summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Fix commit a3160fc1bd7368395745b9cee6e40fb819f5564crelease/2.3Arne Schwabe2015-10-151-1/+1
| | | | | | | | | | | Move things to the proper place, ensure that line_ptr is actually properly initialized for *every* line read, not just for the first one Acked-by: Lev Stipakov <lstipakov@gmail.com> Message-Id: 1444827956-2169-1-git-send-email-arne@rfc2549.org URL: http://article.gmane.org/gmane.network.openvpn.devel/10271 Signed-off-by: David Sommerseth <davids@redhat.com> (cherry picked from commit cba33989101175ac07434b9c5cceba116bf38127)
* Fix "White space before end tags can break the config parser"janjust2015-10-111-1/+4
| | | | | | | | | | | trac #569 Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1444493569-24026-1-git-send-email-janjust@nikhef.nl> URL: http://article.gmane.org/gmane.network.openvpn.devel/10249 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit c67acea173dc9ee37220f5b9ff14ede081181992)
* Add CONTRIBUTING.rstSamuli Seppänen2015-10-101-0/+30
| | | | | | | | Signed-off-by: Samuli Seppänen <samuli@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1444484474-6471-1-git-send-email-samuli@openvpn.net> Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 0c1d92291e4c1829bf503067e1f9d39328d01ee9)
* Increase control channel packet size for faster handshakesSteffan Karger2015-10-041-2/+3
| | | | | | | | | | | | | | | | | | | | | | | Instead of limiting the control channel TCP/UDP packet payload size at '100 bytes + real control channel overhead' (~140 bytes ethernet payload), increase the max TCP/UDP payload size to '1250 bytes - calculated overhead' (~1210 bytes ethernet payload). Note that this patch does *not* yield an optimal solution, but it is a simple and rather safe change that will improve connection setup times significantly. v2: use the mininum value of --link-mtu and 1250 to give the user a way to reduce control packet size if really needed. trac #545 Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1435693496-10931-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9841 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit fc91d4b0071178e298052078431fb86f03be84fc)
* Check return value of ms_error_text()Steffan Karger2015-10-041-0/+1
| | | | | | | | | | | | | | | ms_error_text() may return NULL, and it is unclear (or, at least undocumented) whether the OpenSSL ERR code (and our code using the ERR code) can deal with esd->string being NULL. So, just to be sure, check that ms_error_text() succeeded before passing the result to ERR_load_strings(). Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <561130FC.8090008@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/10176 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 5584b738a332d0abc740d9303c275764c2ca13f1)
* Replace strdup() calls for string_alloc() callsSteffan Karger2015-10-046-6/+8
| | | | | | | | | | | | | As reported by Bill Parker in trac #600, strdup() return values are not always correctly checked for failed allocations. This patch adds missing checks by using string_alloc(), which performs the required checks. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <561130FC.8090008@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/10176 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit ddc7692d245017c71adc40ad5cc195617e39fce0)
* Repair test_local_addr() on WIN32Gert Doering2015-09-251-1/+1
| | | | | | | | | | | | | | Intermediate result was stored in a "bool" variable, but the actual range of results is 0/1/2 - so "2" (TLA_LOCAL) never worked. Change to "int". Diagnosed by "dferbas" in trac #609 (thanks). Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1443162970-38210-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/10168 (cherry picked from commit c40f088e52132273f6d4e83d05fa64bbaedd860f)
* Replace unaligned 16bit access to TCP MSS value with bytewise accessGert Doering2015-09-211-9/+8
| | | | | | | | | | | | | | TCP options are not always word-aligned, and accessing a 16bit value at an odd memory address will cause a "bus error" crash on some architectures, e.g. Linux/Sparc(64) Trac #497 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1440680402-96548-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/10056 (cherry picked from commit 2e2a34181962b33d70c34c28dcb1e1977c2fd54e)
* Log serial number of revoked certificateBoris Lytochkin2015-09-202-2/+10
