summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Add comile time information/settings from ./configure to --versionDavid Sommerseth2010-10-214-0/+85
| | | | | | | | | | | This patch will create ./configure.h which will contain two new #define strings. CONFIGURE_DEFINES will contain all USE, ENABLED, DISABLED and DEPRECATED defines from ./config.h. CONFIGURE_CALL will contain the complete ./configure line which was used when configuring the package for building. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: James Yonan <james@openvpn.net>
* pkitool lacks expected option "--help"Wil Cooley2010-10-211-0/+6
| | | | | | | | | | | | | The pkitool script lacks the "--help" parameter to actually display the usage statement; most people are conditioned to try that before running the command without options. This patch adds that and "--version" to display just the program name and version. sf.net tracker: <https://sourceforge.net/tracker/?func=detail&atid=454721&aid=1705407&group_id=48978> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Jan Just Keijser <janjust@nikhef.nl>
* Several updates to openvpn.8 (man page updates)Karl O. Pinc2010-10-211-9/+13
| | | | | | | | | | | This is a collection of 4 patches sent to the -devel mailing list: * [PATCH] Frob the openvpn(8) man page tls-verify section to clarify * [PATCH] More improvments to openvpn(8) --tls-verify * [PATCH] Yet another tweak of openvpn(8) --tls-verify * [PATCH] Final frobbing of openvpn(8) --tls-verify Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: David Sommerseth <dazo@users.sourceforge.net>
* enhance tls-verify possibilityMathieu GIANNECCHINI2010-10-216-0/+87
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It should be nice to enhance tls-verify check possibilities against peer cert during a pending TLS connection like : - OCSP verification - check any X509 extensions of the peer certificate - delta CRL verification - ... This patch add a new "tls-export-cert" option which allow to get peer certificate in PEM format and to store it in an openvpn temporary file. Peer certificate is stored before tls-script execution and deleted after. The name of the related temporary file is available under tls-verify script by an environment variable "peer_cert". The patch was made from OpenVPN svn Beta21 branches. Here is a very simple exemple of Tls-verify script which provide OCSP support to OpenVPN (with tls-export-cert option) without any OpenVPN "core" modification : X509=$2 openssl ocsp \ -issuer /etc/openvpn/ssl.crt/RootCA.pem \ -CAfile /etc/openvpn/ssl.capath/OpenVPNServeur-cafile.pem \ -cert $peer_cert \ -url http://your-ocsp-url if [ $? -ne 0 ] then echo "error : OCSP check failed for ${X509}" | logger -t "tls-verify" exit 1 fi This has been discussed here: <http://thread.gmane.org/gmane.network.openvpn.devel/2492> <http://thread.gmane.org/gmane.network.openvpn.devel/3150> <http://thread.gmane.org/gmane.network.openvpn.devel/3217> This patch has been modified by David Sommerseth, by fixing a few issues which came up to during the code review process. The man page has been updated and tmp_file in ssl.c is checked for not being NULL before calling delete_file(). Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Gert Doering <gert@greenie.muc.de>
* Reworked the eurephia patch for inclusion to the openvpn-testing treeDavid Sommerseth2010-10-213-0/+29
| | | | | | | | | | | Addedd configure option (--disable-eurephia) to disable the code which the eurephia plug-in depends on. It was chosen to use --disable-eurephia, as this patch is not much intrusive. It just enables a SHA1 fingerprint environment variable for each certificate being used for the connection. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* Fix problem with special case route targets ('remote_host')Gert Doering2010-10-211-0/+2
| | | | | | | | | | | | | | | | | | The init_route() function will leave &netlist untouched for get_special_addr() routes ("remote_host" being one of them). netlist is on stack, contains random garbage, and netlist.len will not be 0 - thus, random stack data is copied from netlist.data[] until the route_list is full. This issue has been reported several places lately: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=600166 http://thread.gmane.org/gmane.network.openvpn.devel/4083 https://forums.openvpn.net/viewtopic.php?f=1&t=7201&p=8168 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: James Yonan <james@openvpn.net> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* Fixed compiler warnings reported on Ubuntu 10.04David Sommerseth2010-10-214-10/+11
