summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Prepared v2.2-beta5 for releasev2.2-beta5David Sommerseth2010-11-252-1/+6
| | | | Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* Merge branch 'feat_misc' into beta2.2David Sommerseth2010-11-251-1/+1
|\
| * Fixed an issue causing a build failure with MS Visual Studio 2008.Samuli Seppänen2010-11-251-1/+1
| | | | | | | | | | | | | | | | | | | | The new SOCKS auth code in socks.c contained a call to sprintf instead of openvpn_sprintf. This caused build to fail if MS Visual Studio 2008 C compiler was used. This change fixes that issue. Signed-off-by: Samuli Seppänen <samuli@openvpn.net> Acked-by: David Sommerseth <dazo@users.sourceforge.net> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* | Prepared for v2.2-beta4 for releasev2.2-beta4David Sommerseth2010-11-212-2/+2
| | | | | | | | Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* | Updated ChangeLog with info about last mergesDavid Sommerseth2010-11-181-0/+39
| | | | | | | | Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* | Merge branch 'feat_misc' into beta2.2David Sommerseth2010-11-1846-1064/+60
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: acinclude.m4 config-win32.h configure.ac misc.c thread.c thread.h - These conflicts was mainly due to feat_misc getting old and mostly caused by the pthread clean-up patches in feat_misc Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * Merged add_bypass_address() and add_host_route_if_nonlocal()David Sommerseth2010-11-181-22/+12
| | | | | | | | | | | | | | | | | | The add_host_route_if_nonlocal() function is too simple to really benefit from calling add_bypass_address() when this function is the only caller to this function. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Peter Stuge <peter@stuge.se>
| * Removed functions not being used anywhereDavid Sommerseth2010-11-182-21/+0
| | | | | | | | | | | | | | | | | | | | The GNU C compiler gave warnings about these functions in the patch not being used anywhere. Doing a git grep on the code turned out there were no callers to these functions. Taking these functions out, as there is not good reason why to carry dead code. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Peter Stuge <peter@stuge.se>
| * Only add some functions when really neededDavid Sommerseth2010-11-182-0/+4
| | | | | | | | | | | | | | | | | | | | | | The GNU C compiler gave warnings about some functions not being used. These functions where only used if certian #ifdef sections was enabled. This patch encapsulates these function declarations with matching #ifdef's to make it more clear when these functions are needed. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Peter Stuge <peter@stuge.se>
| * Fixed potential misinterpretation of boolean logicDavid Sommerseth2010-11-181-1/+1
| | | | | | | | | | | | | | | | The GNU C compiler warned about a potential issue with an if() expression missing an extra set of parentheses. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Peter Stuge <peter@stuge.se>
| * Fix compiler warnings about not used dummy() functionsDavid Sommerseth2010-11-184-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It has been reported that the Microsoft Visual C compiler complains if a .c file do not contain any compilable code, which can happen if the code has been #ifdef'ed out. To avoid this, these #ifdef sections have a #else section which adds a static dummy() function which does nothing. On the other hand, the GNU C compiler complains about unused functions when it discovers this situation. This patch tries to only add these dummy() functions if the Microsoft Visual C compiler is detected, via the _MSC_VER macro. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Peter Stuge <peter@stuge.se>
| * Use stricter snprintf() formatting in socks_username_password_auth() (v3)David Sommerseth2010-11-181-3/+10
| | | | | | | | | | | | | | | | | | | | | | | | commit fc1fa9ffc7e3356458ec3 added a new function which needs to have a stricter string formatting. This was detected due to a compiler warning. This patch makes sure that the length of username and password is not longer than 255 bytes. It also adds extra checks to avoid NULL pointer issues with strlen() on these two parameters. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Gert Doering <gert@greenie.muc.de>
| * Clean-up: Removing useless code - hash related functionsDavid Sommerseth2010-11-146-49/+20
| | | | | | | | | | | | | | | | Removed even more function which where practically empty and took away some function arguments which were not used. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: James Yonan <james@openvpn.net>
| * Clean-up: Remove more dead and inactive code pathsDavid Sommerseth2010-11-1411-52/+5
| | | | | | | | | | | | | | | | These code paths was practically not needed with no locking mechanisms enabled and was just bloating the source code. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: James Yonan <james@openvpn.net>
