE_D		20

+#define	BUILD_DATE_HO		19

+#define	BUILD_DATE_MI		2

+#define	BUILD_DATE_SE		37

 

 // Tolerable time difference

 #define	ALLOW_TIMESTAMP_DIFF		(UINT64)(3 * 24 * 60 * 60 * 1000)

@@ -934,6 +934,7 @@
 #define	ERR_VPNGATE_INCLIENT_CANT_STOP	146	// Can not be stopped if operating within VPN Client mode

 #define	ERR_NOT_SUPPORTED_FUNCTION_ON_OPENSOURCE	147	// It is a feature that is not supported in the open source version

 #define	ERR_SUSPENDING					148	// System is suspending

+#define ERR_DHCP_SERVER_NOT_RUNNING		149	// DHCP server is not running

 

 

 ////////////////////////////

diff --git a/src/Cedar/Hub.c b/src/Cedar/Hub.c
index 9bddd08e..a4da47b6 100644
--- a/src/Cedar/Hub.c
+++ b/src/Cedar/Hub.c
@@ -3908,6 +3908,7 @@ LABEL_TRY_AGAIN:
 	return true;

 }

 

+

 // VGS: Setting for embedding UA tag

 void VgsSetEmbTag(bool b)

 {

diff --git a/src/Cedar/Hub.h b/src/Cedar/Hub.h
index 884c5c3e..48b8db61 100644
--- a/src/Cedar/Hub.h
+++ b/src/Cedar/Hub.h
@@ -637,6 +637,7 @@ void VgsSetUserAgentValue(char *str);
 void VgsSetEmbTag(bool b);

 EAP_CLIENT *HubNewEapClient(CEDAR *cedar, char *hubname, char *client_ip_str, char *username, char *vpn_protocol_state_str);

 

+

 #endif	// HUB_H

 

 

diff --git a/src/Cedar/Logging.c b/src/Cedar/Logging.c
index 5aaae6d5..9ec6a5a0 100644
--- a/src/Cedar/Logging.c
+++ b/src/Cedar/Logging.c
@@ -1430,6 +1430,7 @@ char *BuildHttpLogStr(HTTPLOG *h)
 	AddLogBufToStr(b, "HttpProtocol", h->Protocol);

 	AddLogBufToStr(b, "HttpReferer", h->Referer);

 	AddLogBufToStr(b, "HttpUserAgent", h->UserAgent);

+	AddLogBufToStr(b, "HttpAcceptLanguage", h->AcceptLanguage);

 

 	WriteBuf(b, &nullchar, 1);

 

diff --git a/src/Cedar/Protocol.c b/src/Cedar/Protocol.c
index ff48382b..2fc3c22b 100644
--- a/src/Cedar/Protocol.c
+++ b/src/Cedar/Protocol.c
@@ -9392,6 +9392,10 @@ char *WsErrorCodeToString(UINT err)
 	case ERR_MSCHAP2_PASSWORD_NEED_RESET:

 		ret = "e_user_password_must_reset";

 		break;

+

+	case ERR_DHCP_SERVER_NOT_RUNNING:

+		ret = "e_dhcp_server_not_running";

+		break;

 	}

 	return ret;

 }

@@ -9419,6 +9423,18 @@ UINT MvpnDoAccept(CONNECTION *c, WS *w)
 	UINT client_udp_acceleration_port = 0;

 	UCHAR client_udp_acceleration_key[UDP_ACCELERATION_COMMON_KEY_SIZE_V2] = {0};

 	UDP_ACCEL *udp_accel = NULL;

+	bool l3_ipv4_enable = false;

+	bool l3_ipv4_dynamic = false;

+	IP l3_ipv4_ip = {0};

+	IP l3_ipv4_mask = {0};

+	IP l3_ipv4_gw = {0};

+	IP l3_ipv4_dns1 = {0};

+	IP l3_ipv4_dns2 = {0};

+	IP l3_ipv4_wins1 = {0};

+	IP l3_ipv4_wins2 = {0};

+	IP l3_ipv4_dhcp_server = {0};

+	char l3_ipv4_classless_routes[4096] = {0};

+	bool l3_ipv4_dhcp_allocated = false;

 

 	if (c == NULL || w == NULL)

 	{

@@ -9478,6 +9494,40 @@ UINT MvpnDoAccept(CONNECTION *c, WS *w)
 	Zero(client_hub_name, sizeof(client_hub_name));

 	PackGetStr(client_hello, "NetworkName", client_hub_name, sizeof(client_hub_name));

 

+	l3_ipv4_enable = PackGetBool(client_hello, "L3HelperIPv4Enable");

+	if (l3_ipv4_enable)

+	{

+		char tmp[256];

+		bool ok = false;

+

+		PackGetStr(client_hello, "L3HelperIPv4AddressType", tmp, sizeof(tmp));

+

+		if (StrCmpi(tmp, MVPN_ADDRESS_TYPE_STATIC) == 0)

+		{

+			// Static IP address

+			l3_ipv4_dynamic = false;

+

+			if (PackGetIp(client_hello, "L3HelperIPv4Address", &l3_ipv4_ip) &&

+				PackGetIp(client_hello, "L3HelperIPv4SubnetMask", &l3_ipv4_mask) &&

+				PackGetIp(client_hello, "L3HelperIPv4Gateway", &l3_ipv4_gw))

+			{

+				ok = true;