| | | | | | | | | | | | | | | | | | The warnings reported where: -------------------------------------------------------- misc.c:158: warning: ignoring return value of ‘nice’, declared with attribute warn_unused_result options.c:4033: warning: format not a string literal and no format arguments options.c:4043: warning: format not a string literal and no format arguments options.c:4053: warning: format not a string literal and no format arguments push.c:182: warning: format not a string literal and no format arguments push.c:199: warning: format not a string literal and no format arguments push.c:235: warning: format not a string literal and no format arguments status.c:171: warning: ignoring return value of ‘ftruncate’, declared with attribute warn_unused_result -------------------------------------------------------- Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Gert Doering <gert@greenie.muc.de> Acked-by: Peter Stuge <peter@stuge.se>
* More t_client.sh updates - exit with SKIP when we want to skipDavid Sommerseth2010-10-211-3/+3
| | | | | | | | Several places we exited with 0 instead of 77 when we want to indicate that we should skip this test. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Gert Doering <gert@greenie.muc.de>
* Test framework improvment - Do not FAIL if t_client.rc is missingDavid Sommerseth2010-10-211-10/+10
| | | | | | | | This is to avoid 'make check' fail if this extra test case is not configured. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Gert Doering <gert@greenie.muc.de>
* Build t_client.sh by configure at run-time.Gert Doering2010-10-212-14/+22
| | | | | | | | | | | This is now built using "configure", knows how to find "ip", "ifconfig" and "netstat" (configure does the work :-) ), *and* has been tested on Solaris (works!). extend configure.ac to find "netstat" binary and to chmod +x "t_client.sh" Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <dazo@users.sourceforge.net> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* full "VPN client connect" test framework for OpenVPNGert Doering2010-10-213-1/+382
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Run from "make check" if "t_client.rc" is found in workdir or srcdir (copy t_client.rc-sample, fill in specifics for your test server) How does it work? - you run "sudo make check" (needs root access to configure tun if!) - t_client.sh reads t_client.rc from current dir or ${srcdir} - t_client.rc defines a number of "test suffixes" to run (could be "1" "2" "3" or "p2m", "p2p", "special" or whatever you like), and for each suffix, there's config variables to specify - how to call OpenVPN - which hosts to ping for IPv4 and IPv6 when OpenVPN is up (and actually before starting OpenVPN - to make the test more meaningful, I have decided that the test hosts must not ping before the tests starts) - which addresses must show up in the output of "ifconfig" after OpenVPN has started - all variables except OPENVPN_CONF_<x> are optional (this should all be fairly obvious from looking at t_client.rc-sample) - the script wants to connect to a well-defined OpenVPN server that will assign well-known IPv4 (and IPv6) addresses, have well-defined pingable addresse, etc. - so you need to setup the test server before the script is useful for you. (Whether you use certificates or username/password is up to you, you could even mix and match - run one test with certs, and one with user/pass against different target ports... :-) ) [we *could* run a "reference server" somewhere and ship a sample t_client.rc + cert so that users could use this right away, but I do not currently have the resources to run such a public server] - whatever the script does is logged to a newly created directory below the current directory (openvpn output, ifconfig+route before starting OpenVPN, while running it, after ending it) - important: at least on NetBSD and OpenBSD, the script will print one failure, because the tun0 interface created is not destroyed after openvpn ends. For OpenBSD, I have changed close_tun() to do so ("ifconfig tun0 destroy"), for NetBSD I have not yet changed anything - but I strongly believe that the output of "ifconfig+route" should be reverted to exactly how it looked like before OpenVPN was started, so I consider this a bug in the NetBSD-specific bits of OpenVPN (and will look into this). - the test framework has been tested on Linux, NetBSD and OpenBSD. It *should* work fine on FreeBSD and Solaris. It works on MacOS X (but the output looks funny, because /bin/sh does not implement "echo -e" - need to add configure trickery) It will *not* work on Windows yet - I haven't looked into what's needed to make it work (background processes and signals in mingw bash?), maybe it's as easy as adding the necessary "ipconfig" and "netsh" commands to print interface + routing config... - I have only tested "connect via IPv4 transport, use IPv4+IPv6 payload", but the framework is generic enough that "connect via IPv6 transport" should work just fine (just setup OPENVPN_CONF_x accordingly in the t_client.rc). - this is neither finished nor pretty, but it helps me a *lot* in quickly testing whether I broke anything when fiddling system-dependent code (tun.c, route.c) across multiple build hosts - so I hope this is going to be fairly useful to Samuli and the buildbot :-) Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <dazo@users.sourceforge.net> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* Fixes openssl-1.0.0 compilation warningchantra2010-10-211-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | When compiling against OpenSSL v1.0.0, the following compiler warnings appears. ssl.c: In function ‘verify_callback’: ssl.c:944: warning: passing argument 1 of ‘sk_num’ from incompatible pointer type /usr/include/openssl/stack.h:79: note: expected ‘const struct _STACK *’ but argument is of type ‘struct stack_st_X509_REVOKED *’ ssl.c:947: warning: passing argument 1 of ‘sk_value’ from incompatible pointer type /usr/include/openssl/stack.h:80: note: expected ‘const struct _STACK *’ but argument is of type ‘struct stack_st_X509_REVOKED *’ ssl.c: In function ‘init_ssl’: ssl.c:1565: warning: passing argument 1 of ‘sk_num’ from incompatible pointer type /usr/include/openssl/stack.h:79: note: expected ‘const struct _STACK *’ but argument is of type ‘struct stack_st_X509 *’ ssl.c: In function ‘print_details’: ssl.c:1766: warning: assignment discards qualifiers from pointer target type Trac ticket #5 https://community.openvpn.net/openvpn/ticket/5 Signed-off-by: chantra <chantra@debuntu.org> Acked-by: David Sommerseth <dazo@users.sourceforge.net> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* Fix <net/if.h> compile time problems on OpenBSD for goodGert Doering2010-10-211-4/+4
| | | | | | | | | Previous fix (commit eb973e055bc249948) fixed NetBSD but not OpenBSD (include <sys/socket.h> *after* <sys/types.h>) Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: krzee <jeff@doeshosting.com> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* Fix compile problems on NetBSD and OpenBSDGert Doering2010-10-211-0/+3
| | | | | | | | | Configure will not find <net/if.h> due to missing <sys/types.h> in the test program, and thus, tun.c will fail to compile with missing symbol IFF_MULTICAST. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: krzee <jeff@doeshosting.com> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* Fix multiple configured scripts conflicts issue (version 2)David Sommerseth2010-10-211-0/+18
| | | | | | | | | | | | | | This is a fix for trac ticket #20, <https://community.openvpn.net/openvpn/ticket/20> which was started in the sf.net bug tracker: <http://sourceforge.net/tracker/?func=detail&aid=2078470&group_id=48978&atid=454719> The implemented solution is to give a warning for each of the different script hooks available. The last configured script will override any earlier configured scripts, to ensure that the command line can override the configuration file. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: James Yonan <james@openvpn.net>
