summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Fix "." in description of utun.Thomas Veerman2014-01-231-2/+2
| | | | Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Add "test-driver" and "compile" to .gitignoreGert Doering2014-01-201-0/+2
| | | | | Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org>
* convert struct signal_info elementHeiko Hund2014-01-171-1/+1
| | | | | | | | | | | This one place was forgotten when the elements type was changed from bool to int in the dual stack patch 23d61c56. Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1389972638-8006-2-git-send-email-heiko.hund@sophos.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/8243 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* make sure sa_family_t is definedHeiko Hund2014-01-172-0/+13
| | | | | | | | | | | On Windows there's no sa_family_t. This patch defines it in syshead.h is configure did not find it in the system headers. Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1389972638-8006-1-git-send-email-heiko.hund@sophos.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/8242 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Replace copied structure elements with including <net/route.h>Gert Doering2014-01-161-93/+2
| | | | | | | | | | | | | | | | | | | | | | The code for FreeBSD, Dragonfly, OpenBSD and NetBSD contained copies of structures from <net/route.h> (struct rt_msghdr in particular). OpenBSD changed some structure elements, making OpenVPN incompatible, depending on the specific OpenBSD version. Clean up: remove copied definitions, replace by including <net/route.h> directly - this could not be done originally due to a conflict with "struct route" in OpenVPN and <net/route.h>, cleaned up by the previous commit. Tested on FreeBSD 9.1-RELEASE, NetBSD 5.1, OpenBSD 4.9 (route.c compiles with no warnings, and "openvpn --show-gateway" works, which is the only part of the code that uses the structures in question). Fix trac #340 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1389650074-18455-2-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/8230
* Rename 'struct route' to 'struct route_ipv4'Gert Doering2014-01-163-26/+26
| | | | | | | | | | | | To fix trac #340, we need to rename our "struct route" to avoid a collision with "struct route" from <net/route.h> on *BSD. No functional changes. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1389650074-18455-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/8231
* Fix compiler warnings in ssl_polarssl.cSteffan Karger2014-01-121-5/+8
| | | | | | | | | | | | | * Made some type casts explicit. * Changed type of sha256_hash to unsigned char[], because polar expects that. * Added missing error.h include. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1389555572-6210-4-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/8225 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Remove unused variables from ssl_verify_polarssl.c's x509_get_serial()Steffan Karger2014-01-121-2/+0
| | | | | | | | Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1389555572-6210-3-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/8222 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix compiler warning for unused result of write()Steffan Karger2014-01-121-1/+2
| | | | | | | | | | Issue a warning instead of ignoring a failed write() completely. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1389555572-6210-2-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/8223 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Document issue with --chroot, /dev/urandom and PolarSSL.Gert Doering2014-01-121-0/+10
| | | | | | | | | See trac#218 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1389441036-12538-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/8213
* Cleanup ir6->netbits handling.Gert Doering2014-01-113-59/+18
| | | | | | | | | | | | | | | | | Get rid of all "if (ir6->netbits>=0)" checks, as those are always true (unlike ir->netbits for IPv4, we don't do the special case for "if it's a host, put -1 in there" for IPv6). Merge mroute_helper_{add,del}_iroute and mroute_helper_{add,del}_iroute6 into unified mroute_helper_{add,del}_iroute46() function as they did the same thing anyway, just with slightly different parameters. Make Arne happy. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1389371142-26705-2-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/8198
* remove some 'unused variable' warningsGert Doering2014-01-113-3/+3
| | | | | | | | Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1389371142-26705-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/8197
* Reduce IV_OPENVPN_GUI_VERSION= to IV_GUI_VER=Gert Doering2014-01-091-2/+2
| | | | | | | | | | Use shorter variable name to signal the same thing (see f3a2cd255a3bc73) to save space in the buffer used by the collective IV_ info sent to server. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1389296891-1487-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/8183
* Make code and documentation for --remote-random-hostname consistent.Gert Doering2014-01-092-19/+10
