summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
| * Change the netsh.exe command from "add" to "set".smos2011-05-191-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | This prevents the netsh.exe command from exiting with a status 1 when the address already exists. By adding store=active the address will not survive a reboot and be assigned temporarily. Tested on Windows 7 and Windows XP SP 2. Signed-off-by: smos <seth.mos@dds.nl> Acked-by: Gert Doering <gert@greenie.muc.de> Signed-off-by: Gert Doering <gert@greenie.muc.de>
* | Fix const declarations in plug-in v3 structsDavid Sommerseth2011-05-191-4/+4
| | | | | | | | | | | | | | | | | | Microsoft Visual Studio complains about const char const **ptr declarations and expects them to be be const char ** const ptr. The latter is what was the intention, that neither the pointer nor the value(s) it points at can be changed. Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de>
* | Fix 2.2.0 build failure when management interface disabledMatthew L. Creech2011-05-191-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I just upgraded to 2.2.0, and my build fails with: ps.c: In function 'port_share_open': ps.c:778:7: error: 'management' undeclared (first use in this function) ps.c:778:7: note: each undeclared identifier is reported only once for each function it appears in make[5]: *** [ps.o] Error 1 [Comment by David Sommerseth: This happens only when building with --enable-small, --disable-management and --disable-pkcs11 Also changed MANAGEMENT_ENABLED to ENABLE_MANAGEMENT from the original patch. ] Mailing-list: http://thread.gmane.org/gmane.network.openvpn.devel/4639 Signed-off-by: Matthew L. Creech <mlcreech@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Signed-off-by: David Sommerseth <davids@redhat.com>
* | Fix issues with some older GCC compilersSimon Matter2011-05-101-3/+3
| | | | | | | | | | | | | | | | | | | | | | Some older GCC compilers don't like that variables are declared in the middle of the code, and expect them on the top in the block/scope. Trac-ticket: 99 Signed-off-by: Simon Matter <simon.matter@invoca.ch> Acked-by: David Sommerseth <davids@redhat.com> Signed-off-by: David Sommerseth <davids@redhat.com>
* | Fix compile issues when using --enable-small and --disable-ssl/--disable-cryptoGustavo Zacarias2011-04-271-1/+2
| | | | | | | | | | | | | | | | | | The tmp_dir string is required in the options struct regardless of options so spin it out of #if conditionals. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Acked-by: David Sommerseth <dazo@users.sourceforge.net> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* | Solved hidden merge conflicts between master and svn-branch-2.1David Sommerseth2011-04-262-4/+7
| | | | | | | | | | | | | | | | | | ps.c - The feat_ipv6_transport patch set modifies struct openvpn_sockaddr by adding a union named 'addr' in commit 8335caf929f21b31. ssl.c - A needed } and #endif had been dropped by a mistake Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* | Merge branch 'svn-branch-2.1' into mergeDavid Sommerseth2011-04-2639-333/+1702
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Pulling in changes from James' 2.1/openvpn branch in SVN. Conflicts: buffer.c init.c manage.h multi.c openvpn.8 options.c ssl.c version.m4 win/sign.py Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * | Fixed compile issues on Windows.James Yonan2011-04-264-4/+4
| | | | | | | | | | | | | | | | | | | | | Version 2.1.3w git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7219 e7ae566f-a301-0410-adde-c780ea21d3b5
| * | Added new "extra-certs" and "verify-hash" options (see man page forJames Yonan2011-04-267-1/+128
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | details). Increase the timeout after SIGUSR1 restart when restart is not due to server_poll_timeout. Version 2.1.3v git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7215 e7ae566f-a301-0410-adde-c780ea21d3b5
| * | Added 'dir' flag to "crl-verify" (see man page for info).James Yonan2011-04-267-61/+96
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Don't call SSL_CTX_set_client_CA_list or SSL_CTX_set_client_CA_list if not running in server mode (these functions are only useful for TLS/SSL servers). Modified openvpn_snprintf to return false on overflow, and true otherwise. When AUTH_FAILED,... is received, log the full string. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7213 e7ae566f-a301-0410-adde-c780ea21d3b5
| * | Revert r7092 and r7151, i.e. remove --enable-osxipconfigJames Yonan2011-04-263-35/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | configure option. ipconfig on Mac has certain behavior that makes it unsuitable for use by OpenVPN to configure tun/tap interface. Version 2.1.3u git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7191 e7ae566f-a301-0410-adde-c780ea21d3b5
