summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Print helpful error message on --mktun/--rmtun if not available.Gert Doering2015-04-282-4/+8
| | | | | | | | | | | | | | | | OpenVPN only supports --mktun/--rmtun to create/destroy persistant tunnels on Linux. On BSD OSes, "ifconfig tun0 create" can do the same job, so we do not actually need to support it - but the previous error message ("unknown option") wasn't helpful. So always accept the option now, and on non-supported systems, direct user to manpage. Trac #85 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <dazo@users.sourceforge.net> Message-Id: <1430219063-12291-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9617 (cherry picked from commit 4ad2b65d9deb3197d847d7dcc36715aa5394836f)
* Manual page update for Re-enabled TLS version negotiation.Matthias Andree2015-04-131-5/+8
| | | | | | | | Signed-off-by: Matthias Andree <matthias.andree@gmx.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1427745294-31041-1-git-send-email-matthias.andree@gmx.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9562 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Re-enable TLS version negotiation by defaultSteffan Karger2015-04-131-10/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Re-enable TLS version negotiation by default, so that users benefit from the stronger and better crypto of TLSv1.1 and TLSv1.2, without having to add 'tls-version-min' to their config files. We tried this before in 2.3.3, but got various reports of people no longer being able to connect. Back then, we did not have a way for users to control the TLS version. We now have --tls-version-min and --tls-version-max, and even automatically set --tls-version-max to 1.1 if --cryptoapi is used, because the cryptoapi code is incompatible with TLS 1.2. To make sure users can fall back to the _exact_ old default behaviour, not only limit the TLS version to 1.0 if --tls-version-max 1.0 is set, but also keep using the API calls TLSv1_{client,server}_method(), instead of the ones that support negotiation (SSLv23_{client,server}_method()). (Yes, the naming is awkward, but 'SSLv23' really means 'enable negotiation' in OpenSSL-API language. This patch is for the release/2.3 branch only. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Matthias Andree <matthias.andree@gmx.de> Message-Id: <1426015605-4068-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9542 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Remove unneeded parameter 'first_time' from possibly_become_daemon()Steffan Karger2015-04-131-3/+3
| | | | | | | | | | | | | The static helper function possibly_become_daemon() is called only once, by do_init_first_time(), which checks 'first_time' to be true before calling possibly_become_daemon(). This makes the parameter useless. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1427328089-886-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9555 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 857c04ef06cd13d59c5b45332f07996e71372576)
* Fix incorrect use of get_ipv6_addr() for iroute options.Gert Doering2015-03-081-1/+1
| | | | | | | | | | get_ipv6_addr() returns "bool/false", not "int < 0" to signal error. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1425819401-18465-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9532 (cherry picked from commit e8562d5531277ee4dd7c517ef68e87af077ac948)
* Fix mssfix default value in connection_list contextLev Stipakov2015-03-071-1/+1
| | | | | | | | | | | | | | | | | | | | Due to this bug, mssfix hasn't been assigned to fragment value and used default value (1450) instead. As a consequence, TCP packets get fragmented, which causes performance penalty. Since dual stack patch (commit 23d61c56b9fd218c39ad151b01b7e2d6690e6093) OpenVPN uses options->connection_list, even for single remote. This fix assigns mssfix value to fragment value for connection_entry inside connection_list instead of connection_entry inside options struct (which does not work for connection_list case). Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1425587636-23338-1-git-send-email-lstipakov@gmail.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/9507 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit d384a9587951617d12e31e0a18050bd86402d5df)
* Allow for CN/username of 64 characters (fixes off-by-one)Steffan Karger2015-03-061-3/+3
| | | | | | | | | | | | | | | | | | | This is an alternative patch to fix the issue reported in trac #515 by Jorge Peixoto. Instead of increasing the TLS_USERNAME_LEN define, do +1 at the relevant places in the code. Also see Jorge's original patch and the discussion on the maillinglist: http://thread.gmane.org/gmane.network.openvpn.devel/9438 Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <54F8CC9B.9040104@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9508 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit ecd934b1ef83eec58eb2df5d3a98309ca56d5812) Conflicts: src/openvpn/ssl_verify.c