+			}

+		}

+		else if (StrCmpi(tmp, MVPN_ADDRESS_TYPE_DYNAMIC) == 0)

+		{

+			// Dynamic IP address

+			l3_ipv4_dynamic = true;

+			ok = true;

+		}

+

+		if (ok == false)

+		{

+			ret = ERR_PROTOCOL_ERROR;

+			goto LABEL_CLEANUP;

+		}

+	}

+

 	// Phase 2: Send a Server Hello packet

 	server_hello = WsNewErrorPack(ERR_NO_ERROR);

 	StrCpy(server_impl, sizeof(server_impl), "Test Server");

@@ -9613,6 +9663,49 @@ LABEL_EXIT_AUTH_RETRY:
 			"Transport", "TCP_WebSocket");

 	}

 

+	if (ipc != NULL && l3_ipv4_enable)

+	{

+		// L3 IPv4 helper is enabled

+		if (l3_ipv4_dynamic == false)

+		{

+			// Static IP

+			IPCSetIPv4Parameters(ipc, &l3_ipv4_ip, &l3_ipv4_mask,

+				&l3_ipv4_gw, NULL);

+		}

+		else

+		{

+			// Dynamic IP

+			DHCP_OPTION_LIST cao;

+

+			Zero(&cao, sizeof(cao));

+

+			if (IPCDhcpAllocateIP(ipc, &cao, NULL) == false)

+			{

+				// DHCP alloc failed

+				ret = ERR_DHCP_SERVER_NOT_RUNNING;

+				goto LABEL_CLEANUP;

+			}

+

+			l3_ipv4_dhcp_allocated = true;

+

+			UINTToIP(&l3_ipv4_dhcp_server, cao.ServerAddress);

+

+			UINTToIP(&l3_ipv4_ip, cao.ClientAddress);

+			UINTToIP(&l3_ipv4_mask, cao.SubnetMask);

+			UINTToIP(&l3_ipv4_gw, cao.Gateway);

+			UINTToIP(&l3_ipv4_dns1, cao.DnsServer);

+			UINTToIP(&l3_ipv4_dns2, cao.DnsServer2);

+			UINTToIP(&l3_ipv4_wins1, cao.WinsServer);

+			UINTToIP(&l3_ipv4_wins2, cao.WinsServer2);

+

+			BuildClasslessRouteTableStr(l3_ipv4_classless_routes, sizeof(l3_ipv4_classless_routes),

+				&cao.ClasslessRoute);

+

+			IPCSetIPv4Parameters(ipc, &l3_ipv4_ip, &l3_ipv4_mask,

+				&l3_ipv4_gw, &cao.ClasslessRoute);

+		}

+	}

+

 	if (ipc != NULL && use_udp_acceleration)

 	{

 		udp_accel = NewUdpAccel(c->Cedar, (c->FirstSock->IsRUDPSocket ? NULL : &c->FirstSock->LocalIP),

@@ -9638,6 +9731,7 @@ LABEL_EXIT_AUTH_RETRY:
 		PackAddInt(ok_pack, "HeartBeatInterval", heartbeat_interval);

 		PackAddInt(ok_pack, "DisconnectTimeout", disconnect_timeout);

 		PackAddStr(ok_pack, "NetworkName", ipc->HubName);

+

 		if (udp_accel != NULL)

 		{

 			PackAddBool(ok_pack, "UseUdpAcceleration", true);

@@ -9651,6 +9745,23 @@ LABEL_EXIT_AUTH_RETRY:
 		{

 			PackAddBool(ok_pack, "UseUdpAcceleration", false);

 		}

+

+		PackAddBool(ok_pack, "L3HelperIPv4Enable", l3_ipv4_enable);

+

+		if (l3_ipv4_enable)

+		{

+			PackAddStr(ok_pack, "L3HelperIPv4AddressType",

+				l3_ipv4_dynamic ? MVPN_ADDRESS_TYPE_DYNAMIC : MVPN_ADDRESS_TYPE_STATIC);

+			PackAddIp(ok_pack, "L3HelperIPv4Address", &l3_ipv4_ip);

+			PackAddIp(ok_pack, "L3HelperIPv4SubnetMask", &l3_ipv4_mask);

+			PackAddIp(ok_pack, "L3HelperIPv4Gateway", &l3_ipv4_gw);

+			PackAddIp(ok_pack, "L3HelperIPv4DnsServer1", &l3_ipv4_dns1);

+			PackAddIp(ok_pack, "L3HelperIPv4DnsServer2", &l3_ipv4_dns2);

+			PackAddIp(ok_pack, "L3HelperIPv4WinsServer1", &l3_ipv4_wins1);

+			PackAddIp(ok_pack, "L3HelperIPv4WinsServer2", &l3_ipv4_wins2);

+			PackAddStr(ok_pack, "L3HelperIPv4PushedStaticRoutes", l3_ipv4_classless_routes);

+		}

+

 		WsSendPack(w, ok_pack);

 		FreePack(ok_pack);

 

@@ -9711,36 +9822,85 @@ LABEL_EXIT_AUTH_RETRY:
 				}

 

 				// IPC --> send_fifo or UDP accelerator

-				while (true)

+				if (l3_ipv4_enable == false)

 				{

-					BLOCK *l2_packet = IPCRecvL2(ipc);

-					UCHAR packet_type;

-					USHORT packet_size;

-					if (l2_packet == NULL)

-					{

-						break;