| | | | | | | | | | | | | | | | | | | | In most of situations admin of OpenVPN server needs to know which particular certificate is used by client. In the case when certificate is OK, environment variable can be used for that but once it is revoked, no user scripts are invoked so there is no way to get serial number: only subject is printed in logs. So we log certificate serial in case it is revoked. Sponsored-by: Yandex LLC Signed-off-by: Boris Lytochkin <lytboris@yandex-team.ru> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <55FEBF7E.3010209@yandex-team.ru> URL: http://article.gmane.org/gmane.network.openvpn.devel/10154 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 767e4c56becbfeea525e4695a810593f373883cd)
* Show extra-certs in current parameters.Arne Schwabe2015-08-081-0/+1
| | | | | | | | | | | Closes ticket #591 Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1438859835-3977-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/10005 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 291c227d2ccecaa92602eaa5259a23c7093e30e5)
* Un-break --auth-user-pass on windowsGert Doering2015-08-041-0/+2
| | | | | | | | | | | | | | | Commit b131c7b974d9d4d3f0 introduced a check to create a meaningful warning if we try to read a password after daemon()izing (by checking whether stdin or stderr is connected to a tty). For some reason this breaks on Windows builds if run under GUI control - but since Windows doesn't have this particular daemon() issue anyway, just #ifndef WIN32 the offending code. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1438692796-14663-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/10000 (cherry picked from commit 0ffd744332f51878c4df430ab14aca3126bdfc8a)
* Preparing for release v2.3.8 (ChangeLog, version.m4)Gert Doering2015-08-032-2/+25
| | | | Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix overflow check in openvpn_decrypt()Steffan Karger2015-08-012-11/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Sebastian Krahmer from the SuSE security team reported that the buffer overflow check in openvpn_decrypt() was too strict according to the cipher update function contract: "The amount of data written depends on the block alignment of the encrypted data: as a result the amount of data written may be anything from zero bytes to (inl + cipher_block_size - 1) so outl should contain sufficient room." This stems from the way CBC mode works, which caches input and 'flushes' it block-wise to the output buffer. We do allocate enough space for this extra block in the output buffer for CBC mode, but not for CFB/OFB modes. This patch: * updates the overflow check to also verify that the extra block required according to the function contract is available. * uses buf_inc_len() to double-check for overflows during en/decryption. * also reserves the extra block for non-CBC cipher modes. In practice, I could not find a way in which this would fail. The plaintext is never longer than the ciphertext, and the implementations of CBC/OFB/CBC for AES and BF in both OpenSSL and PolarSSL/mbed TLS do not use the buffer beyond the plaintext length when decrypting. However, some funky OpenSSL engine I did not check *might* use the buffer space required by the function contract. So we should still make sure we have enough room anyway. v2 - always ASSERT() on buf_inc_len(). It is a double-check so should really not fail, but if it fails there has been a buffer overflow. At that point the best thing we can do is assert out. (The primary check *is* handled gracefully, and just drops the packet.) Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1438165826-32762-1-git-send-email-steffan.karger@fox-it.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/9974 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit cc377dec820f9e6e7e72981013eb3857aa6ea5ce)
* Fix commit e473b7c if an inline file happens to have a line break exactly at ↵Arne Schwabe2015-07-272-2/+5
| | | | | | | | | | | | | | | | buffer limit The check does only for strlen(line) space and buf_printf will only use at most space -1 and not print the final character ('\n') in this corner. Since a missing \n only breaks certificates at the start and end marker, missing line breaks otherwise do not trigger this error. Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1438011191-19389-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/9956 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit d40cbf0e2601b35bfb1c0551c6f3907b5c5178ff)
* Fix using management interface to get passwords.Steffan Karger2015-07-211-2/+9