* New approach to handle peer-id related changes to link-mtu (2.3 version)Gert Doering2015-02-273-4/+36
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Instead of statically increasing link-mtu by +3, keep the old value for OCC compatibility with old servers/clients, and only increase link-mtu if peer-id option is enabled (right now: is pushed by server). If link-mtu has been set in the config, keep configured value, and log warning (because the extra overhead has to decrease tun-mtu). Reserve extra +3 bytes in frame->extra_link. v2: use frame->extra_link, not frame->extra_buffer (receive path on server) introduce frame_add_to_link_mtu() to manipulate frame->link_mtu value rework comments to make more clear what is happening Adaption to 2.3: reserve +8 bytes in frame->extra_buffer - if compression is not enabled, the 2.3 code does not reserve space for compression overhead (2.4 code does), so the buffer ends up being too small. +3 is not sufficient because the buffer handling code also does some alignment tricks... This reverts commit 4ec70ca227370380011d072c09b739135e236183. Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 9e0963c11aa439deb382d7d6bc40b6ade999401c) Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1424031695-10218-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9458
* Fix frame size calculation for non-CBC modes.Steffan Karger2015-02-271-5/+21
| | | | | | | | | | | | | | | | CBC mode is the only mode that OpenVPN supports that needs padding. So, only include the worst case padding size in the frame size calculation when using CBC mode. While doing so, rewrite crypto_adjust_frame_parameters() to be better readable, and provide debug output (for high debug levels). Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1406667144-17674-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/8952 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 669f898b8fcaf7a8d43825fa0255c2791cc0ef89)
* Disable SSL compressionSteffan Karger2015-02-151-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | As reported in trac #502, SSL compression can cause problems in some corner cases. OpenVPN does not need SSL compression, since the control channel is low bandwidth. This does not influence the data channel compressen (i.e. --comp or --comp-lzo). Even though this has not yet been relevant for OpenVPN (since an attacker can not easily control contents of control channel messages), SSL compression has been used in the CRIME and BREACH attacks on TLS. TLS 1.3 will probably even remove support for compression all together, for exactly this reason. Since we don't need it, and SSL compression causes issues, let's just disable it in OpenSSL builds. PolarSSL has no run-time flag to disable compression, but is by default compiled without compression. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1424010266-5910-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9453 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 5d5233778868ddd568140c394adfcfc8e3453245)
* Account for peer-id in frame size calculationSteffan Karger2015-01-231-6/+4
| | | | | | | | | | | | | | | | Data channel packet using P_DATA_V2 will use three bytes extra for the peer-id. This needs to be accounted for, otherwise OpenVPN will throw TCP/UDP packet too large on write to [AF_INET]10.1.1.1:1194 warnings. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Lev Stipakov <lstipakov@gmail.com> Message-Id: <1422042761-10014-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9418 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit f95010ad247a8998e0c39e394236251fca316849)
* Default gateway can't be determined on illumos/Solaris platformsAlexander Pyhalov2014-12-311-2/+19
| | | | | | | | | | The logic which is used on BSD is preserved. The only distinction is that illumos doesn't provide sa_len field in sockaddr structures. Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1413315802-62359-4-git-send-email-alp@rsu.ru> URL: http://article.gmane.org/gmane.network.openvpn.devel/9128 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Set tls-version-max to 1.1 if cryptoapicert is usedSteffan Karger2014-12-281-0/+18
| | | | | | | | | | | | | | | | | | | | OpenVPN's current cryptoapicert implementation does not support TLS 1.2 (and newer). Fixing this requires a rewrite of our cryptoapi code to use Microsofts' "Cryptography API: Next Generation", and several hacks to work around that API. As long as we don't fix that, make openvpn automatically cap the TLS version to 1.1 when using cryptoapi (and tell the user we're doing so). This enables the user to use cryptoapi + TLS version negotiation (upto TLS 1.1) without having to change his configuration. This patch has been tested on Windows 8.1 for both the master and release/2.3 branches. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1419762313-31233-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9361 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 04dcb96cc1f525afee3f830248ecaa22d1b4a4c2)