* Exclude ping and control packets from activityDavide Brini2010-10-213-7/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Problem: using --ping and --inactive together partially defeats the point of using --inactive as periodic ping packets are counted as activity. Here is the original discussion: http://article.gmane.org/gmane.network.openvpn.devel/3676 It turns out that "activity" is detected and recorded in two places in the code, both in forward.c: in process_outgoing_tun() for received packets, after they've been decrypted and sent to the TUN device; and in process_outgoing_link(), after they've been encrypted and written to the network socket. In the first case we can be sure that packets that get so far are really due to user activity, whereas in the second case there can be non-user packets (like OpenVPN's internal ping packets, and TLS control packets), and those should not be counted as activity as they are not coming from the user. So a need arises to detect those control packets and not count them as activity for the purposes of --inactive. Unfortunately, at that stage packets are already compressed and encrypted, so it's not possible to look into them to see what they are. However, there seems to be a convention in the code that packets whose buffer length in the context_2 structure is 0 should be ignored for certain purposes. TLS control packets follow that convention already, so this patch makes a small change in the code that generates the ping packets to set their buffer length to 0 as well. Finally, the call to register_activity() in process_outgoing_link() is made conditional to the buffer length being > 0. According to my tests, now --inactive behaves correctly according to the configured parameters (time or time+bytes) even when --ping is being used. forward.c: Call register_activity() in process_outgoing_link() only if the packet is not a ping or TLS control packet. openvpn.8: Updated the description of --inactive to describe the new semantics. ping.c: Set c->c2.buf.len = 0 after the ping packet has been generated and encrypted. Test routine is described here: <https://community.openvpn.net/openvpn/wiki/PingInactivePatch?version=6> Signed-off-by: Davide Brini <dave_br@gmx.com> Acked-by: David Sommerseth <dazo@users.sourceforge.net> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* Fix errors in openvpn-plugin.h documentationchantra2010-10-211-1/+2
| | | | | | | | Just minor updates to comments in openvpn-plugin.h Signed-off-by: chantra <chantra@debuntu.org> Acked-by: David Sommerseth <dazo@users.sourceforge.net> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* Fixed client hang when server don't PUSH (aka the NO_SOUP_FOR_YOU patch)David Sommerseth2010-10-211-0/+17
| | | | | | | | | | | | | | | | Solves bug ticket 13 <https://community.openvpn.net/openvpn/ticket/13> When the client sends PUSH_REQUESTS, it waits until the server sends PUSH_REPLY. If the server do not have anything to push to the client nothing happens. The client will then regularly send new PUSH_REQUESTS until it gets an answer, which results in not completing the connection negotiation. This patch makes the server send an empty PUSH_REPLY when it has nothing to more to push to the client. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: James Yonan <james@openvpn.net>
* Handle non standard subnets in PF grammarchantra2010-10-211-0/+5
| | | | | | | | | | Allow subnets for like 192.168.100.8/28 to be understood. A warning will be logged when subnet is incorrect and is being corrected to what is assumed to be correct. Signed-off-by: chantra <chantra@debuntu.org> Acked-by: Gert Doering <gert@greenie.muc.de> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* OCSP_check.sh: new check logicDavid Sommerseth2010-10-211-10/+32
| | | | | | | | | | | | | | | | | | | | | contrib/OCSP_check/OCSP_check.sh: I discovered that, quite surprisingly, the exit status of "openssl ocsp" is 0 even if the certificate status is "revoked". This means that the logic of the script needs to be rewritten so that it parses the output returned by the query and explicitly looks for a "0x<serial number>: good" line, and exit if either the command has a non-zero exit status, or the above line is not found. Doing that portably without bashisms requires some juggling around, so perhaps the code is slightly less clean now, but it does have many comments. Signed-off-by: Davide Brini <dave_br@gmx.com> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: David Sommerseth <dazo@users.sourceforge.net>
* Avoid repetition of "this config may cache passwords in memory" (v2)David Sommerseth2010-10-211-1/+3
| | | | | | | | | | | For OpenVPN clients with long living connections, this message is repeated everytime the connection is renegotiated. This patch removes this behaviour and will only show this warning once. Patch ACKed on the developers meeting 2009-04-29. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: James Yonan <james@openvpn.net>