| | | | | | | | | | | | | | | | | | | | | Commits da9b292733e929a2900dc32d37f0424c3d588366 and 315f6fbc7f657a7f1127628bd714f468709d5185 broke the use case where we are asking password from the management client. The password is always asked before daemonization. With this fix we avoid this and ask it via management interface in the same spot as before the mentioned commits. Tested on Linux. v2: This patch was first submitted by Christian Pellegrin (from Google), and reworked by Steffan Karger (from the OpenVPN team) to also work for setups with --management-query-passwords but without --auth-user-pass. Signed-off-by: Steffan Karger <steffan@karger.me> Signed-off-by: Christian Pellegrin <chripell@google.com> Tested-by: Christian Pellegrin <chripell@google.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <55A6C46C.5080601@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9927 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit d4fbe287fc2ddbef05fdfe22adc641859a8a7412)
* Document --daemon changes and consequences (--askpass, --auth-nocache).Gert Doering2015-07-141-0/+16
| | | | | | | | | | Trac #574, #576 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1436857794-29419-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9923 (cherry picked from commit b6ec7fbe96f4e200b8962ef6bb572bbb2228133e)
* Fix --askpass not allowing for password input via stdinJames Geboski2015-07-131-2/+2
| | | | | | | | | | | | | | | | | | | This resolves --askpass treating stdin as a file during the file access check. In turn, this leads to openvpn failing to start if this option is set to stdin. By default, --askpass reads the certificate's password from stdin rather than a file. Without passing the CHKACC_ACPTSTDIN flag to check_file_access(), stdin is marked as being a nonexistent file. Trac #248 Signed-off-by: James Geboski <jgeboski@gmail.com> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <55A41225.2020705@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9918 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 4e1e3ba1d8582a1e95dd6f9564e97c99784959a7)
* Produce a meaningful error message if --daemon gets in the way of asking for ↵Gert Doering2015-07-131-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | passwords. With the --daemon / SSL init reordering in da9b292733, we fail if we daemonize first and then try to ask for a private key passphrase (or, for that matter, username+password if --auth-nocache is set) - but no meaningful error message was printed, instead depending on operating system and library versions, either we looped around "ssl init failed" or died with an unspecified "fatal error". So: check if get_user_pass_cr() is called in a context that needs "from_stdin", but both stdin and stderr are not connected to a tty device (which getpass() needs). In that case, print a meaningful error message pointing to --askpass, and die. Trac #574 and #576 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1436814607-16707-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9916 (cherry picked from commit 079e5b9c13bf81d7afc6f932b5417d2f08f8e64b)
* fix regression: query password before becoming daemonSteffan Karger2015-07-133-5/+11
| | | | | | | | | | | | | | | | | The init sequence was changed to daemonize before the crypto init to fix issues on FreeBSD some commits ago. This introduced a regression where we would no longer query for passwords before daemonizing, as described in trac #574 and #576. This commit restores the correct order, and adds a bit of const correctness since we're touching this now code anyway. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1436477759-5884-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9901 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 315f6fbc7f657a7f1127628bd714f468709d5185)
* Make __func__ work with Visual Studio tooSteffan Karger2015-07-021-0/+4
| | | | | | | | | | | | Because even VS2013 is incapable of doing C99. Signed-off-by: Steffan Karger <steffan@karger.me> Tested-by: Fish Wang <fish.thss@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <CAA1AbxKrPXnc1+PPH4dQV1OksY_0t3ewqRnqVrjhZL+i2Pbkmw@mail.gmail.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/9859 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 9884e20810bda737c7708ff587e09cc0bb8475c7)
* Report missing endtags of inline files as warningsArne Schwabe2015-06-301-1/+8