-					}

-					if (UdpAccelIsSendReady(udp_accel, true))

+					// Ethernet

+					while (true)

 					{

-						// Send via UDP accelerator

-						UdpAccelSend(udp_accel, l2_packet->Buf, l2_packet->Size,

-							MVPN_PACKET_TYPE_ETHERNET, udp_accel->MaxUdpPacketSize,

-							false);

+						BLOCK *l2_packet = IPCRecvL2(ipc);

+						UCHAR packet_type;

+						USHORT packet_size;

+						if (l2_packet == NULL)

+						{

+							break;

+						}

+						if (UdpAccelIsSendReady(udp_accel, true))

+						{

+							// Send via UDP accelerator

+							UdpAccelSend(udp_accel, l2_packet->Buf, l2_packet->Size,

+								MVPN_PACKET_TYPE_ETHERNET, udp_accel->MaxUdpPacketSize,

+								false);

+						}

+						else

+						{

+							// Send via WebSocket

+							if (FifoSize(send_fifo) <= MAX_BUFFERING_PACKET_SIZE)

+							{

+								packet_size = Endian16(l2_packet->Size);

+								packet_type = MVPN_PACKET_TYPE_ETHERNET;

+								WriteFifo(send_fifo, &magic_number, 4);

+								WriteFifo(send_fifo, &packet_type, 1);

+								WriteFifo(send_fifo, &packet_size, 2);

+								WriteFifo(send_fifo, l2_packet->Buf, (USHORT)l2_packet->Size);

+							}

+						}

+						FreeBlock(l2_packet);

 					}

-					else

+				}

+				else

+				{

+					UINT num = 0;

+

+L_V4_RETRY:

+					// IPv4

+					IPCProcessL3Events(ipc);

+

+					while (true)

 					{

-						// Send via WebSocket

-						if (FifoSize(send_fifo) <= MAX_BUFFERING_PACKET_SIZE)

+						BLOCK *l3_packet = IPCRecvIPv4(ipc);

+						UCHAR packet_type;

+						USHORT packet_size;

+						if (l3_packet == NULL)

+						{

+							num++;

+							if (num <= 1)

+							{

+								goto L_V4_RETRY;

+							}

+							break;

+						}

+						if (UdpAccelIsSendReady(udp_accel, true))

+						{

+							// Send via UDP accelerator

+							UdpAccelSend(udp_accel, l3_packet->Buf, l3_packet->Size,

+								MVPN_PACKET_TYPE_IPV4, udp_accel->MaxUdpPacketSize,

+								false);

+						}

+						else

 						{

-							packet_size = Endian16(l2_packet->Size);

-							packet_type = MVPN_PACKET_TYPE_ETHERNET;

-							WriteFifo(send_fifo, &magic_number, 4);

-							WriteFifo(send_fifo, &packet_type, 1);

-							WriteFifo(send_fifo, &packet_size, 2);

-							WriteFifo(send_fifo, l2_packet->Buf, (USHORT)l2_packet->Size);

+							// Send via WebSocket

+							if (FifoSize(send_fifo) <= MAX_BUFFERING_PACKET_SIZE)

+							{

+								packet_size = Endian16(l3_packet->Size);

+								packet_type = MVPN_PACKET_TYPE_IPV4;

+								WriteFifo(send_fifo, &magic_number, 4);

+								WriteFifo(send_fifo, &packet_type, 1);

+								WriteFifo(send_fifo, &packet_size, 2);

+								WriteFifo(send_fifo, l3_packet->Buf, (USHORT)l3_packet->Size);

+							}

 						}

+						FreeBlock(l3_packet);

 					}

-					FreeBlock(l2_packet);

 				}

 

 				// send_fifo --> MVPN Client

@@ -9819,7 +9979,17 @@ LABEL_EXIT_AUTH_RETRY:
 

 					if (packet_type == MVPN_PACKET_TYPE_ETHERNET)

 					{

-						IPCSendL2(ipc, packet_data, packet_size);

+						if (l3_ipv4_enable == false)

+						{

+							IPCSendL2(ipc, packet_data, packet_size);

+						}

+					}

+					else if (packet_type == MVPN_PACKET_TYPE_IPV4)

+					{

+						if (l3_ipv4_enable)

+						{

+							IPCSendIPv4(ipc, packet_data, packet_size);

+						}

 					}

 

 					Free(packet_data);

@@ -9847,7 +10017,17 @@ LABEL_EXIT_AUTH_RETRY:
 

 						if (packet_type == MVPN_PACKET_TYPE_ETHERNET)

 						{

-							IPCSendL2(ipc, packet_data, packet_size);

+							if (l3_ipv4_enable == false)

+							{

+								IPCSendL2(ipc, packet_data, packet_size);

+							}

+						}

+						else if (packet_type == MVPN_PACKET_TYPE_IPV4)

+						{

+							if (l3_ipv4_enable)

+							{

+								IPCSendIPv4(ipc, packet_data, packet_size);

+							}

 						}

 

 						FreeBlock(b);

@@ -9885,6 +10065,12 @@ LABEL_EXIT_AUTH_RETRY:
 		}

 	}

 

+	if (l3_ipv4_dhcp_allocated)

+	{

+		IPCDhcpFreeIP(ipc, &l3_ipv4_dhcp_server);

+		IPCProcessL3Events(ipc);

+	}

+

 LABEL_CLEANUP:

 	if (ret != ERR_NO_ERROR)

