summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Fixed potential NULL pointer issueDavid Sommerseth2010-10-211-1/+1
| | | | | | | | If create_temp_file() returns NULL, this strlen() check would cause a SEGV. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Gert Doering <gert@greenie.muc.de>
* Removed no longer needed delete_file() callDavid Sommerseth2010-10-211-1/+0
| | | | | | | | Fabian Knittel noticed that this delete_file() calls should have been removed in commit 5d30273a8741d2c1410bfdbc08b341398bf39b40 Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Gert Doering <gert@greenie.muc.de>
* Updated the man page to reflect the behavioural change of create_temp_file()David Sommerseth2010-10-211-1/+1
| | | | | | | | As this function now creates the temp file, it is no longer 'not-yet-created', but 'freshly created'. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Gert Doering <gert@greenie.muc.de>
* Renamed all calls to create_temp_filename()David Sommerseth2010-10-214-37/+53
| | | | | | | | | All places where create_temp_filename() was called are now calling create_temp_file(). Extra checks on the result of create_temp_file() is added in addition. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Gert Doering <gert@greenie.muc.de>
* Harden create_temp_filename() (version 2)David Sommerseth2010-10-212-16/+48
| | | | | | | | | | | | | | | | | | By hardening the create_temp_filename() function to check if the generated filename exists and to create the temp file with only S_IRUSR|S_IWUSR bit files set before calling the script, it should become even more difficult to exploit such a scenario. After a discussion on the mailing list, Fabian Knittel provided an enhanced version of the inital patch which is added to this patch. This patch also renames create_temp_filename() to create_temp_file(), as this patch also creates the temporary file. The function returns the filename of the created file, or NULL on error. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Signed-off-by: Fabian Knittel <fabian.knittel@avona.com> Acked-by: Gert Doering <gert@greenie.muc.de>
* Make use of counter_type instead of int when counting bytes and network packetsDavid Sommerseth2010-10-212-3/+4
| | | | | | | | This is in response to a reported Debian bug, where the connection counter overflows. <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=576827> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Gert Doering <gert@greenie.muc.de>
* The man page needs dash escaping in UTF-8 environmentsJan Brinkmann2010-10-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | There was a debian bugreport which was filed in 2005 . It was patched but it seems that nobody forwarded the patch to the openvpn project itself. The problem is quite simple: The dashes for options (the double dashes) are not escaped. This causes trouble in relationship with utf-8 . Since the bugreport was closed it was patched within the debian/ubuntu packages itself. I've attached the patch to get it atleast reviewed by the openvpn project itself. See <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=296133> for details. sf.net tracker: <https://sourceforge.net/tracker/?func=detail&aid=2935611&group_id=48978&atid=454721> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Tested-by: Jan Just Keijser <janjust@nikhef.nl> Tested-by: Pavel Shramov <shramov@mexmat.net> Tested-by: Samuli Seppänen <samuli@openvpn.net>
* When I began testing OpenVPN v2.1_rc9 I was having trouble authenticating to ↵Daniel Johnson2010-10-211-7/+35
| | | | | | | | | | | | | | the MS Active Directory through auth-pam and Samba. I used the following line in my configs (without the linebreak of course): plugin /opt/openvpn/openvpn-auth-pam.so "openvpn login OURDOMAIN+USERNAME password PASSWORD" Finally I turned on more verbose logging and found that the plugin did not recognize "USERNAME" as something to replace, because it expected the string to be surrounded by whitespace. I wrote the following patch to correct this. I hope you find it useful, Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* Debian patch: Fix spelling in log messageAlberto Gonzalez Iniesta2010-10-211-1/+1
| | | | | Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: David Sommerseth <dazo@users.sourceforge.net>