* Make 'provider' option to --show-pkcs11-ids optional where p11-kit is presentDavid Woodhouse2014-12-272-3/+36
| | | | | | | | | Trac: 490 Signed-off-by: David Woodhouse <David.Woodhouse@intel.com> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1418905506.21260.6.camel@infradead.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/9355 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* pkcs11: Load p11-kit-proxy.so module by defaultDavid Woodhouse2014-12-273-0/+26
| | | | | | | | | | | | | | If the user specifies --pkcs11-id or --pkcs-id-management but neglects to explicitly provide a --pkcs11-provider argument, and if the system has p11-kit installed, then load the p11-kit proxy module so that the system-configured tokens are available. Trac: 490 Signed-off-by: David Woodhouse <David.Woodhouse@intel.com> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1418303015.31745.78.camel@infradead.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/9342 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* plugins, down-root: Code style clean-upDavid Sommerseth2014-12-091-307/+323
| | | | | | | | | | | | | | | | | | The coding style was somewhat chaotic. Cleaning it up using the astyle tool. The style parameters are coherent to what was agreed upon at the Munich Hackathon 2014 [1]. astyle --style=allman --indent=spaces=4 -c Also included a "Local variables" section which some editors may pick up automatically. Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1418078751-3614-1-git-send-email-openvpn.list@topphemmelig.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/9331 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit e2e9a69c1ecc7142cc17d665076795215b6a8e9a)
* sockets: Remove the limitation of --tcp-nodelay to be server-onlyDavid Sommerseth2014-12-092-2/+4
| | | | | | | | | | | | | | | | | | | The assert(0) happening if trying to use --tcp-nodelay in a client config is really not helpful at all. When this assert(0) was removed, another warning appeared that this could only be used in server configs. That itself is also quite silly, as clients can choose to use --socket-flags TCP_NODELAY in the client config instead. This behaviour does not help the user in any way. This patch removes the server-only restriction and rather provides a more helpful warning when using --tcp-nodelay on the client side. Trac: 489 Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: 1418118764-17846-1-git-send-email-openvpn.list@topphemmelig.net URL: http://article.gmane.org/gmane.network.openvpn.devel/9334 (cherry picked from commit 706283d3765d1ee62dbd913fbfc191855b92528d)
* plugin, down-root: Fix compiler warningsDavid Sommerseth2014-12-081-3/+1
| | | | | | | | | | | | | | | | Removed a few compiler warnings: down-root.c:164:4: warning: implicit declaration of function 'warn' [-Wimplicit-function-declaration] down-root.c:239:5: warning: implicit declaration of function 'err' [-Wimplicit-function-declaration] down-root.c:461:7: warning: unused variable 'i' [-Wunused-variable] down-root.c:460:15: warning: unused variable 'p' [-Wunused-variable] Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: 1418074541-24987-1-git-send-email-openvpn.list@topphemmelig.net URL: http://article.gmane.org/gmane.network.openvpn.devel/9327 (cherry picked from commit 7dd51f6f50b17ab91cbb724e2d5e96657fab834a)
* Update doxygen (a bit)Steffan Karger2014-12-075-41/+107
| | | | | | | | | | | | | | | | | | This is not a full update, but just updates some data channel-related docs I came across. Other pages probably need a bit of attention too. Stuff that was changed: * Explain data channel crypto format in crypto.h * Add P_DATA_V1 and P_DATA_V2 packet format spec * Remove '2.1' from title * Update some OpenSSL-specific text Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1417978095-19427-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9318 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit b08c25dbaeffbdd80acc143a931a276163c851a3)
* down-root: Improve error messagesDavid Sommerseth2014-12-061-16/+36
| | | | | | | | | | | | If down-root fails it will now use warn() to provide some more information about what went wrong, by retrieving the error message via errno. Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1416262460-9158-1-git-send-email-openvpn.list@topphemmelig.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/9247 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit b0f2c521303b7bceb6806680363bc4b9d225e5b8)
* down-root plugin: Replaced system() calls with execve()David Sommerseth2014-12-061-92/+48
| | | | | | | | | | | | | | | | | | | | The system() call is prone to shell expansions and provides far more environments variables to the executable run than what is usually preferred. By moving over to exevce() shell expansions are far more difficult to achieve and only the OpenVPN provided environment variables are available. This is a response to the patch submitted to openvpn-devel ML: http://article.gmane.org/gmane.network.openvpn.devel/7919 v2 - Pulling it up again, fixing a few whitespace and spelling issues Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1416148262-20978-1-git-send-email-openvpn.list@topphemmelig.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/9238 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit f87b1beccb817e1633bc95bd5dd19deec35c7edc)