| | | | | | | | | | | | | (2.3 reports as warning only, 2.4 reports as M_FATAL) trac #568 Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1435581995-11820-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/9830 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 68eecf76978a80bd5d88e944e4ed5e42bf2fd8e4)
* Del ipv6 addr on close of linux tun interfaceHolger Kummert2015-06-261-0/+26
| | | | | | | | | | | | | | | | | | | | | | | | When a linux tun interface is closed (e.g. on disconnect) an optional ipv6 addr that was previously set is deleted now. Without this patch a later reconnect could fail with 'Linux ip -6 addr add failed: external program exited with error status: 2' and openvpn would exit. This is mainly relevant for persistant tun devices (staying around after openvpn exits) but can also happen at reconnect. If addresses are *supposed* to stay around on openvpn exit, run openvpn with --ifconfig-noexec and configure IPv4/IPv6 addresses manually before openvpn starts (or using an --up script). Trac #141 Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1435248080-12670-1-git-send-email-Holger.Kummert@Sophos.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/9810 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit e5f71d674e3b119d6a252d7cef1c17b5c2b36a9a)
* write pid file immediately after daemonizingSteffan Karger2015-06-215-36/+14
| | | | | | | | | | | | | | | | | | Since we split daemonizing from changing directory in commit da9b292 (f025de005d719201a69ad0313d545a1ddd244752 in release/2.3), we can now simply write the pid file immediately after daemonizing. This not only fixes the bug reported in trac #563, but also further simplifies the code. trac #563 Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1434665325-3225-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9793 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 659eae7b79e5565bb0c93f6d6d04e2163fea1141)
* Preparing for release v2.3.7 (ChangeLog, version.m4)Gert Doering2015-06-022-3/+86
| | | | Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix FreeBSD ifconfig for topology subnet tunnels.Gert Doering2015-06-021-1/+23
| | | | | | | | | | | | | | | | | | | For "topology subnet", we only pretend to have a subnet and keep using the tun if in point-to-point mode - but for that to fully work, the "remote" address needs to be different from the "local" address. So just arbitrarily construct one from the on-link subnet - base+1, if "that is not us", base+2, otherwise. Fix trac #481 See also: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=194745 Signed-off-by: Gert Doering <gert@greenie.muc.de> Tested-By: Anton Sayetsky <vsasjason@gmail.com> Lazy-ACK-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1430071438-31675-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9606 (cherry picked from commit 60fd44e501f2002459a49c6c9bc64370ea26ca87)
* Improve documentation in --script-security section of the man-pageSamuli Seppänen2015-06-021-0/+5
| | | | | | | | | | | Trac: #395 Signed-off-by: Samuli Seppänen <samuli@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1433231982-24945-1-git-send-email-samuli@openvpn.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/9777 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 001384e2952b54089e889edbda3196283b21641d)
* Move res_init() call to inner openvpn_getaddrinfo() loopGert Doering2015-06-021-4/+3
| | | | | | | | | | | | | | | | | | | A non-working nameserver in /etc/resolv.conf could lead to endless loops inside openvpn_getaddrinfo(), because many systems will only pick up changes to resolv.conf if res_init() is called again. To reproduce, run openvpn with --resolv-retry infinite (2.3) or --resolv-retry "a high number" (master) on a BSD system. Linux glibc seems to stat() resolv.conf on calls to getaddrinfo() and pick up changes automatically. Trac #523 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1433080749-6892-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9763 (cherry picked from commit 288a819af7d3a6fab9e0b69ae8dbaac74b36307b)
* Fix --redirect-private in --dev tap mode.Guy Yur2015-06-011-1/+1
| | | | | | | | | | | | | | | | | | | | | When specifying redirect-private option and not specifying route-gateway or ifconfig options, OpenVPN fails to add the route to the remote host with the following message: NOTE: unable to redirect default gateway -- VPN gateway parameter (--route-gateway or --ifconfig) is missing In redirect_default_route_to_vpn() the check for remote endpoint happens even though it is not used by redirect-private - make check conditional on RG_REROUTE_GW (= --redirect-gateway). Trac #261 Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20150531120327.GE382@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9761 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 1e2b229e5140b784820906feb8446e47c1ecc62e)