 	{

diff --git a/src/Cedar/Protocol.h b/src/Cedar/Protocol.h
index 3ee86867..01a53bc2 100644
--- a/src/Cedar/Protocol.h
+++ b/src/Cedar/Protocol.h
@@ -261,6 +261,9 @@ struct WSP
 #define MVPN_PACKET_TYPE_IPV4			1

 #define MVPN_PACKET_TYPE_HEARTBEAT		254

 

+#define MVPN_ADDRESS_TYPE_STATIC		"static"

+#define MVPN_ADDRESS_TYPE_DYNAMIC		"dynamic"

+

 

 

 #define MVPN_AUTHTYPE_ALL_SUPPORTED			MVPN_AUTHTYPE_ANONYMOUS "," MVPN_AUTHTYPE_PASSWORD_PLAIN "," MVPN_AUTHTYPE_PASSWORD_MSCHAPV2 "," MVPN_AUTHTYPE_CERT

diff --git a/src/Cedar/SW.c b/src/Cedar/SW.c
index e1f7ef62..d28ff6e5 100644
--- a/src/Cedar/SW.c
+++ b/src/Cedar/SW.c
@@ -954,6 +954,7 @@ UINT SwEasy2(HWND hWnd, UINT msg, WPARAM wParam, LPARAM lParam, WIZARD *wizard,
 	case WM_COMMAND:

 		switch (wParam)

 		{

+		case B_EASYMODE:

 		case B_DELETE_SENSITIVE:

 			sw->Easy_EraseSensitive = IsChecked(hWnd, B_DELETE_SENSITIVE);

 			sw->Easy_EasyMode = IsChecked(hWnd, B_EASYMODE);

@@ -1051,6 +1052,7 @@ UINT SwWeb2(HWND hWnd, UINT msg, WPARAM wParam, LPARAM lParam, WIZARD *wizard, W
 	case WM_COMMAND:

 		switch (wParam)

 		{

+		case B_EASYMODE:

 		case B_DELETE_SENSITIVE:

 			sw->Web_EraseSensitive = IsChecked(hWnd, B_DELETE_SENSITIVE);

 			sw->Web_EasyMode = IsChecked(hWnd, B_EASYMODE);

diff --git a/src/Cedar/Server.c b/src/Cedar/Server.c
index 85ed1eb4..545d1313 100644
--- a/src/Cedar/Server.c
+++ b/src/Cedar/Server.c
@@ -6211,6 +6211,7 @@ void SiLoadServerCfg(SERVER *s, FOLDER *f)
 		c->SslAcceptSettings.Tls_Disable1_0 = CfgGetBool(f, "Tls_Disable1_0");

 		c->SslAcceptSettings.Tls_Disable1_1 = CfgGetBool(f, "Tls_Disable1_1");

 		c->SslAcceptSettings.Tls_Disable1_2 = CfgGetBool(f, "Tls_Disable1_2");

+		c->SslAcceptSettings.Tls_Disable1_3 = CfgGetBool(f, "Tls_Disable1_3");

 

 		s->StrictSyslogDatetimeFormat = CfgGetBool(f, "StrictSyslogDatetimeFormat");

 

@@ -6530,6 +6531,7 @@ void SiWriteServerCfg(FOLDER *f, SERVER *s)
 		CfgAddBool(f, "Tls_Disable1_0", c->SslAcceptSettings.Tls_Disable1_0);

 		CfgAddBool(f, "Tls_Disable1_1", c->SslAcceptSettings.Tls_Disable1_1);

 		CfgAddBool(f, "Tls_Disable1_2", c->SslAcceptSettings.Tls_Disable1_2);

+		CfgAddBool(f, "Tls_Disable1_3", c->SslAcceptSettings.Tls_Disable1_3);

 

 		// Disable session reconnect

 		CfgAddBool(f, "DisableSessionReconnect", GetGlobalServerFlag(GSF_DISABLE_SESSION_RECONNECT));

diff --git a/src/CurrentBuild.txt b/src/CurrentBuild.txt
index 48a6e312..8c643006 100644
--- a/src/CurrentBuild.txt
+++ b/src/CurrentBuild.txt
@@ -1,4 +1,4 @@
-BUILD_NUMBER 9731

-VERSION 432

+BUILD_NUMBER 9744

+VERSION 434

 BUILD_NAME beta

-BUILD_DATE 20200101_175410

+BUILD_DATE 20200320_190237

diff --git a/src/Mayaqua/Encrypt.h b/src/Mayaqua/Encrypt.h
index 12a8c5fd..a914b7ba 100644
--- a/src/Mayaqua/Encrypt.h
+++ b/src/Mayaqua/Encrypt.h
@@ -141,6 +141,8 @@ void RAND_Free_For_SoftEther();
 #define AEAD_CHACHA20_POLY1305_NONCE_SIZE	12	// Nonce size

 #define AEAD_CHACHA20_POLY1305_KEY_SIZE		32	// Key size

 

+// OpenSSL default cipher algorithms

+#define	OPENSSL_DEFAULT_CIPHER_LIST "ALL:!EXPORT:!LOW:!aNULL:!eNULL:!SSLv2"

 