* Fix autotools cross-compiling supportDavid Sommerseth2010-10-212-22/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | This is a modified version of a patch sent to the sf.net patch tracker: <http://sourceforge.net/tracker/?func=detail&aid=2491190&group_id=48978&atid=454721> After having disucssed this patch on IRC (#openvpn-discussions) March 4, 2010, it was decided to accept this patch when not modifying TARGET_* defines through out the code. Further, in a mail comment Alon Bar-Lev had some other comments of what would be needed to be done. Mail reference: <http://thread.gmane.org/gmane.network.openvpn.devel/3176> This patch has been tested by bootstrapping the code on a RHEL4.6 box. with the following autotools packages installed: autoconf-2.59-5 automake-1.9.2-3 libtool-1.5.6-4.EL4.2 It builds cleanly and 'make check' passes. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: James Yonan <james@openvpn.net> Acked-by: Alon Bar-Lev <alon.barlev@gmail.com>
* On TARGET_LINUX define _GNU_SOURCE if not definedDavid Sommerseth2010-10-211-0/+4
| | | | | | | | | | | | This is to include peercred support on hosts where _GNU_SOURCE is not defined by default. This issue has been found on Gentoo with glibc-2.8. The solution was discussed on the IRC meeting March 4, 2010 in #openvpn-discussions. <http://thread.gmane.org/gmane.network.openvpn.devel/3242> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: James Yonan <james@openvpn.net>
* The man page needs dash escaping in UTF-8 environmentsJan Brinkmann2010-10-211-807/+807
| | | | | | | | | | | | | | | | | | | | | | | There was a debian bugreport which was filed in 2005 . It was patched but it seems that nobody forwarded the patch to the openvpn project itself. The problem is quite simple: The dashes for options (the double dashes) are not escaped. This causes trouble in relationship with utf-8 . Since the bugreport was closed it was patched within the debian/ubuntu packages itself. I've attached the patch to get it atleast reviewed by the openvpn project itself. See <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=296133> for details. sf.net tracker: <https://sourceforge.net/tracker/?func=detail&aid=2935611&group_id=48978&atid=454721> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Tested-by: Jan Just Keijser <janjust@nikhef.nl> Tested-by: Pavel Shramov <shramov@mexmat.net> Tested-by: Samuli Seppänen <samuli@openvpn.net>
* bash->bourne script cleanupDan Nelson2010-10-2117-17/+17
| | | | | | | | | | | | | | | | | | Many of the scripts in the openvpn source have their shell set to /bin/bash, but only two use bash features. The attached patch (against openvpn-2.1_rc9) sets the shell on the rest of the scripts to /bin/sh for better portability. The only scripts that actually require bash are contrib/pull-resolv-conf/client.{up,down} ; they use the ${!var} variable indirection feature. sf.net tracker: <https://sourceforge.net/tracker/?func=detail&aid=2040296&group_id=48978&atid=454721> Discussed on the IRC meeting March 4, 2010 in #openvpn-discussions. <http://thread.gmane.org/gmane.network.openvpn.devel/3242> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: James Yonan <james@openvpn.net>
* Allow 'lport 0' setup for random port bindingEnrico Scholz2010-10-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I am running a multihomed host where 'local <extip>' must be specified for proper operation. Unfortunately, this implies 'lport 1194' or another static port. This causes problems with stateful firewalls which register the host/port pairs in the internal connection tracking table. On ungraceful reconnects, the new TCP connection will have same the host/port pairs but unexpected sequence numbers. The new connection will be assumed as invalid hence and be dropped. It would be nice when local port can be configured to be bound to a random port number. After reading code, | else if (streq (p[0], "lport") && p[1]) | ... | port = atoi (p[1]); |- if (!legal_ipv4_port (port)) |+ if (port != 0 && !legal_ipv4_port (port)) | { in options.c seems to be the only required change. This has been discussed here: <http://thread.gmane.org/gmane.network.openvpn.user/28622> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Gert Doering <gert@greenie.muc.de>