| * | Version 2.1.3tJames Yonan2011-04-261-1/+1
| | | | | | | | | | | | git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7152 e7ae566f-a301-0410-adde-c780ea21d3b5
| * | For Mac OSX, when DARWIN_USE_IPCONFIG is defined, retry ipconfigJames Yonan2011-04-261-1/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | command on failure once every second for up to 15 seconds. This is necessary to work around an issue observed on OSX 10.5 where the ipconfig command sometimes fails if executed immediately after the tun device open. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7151 e7ae566f-a301-0410-adde-c780ea21d3b5
| * | Fixed bug in port-share that could cause port share process toJames Yonan2011-04-262-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | crash with output like this: TCP connection established with 85.190.0.3:41781 85.190.0.3:41781 SIGTERM[soft,port-share-redirect] received, client-instance exiting MANAGEMENT: TCP recv error: Socket operation on non-socket MANAGEMENT: Client disconnected MANAGEMENT: Triggering management exit Exiting due to fatal error EVENT: epoll_ctl EPOLL_CTL_MOD failed, sd=6: Bad file descriptor (errno=9) Then an error like this for every incoming connection that should be proxied: 76.120.71.74:55302 PORT SHARE: sendmsg failed -- unable to communicate with background process (6,8,-1,-1): Connection refused (errno=111) Version 2.1.3s git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7127 e7ae566f-a301-0410-adde-c780ea21d3b5
| * | Fixed bug that incorrectly placed stricter TCP packet replay rules onJames Yonan2011-04-266-14/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | UDP sessions when the client daemon was running in UDP/TCP adaptive mode, and transitioned from TCP to UDP. The bug would cause a single dropped packet in UDP mode to trigger a barrage of packet replay errors followed by a disconnect and reconnect. Version 2.1.3r git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7125 e7ae566f-a301-0410-adde-c780ea21d3b5
| * | Added more packet ID debug info at debug level 3 for debuggingJames Yonan2011-04-266-28/+142
| | | | | | | | | | | | | | | | | | | | | | | | | | | false positive packet replays. Version 2.1.3q. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7109 e7ae566f-a301-0410-adde-c780ea21d3b5
| * | Added ./configure --enable-osxipconfig option for Mac OS X which willJames Yonan2011-04-263-2/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | enable the use of ipconfig (instead of ifconfig) for configuring the IP address and netmask of the tun/tap adapter. Version 2.1.3p git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7092 e7ae566f-a301-0410-adde-c780ea21d3b5
| * | Added "auth-token" client directive, which is intended to beJames Yonan2011-04-2611-13/+113
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | pushed by server, and that is used to offer a temporary session token to clients that can be used in place of a password on subsequent credential challenges. This accomplishes the security benefit of preventing caching of the real password while offering most of the advantages of password caching, i.e. not forcing the user to re-enter credentials for every TLS renegotiation or network hiccup. auth-token does two things: 1. if password caching is enabled, the token replaces the previous password, and 2. if the management interface is active, the token is output to it: >PASSWORD:Auth-Token:<token> Also made a minor change to HALT/RESTART processing when password caching is enabled. When client receives a HALT or RESTART message, and if the message text contains a flags block (i.e. [FFF]:message), if flag 'P' (preserve auth) is present in flags, don't purge the Auth password. Otherwise do purge the Auth password. Version 2.1.3o git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7088 e7ae566f-a301-0410-adde-c780ea21d3b5
| * | win/sign.py now accepts an optional tap-dir argument.James Yonan2011-04-261-4/+8
| | | | | | | | | | | | git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7086 e7ae566f-a301-0410-adde-c780ea21d3b5
| * | Version 2.1.3nJames Yonan2011-04-261-1/+1
| | | | | | | | | | | | git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7069 e7ae566f-a301-0410-adde-c780ea21d3b5
| * | Client will now try to reconnect if no push reply receivedJames Yonan2011-04-264-3/+20
| | | | | | | | | | | | | | | | | | | | | within handshake-window seconds. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7066 e7ae566f-a301-0410-adde-c780ea21d3b5
| * | Extended "client-kill" management interface command (server-side)James Yonan2011-04-267-19/+53
