summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Check return value of ms_error_text()Steffan Karger2015-10-041-0/+1
| | | | | | | | | | | | | | ms_error_text() may return NULL, and it is unclear (or, at least undocumented) whether the OpenSSL ERR code (and our code using the ERR code) can deal with esd->string being NULL. So, just to be sure, check that ms_error_text() succeeded before passing the result to ERR_load_strings(). Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <561130FC.8090008@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/10176 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Replace strdup() calls for string_alloc() callsSteffan Karger2015-10-046-6/+8
| | | | | | | | | | | | As reported by Bill Parker in trac #600, strdup() return values are not always correctly checked for failed allocations. This patch adds missing checks by using string_alloc(), which performs the required checks. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <561130FC.8090008@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/10176 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Repair test_local_addr() on WIN32Gert Doering2015-09-251-1/+1
| | | | | | | | | | | | | Intermediate result was stored in a "bool" variable, but the actual range of results is 0/1/2 - so "2" (TLA_LOCAL) never worked. Change to "int". Diagnosed by "dferbas" in trac #609 (thanks). Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1443162970-38210-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/10168
* Replace unaligned 16bit access to TCP MSS value with bytewise accessGert Doering2015-09-211-9/+8
| | | | | | | | | | | | | TCP options are not always word-aligned, and accessing a 16bit value at an odd memory address will cause a "bus error" crash on some architectures, e.g. Linux/Sparc(64) Trac #497 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1440680402-96548-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/10056
* Log serial number of revoked certificateBoris Lytochkin2015-09-202-2/+10
| | | | | | | | | | | | | | | | | | | In most of situations admin of OpenVPN server needs to know which particular certificate is used by client. In the case when certificate is OK, environment variable can be used for that but once it is revoked, no user scripts are invoked so there is no way to get serial number: only subject is printed in logs. So we log certificate serial in case it is revoked. Sponsored-by: Yandex LLC Signed-off-by: Boris Lytochkin <lytboris@yandex-team.ru> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <55FEBF7E.3010209@yandex-team.ru> URL: http://article.gmane.org/gmane.network.openvpn.devel/10154 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix IPv6 host routes to LAN gateway on OpenSolarisGert Doering2015-09-201-5/+12
| | | | | | | | | | | | | | | The tun/tap routes need to be set with "metric 0", while this will prevent routes to LAN gateways from being installed. So, set metric 0 only if no other interface is requested... (Note: OpenSolaris can not specify host+interface gateways, so we just use the GW addresses - it seems to still work for fe80:: addresses, however it is done internally. NUD maybe?) Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1441985627-14822-10-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/10092
* get_default_gateway_ipv6(): *BSD / MacOS / Solaris PF_ROUTE implementationGert Doering2015-09-201-4/+183
| | | | | | | | | | | | | | | | | | | As for IPv4, a common implementation for all (supported) BSD families and Solaris. Supporting the latter requires separate implementations for IPv4 and IPv6, unfortunately, so it's quite a bit of duplicate code. Further, extend add_route_ipv6() and delete_route_ipv6() to handle link-local gateway addresses that require "gateway + interface" in scoped notation ("fe80::1%em0"). Tested on FreeBSD 7.4/amd64, 9.3/sparc64, 10.0/amd64, NetBSD 5.1/amd64, OpenBSD 4.9/i386, MacOS X 10.5/32 and 10.10/64 and OpenSolaris 10.11/i386. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1441985627-14822-9-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/10082
* Implement '--redirect-gateway ipv6'Gert Doering2015-09-203-0/+33
| | | | | | | | | | | | | | | | | | | Add "ipv6" and "!ipv4" sub-options to "--redirect-gateway" option. This is done in the same way as in the OpenVPN 3 code base, so "--redirect-gateway ipv6" will redirect both IPv4 and IPv6 - if you want v6-only, use "--redirect-gateway ipv6 !ipv4". The actual implementation is much simpler than for IPv4 - we just add a few extra routes to the route_ipv6_option_list and leave it to init_route_ipv6_list() to figure out whether there is an overlap with IPv6 transport, and if yes, insert a host route to the VPN server via the current IPv6 default gateway. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1441985627-14822-8-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/10086
* Do not install a host route for the VPN on AndroidArne Schwabe2015-09-171-1/+7
| | | | | | | | | | Routing loops are avoided using the VPNService API protect API Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1442485438-15704-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/10135 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Implement handling of overlapping IPv6 routes with IPv6 remote VPN server ↵Gert Doering2015-09-177-26/+175