* remove duplicate code in FREEBSD+DRAGONFLY system-dependent ifconfigGert Doering2010-10-211-14/+3
| | | | | | | | | (ACKed by Eric F Crist and David Sommerseth) (cherry picked from commit dd66b12647852e3f1267be70b0fb3b11deedf377) Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Signed-off-by: Gert Doering <gert@greenie.muc.de>
* verb 5 logging wrongly reports received bytesDavid Sommerseth2010-10-211-2/+2
| | | | | | | | | | | | | | | | | | | | | | With --verb 5, openvpn logs a single letter (rwRW) for each package received or sent. I recently ran into a problem with the tun device on Linux where the read from that device returned 0. Unfortunately this was also logged as "r", which made me assume that openvpn had received something, while it actually hadn't. (See https://dev.openwrt.org/ticket/6650 for the bug that made me find out about this problem with openvpn.) I'm attaching a patch which prevents openvpn from logging "r" or "R" when it didn't actually read anything. This is against openvpn 2.1-rc20, but probably still applies to the most recent version. This patch was received anonymously via the sf.net bug tracker: <http://sourceforge.net/tracker/?func=detail&atid=454719&aid=2951003&group_id=48978> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Gert Doering <gert@greenie.muc.de>
* [PATCH] Change verify-cn so cn is no longer hardcoded in openvpn's config fileKarl O. Pinc2010-10-211-15/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch should be easy to process. A resubmission of the patch sent to this list on 04/23/2009. The patch changes the verify-cn script sample to be used with --tls-verify so that instead of having to hardcode a cn to verify in the OpenVPN configuration file the allowed cns may be written into a separate file. This makes the process of verifying cns a whole lot more dynamic, to the point where it is useful in the real world. One problem with this patch is that it is backwards incompatible. I did not bother keeping the original calling interface as A) it's a sample script, and B) the original's functionality seems useless and equalivant functionality is easily available with the new script. The problem with the original is that there seems little point in verifying a client's cn when all the clients share one cn, as would have to be the case when the cn is hardcoded into the openvpn config file. This patch applies against the testing allmiscs branch, and should apply against any of the other testing branches as well. It works for me. I've tested it throughly but not used it extensively in production. Regards, Karl <kop@meme.com> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Gert Doering <gert@greenie.muc.de> Acked-by: Eric F Crist <ecrist@secure-computing.net>
* Added mapping files from SVN commit ID to more descriptive commit IDs.David Sommerseth2010-10-212-0/+2
| | | | | | | | Unfortunately, this will not rewrite the commit history. So all commits done by james@e7ae566f-a301-0410-adde-c780ea21d3b5 is James Yonans commits. It was considered to risky to use git tools to rewrite the commit history, as it could influence those already using this git tree.
* Added --proto-force directive.James Yonan2010-09-015-2/+35
| | | | | | | Version 2.1.3a git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6424 e7ae566f-a301-0410-adde-c780ea21d3b5
* Don't configure Linux tun/tap txqueuelen setting if OpenVPNJames Yonan2010-08-311-1/+1
| | | | | | | txqueuelen directive is set to 0. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6420 e7ae566f-a301-0410-adde-c780ea21d3b5
* Allow PKCS12 file content to be included inline in configuration file,James Yonan2010-08-293-10/+39
| | | | | | | rendered as base64. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6412 e7ae566f-a301-0410-adde-c780ea21d3b5
* Attempt to fix issue where domake-win build system was not properlyv2.1.3James Yonan2010-08-2011-203/+191
| | | | | | | | | | | | | signing drivers and .exe files. Added win/tap_span.py for building multiple versions of the TAP driver and tapinstall binaries using different DDK versions to span from Win2K to Win7 and beyond. Version 2.1.3 git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6404 e7ae566f-a301-0410-adde-c780ea21d3b5