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | to accept an optional message string. The message string format is: RESTART|HALT,<human-readable-message> RESTART will tell the client to restart (i.e. SIGUSR1). HALT will tell the client to exit (i.e. SIGTERM). On the client, human-readable-message will be communicated via management interface: >NOTIFY,<severity>,<type>,<human-readable-message>" Version 2.1.3m git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7063 e7ae566f-a301-0410-adde-c780ea21d3b5
| * | Fixed bug introduced in r7031 that might cause this error message:James Yonan2011-04-261-6/+16
| | | | | | | | | | | | | | | | | | | | | PORT SHARE: sendmsg failed (unable to communicate with background process) git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7062 e7ae566f-a301-0410-adde-c780ea21d3b5
| * | Fixed issue where a client might receive multiple push replies fromJames Yonan2011-04-263-2/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | a server if it sent multiple push requests due to the server being slow to respond. This could cause the client to process pushed options twice, leading to duplicate pushed routes, among other issues. The fix, implemented server-side, is to reply only once to a push request even if multiple requests are received. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7060 e7ae566f-a301-0410-adde-c780ea21d3b5
| * | env_filter_match now includes the serial number of all certsJames Yonan2011-04-261-1/+1
| | | | | | | | | | | | | | | | | | | | | in chain (as tls_serial_n vars), rather than only tls_serial_0. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7055 e7ae566f-a301-0410-adde-c780ea21d3b5
| * | Reduce log verbosity at level 3, with a focus on removing excessive log ↵James Yonan2011-04-256-27/+33
| | | | | | | | | | | | | | | | | | | | | | | | verbosity generated by port-share activity. Version 2.1.3k git-svn-id: http://svn.openvpn.net/projects/branches/BETA21@7033 e7ae566f-a301-0410-adde-c780ea21d3b5
| * | Added optional journal directory argument to "port-share" directive, for ↵James Yonan2011-04-258-33/+131
| | | | | | | | | | | | | | | | | | reporting client IP origins of proxied connections. git-svn-id: http://svn.openvpn.net/projects/branches/BETA21@7031 e7ae566f-a301-0410-adde-c780ea21d3b5
| * | Added --enable-lzo-stub configure option to build an OpenVPN client without ↵James Yonan2011-04-257-14/+85
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | LZO, but that has limited interoperability with LZO-enabled servers. Modified "push-peer-info" option to push IV_LZO_STUB=1 to server when client was built with --enable-lzo-stub configure option. This tells the server that the client lacks LZO capabilities, so the server should turn off LZO compression for this client via "lzo no". Added "setenv PUSH_PEER_INFO" option having the same effect as "push-peer-info". Version 2.1.3j git-svn-id: http://svn.openvpn.net/projects/branches/BETA21@7023 e7ae566f-a301-0410-adde-c780ea21d3b5
| * | Added "client-nat" option for stateless, one-to-oneJames Yonan2011-02-1815-17/+490
| | | | | | | | | | | | | | | | | | | | | | | | | | | NAT on the client side. Version 2.1.3i. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6944 e7ae566f-a301-0410-adde-c780ea21d3b5
| * | Properly handle certificate serial numbers > 32 bits.James Yonan2011-02-142-4/+12
| | | | | | | | | | | | | | | | | | | | | Version 2.1.3h git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6931 e7ae566f-a301-0410-adde-c780ea21d3b5
| * | Fixes to r6925.James Yonan2011-02-141-3/+3
| | | | | | | | | | | | git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6927 e7ae566f-a301-0410-adde-c780ea21d3b5
| * | Implemented get_default_gateway_mac_addr for Mac OS X (previously,James Yonan2011-02-143-59/+125
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | was only defined for Windows and Linux). This enables OS X to report the MAC address of the default gateway to the server for ID purposes when client-side --push-peer-info option is specified. Also, minor fix to OS X get_default_gateway function: * include net/route.h directly rather than selectively paste stuff from it into route.c git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6925 e7ae566f-a301-0410-adde-c780ea21d3b5
| * | Fixed minor compile issue triggered on builds whereJames Yonan2011-01-181-1/+1
| | | | | | | | | | | | | | | | | | | | | MANAGEMENT_DEF_AUTH is not enabled. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6830 e7ae566f-a301-0410-adde-c780ea21d3b5
| * | * added --management-up-down option to allow management interfaceJames Yonan2011-01-106-21/+55
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | to be notified of tunnel up/down events. * pulled --ip-win32 options will be suppressed on the client if --route-nopull option is specified. Version 2.1.3f git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6813 e7ae566f-a301-0410-adde-c780ea21d3b5
| * | Added --x509-track option.James Yonan2011-01-0510-4/+186