* Fix certificate serial number exportDavide Brini2010-10-213-4/+119
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | contrib/OCSP_check/OCSP_check.sh: New barebone script to demonstrate how to use $tls_serial_{n} to perform simple OCSP queries using OpenSSL command line "openssl ocsp". Minimal sanity checks to fail if user tries to use it without customizing. openvpn.8: Added some notes about $tls_serial_{n} format and usage to the existing description. ssl.c: correctly manage and export serial numbers of any size (as parsed by OpenSSL) into the environment. Set to empty string in case of errors, as 0 and negative numbers are all possible (although illegal) certificate serial numbers. Use an OpenSSL BIO object to do the job. Conforms to coding style guidelines. See the discussion at http://article.gmane.org/gmane.network.openvpn.devel/3588 for more details. Signed-off-by: Davide Brini <dave_br@gmx.com> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: David Sommerseth <dazo@users.sourceforge.net>
* Fix missing /bin/bash -> /bin/shDavide Brini2010-10-211-1/+1
| | | | | | | | | | In commit a9c9a89e96dc1e4e843e05ecadc4349b81606b06 the client.{up,down} scripts where overhauled and bashism was removed. During that process, a #! change was missing. Signed-off-by: Davide Brini <dave_br@gmx.com> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: David Sommerseth <dazo@users.sourceforge.net>
* Enhance contrib/pull-resolv-conf/client.{up,down} scriptsDavide Brini2010-10-212-69/+64
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Patch arrived from Davide Brini: - No more bashisms (AFAICT). Should work with any POSIX-compatible shell (which means "almost all reasonably recent shells"), though I've only tested with bash and dash. - Unnecessary calls to external tools (sed) removed - Manages multiple DNS and DOMAIN options. Each DNS option becomes a "nameserver" line in the new resolv.conf (up to a maximum of 3). If there's a single DOMAIN option, it becomes a "domain" line in resolv.conf; otherwise, all the domains are listed in a "search" line in resolv.conf (eg "search foo.com example.net"). - Client.up renames the existing resolv.conf and creates a brand new one; client.down restores it from the saved copy when the VPN terminates (the usual rules about running as root apply). This is how Gentoo does that; the old scripts instead added/removed some lines at the beginning of the file, which looks a less clean approach to me. The rename approach also dramatically simplifies and shortens client.down, as you'll see. - Uses resolvconf if it's available (detected by the presence of /sbin/resolvconf) rather than writing to resolv.conf directly. Not sure whether this is a Linux-only thing or other systems use it though. Script has been smoke tested on Fedora 12 with OpenVPN 2.1.1 without the resolvconf package , and in addition Debian Lenny with OpenVPN 2.1_rc11 according to the patch. Signed-off-by: Davide Brini <dave_br@gmx.com> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: David Sommerseth <dazo@users.sourceforge.net>
* The man page does not mention that the default value of "mssfix" is 1450.Davide Brini2010-10-211-1/+2
| | | | | | Signed-off-by: Davide Brini <dave_br@gmx.com> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: David Sommerseth <dazo@users.sourceforge.net>
* Fixed potential NULL pointer issueDavid Sommerseth2010-10-211-1/+1
| | | | | | | | If create_temp_file() returns NULL, this strlen() check would cause a SEGV. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Gert Doering <gert@greenie.muc.de>
* Removed no longer needed delete_file() callDavid Sommerseth2010-10-211-1/+0
| | | | | | | | Fabian Knittel noticed that this delete_file() calls should have been removed in commit 5d30273a8741d2c1410bfdbc08b341398bf39b40 Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Gert Doering <gert@greenie.muc.de>
* Updated the man page to reflect the behavioural change of create_temp_file()David Sommerseth2010-10-211-1/+1
| | | | | | | | As this function now creates the temp file, it is no longer 'not-yet-created', but 'freshly created'. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Gert Doering <gert@greenie.muc.de>