* Warn that tls-auth with free form files is going to be removed from OpenVPN 2.4Arne Schwabe2014-12-062-2/+4
| | | | | | | | Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1417872129-31980-2-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/9309 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Really fix '--cipher none' regressionSteffan Karger2014-12-022-4/+5
| | | | | | | | | | | | | | | | | | | | ... by not incorrectly hinting to the compiler the function argument of cipher_kt_mode_{cbc,ofb_cfb}() is nonnull, since that no longer is the case. Verified the fix on Debian Wheezy, one of the platforms the reporter in trac #473 mentions with a compiler that would optimize out the required checks. Also add a testcase for --cipher none to t_lpback, to prevent further regressions. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1417552920-31770-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9300 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 98156e90e1e83133a6a6a020db8e7333ada6156b)
* Include systemd units in the source tarball (make dist)Mike Gilbert2014-12-021-0/+2
| | | | | | | | Acked-by: David Sommerseth <davids@redhat.com> Message-Id: 1417548862-24990-1-git-send-email-floppym@gentoo.org URL: http://article.gmane.org/gmane.network.openvpn.devel/9299 Signed-off-by: David Sommerseth <davids@redhat.com> (cherry picked from commit 6ece60c6dc7a3cda58f4dfea4e6cd3016023234f)
* autotools: Fix wrong ./configure help screen default valuesDavid Sommerseth2014-11-301-3/+3
| | | | | | | | | | | | | | | | enable_crypto_ofb_cfb is "yes" by default, so the --help screen should show --disable-ofb-cfb and not --enable-ofb-cfb. enable_small and enable_password_save are both "no" by default, so the --help screen should state "default: no". Now it says "yes" as default, but is really disabled in the reality. Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1416852578-7581-1-git-send-email-openvpn.list@topphemmelig.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/9278 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 104360b4f40a4ba29987d9478aed70450fec75a2)
* Preparing for release v2.3.6 (ChangeLog, version.m4)Gert Doering2014-11-282-2/+19
| | | | Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Drop too-short control channel packets instead of asserting out.Steffan Karger2014-11-281-1/+5
| | | | | | | | | | | | | | | | | | | This fixes a denial-of-service vulnerability where an authenticated client could stop the server by triggering a server-side ASSERT(). OpenVPN would previously ASSERT() that control channel packets have a payload of at least 4 bytes. An authenticated client could trigger this assert by sending a too-short control channel packet to the server. Thanks to Dragana Damjanovic for reporting the issue. This bug has been assigned CVE-2014-8104. Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1CED409804E2164C8104F9E623B08B9018803B0FE7@FOXDFT02.FOX.local> Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit c5590a6821e37f3b29735f55eb0c2b9c0924138c)
* Add client-only support for peer-id.Gert Doering2014-11-246-7/+62
| | | | | | | | | | | | | This is a reduced version of the peer-id patch from Lev Stipakov implementing only the client side bits - send IV_PROTO=2, accept "peer-id <n>" as pushed option, support P_DATA_V2 packets. v2: remove addition of "struct tls_multi;" to options.h, not needed Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1416770250-92680-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9274
* systemd: Reworked the systemd unit file to handle server and client configs ↵David Sommerseth2014-11-242-3/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | better Systemd can delay starting a service if the network isn't fully available yet. This feature is useful in client configurations, where OpenVPN will not be started before the client can reach the Internet. It is the network service manager which tells systemd if the system is "online" or not. For server configurations, the OpenVPN should be able to be started, regardless if the system is "online" or not. This is also the old behaviour of most of the old init.d script and the last systemd unit file. This patch splits the previous systemd unit file into to two files. One which is aimed at clients (openvpn-client@.service) and one for server configurations (openvpn-server@.service). These files will also pick the configurations from different sub-directories. The unit file for openvpn-client@ will use /etc/openvpn/client and the server unit file will use /etc/openvpn/server. This also ensures that config files are not started in the wrong manner. The arguments given to the openvpn binary have also shifted order, to ensure that some of them cannot be overridden by the config file, such as --daemon and --writepid. For server configurations a --status file is also added with the status format set to 2. This can be overridden by the configuration file. Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1415889817-28049-1-git-send-email-openvpn.list@topphemmelig.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/9222 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 3341a98c2852d1d0c1eafdc70a3bdb218ec29049)