| | | | | | | | | | | | | | | | | | | | | Version 2.1.3e git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6780 e7ae566f-a301-0410-adde-c780ea21d3b5
| * | Misc fixes to r6708.James Yonan2010-12-138-51/+72
| | | | | | | | | | | | | | | | | | | | | | | | Fixed issue where "signal SIGTERM" entered from the management interface might get subsequently downgraded to a SIGUSR1. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6716 e7ae566f-a301-0410-adde-c780ea21d3b5
| * | Minor addition of logging info before and afterJames Yonan2010-12-102-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | execution of Windows net commands. Version 2.1.3d git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6712 e7ae566f-a301-0410-adde-c780ea21d3b5
| * | Added "management-external-key" option. This option can be usedJames Yonan2010-12-0910-59/+433
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | instead of "key" in client mode, and allows the client to run without the need to load the actual private key. When the SSL protocol needs to perform an RSA sign operation, the data to be signed will be sent to the management interface via a notification as follows: >RSA_SIGN:[BASE64_DATA] The management interface client should then sign BASE64_DATA using the private key and return the signature as follows: rsa-sig [BASE64_SIG_LINE] . . . END This capability is intended to allow the use of arbitrary cryptographic service providers with OpenVPN via the management interface. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6708 e7ae566f-a301-0410-adde-c780ea21d3b5
* | | Merge branch 'feat_ipv6_payload'David Sommerseth2011-04-2527-134/+2622
|\ \ \ | | |/ | |/| | | | | | | | | | | | | | | | | | | Conflicts: options.c - feat_ipv6_payload and feat_ip6_transport both updates this file with presence information Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * | rebased to 2.2RC2 (beta 2.2 branch)Gert Doering2011-04-245-47/+95
| | | | | | | | | | | | | | | | | | | | | | | | | | | removed mutex locking stuff (no more threading in 2.2) fixed rebase/merge artifacts in mroute.c add current ChangeLog.IPv6 and TODO.IPv6 to commit tag as ipv6-20110424-2 Signed-off-by: Gert Doering <gert@greenie.muc.de>
| * | Implement "ipv6 ifconfig" for TAP interfaces on SolarisGert Doering2011-04-241-2/+40
| | | | | | | | | | | | | | | | | | | | | Solaris close_tun(): add explicit "unplumb'ing" of IPv6 tun/tap interfaces, otherwise they would linger around after OpenVPN exits. Signed-off-by: Gert Doering <gert@greenie.muc.de>
| * | bump IPv6 version number (openvpn --version) to 20100922-1Gert Doering2011-04-242-1/+11
| | | | | | | | | | | | | | | | | | document Linux tun fixes and test results in ChangeLog.IPv6 Signed-off-by: Gert Doering <gert@greenie.muc.de>
| * | bugfix for linux/iproute2: IPv6 ifconfig code block was not called forGert Doering2011-04-241-14/+15
| | | | | | | | | | | | | | | | | | | | | "dev tun"+"topology subnet" - moved code out of "if (tun)" block, works. add more debug information to help diagnose cases where IPv6 isn't working Signed-off-by: Gert Doering <gert@greenie.muc.de>
| * | correct URL for "more information about IPv6 patch is *here*"Gert Doering2011-04-241-1/+1
| | | | | | | | | | | | Signed-off-by: Gert Doering <gert@greenie.muc.de>
| * | 2.2-beta3 has a signed TAP driver with the IPv6 code, but it's notGert Doering2011-04-242-2/+7
| | | | | | | | | | | | | | | | | | | | | version 9.7 as anticipated (that's 2.1.3) but 9.8 - change test to require 9.8, and change message to point to 2.2-beta3 and up. Signed-off-by: Gert Doering <gert@greenie.muc.de>
| * | renamed t_client.sh to t_client.sh.inGert Doering2011-04-241-298/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | build t_client.sh by configure at run-time, with proper paths to ip/ifconfig/netstat binaries, and (most important) with proper #!SHELL extend configure.ac to find "netstat" binary and to chmod +x "t_client.sh" Signed-off-by: Gert Doering <gert@greenie.muc.de>
| * | full "VPN client connect" test framework for OpenVPNGert Doering2011-04-241-0/+298
| | | | | | | | | | | | | | | | | | | | | run from "make check" if "t_client.rc" is found in workdir or srcdir (copy t_client.rc-sample, fill in specifics for your test server) Signed-off-by: Gert Doering <gert@greenie.muc.de>
| * | implement IPv6 ifconfig + route setup/deletion on OpenBSDGert Doering2011-04-243-11/+71
| | | | | | | | | | | | | | | | | | | | | destroy tunX interface on tun_close() tested on OpenBSD 4.7 Signed-off-by: Gert Doering <gert@greenie.muc.de>
| * | revert unconditionally-enabling of setenv_es() logging (too noisy)Gert Doering2011-04-241-1/+3
| | | | | | | | | | | | replace with #ifdef DEBUG_VERBOSE_SETENV compile-time flag
| * | tag and release as 20100307-1Gert Doering2011-04-243-2/+37
| | |
generated by cgit (git 2.34.1) at 2025-09-30 06:57:42 +0000