* Renamed all calls to create_temp_filename()David Sommerseth2010-10-214-37/+53
| | | | | | | | | All places where create_temp_filename() was called are now calling create_temp_file(). Extra checks on the result of create_temp_file() is added in addition. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Gert Doering <gert@greenie.muc.de>
* Harden create_temp_filename() (version 2)David Sommerseth2010-10-212-16/+48
| | | | | | | | | | | | | | | | | | By hardening the create_temp_filename() function to check if the generated filename exists and to create the temp file with only S_IRUSR|S_IWUSR bit files set before calling the script, it should become even more difficult to exploit such a scenario. After a discussion on the mailing list, Fabian Knittel provided an enhanced version of the inital patch which is added to this patch. This patch also renames create_temp_filename() to create_temp_file(), as this patch also creates the temporary file. The function returns the filename of the created file, or NULL on error. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Signed-off-by: Fabian Knittel <fabian.knittel@avona.com> Acked-by: Gert Doering <gert@greenie.muc.de>
* Make use of counter_type instead of int when counting bytes and network packetsDavid Sommerseth2010-10-212-3/+4
| | | | | | | | This is in response to a reported Debian bug, where the connection counter overflows. <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=576827> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Gert Doering <gert@greenie.muc.de>
* The man page needs dash escaping in UTF-8 environmentsJan Brinkmann2010-10-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | There was a debian bugreport which was filed in 2005 . It was patched but it seems that nobody forwarded the patch to the openvpn project itself. The problem is quite simple: The dashes for options (the double dashes) are not escaped. This causes trouble in relationship with utf-8 . Since the bugreport was closed it was patched within the debian/ubuntu packages itself. I've attached the patch to get it atleast reviewed by the openvpn project itself. See <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=296133> for details. sf.net tracker: <https://sourceforge.net/tracker/?func=detail&aid=2935611&group_id=48978&atid=454721> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Tested-by: Jan Just Keijser <janjust@nikhef.nl> Tested-by: Pavel Shramov <shramov@mexmat.net> Tested-by: Samuli Seppänen <samuli@openvpn.net>
* When I began testing OpenVPN v2.1_rc9 I was having trouble authenticating to ↵Daniel Johnson2010-10-211-7/+35
| | | | | | | | | | | | | | the MS Active Directory through auth-pam and Samba. I used the following line in my configs (without the linebreak of course): plugin /opt/openvpn/openvpn-auth-pam.so "openvpn login OURDOMAIN+USERNAME password PASSWORD" Finally I turned on more verbose logging and found that the plugin did not recognize "USERNAME" as something to replace, because it expected the string to be surrounded by whitespace. I wrote the following patch to correct this. I hope you find it useful, Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* Debian patch: Fix spelling in log messageAlberto Gonzalez Iniesta2010-10-211-1/+1
| | | | | Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: David Sommerseth <dazo@users.sourceforge.net>
* Fix autotools cross-compiling supportDavid Sommerseth2010-10-212-22/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | This is a modified version of a patch sent to the sf.net patch tracker: <http://sourceforge.net/tracker/?func=detail&aid=2491190&group_id=48978&atid=454721> After having disucssed this patch on IRC (#openvpn-discussions) March 4, 2010, it was decided to accept this patch when not modifying TARGET_* defines through out the code. Further, in a mail comment Alon Bar-Lev had some other comments of what would be needed to be done. Mail reference: <http://thread.gmane.org/gmane.network.openvpn.devel/3176> This patch has been tested by bootstrapping the code on a RHEL4.6 box. with the following autotools packages installed: autoconf-2.59-5 automake-1.9.2-3 libtool-1.5.6-4.EL4.2 It builds cleanly and 'make check' passes. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: James Yonan <james@openvpn.net> Acked-by: Alon Bar-Lev <alon.barlev@gmail.com>
* On TARGET_LINUX define _GNU_SOURCE if not definedDavid Sommerseth2010-10-211-0/+4