* Use EAI_AGAIN instead of EAI_SYSTEM for openvpn_getaddrinfo().Gert Doering2015-06-011-1/+1
| | | | | | | | | | | | Windows has no EAI_SYSTEM (introduced by 5f6c01ea6172ed), but everyone has EAI_AGAIN - which also fits ("a temporary failure in name resolution"). Trac #276 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1433178914-7842-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9768
* Use configure.ac hack to apply serial_test AM option only if supported.Gert Doering2015-06-011-1/+15
| | | | | | | | | | | | | | | | Inspired by libguestfs' configure.ac hack - test automake version, and if 1.12 or newer, use m4 magic to pass "serial_tests" option to AM_INIT_AUTOMAKE(). https://www.redhat.com/archives/libguestfs/2013-February/msg00102.html Trac #427 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <davids@redhat.com> Message-Id: <1433185487-9724-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9769 (cherry picked from commit c615835aa93701c764c23fc2579d97757c1a9970)
* On signal reception, return EAI_SYSTEM from openvpn_getaddrinfo().Gert Doering2015-06-011-1/+4
| | | | | | | | | | | | | | | | | | | A signal (except SIGUSR1) received while waiting for getaddrinfo() is considered fatal, so openvpn_getaddrinfo() is destroying the returned information with freeaddrinfo(), but still signalled "success" (0) to the caller - so if the caller accessed *res before checking *signal_received, it would access just-free()ed memory, which on some platforms still worked and on others caused a crash. Also, ensure that *ai is also NULLed in the caller now. Trac #276 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1433104918-9523-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9764 (cherry picked from commit 5f6c01ea6172ed1d8ed04e31f9f6c3f8e4696109)
* Revert "Enforce "serial-tests" behaviour for tests/Makefile"Gert Doering2015-05-281-2/+0
| | | | | | This reverts commit c196ea922755bb25f9837080d562ef4d3495999f, because it breaks "autoreconf -vif" on autoconf versions older than 1.12 - like, CentOS 6, Debian 7, ...
* Enforce "serial-tests" behaviour for tests/MakefileGert Doering2015-05-271-0/+2
| | | | | | | | | | | | | | | | | | Our "make check" testsuite creates quite a bit of output which is intended to help pinpointing the exact reason for failure - hidden by default by automake 1.12 and up, which default to "parallel-tests" which has no benefit for us. So, just set the automake option to revert to the old behaviour. See also: https://www.gnu.org/software/automake/manual/html_node/Serial-Test-Harness.html Trac #427 Signed-off-by: Gert Doering <gert@greenie.muc.de> Message-ID: <20150524193011.GK382@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9738 Acked-by: David Sommerseth <openvpn.list@topphemmelig.net> (cherry picked from commit fc03ca9d13e35c40bdf1c3c676db2adf48c60223)
* slightly enhance documentation about --cipherGert Doering2015-05-271-1/+1
| | | | | | | | | | | | point out that this is for "data channel" packets trac #463 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1432674063-15916-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9746 (cherry picked from commit 0fe2498ef9326e301869c9e8a9e622a3996ae579)
* Call daemon() before initializing crypto librarySteffan Karger2015-05-265-29/+17
| | | | | | | | | | | | | | | | | | | But keep the chdir to / at the place where deamon() was before, to preserve the current behaviour wrt relative paths in the config. This should fix the issue reported in trac #480, without changing the behaviour visible to the end user. Note that by moving the daemon() call to an earlier stage of the init process, we no longer have to call platform_mlockall() again, or do a pkcs11_forkFixup(). Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1430144937-4149-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9609 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit da9b292733e929a2900dc32d37f0424c3d588366)
* Disallow usage of --server-poll-timeout in --secret key mode.Gert Doering2015-05-243-0/+8