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | address - socket.[ch]: add link_socket_current_remote_ipv6() helper to extract current address of remote VPN server (if IPv6, NULL otherwise), IPv6 equivalent to link_socket_current_remote() - init.c: pass remote VPN server address to init_route_ipv6_list() (link_socket_current_remote_ipv6()) - route.h: add route_ipv6_gateway_info to route_ipv6_list, and reorder structures so that this actually compiles. Add iface/adapter_index to struct route_ipv6 (for non-tun/tap routes). - route.[ch]: add "const" to *dest argument to get_default_gateway_ipv6() - route.c: add route_ipv6_match_host() helper to check whether an IPv6 address is matched by a given "route_ipv6" IPv6 route) - route.c: init_route_ipv6_list() - call get_default_gateway_ipv6() - check to-be-installed IPv6 routes against VPN server address (if IPv6) - if an overlap is seen, add a host route for the VPN server address via the just-discovered gateway to the list of IPv6 routes to be installed (rl6->routes_ipv6) - warn if overlap is detected but platform code has not been able to discover IPv6 default gateway - route.c: add_route_ipv6() / delete_route_ipv6(): set "device" to "external default gateway interface" (r6->iface) instead of TUN/TAP device (if set), which nicely enables arbitrary gateway/interface combinations for Linux - ssl.c: add "IV_RGI6=1" to push-peer-info data to let server know we can handle pushed IPv6 routes that overlap with server IPv6 address - tun.c: when adding/removing on-link routes, CLEAR(r6) first to ensure new struct route_ipv6 members are cleared Tested on Linux with iproute2 and /bin/route, on eth and tun routes. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1441985627-14822-7-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/10089
* get_default_gateway_ipv6(): Linux / Netlink implementation.Gert Doering2015-09-171-12/+136
| | | | | | | | | | Using "netlink socket" directly, without external netlink helper libraries. For this very simple case, it's easy enough. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1441985627-14822-6-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/10091
* Make client delay less before sending PUSH_REQUESTGert Doering2015-09-171-2/+2
| | | | | | | | | | | | | | | | Speed up PUSH_REQUEST handling on the client side by reducing the amount of dependent 1s-coarse-timers to "just one". After "TLS is up!", one timer needs to fire to wakeup "check_connection_established_dowork()", and that one used to setup another 1s timer before sending PUSH_REQUEST - which is just dead time where we sit idly... So, fire immediately. Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20150701154039.GG382@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9851 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Remove #ifdefs for client nat support.Arne Schwabe2015-09-159-45/+9
| | | | | | | | | The client-nat feature was always unconditionally enabled Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1442309019-7586-3-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/10109 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Use pseudo gw as default gw on Android as a workaround for not being able to ↵Arne Schwabe2015-09-151-0/+14
| | | | | | | | | | read /proc/net/route Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1442309019-7586-5-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/10111 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Extend network-change command to allow reprotecting on the same network (for ↵Arne Schwabe2015-09-153-7/+12
| | | | | | | | | | short connection losses) Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1442309019-7586-7-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/10106 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix loglevel of protect socket messageArne Schwabe2015-09-151-2/+2
| | | | | | | | Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1442309019-7586-6-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/10112 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Don't redirect the gateway on Android even if requestedArne Schwabe2015-09-151-0/+4
| | | | | | | | | | Routing loops are avoided using the VPNService API Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1442309019-7586-4-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/10113 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Add support for requesting the fd again to rebind to the next interface.Arne Schwabe2015-09-153-0/+63
| | | | | | | | | | | This not done via android_control since calling management from management leads to an infinitive loop Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1442309019-7586-2-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/10110 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Remove unused function h_errno_msgArne Schwabe2015-09-151-17/+0
| | | | | | | | Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1442309019-7586-8-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/10108 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Create basic infrastructure for IPv6 default gateway handling / redirection.Gert Doering2015-09-155-7/+97
