summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Don't exit daemon if opening or parsing the CRL fails.Steffan Karger2014-07-102-4/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | As requested in trac ticket #83, the daemon should not exit if opening the CRL file during a connection attempt fails; OpenVPN should merely deny the connection. CRL files need to be periodically updated. When users update their CRL in place and a connection attempt takes place simultaneously, the CRL file might temporarily not be available, or not be in a consistent state. Previously, that would result in the daemon exiting. With this patch, that results in one (or possibly a few) failed connection attempts, but service will restore automatically as soon as the CRL is again available in a valid state. Note that on startup OpenVPN still checks the existence and accessibility of the CRL file, and will refuse to start on error. While I was touching the code, I improved error reporting for the PolarSSL code a bit. The polar code opens and parses the CRL in a single call, so on error retrieve details from polarssl and report those to the user. Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <53BED57C.7070300@fox-it.com> Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Do not upcase x509-username-field for mixed-case arguments.Andris Kalnozols2014-07-102-10/+60
| | | | | | | | | | | | | | | I revisited options.c to refine its brute-force upcasing behavior. Now, the upcasing is done only if the option argument is all lowercase. Mixed-case arguments and those with the "ext:" prefix are left unchanged. This preserves the original intent of the "helpful" upcasing feature for backwards compatibility while limiting its scope in a straightforward way. Signed-off-by: Andris Kalnozols <andris@hpl.hp.com> Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <53B1BDD8.8020705@karger.me> Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit f4e0ad82b0eaccce965074c1ceec2b7e3853dc0d)
* Call init script helpers with explicit path (./)Gert Doering2014-07-082-2/+2
| | | | | | | | | | | | | | | | | The provided OpenVPN init scripts scan /etc/openvpn for *.conf and run an OpenVPN process for each, and if a .sh script with the same base name exists, this is run before openvpn. Change from running "$name.sh" to "./$name.sh" - depending on the shell used, the script won't be found otherwise, and ensuring that the script isn't searched in $PATH is the right thing anyway. Reported in trac #423 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <dazo@users.sourceforge.net> Message-Id: <1404804054-32424-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/8858 (cherry picked from commit cf31d5f32197159691fa9e3e4afcfc35307702d6)
* Fix t_lpback.sh platform-dependent failuresGert Doering2014-07-081-2/+5
| | | | | | | | | | | | commit e97aa06dc058 introduced "full openvpn cipher testing", but fails on OpenSSL 0.9.8 with DES-CFB1 (skip), on NetBSD for RC5-* (needs extra library, libcrypto_rc5.a) and on Solaris for POSIXly "tail" (rewrite). Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1404830758-7927-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/8861 (cherry picked from commit bbae238d5084012525a61a0e3ab947c414a555ae)
* Extend t_lpback tests to test all ciphers reported by --show-ciphersSteffan Karger2014-07-071-4/+26
| | | | | | | | | | | ... instead of just BF-CBC. Should catch more mistakes. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1402244175-31462-5-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/8777 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit b2bff9fa15695f2850999688b0ca6047016fd7f5)
* Improve --show-ciphers to show if a cipher can be used in static key modeSteffan Karger2014-07-072-10/+13
| | | | | | | | | | | | | Also remove the bulky warning from init_key_type() and add the information to the --show-ciphers output. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <53BAEF65.2070509@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/8852 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit d344820faeae987f52e574e15812c86aa5c59ae6)
* Add proper check for crypto modes (CBC or OFB/CFB)Steffan Karger2014-07-076-27/+99
| | | | | | | | | | | | | | | | | | | OpenSSL has added AEAD-CBC mode ciphers like AES-128-CBC-HMAC-SHA1, which have mode EVP_CIPH_CBC_MODE, but require a different API (the AEAD API). So, add extra checks to filter out those AEAD-mode ciphers. Adding these made the crypto library agnostic function cfb_ofb_mode() superfuous, so removed that on the go. Also update all cipher mode checks to use the new cipher_kt_mode_*() functions for consistency. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1402244175-31462-3-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/8779 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit a4b27b6481c7496f2a8705c993edfe150a3541cb)
* Rename ALLOW_NON_CBC_CIPHERS to ENABLE_OFB_CFB_MODE, and add to configure.Steffan Karger2014-07-074-4/+10