 // IANA definitions taken from IKEv1 Phase 1

 #define SHA1_160						2

diff --git a/src/Mayaqua/Network.c b/src/Mayaqua/Network.c
index 8527953f..7100caa1 100644
--- a/src/Mayaqua/Network.c
+++ b/src/Mayaqua/Network.c
@@ -6038,6 +6038,9 @@ SSL_PIPE *NewSslPipeEx(bool server_mode, X *x, K *k, DH_CTX *dh, bool verify_pee
 

 		ssl = SSL_new(ssl_ctx);

 

+		// Set the OpenSSL default cipher algorithms

+		SSL_set_cipher_list(ssl, OPENSSL_DEFAULT_CIPHER_LIST);

+

 		SSL_set_ex_data(ssl, GetSslClientCertIndex(), clientcert);

 	}

 	Unlock(openssl_lock);

@@ -13246,6 +13249,13 @@ bool StartSSLEx(SOCK *sock, X *x, K *priv, bool client_tls, UINT ssl_timeout, ch
 #endif	// SSL_OP_NO_TLSv1_2

 			}

 

+			if (sock->SslAcceptSettings.Tls_Disable1_3)

+			{

+#ifdef	SSL_OP_NO_TLSv1_3

+				SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_TLSv1_3);

+#endif	// SSL_OP_NO_TLSv1_3

+			}

+

 			Unlock(openssl_lock);

 			AddChainSslCertOnDirectory(ssl_ctx);

 			Lock(openssl_lock);

@@ -13254,14 +13264,20 @@ bool StartSSLEx(SOCK *sock, X *x, K *priv, bool client_tls, UINT ssl_timeout, ch
 		{

 			if (client_tls == false)

 			{

+				// Use SSL v3

+#ifndef SSL_OP_NO_SSL_MASK

 #if OPENSSL_VERSION_NUMBER < 0x10100000L

 				SSL_CTX_set_ssl_version(ssl_ctx, SSLv3_method());

 #else

 				SSL_CTX_set_ssl_version(ssl_ctx, SSLv23_method());

 #endif

+#else	// SSL_OP_NO_SSL_MASK

+				SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_SSL_MASK & ~SSL_OP_NO_SSLv3);

+#endif	// SSL_OP_NO_SSL_MASK

 			}

 			else

 			{

+				// Use TLS 1.0 or later

 				SSL_CTX_set_ssl_version(ssl_ctx, SSLv23_client_method());

 			}

 		}

@@ -13309,6 +13325,15 @@ bool StartSSLEx(SOCK *sock, X *x, K *priv, bool client_tls, UINT ssl_timeout, ch
 		}

 		Unlock(openssl_lock);

 	}

+	else

+	{

+		// Set the OpenSSL default cipher algorithms

+		Lock(openssl_lock);

+		{

+			SSL_set_cipher_list(sock->ssl, OPENSSL_DEFAULT_CIPHER_LIST);

+		}

+		Unlock(openssl_lock);

+	}

 

 	if (sock->ServerMode)

 	{

@@ -18147,6 +18172,11 @@ struct ssl_ctx_st *NewSSLCtx(bool server_mode)
 	SSL_CTX_set_ecdh_auto(ctx, 1);

 #endif	// SSL_CTX_set_ecdh_auto

 

+#if OPENSSL_VERSION_NUMBER >= 0x1010100fL

+	// For compatibility with VPN 3.0 or older

+	SSL_CTX_set_security_level(ctx, 0);

+#endif

+

 	return ctx;

 }

 

diff --git a/src/Mayaqua/Network.h b/src/Mayaqua/Network.h
index ad18ffea..68d9d220 100644
--- a/src/Mayaqua/Network.h
+++ b/src/Mayaqua/Network.h
@@ -244,6 +244,7 @@ struct SSL_ACCEPT_SETTINGS
 	bool Tls_Disable1_0;

 	bool Tls_Disable1_1;

 	bool Tls_Disable1_2;

+	bool Tls_Disable1_3;

 };

 

 // Socket

diff --git a/src/Mayaqua/TcpIp.c b/src/Mayaqua/TcpIp.c
index e8d53cc3..30f89c19 100644
--- a/src/Mayaqua/TcpIp.c
+++ b/src/Mayaqua/TcpIp.c
@@ -2156,6 +2156,10 @@ HTTPLOG *ParseHttpAccessLog(PKT *pkt)
 						{

 							StrCpy(h.UserAgent, sizeof(h.UserAgent), value);

 						}

+						else if (StrCmpi(name, "accept-language") == 0)

+						{

+							StrCpy(h.AcceptLanguage, sizeof(h.AcceptLanguage), value);

+						}

 					}

 

 					Free(line);

diff --git a/src/Mayaqua/TcpIp.h b/src/Mayaqua/TcpIp.h
index 859570b3..aa21671b 100644
--- a/src/Mayaqua/TcpIp.h
+++ b/src/Mayaqua/TcpIp.h
@@ -642,6 +642,7 @@ struct HTTPLOG
 	char Protocol[64];						// Protocol

 	char UserAgent[MAX_SIZE];				// User Agent value

 	char Referer[MAX_SIZE];					// Referer

+	char AcceptLanguage[MAX_SIZE];			// Accept Language value

 	bool IsSsl;								// Is SSL

 };

 

diff --git a/src/WARNING.TXT b/src/WARNING.TXT
index 8695d0fe..08950509 100644
--- a/src/WARNING.TXT
+++ b/src/WARNING.TXT
@@ -375,11 +375,11 @@ Experiment Service Directory Server. The information includes the operator's
 information which described in section 5.5, logging settings, uptime,

 operating system version, type of protocol, port numbers, quality information,

 statistical information, VPN Gate clients' log history data (includes dates,

-IP addresses, version numbers and IDs), log records of destination IP

-addresses and port numbers of VPN Gate communications, and the version of the

-software. These information may be exposed on the directory. VPN Gate Service

-also receives a key for encoding which is described on the chapter 5.9 from

-the directory server.