| * Clean-up: Remove pthread and mutex locking codeDavid Sommerseth2010-11-1432-921/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This code was not activated at all, and hard coded as disabled in syshead.h with this code snippet: /* * Pthread support is currently experimental (and quite unfinished). */ #if 1 /* JYFIXME -- if defined, disable pthread */ #undef USE_PTHREAD #endif So no matter if --enable-pthread when running ./configure or not, this feature was never enabled in reality. Further, by removing the blocker code above made OpenVPN uncompilable in the current state. As the threading part needs to be completely rewritten and pthreading will not be supported in OpenVPN 2.x, removing this code seems most reasonable. In addition, a lot of mutex locking code was also removed, as they were practically NOP functions, due to pthreading being forcefully disabled Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: James Yonan <james@openvpn.net>
* | Merge branch 'bugfix2.1' into beta2.2David Sommerseth2010-11-182-17/+58
|\ \
| * | Added command-line option parser and an unsigned build option to build_all.pySamuli Seppänen2010-11-181-15/+56
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Modified win/build_all.py so that it parses command-line options using getopt. Added option "-u / --unsigned" which allows forcing unsigned builds and a "-h / --help" option. By default a signed build is generated, provided that the Python SignTool module is installed. If not, the build is interrupted. Signed-off-by: Samuli Seppänen <samuli@openvpn.net> Acked-by: Peter Stuge <peter@stuge.se> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * | Merge branch 'svn-BETA21' into bugfix2.1David Sommerseth2010-11-182-3/+3
| |\ \
| | * | Fixes to prevent compile breakage when --disable-crypto is used.James Yonan2010-11-162-5/+2
| | | | | | | | | | | | | | | | git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6656 e7ae566f-a301-0410-adde-c780ea21d3b5
| | * | In verify_callback, the subject var should be freed by OPENSSL_free,James Yonan2010-11-162-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | not free, since it is allocated by OpenSSL. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6655 e7ae566f-a301-0410-adde-c780ea21d3b5
* | | | Merge branch 'bugfix2.1' into beta2.2David Sommerseth2010-11-144-9/+8
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: options.c - Disagreements about a new included file (forward.h) Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * | | Fixed compiling issues when using --disable-cryptoJames Yonan2010-11-142-5/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Peter Korsgaard <jacmet@sunsite.dk> reported an issue [1] when compiling with --disable-crypto activated. He suggested a patch, which only partly solved the issue. SVN r6568 / commit 3cf9dd88fd84108 added a new feature which further made it impossible to compile without crypto. This patch fixes both issues, based on Peter Korsgaard's patch. [1] <http://sourceforge.net/mailarchive/forum.php?thread_name=87fwx08bod.fsf%40macbook.be.48ers.dk&forum_name=openvpn-devel> Signed-off-by: James Yonan <james@openvpn.net> Acked-by: David Sommerseth <dazo@users.sourceforge.net> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * | | Remove hardcoded path to resolvconfJesse Young2010-11-142-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Jesse Young <jesse.young@gmail.com> Acked-by: David Sommerseth <dazo@users.sourceforge.net> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* | | | Merge branch 'feat_misc' into beta2.2David Sommerseth2010-11-141-0/+2
|\ \ \ \ | | |_|/ | |/| |
| * | | Added check for variable CONFIGURE_DEFINES into options.cSamuli Seppänen2010-11-141-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The file containing CONFIGURE_DEFINES variable, configure.h, is not present if openvpn is built using the Python + Visual C -based buildsystem. This causes the build to fail. This patch adds a check to see if variable exists before trying to use it. Signed-off-by: Samuli Seppänen <samuli@openvpn.net> Acked-by: Peter Stuge <peter@stuge.se> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* | | | Merge branch 'feat_misc' into beta2.2David Sommerseth2010-11-137-39/+266
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: Makefile.am openvpn.8 options.c socket.c ssl.c - feat_misc is missing a lot of bugfix2.1 changes Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * | | Make "topology subnet" work on Solaris (ifconfig + route metric changes by ↵Gert Doering2010-11-122-5/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Kazuyoshi Aizawa, adding of local "connected subnet" route by me) Tested on OpenSolaris/i386, no impact for other TARGETs. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Kazuyoshi Aizawa <admin2@whiteboard.ne.jp> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * | | Integrate support for TAP mode on Solaris, written by Kazuyoshi Aizawa ↵Gert Doering2010-11-121-22/+98
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | <admin2@whiteboard.ne.jp>. See also http://www.whiteboard.ne.jp/~admin2/tuntap/ Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Kazuyoshi Aizawa <admin2@whiteboard.ne.jp> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * | | Adding support for SOCKS plain text authenticationPierre Bourdon2010-11-125-12/+138