| | | | | | | | | | | | | Makes OFB/CFB compile time configurable, and fixes output of --show-ciphers to also show OFB/CFB ciphers along the way (becasue crypto.h was not included from crypto_openssl.c). Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1402244175-31462-2-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/8781 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit c353af2f474f79bfd7b2b67ecc02e91152500209)
* refine assertion to allow other modes than CBCHeiko Hund2014-07-071-1/+1
| | | | | | | | | | | | | | | | cipher_ctx_final() only returns an outlen in CBC mode. If CFB or OFB are used the assertion outlen == iv_len is always false. There's no CBC mode defined for the GOST 28147-89 block cipher. Hence this patch is needed for it to work. It's needed for other ciphers like BF-CFB as well, though. Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <538A00AA.7090007@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/8748 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit be46a2c083a6bd77754bc1674249eab583d25dac)
* Fix socket-flag/TCP_NODELAY on Mac OS XJames Bekkema2014-06-301-0/+8
| | | | | | | | | | | | | | | | | | Hi All, OpenVPN 2.3.4 will currently throw a warning of "NOTE: setsockopt TCP_NODELAY=1 failed (No kernel support) when attempting to use the TCP_NODELAY socket option on Mac OS X/Darwin. Kernel support is there, however the required header file where TCP_NODELAY is defined is not being included. This patch simply alters syshead.h to include <netinet/tcp.h> on Darwin platforms. Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <A1005665-126D-45D5-A6F2-75ED0EAE30FE@sparklabs.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/8809 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 37170767a221a4847416fc339083704ae1b4c001)
* Fix some typos in the man page.Andris Kalnozols2014-06-281-4/+4
| | | | | | | | Signed-off-by: Andris Kalnozols <andris@hpl.hp.com> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <53AF0D20.7020204@karger.me> Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit b443772bb6fa9177ab015e8b69fbd804cfffee6b)
* Update README.polarsslSteffan Karger2014-06-241-3/+1
| | | | | | | | | | | | PolarSSL support has been extended and adjusted, but README.polarssl was not accordingly adjusted. This updates README.polarssl to the current state of affairs for OpenVPN 2.3. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1403640206-7024-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/8804 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix bug that incorrectly refuses oid representation eku's in polar buildsSteffan Karger2014-06-241-1/+1
| | | | | | | | | | | | | The return value of x509_get_numeric_string() was interpreted incorrectly by ssl_verify_polarssl.c's x509_verify_cert_eku(). This patch enables the usage of oid represenation in --remote-cert-eku options. Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: David Sommerseth <dazo@users.sourceforge.net> Message-Id: <1398415277-6880-1-git-send-email-steffan.karger@fox-it.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/8627 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit e238b806f5f3843b80d5b1b2b269679210faa7f6)
* Improve error reporting on file access to --client-config-dir and ↵David Sommerseth2014-06-221-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | --ccd-exclusive OpenVPN will do some simple sanity checking at startup to ensure the expected files and directories is in place. However, with --client-config-dir and --ccd-exclusive, things are slightly different. In both cases it is perfectly fine that files does not exists, and we cannot know any file names beforehand due to these filenames being based upon the certificate's CN field. The problem arises when OpenVPN cannot open files inside a directory because the directory permissions are too restrictive, have wrong ownership (triggered by the usage of --user/--group) or other security mechanisms the OS uses. When a client connects, the test_file() function is used to check if a client config file has been prepared. And if not, it continues without trying to read it. So, if the privileges of the running OpenVPN process is not allowed to open and read an existing file, OpenVPN will treat this as a non-existing file without saying anything. This is clearly wrong. So this patch adds an warning message in the OpenVPN log if it could not open the file due to lack of permissions. This will work fine on all *nix based OSes. Windows however reports 'no such file or directory' (errno=2/-ENOENT) even on privilege access errors when the directory this file resides is too restrictive. But there is no easy way to work around that. However, I believe that the initial sanity checking at startup will catch that one, as it will check if the directories it needs exists. This patch has only gone through simple basic testing, with both too few privileges and with proper privileges to the CCD directory. With wrong privileges, the following error can be found if CN=Test client Fri May 2 00:00:10 2014 us=281993 127.0.0.1:41017 Could not access file '/etc/clients/Test client': Permission denied (errno=13) [v2 - use openvpn_errno() instead of errno, for better platform support] Trac: #277 Trac-URL: https://community.openvpn.net/openvpn/ticket/277 Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1398990504-4239-1-git-send-email-dazo@users.sourceforge.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/8688 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 4978dadaed4ecf1b9dd256f57c6a5c895691580b)