| | | | | | | | | | | | | | | | | | | | | | | | | - introduce get_default_gateway_ipv6() and add stub functions with the implementation plan to the 4 major code blocks here (Windows, Linux/Android, *BSD and Solaris, "others") - add &rgi6 to print_default_gateway(), and teach it to print v4, v6 or both, depending on the calling environment - unlike IPv4 (today), get_default_gateway_ipv6() is passed the actual target IPv6 address of the server we're looking for, so we can handle more complicated routing setups ("default to eth0, vpn server to ppp0") correctly - consequently, --show-gateway has an optional parameter now, the IPv6 address to look up (for debugging) - document --show-gateway and the extra option in openvpn.8 Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1441985627-14822-5-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/10087 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Add route_ipv6_gateway* data structures for rgi6 support.Gert Doering2015-09-141-0/+28
| | | | | | | | | | route_gateway_address -> route_ipv6_gateway_address route_gateway_info -> route_ipv6_gateway_info Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1441985627-14822-4-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/10088
* refactor struct route_ipv6_list, bring in line with struct route_list againGert Doering2015-09-142-19/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | adjust "struct route_ipv6_list" (and all users) to reflect changes to "struct route_list" done in commit 7fb0e07e, namely: - new member "rl6->iflags" (RL_* flags) - new member "rl6->spec_flags" (RTSA_* flags) - new member "rl6->remote_host_ipv6" (--remote address we're talking to) - "rl6->routes_added" --> "rl6->iflags & RL_ROUTES_ADDED" - "rl6->did_redirect_default_gateway" --> "rl6->iflags & RL_DID_REDIRECT_DEFAULT_GATEWAY" - "rl6->did_local" --> "rl6->iflags & RL_DID_LOCAL" - "rl6->remote_endpoint_defined" --> "rl6->spec_flags & RTSA_REMOTE_ENDPOINT" - "rl6->default_metric_defined" --> "rl6->spec_flags & RTSA_DEFAULT_METRIC" deviating from IPv4 route_list, there is no "route_special_addr spec" sub-struct, because it's not considered useful (rl->spec.flags becomes rl6->spec_flags, the IPv6 equivalent of everything else in rl->spec just lives inside struct route_ipv6_list) Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1441985627-14822-3-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/10084
* refactor struct route_ipv6, bring in line with struct route_ipv4 againGert Doering2015-09-143-23/+21
| | | | | | | | | | | | | | | adjust "struct route_ipv6" (and all users) to reflect changes to "struct route_ipv4" done in commit 7fb0e07e, namely: - new member "r6->flags" - "r6->defined" becomes "r6->flags & RT_DEFINED" - "r6->metric_defined" becomes "r6->flags & RT_METRIC_DEFINED" - route addition status is stored in "r6->flags & RT_ADDED" Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1441985627-14822-2-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/10083
* Show extra-certs in current parameters, fix clang warning and logic error in ↵Arne Schwabe2015-08-081-1/+2
| | | | | | | | | | | preresolve Closes ticket #591 Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1438859835-3977-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/10005 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Un-break --auth-user-pass on windowsGert Doering2015-08-041-0/+2
| | | | | | | | | | | | | | Commit b131c7b974d9d4d3f0 introduced a check to create a meaningful warning if we try to read a password after daemon()izing (by checking whether stdin or stderr is connected to a tty). For some reason this breaks on Windows builds if run under GUI control - but since Windows doesn't have this particular daemon() issue anyway, just #ifndef WIN32 the offending code. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1438692796-14663-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/10000
* Fix overflow check in openvpn_decrypt()Steffan Karger2015-08-012-11/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Sebastian Krahmer from the SuSE security team reported that the buffer overflow check in openvpn_decrypt() was too strict according to the cipher update function contract: "The amount of data written depends on the block alignment of the encrypted data: as a result the amount of data written may be anything from zero bytes to (inl + cipher_block_size - 1) so outl should contain sufficient room." This stems from the way CBC mode works, which caches input and 'flushes' it block-wise to the output buffer. We do allocate enough space for this extra block in the output buffer for CBC mode, but not for CFB/OFB modes. This patch: * updates the overflow check to also verify that the extra block required according to the function contract is available. * uses buf_inc_len() to double-check for overflows during en/decryption. * also reserves the extra block for non-CBC cipher modes. In practice, I could not find a way in which this would fail. The plaintext is never longer than the ciphertext, and the implementations of CBC/OFB/CBC for AES and BF in both OpenSSL and PolarSSL/mbed TLS do not use the buffer beyond the plaintext length when decrypting. However, some funky OpenSSL engine I did not check *might* use the buffer space required by the function contract. So we should still make sure we have enough room anyway. v2 - always ASSERT() on buf_inc_len(). It is a double-check so should really not fail, but if it fails there has been a buffer overflow. At that point the best thing we can do is assert out. (The primary check *is* handled gracefully, and just drops the packet.) Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1438165826-32762-1-git-send-email-steffan.karger@fox-it.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/9974 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix build on OpenSolaris (non-gmake)Gert Doering2015-07-271-1/+1