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds support for SOCKS plain text (username/password) authentication as described in RFC 1929. It adds an optional third parameter to the socks-proxy option, which is a file containing the login credentials. I've been using this patch for two weeks now and it does not seem to cause any problem. The only modifications are in the SOCKS handshake handling and the options parser. Signed-Off-By: Pierre Bourdon <delroth@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <dazo@users.sourceforge.net> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * | | Fixed static defined length check to use sizeof()Emilien Mantel2010-06-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This comes in addition to commit 935c62be9c0c8a256112d after some additional review comments. Signed-off-by: Emilien Mantel <emilien.mantel@businessdecision.com> Acked-by: Peter Stuge <peter@stuge.se> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * | | Choose a different field in X509 to be usernameEmilien Mantel2010-06-174-14/+36
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For my company, we use a PKI (linked to a LDAP) with OpenVPN. We can't use "CN" to be username (few people can have the same "CN"). In our case, we only use the UID. With my patch, you can choose another field to be username with a new option called --x509-username-field, the default value is "CN". Signed-off-by: Emilien Mantel <emilien.mantel@businessdecision.com> Acked-by: David Sommerseth <dazo@users.sourceforge.net> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * | | ssl.c: fix use of openvpn_run_script()'s return valueFabian Knittel2010-05-041-13/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes two bugs introduced in commit 339f2a4d4b487afa53fa99d72c35b16f31e417d3 Author: David Sommerseth <dazo@users.sourceforge.net> Date: Thu Apr 29 23:35:45 2010 +0200 David's patch replaced openvpn_execve() with openvpn_run_script() in two places, but didn't adjust the return value handling. openvpn_run_script() returns true or false, while openvpn_execve() returns the program's exit code. Without the fix, the --tls-verify script and the --auth-user-pass-verify script fail to run. (I noticed the latter, but haven't actually tested the former.) The return value handling is fine for the other places where openvpn_run_script() is used, because those places previously used openvpn_execve_check() (notice the "_check" suffix). Signed-off-by: Fabian Knittel <fabian.knittel@avona.com> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: David Sommerseth <dazo@users.sourceforge.net>
| * | | Revamped the script-security warning logging (version 2)David Sommerseth2010-04-298-11/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The main task of this patch is to avoid reporting the SCRIPT_SECURITY_WARNING over and over again, in addition to not show this warning when it should not be a problem. This general warning should now only appear once, and only when --script-security is not set, 0 or 1. In all other cases this warning should not appear. In addition, this warning will come close to the script-hook which most probably will fail. It will also give a little bit more concrete hint on which script-hook which failed. If --script-security is 2 or 3, only the execve failure itself will be shown. This message will on the other hand be shown repeatedly. This is a new rewritten version which simplifies the implementaion of the new openvpn_run_script() function. It was considered to remove it completely, but due to code clearity and easy of use it was decided to make this function a static inline function instead. Anyhow, this function will enforce openvpn_execve_check() to be called with the S_SCRIPT flag. Patch ACKed on the developers meeting 2009-04-29. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: James Yonan <james@openvpn.net>
| * | | Don't add compile time information if --enable-small is usedDavid Sommerseth2010-04-221-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is to satisfy those wanting to build openvpn for embedded devices where every bytes matters. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Gert Doering <gert@greenie.muc.de>
| * | | Make use of automake CLEANFILES variable instead of clean-local ruleDavid Sommerseth2010-04-221-4/+1
| | | | | | | | | | | | | | | | | | | | Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Gert Doering <gert@greenie.muc.de>
| * | | Fix dependency checking for configure.h (v2)David Sommerseth2010-04-223-8/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Alon Bar-Lev indicated commit f27bf509315a48b0070294c3993a718df0c2626c was missing proper dependency checking. This patch corrects this and fixes an issue when creating configure.h via make distcheck. This is an enhanced version of the one sent to the openvpn-devel mailing list April 13, 2010 [1], after having received some feedback from Gert Doering, cleaning up configure_log.awk further. [1] <http://thread.gmane.org/gmane.network.openvpn.devel/3410/focus=3491> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Gert Doering <gert@greenie.muc.de>
| * | | Add comile time information/settings from ./configure to --versionDavid Sommerseth2010-04-084-0/+85