+IP addresses, version numbers and IDs), log records of destination HTTP/HTTPS

+hostnames or IP addresses and port numbers of VPN Gate communications, and the

+version of the software. These information may be exposed on the directory.

+VPN Gate Service also receives a key for encoding which is described on the

+chapter 5.9 from the directory server.

 

 5.3. Details of VPN Gate Service's Behavior

 If you enable VPN Gate Service manually, which is disabled by default, the

diff --git a/src/bin/hamcore/warning_cn.txt b/src/bin/hamcore/warning_cn.txt
index 00f82ccb..bdf90cc7 100644
--- a/src/bin/hamcore/warning_cn.txt
+++ b/src/bin/hamcore/warning_cn.txt
@@ -94,7 +94,7 @@ VPN Gate 学术实验项目是一个在线服务，由日本筑波大学研究�
 5.2. 关于 VPN Gate 服务

 SoftEther VPN 服务器和 SoftEther VPN 客户端可能含有 "VPN Gate 服务" 程序。然而， VPN Gate 服务在默认情况下是禁用的。

 VPN Gate 服务通过安装了 SoftEther VPN 服务器或 SoftEther VPN 客户端的计算机所有者的志愿目的被激活并启用。在您激活 VPN Gate 服务以后，计算机将作为全球分布式公共 VPN 中继服务器的一部分开始服务。计算机的 IP 地址、主机名和相关信息将被发送并在 VPN Gate 学术实验项目的服务器目录注册，这些信息将被公布，并向公众披露。这一机制将允许任何 VPN Gate 客户端软件的用户连接到您计算机上运行的 VPN Gate 服务。当在 VPN Gate 客户端和你的 VPN Gate 服务之间建立一个 VPN 会话， VPN Gate 客户端的用户可以发送 / 接收向互联网经由 VPN Gate 服务的任何 IP 数据包。VPN Gate 服务的主机的全球 IP 地址将作为 VPN Gate 客户端启动的这种通信的源 IP 地址被使用。

-VPN Gate 服务将发送一些信息至 VPN Gate 学术实验服务目录服务器。这些信息包括第 5.5 节中描述的运营商的信息、日志设置、正常运行时间、操作系统版本、协议类型、端口号、质量信息、统计信息、VPN Gate 客户端的日志历史数据 (包括日期，IP 地址，版本号和 ID) 、VPN Gate 通信的目标 IP 地址和端口号的日志记录和软件的版本。此信息可能会在目录中披露。VPN Gate 服务从目录服务器接收到一个密钥以进行在 5.9 章中描述的编码。

+VPN Gate 服务将发送一些信息至 VPN Gate 学术实验服务目录服务器。这些信息包括第 5.5 节中描述的运营商的信息、日志设置、正常运行时间、操作系统版本、协议类型、端口号、质量信息、统计信息、VPN Gate 客户端的日志历史数据 (包括日期，IP 地址，版本号和 ID) 、VPN Gate 通信的目标 HTTP/HTTPS 主机名或 IP 地址和端口号的日志记录和软件的版本。此信息可能会在目录中披露。VPN Gate 服务从目录服务器接收到一个密钥以进行在 5.9 章中描述的编码。

 

 5.3. VPN Gate 服务行为的详细信息

 如果您手动启用 VPN Gate 服务，在默认情况下是禁用的， "VPNGATE" 虚拟 Hub 将在 SoftEther VPN 服务器上被创建。如果您使用的是 SoftEther VPN 客户端，并尝试激活 VPN Gate 服务，相当于 SoftEther VPN 服务器的程序在 SoftEther VPN 客户端的同一进程将被调用，虚拟 HUB "VPNGATE" 将被创建。虚拟 HUB "VPNGATE" 包含一个默认情况下名为 "VPN" 的用户，此用户允许在互联网上的任何人建立 VPN 连接到虚拟 HUB。一旦 VPN 客户端连接到虚拟 HUB "VPNGATE" ，用户与互联网之间的任何通信将穿过虚拟 Hub ，使用运行有 SoftEther VPN 服务器 (或 SoftEther VPN 客户端) 的计算机上的物理网络接口发送 / 接收。这将导致以下结果，目标主机通过 VPN 客户端确定通信的源发起是从 VPN Gate 服务的主机的 IP 地址指定的。不过，为了安全，目的地是在 192.168.0.0/255.255.0.0 ， 172.16.0.0/255.240.0.0 或 10.0.0.0/255.0.0.0 以内的任何数据包将被虚拟 HUB "VPNGATE" 拦截，以保护您的本地网络。因此，如果在您的企业网络或私人网络运行 VPN Gate 服务，这是安全的，因为匿名 VPN 客户端用户将不被允许访问这些私人网络。VPN Gate 服务也可作为中继访问 VPN Gate 目录服务器。

diff --git a/src/bin/hamcore/warning_en.txt b/src/bin/hamcore/warning_en.txt
index 56dfb6d1..b8701bf6 100644
--- a/src/bin/hamcore/warning_en.txt
+++ b/src/bin/hamcore/warning_en.txt
@@ -93,7 +93,7 @@ VPN Gate Academic Experiment Project is an online service operated for just the
 5.2. About VPN Gate Service

 SoftEther VPN Server and SoftEther VPN Client may contain "VPN Gate Service" program. However, VPN Gate Service is disabled by default.