| | | | | | | | | Was broken in commit 9de35d4, missing backslash in include/Makefile.am Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1438030010-953-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9967
* Fix out-of-tree builds; openvpn-plugin.h should be in AC_CONFIG_HEADERSSteffan Karger2015-07-271-2/+1
| | | | | | | | | | Was broken in commit 9de35d4. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1438027198-23305-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9964 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Provide OpenVPN runtime version information to plug-insDavid Sommerseth2015-07-274-2/+37
| | | | | | | | | | | | | | | | | | | | Also updated the log_v3 sample-plugin to demonstrate how this works. $ openvpn --plugin log_v3.so --dev tun Fri Jul 10 15:17:28 2015 OpenVPN 2.3_git [git:dev/plugin-version/f05d8623a29078bf+]..... ...more.openvpn.logging... log_v3: OpenVPN 2.3_git (Major: 2, Minor: 3, Patch: git:dev/plugin-version/f05d8623a29078bf+) ...more.openvpn.logging... $ Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1436534548-21507-3-git-send-email-openvpn.list@topphemmelig.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/9904 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Provide compile time OpenVPN version information to plug-insDavid Sommerseth2015-07-275-1/+19
| | | | | | | | | | | This is to provide more fine grained information to plug-ins about the OpenVPN environment when OpenVPN was built. Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1436534548-21507-2-git-send-email-openvpn.list@topphemmelig.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/9905 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix commit e473b7c if an inline file happens to have a line break exactly at ↵Arne Schwabe2015-07-272-2/+5
| | | | | | | | | | | | | | | buffer limit The check does only for strlen(line) space and buf_printf will only use at most space -1 and not print the final character ('\n') in this corner. Since a missing \n only breaks certificates at the start and end marker, missing line breaks otherwise do not trigger this error. Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1438011191-19389-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/9956 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* reintroduce md5_digest wrapper struct to fix gcc warningsSteffan Karger2015-07-274-9/+14
| | | | | | | | | | | | | | | | | I was wrong to assume that adding the const qualifier to the pointer-to- fixed-size-array contruction used in options_hash_changed_or_zero() was allowed. GCC actually warns about this, but I was using clang and clang seems to be fine with the contruction. To make GCC happy too, reintroduce the md5_digest wrapped struct, and use that when passing around the digest. This reverts the "struct md5_digest" parts of 827de237860813d2859a, but keeps the rest. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1437910039-30101-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9949 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* options: fix option check for "plugin"Daniel Hahler2015-07-221-1/+1
| | | | | | | | | | | | | The "plugin" option has one required argument, and an optional one. This fixes a regression in 3d6a4cd (https://community.openvpn.net/openvpn/ticket/557). Signed-off-by: Daniel Hahler <git@thequod.de> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20150721100836.GV382@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9932 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix using management interface to get passwords.Steffan Karger2015-07-211-2/+9
| | | | | | | | | | | | | | | | | | | | Commits da9b292733e929a2900dc32d37f0424c3d588366 and 315f6fbc7f657a7f1127628bd714f468709d5185 broke the use case where we are asking password from the management client. The password is always asked before daemonization. With this fix we avoid this and ask it via management interface in the same spot as before the mentioned commits. Tested on Linux. v2: This patch was first submitted by Christian Pellegrin (from Google), and reworked by Steffan Karger (from the OpenVPN team) to also work for setups with --management-query-passwords but without --auth-user-pass. Signed-off-by: Steffan Karger <steffan@karger.me> Signed-off-by: Christian Pellegrin <chripell@google.com> Tested-by: Christian Pellegrin <chripell@google.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <55A6C46C.5080601@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9927 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Document --daemon changes and consequences (--askpass, --auth-nocache).Gert Doering2015-07-141-0/+16