* Drop incoming fe80:: packets silently now.Gert Doering2014-06-081-2/+11
| | | | | | | | | | | | | | | | | | | | | | | | IPv6 has the concept of "link local" addresses, fe80::<host id>, which normally are present on every link, and are used for stuff like DHCPv6, neighbor discovery, etc. OpenVPN point-to-multipoint mode currently does neither configure them on tun interfaces, nor are they handled in a meaningful way if a client OS always has them (like Windows or Solaris) - so the log fills with many lines of "MULTI: bad source address from client [fe80::...]", serving no useful purpose. This patch just recognizes IPv6 LL packets and silently drops them. Further patches can build on this and add full link-local support, which would require address learning (as the addresse are based on host IDs, not assigned by the server). Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1402080235-24409-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/8773 (cherry picked from commit 70f1864188ad00451683cabf51e56b7730250c40)
* Remove unneeded wrapper functions in crypto_openssl.cSteffan Karger2014-05-261-16/+4
| | | | | | | | | | Both EVPCipherInit_ov() and EVPCipherUpdate_ov() wrapped OpenSSL functions without any changes, so lets just use the functions directly. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1401055713-9891-3-git-send-email-steffan@karger.me> Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Remove function without effect (cipher_ok() always returned true).Steffan Karger2014-05-261-8/+2
| | | | | | | Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1401055713-9891-2-git-send-email-steffan@karger.me> Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fixed some compile issues with show_library_versions()James Yonan2014-05-205-9/+14
| | | | | | | | | | | | | | | | | | * Refactored show_library_versions to work around the fact that some compilers (such as MSVC 2008) can't handle #ifdefs inside of macro references. * Declare show_library_versions() in options.h because it's referenced by other files such as openvpn.c. * Declare get_ssl_library_version() as returning const char *, to avoid loss of const qualifier in ssl_openssl.c. Signed-off-by: James Yonan <james@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1399589436-8730-7-git-send-email-james@openvpn.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/8711 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Define PATH_SEPARATOR for MSVC builds.James Yonan2014-05-201-0/+3
| | | | | | | | Signed-off-by: James Yonan <james@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1399589436-8730-6-git-send-email-james@openvpn.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/8714 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* MSVC 2008 doesn't support dimensioning an array with a const var nor using ↵James Yonan2014-05-201-4/+3
| | | | | | | | | | %z as a printf format specifier. Signed-off-by: James Yonan <james@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1399589436-8730-5-git-send-email-james@openvpn.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/8710 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Explicitly cast the third parameter of setsockopt to const void * to avoid ↵James Yonan2014-05-201-1/+1
| | | | | | | | | | warning. Signed-off-by: James Yonan <james@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1399589436-8730-4-git-send-email-james@openvpn.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/8708 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* In socket.c, fixed issue where uninitialized value (err) is being passed to ↵James Yonan2014-05-201-2/+1
| | | | | | | | | | to gai_strerror. Signed-off-by: James Yonan <james@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1399589436-8730-3-git-send-email-james@openvpn.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/8713 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fixed several instances of declarations after statements.James Yonan2014-05-203-8/+10
| | | | | | | | Signed-off-by: James Yonan <james@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1399589436-8730-2-git-send-email-james@openvpn.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/8709 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Preparing for release v2.3.4 (ChangeLog, version.m4)Gert Doering2014-04-302-2/+35
| | | | Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Make serial env exporting consistent amongst OpenSSL and PolarSSL builds.Steffan Karger2014-04-305-7/+81
| | | | | | | | | | | | | | | This changes the representation of the tls_serial_{n} environment variable from hex to decimal for PolarSSL builds, to match OpenSSL build behaviour. Because hex representation for serials makes sense too, and to ease transition for PolarSSL users, added tls_serial_hex_{n} that exports the serial in hex represenation for both crypto library backends. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <535EB49E.5090809@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/8664 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* When tls-version-min is unspecified, revert to original versioning approach.James Yonan2014-04-305-15/+34
| | | | | | | | | | | | | | | | | | | | | | | For OpenSSL, this means to use TLSv1_(client|server)_method rather than SSLv23_(client|server)_method combined with SSL_OP_NO_x flags for specific TLS versions to disable. For PolarSSL, this means to implicitly control the TLS version via allowed ciphersuites. Point out off-by-default-now setting in the openvpn(8) man page. This patch is only included in the release/2.3 branch, because it's a stopgap measure. 2.4 will have it on-by-default, when the remaining handshake problems are fully debugged and solved. Signed-off-by: James Yonan <james@openvpn.net> Signed-off-by: Gert Doering <gert@greenie.muc.de> Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: James Yonan <james@openvpn.net> Message-Id: <535EC5FE.6060302@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/8665 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Conditionalize calls to print_default_gateway on !ENABLE_SMALLGert Doering2014-04-302-2/+2
| | | | | | | | | | | | | | Calls to print_default_gateway() depended on #ifdef ENABLE_DEBUG, but the actual function wasn't compiled in #ifdef ENABLE_SMALL, so the combination "configure --enable-small --enable-debug" didn't work. Fix. Fix trac #397 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1398805779-29376-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/8670 (cherry picked from commit c29e08a2f33234fb705a8323c0d9e1e07b0773fd)
* Fix is_ipv6 in case of tap interface.Dmitrij Tejblum2014-04-291-1/+1
| | | | | | | | | | | | | | While checking a packet on a TAP interface, is_ipv_X() in proto.c insist that the ethertype must be OPENVPN_ETH_P_IPV4, even if the protocol is IPv6. So the protocol never match, and, thus, mssfix doesn't work for IPv6 on TAP interface. Fix that. Signed-off-by: Dmitrij Tejblum <dt@yandex.ru> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1391873629-14388-1-git-send-email-dt@yandex.ru> URL: http://article.gmane.org/gmane.network.openvpn.devel/8259 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit db037c20086587a609ef33127c15de080270f2cb)
* Fix build system to accept non-system crypto library locations for plugins.Steffan Karger2014-04-272-3/+5
| | | | | | | | | | | | | Flags like {OPEN,POLAR}SSL_CFLAGS were used by the core build, but not by the plugins. However, all plugins include openvpn-plugin.h, which need crypto/ssl headers. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1398080238-19662-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/8576 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit ea31bc680fc83946b2cc8d0c93544a1ab2a01d63)
* More IPv6-related updates to the openvpn man page.Gert Doering2014-04-271-6/+10
| | | | | | | | | | | | | | | Point to correct kernel version for --multihome and IPv4-mapped addresses (3.15, Tore Anderson). Remove old reference to http://www.greenie.net/ from the IPv6 section, as the code and documentation in here is more current than on that site. Some more additions and clarifications. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Tore Anderson <tore@fud.no> Message-Id: <1398511854-3609-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/8642 (cherry picked from commit 2a97e69e71d4afb9c32268890e13db19cb73196b)
* Fix OCSP_check.sh to also use decimal for stdout verification.Steffan Karger2014-04-271-3/+3
| | | | | | | | | | | | This is an extra fix needed on top of 959d607, which already changes the serial parameter to correctly use decimal representation. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1398588561-18964-2-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/8650 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 6ea78cbef6367590567156a20106c620fec224c9)
* Change signedness of hash in x509_get_sha1_hash(), fixes compiler warning.Steffan Karger2014-04-271-1/+1
| | | | | | | | | | | | hash was cast from char * to unsigned char * at the return of the function. This patch removes the implicit cast by declaring hash as unsigned char * . Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1398585348-7969-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/8647 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit d4309c21d9cde43c777985e373242afa78afefa1)