| | | | | | | | | | | | This is to include peercred support on hosts where _GNU_SOURCE is not defined by default. This issue has been found on Gentoo with glibc-2.8. The solution was discussed on the IRC meeting March 4, 2010 in #openvpn-discussions. <http://thread.gmane.org/gmane.network.openvpn.devel/3242> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: James Yonan <james@openvpn.net>
* The man page needs dash escaping in UTF-8 environmentsJan Brinkmann2010-10-211-807/+807
| | | | | | | | | | | | | | | | | | | | | | | There was a debian bugreport which was filed in 2005 . It was patched but it seems that nobody forwarded the patch to the openvpn project itself. The problem is quite simple: The dashes for options (the double dashes) are not escaped. This causes trouble in relationship with utf-8 . Since the bugreport was closed it was patched within the debian/ubuntu packages itself. I've attached the patch to get it atleast reviewed by the openvpn project itself. See <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=296133> for details. sf.net tracker: <https://sourceforge.net/tracker/?func=detail&aid=2935611&group_id=48978&atid=454721> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Tested-by: Jan Just Keijser <janjust@nikhef.nl> Tested-by: Pavel Shramov <shramov@mexmat.net> Tested-by: Samuli Seppänen <samuli@openvpn.net>
* bash->bourne script cleanupDan Nelson2010-10-2117-17/+17
| | | | | | | | | | | | | | | | | | Many of the scripts in the openvpn source have their shell set to /bin/bash, but only two use bash features. The attached patch (against openvpn-2.1_rc9) sets the shell on the rest of the scripts to /bin/sh for better portability. The only scripts that actually require bash are contrib/pull-resolv-conf/client.{up,down} ; they use the ${!var} variable indirection feature. sf.net tracker: <https://sourceforge.net/tracker/?func=detail&aid=2040296&group_id=48978&atid=454721> Discussed on the IRC meeting March 4, 2010 in #openvpn-discussions. <http://thread.gmane.org/gmane.network.openvpn.devel/3242> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: James Yonan <james@openvpn.net>
* Allow 'lport 0' setup for random port bindingEnrico Scholz2010-10-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I am running a multihomed host where 'local <extip>' must be specified for proper operation. Unfortunately, this implies 'lport 1194' or another static port. This causes problems with stateful firewalls which register the host/port pairs in the internal connection tracking table. On ungraceful reconnects, the new TCP connection will have same the host/port pairs but unexpected sequence numbers. The new connection will be assumed as invalid hence and be dropped. It would be nice when local port can be configured to be bound to a random port number. After reading code, | else if (streq (p[0], "lport") && p[1]) | ... | port = atoi (p[1]); |- if (!legal_ipv4_port (port)) |+ if (port != 0 && !legal_ipv4_port (port)) | { in options.c seems to be the only required change. This has been discussed here: <http://thread.gmane.org/gmane.network.openvpn.user/28622> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Gert Doering <gert@greenie.muc.de>
* remove duplicate code in FREEBSD+DRAGONFLY system-dependent ifconfigGert Doering2010-10-211-14/+3
| | | | | | | | | (ACKed by Eric F Crist and David Sommerseth) (cherry picked from commit dd66b12647852e3f1267be70b0fb3b11deedf377) Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Signed-off-by: Gert Doering <gert@greenie.muc.de>
* verb 5 logging wrongly reports received bytesDavid Sommerseth2010-10-211-2/+2
| | | | | | | | | | | | | | | | | | | | | | With --verb 5, openvpn logs a single letter (rwRW) for each package received or sent. I recently ran into a problem with the tun device on Linux where the read from that device returned 0. Unfortunately this was also logged as "r", which made me assume that openvpn had received something, while it actually hadn't. (See https://dev.openwrt.org/ticket/6650 for the bug that made me find out about this problem with openvpn.) I'm attaching a patch which prevents openvpn from logging "r" or "R" when it didn't actually read anything. This is against openvpn 2.1-rc20, but probably still applies to the most recent version. This patch was received anonymously via the sf.net bug tracker: <http://sourceforge.net/tracker/?func=detail&atid=454719&aid=2951003&group_id=48978> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Gert Doering <gert@greenie.muc.de>