| | | | | | | | | Trac #574, #576 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1436857794-29419-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9923
* Fix --askpass not allowing for password input via stdinJames Geboski2015-07-131-2/+2
| | | | | | | | | | | | | | | | | | This resolves --askpass treating stdin as a file during the file access check. In turn, this leads to openvpn failing to start if this option is set to stdin. By default, --askpass reads the certificate's password from stdin rather than a file. Without passing the CHKACC_ACPTSTDIN flag to check_file_access(), stdin is marked as being a nonexistent file. Trac #248 Signed-off-by: James Geboski <jgeboski@gmail.com> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <55A41225.2020705@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9918 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Produce a meaningful error message if --daemon gets in the way of asking for ↵Gert Doering2015-07-131-0/+4
| | | | | | | | | | | | | | | | | | | | | | | passwords. With the --daemon / SSL init reordering in da9b292733, we fail if we daemonize first and then try to ask for a private key passphrase (or, for that matter, username+password if --auth-nocache is set) - but no meaningful error message was printed, instead depending on operating system and library versions, either we looped around "ssl init failed" or died with an unspecified "fatal error". So: check if get_user_pass_cr() is called in a context that needs "from_stdin", but both stdin and stderr are not connected to a tty device (which getpass() needs). In that case, print a meaningful error message pointing to --askpass, and die. Trac #574 and #576 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1436814607-16707-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9916
* fix regression: query password before becoming daemonSteffan Karger2015-07-133-5/+11
| | | | | | | | | | | | | | | | The init sequence was changed to daemonize before the crypto init to fix issues on FreeBSD some commits ago. This introduced a regression where we would no longer query for passwords before daemonizing, as described in trac #574 and #576. This commit restores the correct order, and adds a bit of const correctness since we're touching this now code anyway. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1436477759-5884-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9901 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Make __func__ work with Visual Studio tooSteffan Karger2015-07-021-0/+4
| | | | | | | | | | | Because even VS2013 is incapable of doing C99. Signed-off-by: Steffan Karger <steffan@karger.me> Tested-by: Fish Wang <fish.thss@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <CAA1AbxKrPXnc1+PPH4dQV1OksY_0t3ewqRnqVrjhZL+i2Pbkmw@mail.gmail.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/9859 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Increase control channel packet size for faster handshakesSteffan Karger2015-07-011-2/+3
| | | | | | | | | | | | | | | | | | | | | | Instead of limiting the control channel TCP/UDP packet payload size at '100 bytes + real control channel overhead' (~140 bytes ethernet payload), increase the max TCP/UDP payload size to '1250 bytes - calculated overhead' (~1210 bytes ethernet payload). Note that this patch does *not* yield an optimal solution, but it is a simple and rather safe change that will improve connection setup times significantly. v2: use the mininum value of --link-mtu and 1250 to give the user a way to reduce control packet size if really needed. trac #545 Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1435693496-10931-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9841 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Report missing end-tags of inline files as errorsArne Schwabe2015-06-301-1/+8
| | | | | | | | | | | | (2.3 reports as warning only, 2.4 reports as M_FATAL) trac #568 Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1435581995-11820-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/9830 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Del ipv6 addr on close of linux tun interfaceHolger Kummert2015-06-261-0/+26
| | | | | | | | | | | | | | | | | | | | | | | When a linux tun interface is closed (e.g. on disconnect) an optional ipv6 addr that was previously set is deleted now. Without this patch a later reconnect could fail with 'Linux ip -6 addr add failed: external program exited with error status: 2' and openvpn would exit. This is mainly relevant for persistant tun devices (staying around after openvpn exits) but can also happen at reconnect. If addresses are *supposed* to stay around on openvpn exit, run openvpn with --ifconfig-noexec and configure IPv4/IPv6 addresses manually before openvpn starts (or using an --up script). Trac #141 Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1435248080-12670-1-git-send-email-Holger.Kummert@Sophos.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/9810 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fail if options have extra parameters [v2]Jonathan K. Bullard2015-06-211-267/+276