| | | | | | | | | | | | | | Documentation examples, description and code were disagreeing on what this option actually does. Now they will all agree that it will *prepend* a random-byte string to the hostname name before resolving to work around DNS caching (needs a "*" wildcard record in the zone). Fix trac #143 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1384698620-27946-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/7999
* Fix spurious ignoring of pushed config options (trac#349).Jens Wagner2014-01-073-1/+5
| | | | | | | | | | | | | | | | | | | | | | | The function incoming_push_message(...) in push.c uses a local variable option_types_found, that gets passed to do_up(...). If the server push got split into several parts, only the last part (PUSH_MSG_REPLY) option_types_found is used for do_up (initilized as 0 locally), the previous ones (PUSH_MSG_CONTINUATION) are ignored. So e.g. a ping config, pushed by the server in the first push, followed by a lot of "push route" configs, causing a second push message, will have the do_up() called, but without e.g. the OPT_P_TIMER flag, so those options will be silently ignored. The patch resolves that, by introducing "push_option_types_found" in "c->options" and using that as storage. Fix trac bug #349. Acked-by: Gert Doering <gert@greenie.muc.de> URL: https://community.openvpn.net/openvpn/ticket/349 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Document "lz4" argument to "compress" config option.Gert Doering2014-01-061-2/+4
| | | | | | | Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1389012640-24174-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/8178
* Provide LZ4 sources in src/compat/ and use if no system lz4 library found.Gert Doering2014-01-065-3/+1044
| | | | | | | | | | | Bundle lz4.c and lz4.h from http://code.google.com/p/lz4/ (r109) as src/compat/compat-lz4.[ch], and use that (via #define NEED_COMPAT_LZ4) if autoconf cannot find lz4.h or -llz4 in the system. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1388613479-22377-2-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/8154
* Implement LZ4 compression.Gert Doering2014-01-069-4/+319
| | | | | | | | | | | | | | | | | | Implement LZ4 compression, similar to the existing snappy / push-peer-info model: a LZ4 capable client will send IV_LZ4=1 to the server, and the algorithm is selected by pushing "compress lz4" back. LZ4 does not compress as well as LZO or Snappy, but needs far less CPU and is much faster, thus better suited for mobile devices. See https://code.google.com/p/lz4/ for more details. LZ4 include and library path can be specified by specifying LZ4_LIBS=... and LZ4_CFLAGS=... on the configure command line. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1388613479-22377-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/8153
* Disable export ciphers by default for OpenSSL builds.Steffan Karger2014-01-051-1/+3
| | | | | | | | | | | | | | | Export ciphers are deliberately weak ciphers, and not fully supported by OpenVPN since ephemeral RSA support has been removed a few commits ago. This commit removes them from the default cipher list to avoid confusion. PolarSSL does not support export ciphers, so no action required there. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1388607026-12297-7-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/8146 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Make tls_ctx_restrict_ciphers accept NULL as char *cipher_list.Steffan Karger2014-01-054-12/+24
| | | | | | | | | | | | | | | | This adds some ifs to check for NULL in tls_ctx_restrict_ciphers() to prepare for disabling export ciphers by default in OpenVPN 2.4+. Also let tls_ctx_restrict_ciphers always be called, also when *cipher_list is NULL. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <52C8922E.3030607@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/8173 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Update IPv6 related readme filesArne Schwabe2014-01-032-20/+17
| | | | | | | | Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1388760580-7548-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8167 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Remove OpenSSL tmp_rsa_callback. Removes support for ephemeral RSA in TLS.Steffan Karger2014-01-031-18/+0
| | | | | | | | | | | | | | | | | | | | | This code would not really generate ephemeral keys every time it is called, but a single key that would be reused during process lifetime and returned each time the function was called; probably not what users would expect. TLS allowes ephemeral keys to be used only when no other key exchange, such as (ephemeral) Diffie-Hellman, is performed. The end result is that it was only used by a number of (weak) export ciphers, which could give users a false sense of security. So, instead of fixing a weak cipher mode, we'll just remove support for it completely. Plenty of better alternatives are available in TLS. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1388607026-12297-5-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/8152 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* If --tls-cipher is supplied, make --show-tls parse the list.Steffan Karger2014-01-034-9/+20