* Modernize sample keys and sample configsSteffan Karger2014-11-2326-259/+781
| | | | | | | | | | | | | | | | | | | | | | | | | | I kept most of the certificate properties equal to the old certs, since some people's test scripts might rely on them (and it does not require any creativity from my part). Changes: * Add script to generate fresh test/sample keys (but keep sample keys in git for simple testing) * Switch from 1024 to 4096 bits RSA CA * Switch from 1024 to 2048 bits client/server RSA keys * Switch from 1024 to 2048 bits Diffie-Hellman parameters * Generate EC client and server cert, but sign with RSA CA (lets us test EC <-> RSA interoperability) * Remove 3DES cipher from 'sample' config * Add 'remote-cert-tls server' to client config * Update config files to deprecate nsCertType in favour of the keyUsage and extendedKeyUsage extensions. * Make naming more consistent Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <54721611.4020103@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9271 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix to --shaper documentation on the man-pageSamuli Seppänen2014-11-231-0/+1
| | | | | | | | | | | Trac: #413 Trac-URL: https://community.openvpn.net/openvpn/ticket/413 Signed-off-by: Samuli Seppänen <samuli@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1416564585-14546-1-git-send-email-samuli@openvpn.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/9254 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 245831b9bb096c9139b28612f13609606f105cd5)
* Add --tls-version-maxSteffan Karger2014-11-147-35/+103
| | | | | | | | | | | | | | | Because using TLS 1.2 breaks certain setups, a user might want to enforce a maximum TLS version to use. This patch adds that option. This patch removes a number of #ifdefs from ssl_polarssl.c, because the polarssl versions we currently support (polar 1.2 for openvpn 2.3, and polar 1.3 for openvpn-master) have all versions unconditionally enabled. Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <544EC052.3080809@fox-it.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/9210 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix assertion error when using --cipher noneSteffan Karger2014-11-083-7/+7
| | | | | | | | | | | | | Some commits ago, the cipher mode checks were cleaned up to remove code duplication (and fix the issue in #471), but broke '--cipher none' (reported in #473). This commit fixes that. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <545DED2C.5070002@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9217 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 4e93e6dc88f4d904a4f2eb90140472a8d8fd68d0)
* Preparing for release v2.3.5 (ChangeLog, version.m4)Gert Doering2014-10-252-3/+72
| | | | Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Remove unused variables from ssl_verify_openssl.c extract_x509_extension()Steffan Karger2014-10-251-2/+0
| | | | | | | | Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1414230851-5350-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9195 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* ssl_polarssl.c: fix includes and make casts explicitSteffan Karger2014-10-251-20/+26
| | | | | | | | | | | | | | | | | | The master branch already has a commit doing almost the same (9048d50), but since the API for polarssl 1.2 is different, this could not be cherry-picked back to the 2.3 branch. This commit: * adds a number of missing #includes. * makes a number of implicit casts explicit, to silence gcc -Wall and clang warnings that hide real problems. * changes the type of sha256_hash[] to match what polarssl expects. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1414230469-2670-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9194 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix regression with password protected private keys (polarssl)Steffan Karger2014-10-241-3/+3
| | | | | | | | | | | | | Between versions 1.2.7 and 1.2.8, polarssl changed the errors returned by the X509 parsing functions, which broke the OpenVPN implementation for password protected private keys in polarssl builds. This patch fixes that by checking for the new errors in OpenVPN. Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <5432E951.6020405@fox-it.com> Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix "code=995" bug with windows NDIS6 tap driver.TDivine2014-10-242-0/+28