* Windows security issue:v2.1.2James Yonan2010-08-154-3/+116
| | | | | | | | | | | | | | | | | | | Fixed potential local privilege escalation vulnerability in Windows service. The Windows service did not properly quote the executable filename passed to CreateService. A local attacker with write access to the root directory C:\ could create an executable that would be run with the same privilege level as the OpenVPN Windows service. However, since non-Administrative users normally lack write permission on C:\, this vulnerability is generally not exploitable except on older versions of Windows (such as Win2K) where the default permissions on C:\ would allow any user to create files there. Credit: Scott Laurie, MWR InfoSecurity Version 2.1.2 git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6400 e7ae566f-a301-0410-adde-c780ea21d3b5
* Added warning about tls-remote in man page.James Yonan2010-08-101-0/+7
| | | | git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6384 e7ae566f-a301-0410-adde-c780ea21d3b5
* Distribute win directory (Python/MSVC-based build system)James Yonan2010-08-091-1/+2
| | | | | | | in "make dist" tarball. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6382 e7ae566f-a301-0410-adde-c780ea21d3b5
* Added "net stop dnscache" and "net start dnscache" in frontJames Yonan2010-07-276-8/+34
| | | | | | | of existing --register-dns commands. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6352 e7ae566f-a301-0410-adde-c780ea21d3b5
* Fixed an issue where application payload transmissions on theJames Yonan2010-07-276-12/+54
| | | | | | | | | | TLS control channel (such as AUTH_FAILED) that occur during or immediately after a TLS renegotiation might be dropped. Version 2.1.1n git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6350 e7ae566f-a301-0410-adde-c780ea21d3b5
* Fixed typo: missing comment close.James Yonan2010-07-261-1/+1
| | | | git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6347 e7ae566f-a301-0410-adde-c780ea21d3b5
* Added win/build_exe.py script, which is similar toJames Yonan2010-07-162-21/+38
| | | | | | | | win/build_all.py except that it doesn't build the TAP drivers or tapinstall. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6306 e7ae566f-a301-0410-adde-c780ea21d3b5
* Added --register-dns option for Windows.James Yonan2010-07-169-11/+79
| | | | | | | | | | Fixed some issues on Windows with --log, subprocess creation for command execution, and stdout/stderr redirection. Version 2.1.1m. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6304 e7ae566f-a301-0410-adde-c780ea21d3b5
* Implemented multi-address DNS expansion on the network field of routeJames Yonan2010-07-124-16/+85
| | | | | | | | | | | | commands. When only a single IP address is desired from a multi-address DNS expansion, use the first address rather than a random selection. Version 2.1.1l git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6291 e7ae566f-a301-0410-adde-c780ea21d3b5
* Version 2.1.1kJames Yonan2010-07-101-1/+1
| | | | git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6285 e7ae566f-a301-0410-adde-c780ea21d3b5
* Fixed bug in proxy fallback capability where openvpn.exe couldJames Yonan2010-07-102-18/+22
| | | | | | | | core dump if http-proxy-fallback-disable command was issued in response to ">PROXY:NEED_NOW management" interface notification. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6284 e7ae566f-a301-0410-adde-c780ea21d3b5
* Added support for MSVC debugging of openvpn.exe in settings.in:James Yonan2010-07-103-7/+16
| | | | | | | | # Build debugging version of openvpn.exe !define PRODUCT_OPENVPN_DEBUG git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6283 e7ae566f-a301-0410-adde-c780ea21d3b5
* Fixed issue where bad creds provided by the management interfaceJames Yonan2010-06-102-3/+6
| | | | | | | | | for HTTP Proxy Basic Authentication would go into an infinite retry-fail loop instead of requerying the management interface for new creds. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@5701 e7ae566f-a301-0410-adde-c780ea21d3b5
* Implemented a key/value auth channel from client to server.James Yonan2010-06-0114-9/+248