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch will create ./configure.h which will contain two new #define strings. CONFIGURE_DEFINES will contain all USE, ENABLED, DISABLED and DEPRECATED defines from ./config.h. CONFIGURE_CALL will contain the complete ./configure line which was used when configuring the package for building. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: James Yonan <james@openvpn.net>
| * | | pkitool lacks expected option "--help"Wil Cooley2010-03-021-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The pkitool script lacks the "--help" parameter to actually display the usage statement; most people are conditioned to try that before running the command without options. This patch adds that and "--version" to display just the program name and version. sf.net tracker: <https://sourceforge.net/tracker/?func=detail&atid=454721&aid=1705407&group_id=48978> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Jan Just Keijser <janjust@nikhef.nl>
| * | | Several updates to openvpn.8 (man page updates)Karl O. Pinc2010-03-021-9/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a collection of 4 patches sent to the -devel mailing list: * [PATCH] Frob the openvpn(8) man page tls-verify section to clarify * [PATCH] More improvments to openvpn(8) --tls-verify * [PATCH] Yet another tweak of openvpn(8) --tls-verify * [PATCH] Final frobbing of openvpn(8) --tls-verify Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: David Sommerseth <dazo@users.sourceforge.net>
| * | | enhance tls-verify possibilityMathieu GIANNECCHINI2010-03-026-0/+87
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It should be nice to enhance tls-verify check possibilities against peer cert during a pending TLS connection like : - OCSP verification - check any X509 extensions of the peer certificate - delta CRL verification - ... This patch add a new "tls-export-cert" option which allow to get peer certificate in PEM format and to store it in an openvpn temporary file. Peer certificate is stored before tls-script execution and deleted after. The name of the related temporary file is available under tls-verify script by an environment variable "peer_cert". The patch was made from OpenVPN svn Beta21 branches. Here is a very simple exemple of Tls-verify script which provide OCSP support to OpenVPN (with tls-export-cert option) without any OpenVPN "core" modification : X509=$2 openssl ocsp \ -issuer /etc/openvpn/ssl.crt/RootCA.pem \ -CAfile /etc/openvpn/ssl.capath/OpenVPNServeur-cafile.pem \ -cert $peer_cert \ -url http://your-ocsp-url if [ $? -ne 0 ] then echo "error : OCSP check failed for ${X509}" | logger -t "tls-verify" exit 1 fi This has been discussed here: <http://thread.gmane.org/gmane.network.openvpn.devel/2492> <http://thread.gmane.org/gmane.network.openvpn.devel/3150> <http://thread.gmane.org/gmane.network.openvpn.devel/3217> This patch has been modified by David Sommerseth, by fixing a few issues which came up to during the code review process. The man page has been updated and tmp_file in ssl.c is checked for not being NULL before calling delete_file(). Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Gert Doering <gert@greenie.muc.de>
| * | | Allow 'lport 0' setup for random port bindingEnrico Scholz2010-03-011-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I am running a multihomed host where 'local <extip>' must be specified for proper operation. Unfortunately, this implies 'lport 1194' or another static port. This causes problems with stateful firewalls which register the host/port pairs in the internal connection tracking table. On ungraceful reconnects, the new TCP connection will have same the host/port pairs but unexpected sequence numbers. The new connection will be assumed as invalid hence and be dropped. It would be nice when local port can be configured to be bound to a random port number. After reading code, | else if (streq (p[0], "lport") && p[1]) | ... | port = atoi (p[1]); |- if (!legal_ipv4_port (port)) |+ if (port != 0 && !legal_ipv4_port (port)) | { in options.c seems to be the only required change. This has been discussed here: <http://thread.gmane.org/gmane.network.openvpn.user/28622> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Gert Doering <gert@greenie.muc.de>
| * | | remove duplicate code in FREEBSD+DRAGONFLY system-dependent ifconfigGert Doering2010-02-281-14/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (ACKed by Eric F Crist and David Sommerseth) (cherry picked from commit dd66b12647852e3f1267be70b0fb3b11deedf377) Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Signed-off-by: Gert Doering <gert@greenie.muc.de>
| * | | Merge branch 'master' into bugfix2.1David Sommerseth2010-02-261-6/+15
| |\ \ \
| | * | | Added mapping files from SVN commit ID to more descriptive commit IDs.David Sommerseth2010-02-262-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Unfortunately, this will not rewrite the commit history. So all commits done by james@e7ae566f-a301-0410-adde-c780ea21d3b5 is James Yonans commits. It was considered to risky to use git tools to rewrite the commit history, as it could influence those already using this git tree.