| | | | | | | | | | | | | | | | The internal machinery wants TLS for this to work, so just add this to the (long) list of options not allowed unless either --tls-client or --tls-server is active. For added sanity, add an ASSERT() call to the place where this combination caused a NULL ptr reference, and document the restriction. Fix trac #373 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1432472554-24666-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9736 (cherry picked from commit 6478c1f359e6b0ea2046d9e2801830753e53c06a)
* Clarify --capath option in manpageSteffan Karger2015-05-241-0/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Prevent confusion as described in trac #422 by better explaining the behaviour of --capath, and providing pointers to relevant openssl man pages. Attached are patches for the master and release/2.3 branches. The only difference is that in the master patch, a line referencing the requirement for OpenSSL 0.9.7 is removed, since master already requires OpenSSL >= 0.9.8. -Steffan >From 96e564e113cc26adf22e5d4b51d5754858610c3e Mon Sep 17 00:00:00 2001 From: Steffan Karger <steffan@karger.me> Date: Sun, 24 May 2015 11:20:11 +0200 Subject: [PATCH] Clarify --capath option in manpage Prevent confusion as described in trac #422 by better explaining the behaviour of --capath, and providing pointers to relevant openssl man pages. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <55619DC4.2020108@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9732 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Correct note about DNS randomization in openvpn.8Gert Doering2015-05-241-3/+3
| | | | | | | | | | | | Commit 4880739c17b502d00a removed DNS randomization, but this fact never made it into the man page. Trac #411 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1432414047-28674-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9726
* Fix null pointer dereference in options.cJonathan K. Bullard2015-05-231-1/+1
| | | | | | | | | Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <CAEsd45SHoEtahdVT95a+N-zmjRG4nH3QPxBZoGpnh1pykjSU4A@mail.gmail.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/9723 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 025d611fc68aa0c651c391bd6178d062246f36f0)
* assume res_init() is always there.Gert Doering2015-05-232-7/+6
| | | | | | | | | | | | | | | | | | | | | Previously, the code tried to find res_init(), and on some systems got it wrong in configure, silently not-using res_init(), leading to unexpected failures to re-init the resolver. We know that all supported OSes (except Windows) have res_init(), so change the call to "#ifndef WIN32", and adjust configure.ac to just find the library to link (if any). With that, failures to find res_init() are no longer "hidden" but clearly visible at link time. AC_SEARCH_LIBS() bits inspired by CUPS' cups_network.m4 (GPLv2) Fix (part of) trac #523 Signed-off-by: Gert Doering <gert@greenie.muc.de> Lazy-ACK-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1430162841-5840-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9614 (cherry picked from commit 403dc434d245e5df5ae262935aa2e7364547e260)
* Re-read auth-user-pass file on (re)connect if requiredSteffan Karger2015-05-234-2/+7
| | | | | | | | | | | | | | | Fixes trac #225 ('--auth-user-pass FILE' and '--auth-nocache' problem). This patch is based on the changes suggested by ye_olde_iron in the trac ticket. Also added a note to the manpage to inform people to use absolute paths when combining --auth-user-pass file and --auth-nocache. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1432386145-15045-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9717 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit ac1cb5bfbb9e09e79fd737bc57999d968d77c5ad)
* repair --dev null breakage caused by db950be85d37Gert Doering2015-05-231-10/+14
| | | | | | | | | | | | | "make check" self-test was broken after commit db950be85d37 due to do_ifconfig_setenv() not checking whether tt->did_ifconfig_setup was set (which isn't, for "dev null" type setups) Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan@karger.me> Message-Id: <1432404098-29401-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9718 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 970c4bd2e473f625699bd56db44c1970a9e10ed9)
* include ifconfig_ environment variables in --up-restart env setJan Just Keijser2015-05-234-43/+56