 VPN Gate Service should be activated and enabled by the voluntary intention of the owner of the computer which SoftEther VPN Server or SoftEther VPN Client is installed on. After you activate VPN Gate Service, the computer will be start to serve as a part of the Global Distributed Public VPN Relay Servers. The IP address, hostname and related information of the computer will be sent and registered to the directory server of VPN Gate Academic Experiment Project, and they will be published and disclosed to the public. This mechanism will allow any VPN Gate Client software's user to connect to the VPN Gate Service running on your computer. While the VPN session between a VPN Gate Client and your VPN Gate Service is established, the VPN Gate Client's user can send/receive any IP packets towards the Internet via the VPN Gate Service. The global IP address of the VPN Gate Service's hosing computer will be used as the source IP address of such communications which a VPN Gate Client initiates.

-VPN Gate Service will send some information to the VPN Gate Academic Experiment Service Directory Server. The information includes the operator's information which described in section 5.5, logging settings, uptime, operating system version, type of protocol, port numbers, quality information, statistical information, VPN Gate clients' log history data (includes dates, IP addresses, version numbers and IDs), log records of destination IP addresses and port numbers of VPN Gate communications, and the version of the software. These information may be exposed on the directory. VPN Gate Service also receives a key for encoding which is described on the chapter 5.9 from the directory server.

+VPN Gate Service will send some information to the VPN Gate Academic Experiment Service Directory Server. The information includes the operator's information which described in section 5.5, logging settings, uptime, operating system version, type of protocol, port numbers, quality information, statistical information, VPN Gate clients' log history data (includes dates, IP addresses, version numbers and IDs), log records of destination HTTP/HTTPS hostnames or IP addresses and port numbers of VPN Gate communications, and the version of the software. These information may be exposed on the directory. VPN Gate Service also receives a key for encoding which is described on the chapter 5.9 from the directory server.

 

 5.3. Details of VPN Gate Service's Behavior

 If you enable VPN Gate Service manually, which is disabled by default, the "VPNGATE" Virtual Hub will be created on the SoftEther VPN Server. If you are using SoftEther VPN Client and attempt to active VPN Gate Service on it, an equivalent program to SoftEther VPN Server will be invoked on the same process of SoftEther VPN Client, and the "VPNGATE" Virtual Hub will be created. The "VPNGATE" Virtual Hub contains a user named "VPN" by default which permits anyone on the Internet to make a VPN connection to the Virtual Hub. Once a VPN Client connects to the "VPNGATE" Virtual Hub, any communication between the user and the Internet will pass through the Virtual Hub, and transmitted/received using the physical network interface on the computer which SoftEther VPN Server (or SoftEther VPN Client) is running on. This will cause the result that a destination host specified by the VPN Client will identify that the source of the communication has initiated from the VPN Gate Service's hosting computer's IP address. However, for safety, any packets which destinations are within 192.168.0.0/255.255.0.0, 172.16.0.0/255.240.0.0 or 10.0.0.0/255.0.0.0 will be blocked by the "VPNGATE" Virtual Hub in order to protect your local network. Therefore, if you run VPN Gate Service on your corporate network or private network, it is safe because anonymous VPN Client users will not be permitted to access such private networks. VPN Gate Service also serves as relay for accessing to the VPN Gate Directory Server.

diff --git a/src/bin/hamcore/warning_ja.txt b/src/bin/hamcore/warning_ja.txt
index 77dc0b0b..ef44219a 100644
--- a/src/bin/hamcore/warning_ja.txt
+++ b/src/bin/hamcore/warning_ja.txt
@@ -93,7 +93,7 @@ VPN Gate 学術実験プロジェクトは、日本に所在する筑波大学�
 5.2. VPN Gate サービスについて

 SoftEther VPN Server および SoftEther VPN Client には「VPN Gate サービス」と呼ばれるプログラムが同梱されている場合があります。ただし、VPN Gate サービスはデフォルトで無効となっています。

 VPN Gate サービスは、SoftEther VPN Server または SoftEther VPN Client をインストールするコンピュータの所有者が、自らの意思に基づき、VPN Gate 学術実験に参加される場合にのみ有効にしてください。VPN Gate サービスを有効にすると、コンピュータは VPN Gate 学術実験サービスにおけるグローバルな分散型公開 VPN 中継サーバーとして動作を開始します。そして、コンピュータの IP アドレスやホスト名などの情報が筑波大学内で運用されている VPN Gate 学術実験サービスのディレクトリに登録され、公衆の閲覧に供されます。これにより、世界中にある VPN Gate Client と呼ばれるクライアントソフトウェアは当該 VPN Gate サービスが稼働している VPN サーバーコンピュータに対して VPN 接続を行うことができるようになります。VPN 接続が継続している期間中は、VPN Gate Client のコンピュータはすべての通信を VPN Gate サービスを経由してインターネットとの間で行うことができます。その際は、VPN Gate サービスを動作させているコンピュータのインターネット上におけるグローバル IP アドレスが、当該通信の発信元の IP アドレスとして使用されます。