| | | | | | | | | | | | This allows to check the available TLS ciphers for a specific configuration by supplying both --tls-cipher and --show-tls options. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1388607026-12297-4-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/8150 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Update TLSv1 error messages to SSLv23 to reflect changes from commit 4b67f98Steffan Karger2014-01-031-2/+2
| | | | | | | | | | | | Commit 4b67f98 changed call to TLSv1_{client,server}_method() to SSLv23_{client,server}_method(), this commit updates the corresponding error messages to match the changes in the code. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1388607026-12297-3-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/8147 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Also update TLSv1_method() calls in support code to SSLv23_method() calls.Steffan Karger2014-01-031-2/+2
| | | | | | | | | | | | Commit 4b67f98 changed calls to TLSv1_{sever,client}_method() to SSLv23_{client,server}_method() to enable TLS version negotiation. This commit does the same for two calls of TLSv1_method() from support code. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1388607026-12297-2-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/8148 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Add warning for using connection block variables after connection blocksArne Schwabe2013-12-171-7/+23
| | | | | | | | | | | | | | | In 2.3 some options that were allowed only in global config before have been moved to connection blocks. This changes the behaviour if the variables were defined after connection block. This patch adds a warning to catch these mistakes. Also let warnings errors show [CONNECTION-OPTIONS] instead of [CMD-LINE] for connection blocks Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1387275767-10303-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8117 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix file checks when --chroot is being usedDavid Sommerseth2013-12-161-21/+61
| | | | | | | | | | | | | | | | | | | | | | | | | Commit 0f2bc0dd92f43c9 started to introduce some file sanity checking before OpenVPN started to avoid harder to explain issues due to missing files or directories later on. But that commit did not consider --chroot at all. Which would basically cause OpenVPN to complain on non-missing files, because it would not consider that the files where inside a chroot. This patch is based on the thoughts in a patch by Josh Cepek [1], but trying to simplify it at bit. [1] <http://thread.gmane.org/gmane.network.openvpn.devel/7873>, (Message-ID: l142b7$15v$1@ger.gmane.org) [v2 - Simplify the changes in check_cmd_access(), let the chroot tackling happen only in check_file_access_chroot() only] Trac-ticket: 330 Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1385382778-4723-1-git-send-email-dazo@users.sourceforge.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/8060 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* pkcs11: use generic evp key instead of rsaAlon Bar-Lev2013-12-162-8/+8
| | | | | | | | | | | Enables DSA, ECDSA key usages with newer pkcs11-helper. Signed-off-by: Alon Bar-Lev <alon.barlev@gmail.com> Tested-By: Sanaullah <sanaullah82@gmail.com> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1384209366-26170-1-git-send-email-alon.barlev@gmail.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/7960 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Support non-ASCII characters in Windows tmp pathHeiko Hund2013-12-051-13/+21
| | | | | | | | | | | | | Get the temporary path from the system as UCS-2 and convert it to UTF-8 and return that for internal use. Fix trac#278. Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1384882574-28242-1-git-send-email-heiko.hund@sophos.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/8002 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix IPv6_V6ONLY logic.Gert Doering2013-12-011-1/+2
| | | | | | | | | | | The "ipv6only" setsockopt logic introduced by 8832c6c4cf was inverted, fix. Also add a msg() to show what value is set, as that makes strange v4/v6 connectivity problems much easier to spot. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1385847508-32248-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/8079
* Implement listing on IPv4/IPv6 dual socket on all platformArne Schwabe2013-11-297-11/+41
| | | | | | | | | | With this patch OpenVPN will listen on Ipv4 as well as IPv6 when an IPv6 socket is used. Using bind ipv6only will disable this behavior Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1385382680-5912-7-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8052 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Move ASSERT so external-key with OpenSSL works againArne Schwabe2013-11-291-1/+2
| | | | | | | | Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1385728360-32127-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8069 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Implement dual stack client support for OpenVPNArne Schwabe2013-11-2915-643/+684