| | | | | | | | | | | | | | | | | | | | | | Modification to address bug where OpenVPN enters state where it is unresponsive and cannot be terminated. Log output is continuous spew of "code=995" errors. Revised fix for code=995 sped bug. Adding new tap adapters while connected: https://community.openvpn.net/openvpn/ticket/430 Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1413961660-19251-2-git-send-email-samuli@openvpn.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/9165 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1413961660-19251-3-git-send-email-samuli@openvpn.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/9167 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 7aa178381241ae015273914065471e0d271ee1c3)
* Ensure that client-connect files are always deletedSamuel Thibault2014-10-201-4/+10
| | | | | | | | | | | | | | | | | On a long-running, busy server using either a plug-in which hooks into OPENVPN_PLUGIN_CLIENT_CONNECT or a configuration using --client-connect a lot of unused files will be lingering and potentially filling up the file system with temporary files if the plug-in or --client-connect script fails. This patch ensures that these files are always removed in the end, regardless if the plug-in or script succeeds or fails. Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: David Sommerseth <davids@redhat.com> Message-Id: 20141012195919.GU3738@type URL: http://thread.gmane.org/gmane.network.openvpn.devel/9104/focus=9118 (cherry picked from commit 7da9d40243e0743e2d050ceb6ae34e467dd58973)
* systemd: Use systemd functions to consider systemd availabilityDavid Sommerseth2014-10-163-6/+36
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * OpenVPN 2.3.x backport note This patch is the result of merging two commits from master, both ensuring that systemd and the needed utilities are available. Commit f33ee6bcb12fdc3869b17b7c528a209f16581e2e: This is another systemd implementation clean-up. It was found that SELinux will block OpenVPN from checking /sys/fs/cgroups. As OpenVPN only checked /sys/fs/cgroups and /sys/fs/cgroups/systemd to see if systemd was available or not, it was considered better to query systemd directly to see whether or not to query for usernames and passwords via systemd. This patch has been compile tested on Fedora 19 and Fedora 21 alpha and function tested on Fedora 19. v2 - Use PKG_CHECK_MODULES() + check for libsystemd before libystemd-daemon. systemd >= 209 use a unified library Commit 55480682b9bfa5894402954f4c740954d8c5c556: Don't try to use systemd-ask-password if it is not available If the SYSTEMD_ASK_PASSWORD_PATH executable cannot be found, we don't consider systemd as running. Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de> Signed-off-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1412356567-27125-1-git-send-email-openvpn.list@topphemmelig.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/9072 (cherry picked from commit f33ee6bcb12fdc3869b17b7c528a209f16581e2e) Message-Id: 20140909202044.GJ1118@greenie.muc.de URL: http://article.gmane.org/gmane.network.openvpn.devel/9035 (cherry picked from commit 55480682b9bfa5894402954f4c740954d8c5c556)
* Add systemd unit file for OpenVPNDavid Sommerseth2014-10-161-0/+19
| | | | | | | | | | | | | | This is to encourage all Linux distributions to use a unified systemd unit file. This unit file also tries to reduce the capabilities of the running openvpn process. Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: 1411030936-16309-1-git-send-email-openvpn.list@topphemmelig.net URL: http://article.gmane.org/gmane.network.openvpn.devel/9043 (cherry picked from commit 8a4566ce4f01a434ac9ea841eae74330368398a0)
* Don't let openvpn_popen() keep zombies aroundDavid Sommerseth2014-10-161-2/+5
| | | | | | | | | | | | | | | | | | | | Commit 9449e6a9eba30c9ed054f57d630a88c9f087080f introduced the openvpn_popen() function to support retrieving passwords via systemd. It was discovered that the child processes openvpn fork()ed would be lingering around until openvpn stopped. This was due to the lack of a wait() call. This patch also cleans up a few minor white-space issues in the same code segment. [v2 proper initialisation of status variable] Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: 1409930731-15263-2-git-send-email-davids@redhat.com URL: http://article.gmane.org/gmane.network.openvpn.devel/9021 (cherry picked from commit d886d468849051af525bb8ff1b9080f6c934e3ab)
* Add configure check for the path to systemd-ask-passwordMike Gilbert2014-10-162-1/+4
| | | | | | | | | | | | Gentoo Linux installs this in /usr/bin by default. Also, the user may have installed it in /usr/local/bin if building from source. Acked-by: David Sommerseth <davids@redhat.com> Message-Id: 1404419045-14728-1-git-send-email-floppym@gentoo.org URL: http://article.gmane.org/gmane.network.openvpn.devel/8825 Signed-off-by: David Sommerseth <davids@redhat.com> (cherry picked from commit ba79c71d1255651bfcb8570519b4033c763d47d3)
* Implement on-link route adding for iproute2Philipp Hagemeister2014-10-141-4/+7