| | | | | | | | | | | | | | | | | | here's my patch for bug #93: missing ifconfig_* env vars after up-restart. Tested with both IPv4, IPv6, topology subnet and topology net30 Document differences between --up-restart and --up in openvpn.8 See trac #93 and the discussion starting with <555BF270.3090706@nikhef.nl> on the openvpn-devel mailing list. fix trac #93 Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <555BF270.3090706@nikhef.nl> URL: http://article.gmane.org/gmane.network.openvpn.devel/9705 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit db950be85d37eab40d8fffe0bc2060059f8a7e10)
* Updated manpage for --rport and --lportRobert Fischer2015-05-181-3/+13
| | | | | | | | | | | | [SK: v2, patch taken from trac #127 and updated to current master branch] Signed-off-by: Robert Fischer <ml-openvpn@trispace.org> Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1431976869-4948-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9701 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit d3eacb2d6ebb8a42506343c54e00c72252d683f8)
* Use OPENVPN_ETH_P_* so that <netinet/if_ether.h> is unecessaryFelix Janda2015-05-163-7/+3
| | | | | | | | | | | | | Fixes compilation error on linux with musl libc because of conflicting ethhdr declarations in <netinet/if_ether.h> and <linux/if_ether.h> which is included from <linux/if_tun.h> Signed-off-by: Felix Janda <felix.janda@posteo.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20150516134604.GA2302@euler> URL: http://article.gmane.org/gmane.network.openvpn.devel/9690 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit ddb1f20a9ddbb94956c9f7b1115c89543d9b411a)
* Improve --tls-cipher and --show-tls man page descriptionSteffan Karger2015-05-094-11/+35
| | | | | | | | | | | | | | | | | | | As reported in trac tickets #304, #358 and #359 (and possibly more), the usage and interpretation of --tls-cipher (and --show-tls) is tricky. This patch extends the man page to explain those a bit better and point out that --tls-cipher is an expert feature (i.e. easy to get wrong). Also add a notice to the --show-tls output, referring to the man page explanation. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1430840857-6123-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9651 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 5f66f907cfc57b89110c08e50c7aab228e090911) Conflicts: doc/openvpn.8 src/openvpn/ssl_polarssl.c
* Properly escape dashes on the man-pageSamuli Seppänen2015-05-091-550/+550
| | | | | | | | | | | | | | | | On UTF-8 systems groff interprets unescaped dashes as hyphens and escaped dashes as minus signs. Unescaped dashes can cause problems when searching for or copying and pasting options. This patch ensures that dashes in command-line options are escaped and that everything else is left unescaped. Trac: 512 URL: http://thread.gmane.org/gmane.network.openvpn.devel/9569 Signed-off-by: Samuli Seppänen <samuli@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1430832589-9150-1-git-send-email-samuli@openvpn.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/9648 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Add note about file permissions and --crl-verify to manpage.Gert Doering2015-05-021-0/+5
| | | | | | | | | | Trac #522 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1430593625-855-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9634 (cherry picked from commit d55be0fb8091ff03af1319a27f68401d31ce8571)
* Remove size limit for files inlined in configSteffan Karger2015-05-021-1/+10
| | | | | | | | | | | | | | | | | As described in trac #484, the current inline file size limit of 10000 bytes is becoming an issue for some users. Since RSA keys and signature sizes are increasing, we need to adjust our limits. As #484 reports, 10000 can be too small for PKCS#12 files with 4K RSA keys. Instead of postponing this issue by increasing the static limit, dynamically increase the buffer size while reading. This keeps the memory usage limited but does allow for larger inlined files. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1430122342-11742-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9607 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit e473b7c4ce41a450645e0f89579bc25b4a7f7d49)
* explain effect of --topology subnet on --ifconfigGert Doering2015-04-301-5/+18
| | | | | | | | | | | | | | The fact that the second parameter of --ifconfig is no longer a "remote address" but a "netmask" when using --dev tun and --topology subnet was not documented clearly enough. Trac #370 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1430216419-11943-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9616 (cherry picked from commit 3a840739e43acc5ea15814be08debb9dbb7ba67c)
generated by cgit (git 2.34.1) at 2024-05-10 06:42:36 +0000