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch contains a number of changes. I did not further spit this since some changes make only sense being changed together. Always use connection_list, simplifies the reconnection logic. Change meaning of --connect-retry-max and --connect-retry to be used all connections. This now allows OpenVPN to quit after n unsuccessful udp connection attempts Remove the tcp reconnection logic. Failing a TCP connection will now cause a USR1 like a UDP connection. Also extend sig->source from bool to int to specify signal source. This allows a finer grained reconnection logic if necessary in the future. Dual-Stack support: if an address resolves to multiple records each address is tried in sequential order. Then proceed to next connection entry. Introduce the field current_remote to represent the current connecting remote. Also change some fields to struct addrinfo* form openvn_addr to store multiple addresses needed for the dual stack support. Change meaning from udp and tcp to allow both IPv4 and IPv6. Introducue new udp4 and tcp4 to force IPv4. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1385382680-5912-6-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8058 Signed-off-by: Gert Doering <gert@greenie.muc.de> Message-ID: <20131129194258.GL161@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8071 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* When resolving fails print the error message from socket layerArne Schwabe2013-11-271-5/+7
| | | | | | | | Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1385382680-5912-5-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8059 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* change the type of 'remote' to addrinfo*, and rename to 'remote_list'.Arne Schwabe2013-11-275-39/+111
| | | | | | | | | | | | | | | | | Warning: this is work in progress, preparing for the full dual-stack client patch. With this commit in place, connecting via "--proto udp" or "--proto tcp-client" to a host that has IPv4+IPv6 in place, on an OS that will prefer IPv6 to IPv4 will always fail. The remote_list will have IPv6 in it's first entry, while the socket will try to do AF_INET, and that will not work. This will be fixed by the upcoming change to handle multiple remote IP addresses (as returned by getaddrinfo()) as multiple <connection> blocks, with appropriate retry and AF selection logic. Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1385382680-5912-4-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8053 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Remove the ip-remote-hint option.Arne Schwabe2013-11-263-21/+2
| | | | | | | | | | | | | | | | | | | | | The ip-remote-hint option overrides the remote hostname of every remote/connection entry unless management-query-remote is also defined and the management interfaces overrides the option with remote MOD. The remote name is even overridden when when management interface issues remote ACCEPT after being presented with the non overridden remote. Overriding all remote options can also be done by management-query-remote and issuing remote MOD or by changing alll remote statements in the configuration. Also: remove unused variable newcycle Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1385382680-5912-3-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8057 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Change proto_remote() function to return a constant stringArne Schwabe2013-11-263-12/+14
| | | | | | | | | | | | | Instead of using the implicit protocol string that is returned by the proto/af to names function return a constant string. The strings have become part of the wire protocl and we do not want them to change if the printing of proto/af changes. Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1385382680-5912-2-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8055 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Split link_socket_init_phase1 and link_socket_init_phase2 intoArne Schwabe2013-11-261-207/+256
| | | | | | | | | smaller more managable/readable functions. No functional changes Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1385382680-5912-1-git-send-email-arne@rfc2549.org> Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix assertion when SIGUSR1 is received while getaddrinfo is successfulArne Schwabe2013-11-241-6/+8
| | | | | | | | Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1385064495-25877-4-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8019 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* t_client.sh: ignore fields from "ip -6 route show" output that distort results.Gert Doering2013-11-241-1/+1
| | | | | | | | | | | | | | | "ip -6 route show" prints stuff like "rtt 38ms rttvar 38ms cwnd 10", which sometimes changes while an OpenVPN test is running, resulting in spurious failures in the "ifconfig/route must be restored identically after OpenVPN ends" test in t_client.sh. Not all fields are there all the time, so use "sed" to get rid of whatever is printed this time. Only relevant for "make check" on linux builds with "--enable-iproute2". Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1385309584-23209-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/8047
* Fix two instances of asserting AF_INETArne Schwabe2013-11-241-3/+2