* Rewrite manpage section about --multihomeGert Doering2014-04-251-12/+16
| | | | | | | | | | | | | Part of the information was confusing, part was outdated, and part was just not making sense. Pointed out in trac#348. Also add note about Linux IPv4-mapped issues as per trac#306. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1398453555-19706-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/8635 (cherry picked from commit abe18c69a61b42e5ac68b77f66198fc15be99e31)
* Repair --multihome on FreeBSD for IPv4 sockets.Gert Doering2014-04-251-2/+6
| | | | | | | | | | | | | | | | | The code in link_socket_write_udp_posix_sendmsg() for the IP_RECVDESTADDR case was sending a too-large control message (sizeof openvpn_pktinfo, which is a union for IPv4+IPv6) instead of just openvpn_in4_pktinfo, leading to sendmsg() refusing to send the packet. Use RFC 2292 macros for alignment + size calculation. Fix trac#327 Signed-off-by: Gert Doering <gert@greenie.muc.de> Lazy-Ack-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1390164697-1590-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/8250 (cherry picked from commit 661d914c8732a208580b1eab167255c85da162c9)
* Fix man page and OSCP script: tls_serial_{n} is decimalArne Schwabe2014-04-252-4/+4
| | | | | | | | | | | | | Commit 7d5e26cbb53 fixed extracting serial but did not change the format, which always has been decimal. This patch fixes the manpage and OSCP.sh script to conform with the implementation. Acked-by: James Yonan <james@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1396001222-5033-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8409 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 959d60789b6f0bd74296600f58f626cfa9738f78)
* Minor t_client.sh cleanupsGert Doering2014-04-212-2/+2
| | | | | | | | | | | | - remove built tests/t_client.sh script on "make clean" - ignore Linux iproute2 "ssthresh <n>" output that sometimes shows up in "ip -6 route show" and breaks before/after comparison Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1398019261-30180-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/8557 (cherry picked from commit 1e3a1786a80e4afac37133ce5d6a1dcff779a4ce)
* Use native strtoull() with MSVC 2013.James Yonan2014-04-211-0/+3
| | | | | | | | | | | | MSVC 2013 C library now defines strtoull() function, so use the native implementation when available. Signed-off-by: James Yonan <james@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1398064204-26476-3-git-send-email-james@openvpn.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/8561 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 6b8e2f4a8143a7260a06b6999dcb21c4c72fc620)
* Add SSL library version reporting.Gert Doering2014-04-186-0/+42
| | | | | | | | | | | | | Print the version of the SSL and LZO library (if any) used. SSL library version is also sent as IV_SSL=<version> to the server if --push-peer-info is enabled. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20140416152456.GI16637@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/8537 (cherry picked from commit 1ec984b154aa3247ef58c9d44e7e477880b632b1)
* IPv6 address/route delete fix for Win8Gert Doering2014-04-132-2/+12
| | | | | | | | | | | | | | Use "store=active" for IPv6 address and route deletion - seems to be required on Windows 8 and up, and not doing it will break OpenVPN reconnection (old addresses are not properly deleted, thus address can not be configured on connect). Reported-by: Cedric <cedric+openvpn@bgtn.net> Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Cedric Tabary <cedric+openvpn@bgtn.net> Message-Id: <20140413170648.GU16637@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/8499 (cherry picked from commit 4b4fac9184fcea1eab4f4223309211780cee188a)
* Fix SOCKSv5 method selectionYawning Angel2014-04-131-3/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | So, RFC 1928 doesn't say anything about the METHODS field in the Method Selection message being ordered in terms of preference or anything, and the server is free to pick any of the METHODS offered by the client. Always sending a Method Selection message with NO AUTHENTICATION REQUIRED and USERNAME/PASSWORD set is broken on two fronts: * If the OpenVPN client can't handle the server picking USERNAME/PASSWORD due to the credentials being missing, it shouldn't offer it to the server. * If the OpenVPN client has credentials, then it should always attempt to authenticate. This is a security product. "You can misconfigure it and it will work" is not acceptable. Setting a username/password when the SOCKS server doesn't require/support that as an option is the user not configuring it correctly, and should be treated as such. Also verify that the SOCKS server returned the auth that was requested. URL: https://github.com/OpenVPN/openvpn/pull/14 Fix trac #377, trac #148 Acked-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20140413130102.GR16637@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/8488 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 2903eba5dfe35c981329a833845e24de3882161a)