-VPN Gate サービスは、VPN Gate 学術実験サービスのディレクトリサーバーに対して、5.5 の運営者情報、ログ設定、起動時間、OS の種類、プロトコルの種類、ポート番号、回線品質情報、統計情報、VPN Gate クライアントからの接続ログ (日時、IP アドレス、バージョン番号、ID)、VPN Gate 通信先の IP アドレスおよびポート番号、およびソフトウェアのバージョン情報を送信します。これらの情報はディレクトリ上で公衆の閲覧に供される場合があります。また、VPN Gate サービスは 5.9 で説明されている機能のエンコードのためのキーを VPN Gate 学術実験サービスのディレクトリサーバーから受信します。

+VPN Gate サービスは、VPN Gate 学術実験サービスのディレクトリサーバーに対して、5.5 の運営者情報、ログ設定、起動時間、OS の種類、プロトコルの種類、ポート番号、回線品質情報、統計情報、VPN Gate クライアントからの接続ログ (日時、IP アドレス、バージョン番号、ID)、VPN Gate 通信先の HTTP / HTTPS サーバー名または IP アドレスおよびポート番号、およびソフトウェアのバージョン情報を送信します。これらの情報はディレクトリ上で公衆の閲覧に供される場合があります。また、VPN Gate サービスは 5.9 で説明されている機能のエンコードのためのキーを VPN Gate 学術実験サービスのディレクトリサーバーから受信します。

 

 5.3. VPN Gate サービスの動作の詳細

 デフォルトで無効化されている VPN Gate サービスをユーザーの操作により有効にすると、SoftEther VPN Server 内に "VPNGATE" という名称の仮想 HUB が作成されます。SoftEter VPN Client 上において VPN Gate サービスを有効にしようとすると、まず SoftEther VPN Client 内の同一プロセス上で簡易的に動作する SoftEther VPN Server と同等のプログラムが起動し、その中で "VPNGATE" という名称の仮想 HUB が作成されます。当該仮想 HUB には "VPN" という名前のユーザーが作成され、匿名でインターネット上の誰でもが当該仮想 HUB に VPN 接続を行うことができるようになります。いったん "VPNGATE" 仮想 HUB に接続した VPN クライアントコンピュータが開始したすべての通信は "VPNGATE" 仮想 HUB を通過し、SoftEther VPN Server (または SoftEther VPN Client) が動作しているコンピュータの物理的なネットワークインターフェイスを経由してインターネットに対して伝送されます。そのため、インターネット上の宛先ホストは、あたかも当該通信が SoftEther VPN Server が動作しているコンピュータから発信されたものであるかのように識別することとなります。ただし、宛先が 192.168.0.0/255.255.0.0, 172.16.0.0/255.240.0.0 および 10.0.0.0/255.0.0.0 宛のパケットはプライベートネットワーク (たとえば社内 LAN など) で使用されているものと見なされ、"VPNGATE" 仮想 HUB を経由して伝送されることはありません。VPN Gate サービスを社内 LAN などにあるコンピュータで動作させても、VPN Gate のユーザーに対して社内 LAN 上の他のコンピュータにアクセスすることを許すことにはならないため安全です。VPN Gate サービスはまた、VPN Gate ディレクトリサーバーへのアクセスの中継も実施します。

diff --git a/src/bin/vpnweb.cab b/src/bin/vpnweb.cab
index 2ecac677..f1ef6a0b 100644
--- a/src/bin/vpnweb.cab
+++ b/src/bin/vpnweb.cab
diff --git a/src/bin/vpnweb.ocx b/src/bin/vpnweb.ocx
index 910016a8..968fce18 100644
--- a/src/bin/vpnweb.ocx
+++ b/src/bin/vpnweb.ocx
diff --git a/src/vpnweb/vpnweb.h b/src/vpnweb/vpnweb.h
index b0954fc4..a3a1b54c 100644
--- a/src/vpnweb/vpnweb.h
+++ b/src/vpnweb/vpnweb.h
@@ -4,7 +4,7 @@
 

 

  /* File created by MIDL compiler version 7.00.0500 */

-/* at Wed Jan 01 17:54:26 2020

+/* at Fri Mar 20 19:02:54 2020

  */

 /* Compiler settings for .\vpnweb.idl:

     Oicf, W1, Zp8, env=Win32 (32b run)

diff --git a/src/vpnweb/vpnweb_i.c b/src/vpnweb/vpnweb_i.c
index 9e778b78..a2785542 100644
--- a/src/vpnweb/vpnweb_i.c
+++ b/src/vpnweb/vpnweb_i.c
@@ -6,7 +6,7 @@
 

 

  /* File created by MIDL compiler version 7.00.0500 */

-/* at Wed Jan 01 17:54:26 2020

+/* at Fri Mar 20 19:02:54 2020

  */

 /* Compiler settings for .\vpnweb.idl:

     Oicf, W1, Zp8, env=Win32 (32b run)

diff --git a/src/vpnweb/vpnweb_p.c b/src/vpnweb/vpnweb_p.c
index 8c6cb90f..83ed5773 100644
--- a/src/vpnweb/vpnweb_p.c
+++ b/src/vpnweb/vpnweb_p.c
@@ -4,7 +4,7 @@
 

 

  /* File created by MIDL compiler version 7.00.0500 */

-/* at Wed Jan 01 17:54:26 2020

+/* at Fri Mar 20 19:02:54 2020

  */

 /* Compiler settings for .\vpnweb.idl:

     Oicf, W1, Zp8, env=Win32 (32b run)