| | | | | | | | | The http-proxy and socks-proxy work fine with IPv6 but assert having IPv4 Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1385064495-25877-6-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8010 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Split the PROTO_UDP_xx options into AF_INET/AF_INET6 and PROTO_TCP/PROTO_UDP ↵Arne Schwabe2013-11-248-167/+144
| | | | | | | | | | | | | part. Splitting will make the code a little bit cleaner and prepares for dual stack Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1385236624-3776-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8043 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Simplify print_sockaddr_ex function, merge duplicate ipv4/ipv6 logic.Arne Schwabe2013-11-233-65/+67
| | | | | | | | Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1385064495-25877-2-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8023 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix compile error in ssl_openssl introduced by polar external-management patchArne Schwabe2013-11-231-2/+2
| | | | | | | | | Acked-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1385210434-28364-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8039 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* external_pkcs1_sign: Support non-RSA_SIG_RAW hash_idsJoachim Schipper2013-11-231-7/+69
| | | | | | | | | | | For TLSv1.2, we need to support various hashes. (GPL) code taken from PolarSSL pkcs11_sign(). Signed-off-by: Joachim Schipper <joachim.schipper@fox-it.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1379587649-25506-4-git-send-email-steffan.karger@fox-it.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/7887 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* --management-external-key for PolarSSLJoachim Schipper2013-11-233-5/+102
| | | | | | | | | | | | | Add --management-external-key support, compatible with the OpenSSL implementation. Needs the flexibility of ssl_set_own_cert_alt(), which is new in PolarSSL-1.2. Signed-off-by: Joachim Schipper <joachim.schipper@fox-it.com> Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1379587649-25506-3-git-send-email-steffan.karger@fox-it.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/7886 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Refactor tls_ctx_use_external_private_key()Joachim Schipper2013-11-234-46/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | OpenSSL's tls_ctx_load_cert_file() had a parameter in which a copy of the context's certificate chain was stored on return, used by tls_ctx_use_external_private_key() only and free()d immediately thereafter. PolarSSL also supported this output parameter, but returned a pointer to the context's certificate chain (rather than to a copy of the certificate, as OpenSSL does) - which meant that we would have to #ifdef the free(). PolarSSL cannot make a copy of a certificate chain, and OpenSSL cannot store a pointer to (instead of a copy of) the cert. So remove the output parameter from tls_ctx_load_cert_file() and incorporate the needed functionality directly into tls_ctx_use_external_private_key() (which is straightforward for both OpenSSL and PolarSSL, as long as you don't try to support both at once.) Signed-off-by: Joachim Schipper <joachim.schipper@fox-it.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1379587649-25506-2-git-send-email-steffan.karger@fox-it.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/7888 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Change the type of all ports in openvpn to const char* and let getaddrinfo ↵Arne Schwabe2013-11-2215-246/+181
| | | | | | | | | | | | | | | | | resolve the port together with the hostname. This delays error reporting from config parsing to resolving of host addresses. But it allows statements like remote openvpn.example.org openvpn port https management localhost ntp Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1385064495-25877-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8018 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Remove duplicate cipher entries from TLS translation table.Max Muster2013-11-201-4/+0
| | | | | | | | | Patch from trac#304 - the translation table OpenSSL<->IANA contained duplicates for four IANA names, causing translation backwards to fail. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-By: Steffan Karger <steffan.karger@fox-it.com> URL: https://community.openvpn.net/openvpn/ticket/304
* Fix slow memory drain on each client renegotiation.Gert Doering2013-11-173-12/+21
| | | | | | | | | | | | | | | | | | | | This reverts commit bee92b479414d12035b0422f81ac5fcfe14fa645 and parts of commit dc7be6d078ba106f9b0de12f3e879c3561c3c537, as these introduced a subtle memory drain on client renegotiations (es->gc got initialized, which led to "unused" gc_entry records accumulating while a client is connected). Setting es->gc=NULL causes env_set_add_nolock() / remove_env_item() to free() allocated and no longer used strings in the es, while an active gc would leave them for cleanup with gc_free() at client disconnect time. Signed-off-by: Gert Doering <gert@greenie.muc.de> Conflicts: src/openvpn/buffer.c Acked-by: David Sommerseth <dazo@users.sourceforge.net> Message-Id: <20131023162618.GP161@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/7939
generated by cgit (git 2.34.1) at 2025-09-27 07:35:05 +0000