| | | | | | | | | | | | | | | This is an OpenPGP/MIME signed message (RFC 4880 and 3156) Currently, when compiling with --enable-iproute2 , OpenVPN does not create a correct route when the user is connected to the Internet without a gateway (e.g. via ppp). This patch implements the corresponding FIXME. Signed-off-by: Philipp Hagemeister <phihag@phihag.de> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <54259015.2030005@phihag.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9056 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit baa195b9884e276c4fd3dc0c9e8a84b89ea71cfb)
* ocsp_check - double check if ocsp didn't report any errors in executionHubert Kario2014-10-061-0/+4
| | | | | | | | | | | | | | | | | | | | | in case the reposnses are too old, ocsp tool can return text like this: Response verify OK ca/cert.pem: WARNING: Status times invalid. 139990703290240:error:2707307D:OCSP routines:OCSP_check_validity:status expired:ocsp_cl.c:358: good This Update: Sep 21 12:12:48 2014 GMT Next Update: Sep 22 12:12:48 2014 GMT light change in buffering can cause "verify OK" and "ca/cert.pem: good" to be placed in a way that matching will be valid Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1411727041-11884-2-git-send-email-hkario@redhat.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/9055 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 51390f4de4f02edf377d55a7ef108798d2d8dc88)
* ocsp_check - signature verification and cert staus results are separateHubert Kario2014-10-061-3/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | when openssl returns result of parsing and verification of the OCSP response, the signature verification is separate from the certificate status, as such it's necessary to check both of them. Otherwise results like: Response Verify Failure 140170966779776:error:27069076:OCSP routines:OCSP_basic_verify:signer certificate not found:ocsp_vfy.c:85: ca/cert.pem: good This Update: Sep 23 12:12:28 2014 GMT will be accepted as being trustworthy. Note that "Response verify OK" is printed on stderr, so it can't be discarded. Signed-off-by: Hubert Kario <hkario@redhat.com> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1411727041-11884-1-git-send-email-hkario@redhat.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/9054 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit e0c9e8452932a964b556daaeacdf7d9eab133e36)
* Remove quadratic complexity from openvpn_base64_decode()Jann Horn2014-09-141-1/+1
| | | | | | | | | | | | | | | | | Every four input characters, openvpn_base64_decode called token_decode, which in turn called strlen() on the remaining input. This means that base64 decoding in openvpn had quadratic complexity. All we really need to know is whether the token is complete, so replace the check to check just that, and make the complexity linear wrt the input length. Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <5408494D.7050407@fox-it.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/9016 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 25e1ec71dd150e803c0a25308c193fea124c7b7a)
* Fix typo in cipher_kt_mode_{cbc, ofb_cfb}() doxygen.Steffan Karger2014-07-291-2/+2
| | | | | | | | | Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1406667866-14226-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/8953 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 38cd1ed5ee89218415c5edfc990cfd47fd879d55)
* Add topology in sample server configuration filePhilipp Hagemeister2014-07-131-1/+8
| | | | | | | | | | | | | | This is an OpenPGP/MIME signed message (RFC 4880 and 3156) On modern systems, topology subnet should always be set, but it's missing in the configuration file. Add it with a short explanation. Signed-off-by: Philipp Hagemeister <phihag@phihag.de> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <53BF9998.5020906@phihag.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/8878 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit c277757fcf7fb4c2713db154439f937d48cfae61)
* Fix server routes not working in topology subnet with --server [v3]Arne Schwabe2014-07-132-2/+9
| | | | | | | | | | | | | | | | | | | | | The IPv4 routing code needs an IPv4 address to point a route to, and in --topology subnet mode, the *server* did not have one set by default. So we now just default --route-gateway to the next address right after the server address - the specific address doesn't matter, as the correct next-hop will not be resolved by the host OS but by the OpenVPN daemon. All that is needed is "it's in the subnet routed to the tun interface". Using the server address itself would work on unix, but doesn't work with the Windows TAP driver (as it does not spoof ARP responses for itself). Signed-off-by: Arne Schwabe <arne@rfc2549.org> Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1405254527-23833-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/8904 (cherry picked from commit 4cc6a2595947a0e2f13b37637899bfc50f8509aa)
generated by cgit (git 2.34.1) at 2025-09-26 12:16:10 +0000