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Throw an error if an option has extra parameters; previously they were silently ignored (see also trac #557) This feature was discussed on the openvpn-devel mailing list (http://thread.gmane.org/gmane.network.openvpn.devel/9599). The (modified) message "Unrecognized option or missing or extra parameter(s)" is used except for a few options: * The --help option: An extra parameter for --help generates a specific error message after showing the syntax message. This is done to help a user who tries "--help tls-cipher" or similar, hoping to get more information about the "tls-cipher" option. * The --dhcp-option option: It has its own similar message, into which " or extra" has been inserted. * Ten options such as --up that accept a command (instead of a path) already detect extra parameters and generate specific error messages that mention double-quoting commands which contain embedded spaces. Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <CAEsd45RvRfmqetu-EoFjSdyBk5F9X1K5muPGu-+_+30TMNOU_A@mail.gmail.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/9783 URL: https://community.openvpn.net/openvpn/ticket/557 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* write pid file immediately after daemonizingSteffan Karger2015-06-215-36/+14
| | | | | | | | | | | | | | | | | Since we split daemonizing from changing directory in commit da9b292 (f025de005d719201a69ad0313d545a1ddd244752 in release/2.3), we can now simply write the pid file immediately after daemonizing. This not only fixes the bug reported in trac #563, but also further simplifies the code. trac #563 Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1434665325-3225-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9793 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix FreeBSD ifconfig for topology subnet tunnels.Gert Doering2015-06-021-1/+23
| | | | | | | | | | | | | | | | | | For "topology subnet", we only pretend to have a subnet and keep using the tun if in point-to-point mode - but for that to fully work, the "remote" address needs to be different from the "local" address. So just arbitrarily construct one from the on-link subnet - base+1, if "that is not us", base+2, otherwise. Fix trac #481 See also: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=194745 Signed-off-by: Gert Doering <gert@greenie.muc.de> Tested-By: Anton Sayetsky <vsasjason@gmail.com> Lazy-ACK-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1430071438-31675-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9606
* Improve documentation in --script-security section of the man-pageSamuli Seppänen2015-06-021-0/+5
| | | | | | | | | | Trac: #395 Signed-off-by: Samuli Seppänen <samuli@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1433231982-24945-1-git-send-email-samuli@openvpn.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/9777 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Move res_init() call to inner openvpn_getaddrinfo() loopGert Doering2015-06-021-4/+3
| | | | | | | | | | | | | | | | | | A non-working nameserver in /etc/resolv.conf could lead to endless loops inside openvpn_getaddrinfo(), because many systems will only pick up changes to resolv.conf if res_init() is called again. To reproduce, run openvpn with --resolv-retry infinite (2.3) or --resolv-retry "a high number" (master) on a BSD system. Linux glibc seems to stat() resolv.conf on calls to getaddrinfo() and pick up changes automatically. Trac #523 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1433080749-6892-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9763
* Fix --redirect-private in --dev tap mode.Guy Yur2015-06-011-1/+1
| | | | | | | | | | | | | | | | | | | | When specifying redirect-private option and not specifying route-gateway or ifconfig options, OpenVPN fails to add the route to the remote host with the following message: NOTE: unable to redirect default gateway -- VPN gateway parameter (--route-gateway or --ifconfig) is missing In redirect_default_route_to_vpn() the check for remote endpoint happens even though it is not used by redirect-private - make check conditional on RG_REROUTE_GW (= --redirect-gateway). Trac #261 Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20150531120327.GE382@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9761 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Use EAI_AGAIN instead of EAI_SYSTEM for openvpn_getaddrinfo().Gert Doering2015-06-011-1/+1
| | | | | | | | | | | | Windows has no EAI_SYSTEM (introduced by 5f6c01ea6172ed), but everyone has EAI_AGAIN - which also fits ("a temporary failure in name resolution"). Trac #276 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1433178914-7842-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9768
* Use configure.ac hack to apply serial_test AM option only if supported.Gert Doering2015-06-011-1/+15
| | | | | | | | | | | | | | | Inspired by libguestfs' configure.ac hack - test automake version, and if 1.12 or newer, use m4 magic to pass "serial_tests" option to AM_INIT_AUTOMAKE(). https://www.redhat.com/archives/libguestfs/2013-February/msg00102.html Trac #427 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <davids@redhat.com> Message-Id: <1433185487-9724-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9769
generated by cgit (git 2.34.1) at 2024-04-19 20:25:31 +0000