* [PATCH] Change verify-cn so cn is no longer hardcoded in openvpn's config fileKarl O. Pinc2010-10-211-15/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch should be easy to process. A resubmission of the patch sent to this list on 04/23/2009. The patch changes the verify-cn script sample to be used with --tls-verify so that instead of having to hardcode a cn to verify in the OpenVPN configuration file the allowed cns may be written into a separate file. This makes the process of verifying cns a whole lot more dynamic, to the point where it is useful in the real world. One problem with this patch is that it is backwards incompatible. I did not bother keeping the original calling interface as A) it's a sample script, and B) the original's functionality seems useless and equalivant functionality is easily available with the new script. The problem with the original is that there seems little point in verifying a client's cn when all the clients share one cn, as would have to be the case when the cn is hardcoded into the openvpn config file. This patch applies against the testing allmiscs branch, and should apply against any of the other testing branches as well. It works for me. I've tested it throughly but not used it extensively in production. Regards, Karl <kop@meme.com> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Gert Doering <gert@greenie.muc.de> Acked-by: Eric F Crist <ecrist@secure-computing.net>
* Added mapping files from SVN commit ID to more descriptive commit IDs.David Sommerseth2010-10-212-0/+2
| | | | | | | | Unfortunately, this will not rewrite the commit history. So all commits done by james@e7ae566f-a301-0410-adde-c780ea21d3b5 is James Yonans commits. It was considered to risky to use git tools to rewrite the commit history, as it could influence those already using this git tree.
* Added --proto-force directive.James Yonan2010-09-015-2/+35
| | | | | | | Version 2.1.3a git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6424 e7ae566f-a301-0410-adde-c780ea21d3b5
* Don't configure Linux tun/tap txqueuelen setting if OpenVPNJames Yonan2010-08-311-1/+1
| | | | | | | txqueuelen directive is set to 0. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6420 e7ae566f-a301-0410-adde-c780ea21d3b5
* Allow PKCS12 file content to be included inline in configuration file,James Yonan2010-08-293-10/+39
| | | | | | | rendered as base64. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6412 e7ae566f-a301-0410-adde-c780ea21d3b5
* Attempt to fix issue where domake-win build system was not properlyv2.1.3James Yonan2010-08-2011-203/+191
| | | | | | | | | | | | | signing drivers and .exe files. Added win/tap_span.py for building multiple versions of the TAP driver and tapinstall binaries using different DDK versions to span from Win2K to Win7 and beyond. Version 2.1.3 git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6404 e7ae566f-a301-0410-adde-c780ea21d3b5
* Windows security issue:v2.1.2James Yonan2010-08-154-3/+116
| | | | | | | | | | | | | | | | | | | Fixed potential local privilege escalation vulnerability in Windows service. The Windows service did not properly quote the executable filename passed to CreateService. A local attacker with write access to the root directory C:\ could create an executable that would be run with the same privilege level as the OpenVPN Windows service. However, since non-Administrative users normally lack write permission on C:\, this vulnerability is generally not exploitable except on older versions of Windows (such as Win2K) where the default permissions on C:\ would allow any user to create files there. Credit: Scott Laurie, MWR InfoSecurity Version 2.1.2 git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6400 e7ae566f-a301-0410-adde-c780ea21d3b5
* Added warning about tls-remote in man page.James Yonan2010-08-101-0/+7
| | | | git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6384 e7ae566f-a301-0410-adde-c780ea21d3b5
* Distribute win directory (Python/MSVC-based build system)James Yonan2010-08-091-1/+2
| | | | | | | in "make dist" tarball. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6382 e7ae566f-a301-0410-adde-c780ea21d3b5
generated by cgit (git 2.34.1) at 2024-06-27 09:08:33 +0000