| | * | | Fixed an issue in the Management Interface that could causejames2010-02-261-6/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | a process hang with 100% CPU utilization in --management-client mode if the management interface client disconnected at the point where credentials are queried. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@5458 e7ae566f-a301-0410-adde-c780ea21d3b5
| * | | | verb 5 logging wrongly reports received bytesDavid Sommerseth2010-02-191-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With --verb 5, openvpn logs a single letter (rwRW) for each package received or sent. I recently ran into a problem with the tun device on Linux where the read from that device returned 0. Unfortunately this was also logged as "r", which made me assume that openvpn had received something, while it actually hadn't. (See https://dev.openwrt.org/ticket/6650 for the bug that made me find out about this problem with openvpn.) I'm attaching a patch which prevents openvpn from logging "r" or "R" when it didn't actually read anything. This is against openvpn 2.1-rc20, but probably still applies to the most recent version. This patch was received anonymously via the sf.net bug tracker: <http://sourceforge.net/tracker/?func=detail&atid=454719&aid=2951003&group_id=48978> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Gert Doering <gert@greenie.muc.de>
| * | | | [PATCH] Change verify-cn so cn is no longer hardcoded in openvpn's config fileKarl O. Pinc2010-02-181-15/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch should be easy to process. A resubmission of the patch sent to this list on 04/23/2009. The patch changes the verify-cn script sample to be used with --tls-verify so that instead of having to hardcode a cn to verify in the OpenVPN configuration file the allowed cns may be written into a separate file. This makes the process of verifying cns a whole lot more dynamic, to the point where it is useful in the real world. One problem with this patch is that it is backwards incompatible. I did not bother keeping the original calling interface as A) it's a sample script, and B) the original's functionality seems useless and equalivant functionality is easily available with the new script. The problem with the original is that there seems little point in verifying a client's cn when all the clients share one cn, as would have to be the case when the cn is hardcoded into the openvpn config file. This patch applies against the testing allmiscs branch, and should apply against any of the other testing branches as well. It works for me. I've tested it throughly but not used it extensively in production. Regards, Karl <kop@meme.com> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Gert Doering <gert@greenie.muc.de> Acked-by: Eric F Crist <ecrist@secure-computing.net>
| * | | | Do not randomize resolving of IP addresses in getaddr()David Sommerseth2010-02-181-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Based on a discussion on the mailing list and in the IRC meeting Feb 18, it was decided to remove get_random() from the getaddr() function as that can conflict with round-robin/randomization done by DNS servers. This change must be documented in the release notes. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * | | | Added mapping files from SVN commit ID to more descriptive commit IDs.David Sommerseth2010-02-162-0/+2
| |/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | Unfortunately, this will not rewrite the commit history. So all commits done by james@e7ae566f-a301-0410-adde-c780ea21d3b5 is James Yonans commits. It was considered to risky to use git tools to rewrite the commit history, as it could influence those already using this git tree.
* | | | Merge branch 'bugfix2.1' into beta2.2David Sommerseth2010-11-132-4/+9
|\ \ \ \ | | |/ / | |/| |
generated by cgit (git 2.34.1) at 2024-09-27 16:32:25 +0000