| | | | | | | Version 2.1.1i git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@5668 e7ae566f-a301-0410-adde-c780ea21d3b5
* Implemented http-proxy-override and http-proxy-fallback directives to make itJames Yonan2010-05-2414-72/+565
| | | | | | | | | easier for OpenVPN client UIs to start a pre-existing client config file with proxy options, or to adaptively fall back to a proxy connection if a direct connection fails. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@5652 e7ae566f-a301-0410-adde-c780ea21d3b5
* Minor fixes to recent HTTP proxy changes:James Yonan2010-05-113-5/+5
| | | | | | | | | | * use strcasecmp instead of stricmp * define HASH and HASHHEX as unsigned char to avoid compiler warnings git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@5629 e7ae566f-a301-0410-adde-c780ea21d3b5
* Proxy improvements:James Yonan2010-05-1110-101/+676
| | | | | | | | | | | | | | Improved the ability of http-auth "auto" flag to dynamically detect the auth method required by the proxy. Added http-auth "auto-nct" flag to reject weak proxy auth methods. Added HTTP proxy digest authentication method. Removed extraneous openvpn_sleep calls from proxy.c. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@5628 e7ae566f-a301-0410-adde-c780ea21d3b5
* Fixed issue on Windows with MSVC compiler, where TCP_NODELAY supportJames Yonan2010-05-091-1/+1
| | | | | | | was not being compiled in. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@5620 e7ae566f-a301-0410-adde-c780ea21d3b5
* Updated copyright date to 2010.James Yonan2010-04-28157-160/+160
| | | | git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@5599 e7ae566f-a301-0410-adde-c780ea21d3b5
* Added Python-based build system for Windows inJames Yonan2010-04-2224-26/+609
| | | | | | | | | | | | | win directory. Fixed minor issue in TAP driver DEBUG builds where non-null-terminated unicode strings were being printed incorrectly. Version 2.1.1g git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@5577 e7ae566f-a301-0410-adde-c780ea21d3b5
* Minor change to doclean script:James Yonan2010-04-171-1/+0
| | | | | | | | Don't delete config-win32.h, because this is now a true source file and no longer a generated file. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@5558 e7ae566f-a301-0410-adde-c780ea21d3b5
* Management interface performance optimizations:James Yonan2010-04-166-12/+161
| | | | | | | | | | | | | * Added env-filter MI command to perform filtering on env vars passed through as a part of --management-client-auth * man_write will now try to aggregate output into larger blocks (up to 1024 bytes) for more efficient i/o Version 2.1.1f git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@5557 e7ae566f-a301-0410-adde-c780ea21d3b5
* Updated MSVC build scripts to Visual Studio 2008:James Yonan2010-03-3117-530/+491
| | | | | | | | | | python msvc\config.py nmake /f msvc\msvc.mak Version 2.1.1e git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@5516 e7ae566f-a301-0410-adde-c780ea21d3b5
* Set socket buffers (SO_SNDBUF and SO_RCVBUF) immediately afterJames Yonan2010-03-302-4/+5
| | | | | | | | | socket is created rather than waiting until after connect/listen. Version 2.1.1d git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@5514 e7ae566f-a301-0410-adde-c780ea21d3b5
* Version 2.1.1cJames Yonan2010-03-172-2/+2
| | | | | | | | Enable exponential backoff in reliability layer retransmits. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@5490 e7ae566f-a301-0410-adde-c780ea21d3b5
* Modified ">PASSWORD:Verification Failed" management interfaceJames Yonan2010-03-124-6/+9
| | | | | | | | | notification to include a client reason string: >PASSWORD:Verification Failed: 'AUTH_TYPE' ['REASON_STRING'] git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@5468 e7ae566f-a301-0410-adde-c780ea21d3b5
* Added stub directive "remote-ip-hint".James Yonan2010-03-121-0/+5
| | | | git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@5467 e7ae566f-a301-0410-adde-c780ea21d3b5
* Trivial fix to proxy.c -- #define proxy auth type as UP_TYPE_PROXY.James Yonan2010-03-121-1/+3
| | | | git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@5466 e7ae566f-a301-0410-adde-c780ea21d3b5
generated by cgit (git 2.34.1) at 2024-10-03 13:16:44 +0000