* Fix typo in sample build script to use LDFLAGSkangsterizer2014-04-131-1/+1
| | | | | | | | Came in as github pull request #15 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-By: Arne Schwabe <arne@rfc2549.org> (cherry picked from commit a95358af543b9106f4ef481e4556d1d03459d058)
* Preparing for v2.3.3 (ChangeLog, version.m4)Gert Doering2014-04-082-2/+86
| | | | Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Add openssl-specific common cipher list names to ssl.c.Steffan Karger2014-03-231-0/+13
| | | | | | | | | | | | This adds a number of commonly used cipher list names to ssl.c, which makes OpenVPN not give a "translation not found" warning when using these. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1393684575-28112-2-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/8316 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 0146fd00c3bd70a470290be7be27ee75db2db63b)
* Workaround missing SSL_OP_NO_TICKET in earlier OpenSSL versionsGert Doering2014-03-231-0/+12
| | | | | | | | | | | | | 058e889d introduced using SSL_OP_NO_TICKET, leading to build failures on systems that could build 2.3.2 fine. Inside the 2.3 release train, we do not want to change requirements, so for those build environments, ignore missing SSL_OP_NO_TICKET. 2.4 will require more recent OpenSSL, though. Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20140322183508.GZ16637@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/8384 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Set SSL_OP_NO_TICKET flag in SSL context for OpenSSL builds, to disable TLS ↵James Yonan2014-03-171-1/+1
| | | | | | | | | | | | | | | | | | | | | | stateless session resumption. OpenVPN doesn't want or need SSL session renegotiation or resumption, as it handles renegotiation on its own. For this reason, OpenVPN always disables the SSL session cache: SSL_CTX_set_session_cache_mode (ctx, SSL_SESS_CACHE_OFF) However, even with the above code, stateless session resumption is still possible unless explicitly disabled with the SSL_OP_NO_TICKET flag. This patch does this. Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1395017376-24554-1-git-send-email-james@openvpn.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/8346 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 25f4d4b49bff342fd9dd54cd22f14c9de49e9f8b)
* Introduce safety check for http proxy optionsArne Schwabe2014-03-171-0/+2
| | | | | | | | | Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1395061013-1802-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8353 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 087b510365d9aad8f656a8fb0cc07d51511be9d0)
* Fix "." in description of utun.Thomas Veerman2014-01-231-2/+2
| | | | | Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 66ff10ef5197b6c70429a15e572aeb2d4073b470)
* Replace copied structure elements with including <net/route.h>Gert Doering2014-01-161-93/+2
| | | | | | | | | | | | | | | | | | | | | | | The code for FreeBSD, Dragonfly, OpenBSD and NetBSD contained copies of structures from <net/route.h> (struct rt_msghdr in particular). OpenBSD changed some structure elements, making OpenVPN incompatible, depending on the specific OpenBSD version. Clean up: remove copied definitions, replace by including <net/route.h> directly - this could not be done originally due to a conflict with "struct route" in OpenVPN and <net/route.h>, cleaned up by the previous commit. Tested on FreeBSD 9.1-RELEASE, NetBSD 5.1, OpenBSD 4.9 (route.c compiles with no warnings, and "openvpn --show-gateway" works, which is the only part of the code that uses the structures in question). Fix trac #340 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1389650074-18455-2-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/8230 (cherry picked from commit 615fb9ef36310f85fd6171301128a12740444455)
* Rename 'struct route' to 'struct route_ipv4'Gert Doering2014-01-163-26/+26
| | | | | | | | | | | | | To fix trac #340, we need to rename our "struct route" to avoid a collision with "struct route" from <net/route.h> on *BSD. No functional changes. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1389650074-18455-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/8231 (cherry picked from commit b57e005b8f232760081875937a53e8e7d235faa6)
* Document issue with --chroot, /dev/urandom and PolarSSL.Gert Doering2014-01-121-0/+10
| | | | | | | | | | See trac#218 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1389441036-12538-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/8213 (cherry picked from commit b238a1f2d4b2cdcfc844689b33fd3ac43ed31c1c)
generated by cgit (git 2.34.1) at 2025-09-26 10:32:42 +0000