summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Fix IPv6 examples in t_client.rc-sampleGert Doering2013-11-171-4/+4
| | | | | | | | | | IPv6 documentation prefix is 2001:db*8*:: (not :dba:), and the second test stanza variables need to end in _2, of course... Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Josh Cepek <josh.cepek@usa.net> Message-Id: <1384624401-27943-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/7992
* t_client.sh: Add prepare/cleanup possibilties for each test caseDavid Sommerseth2013-11-161-0/+13
| | | | | | | | | | | By adding PREPARE_$NUM and CLEANUP_$NUM variables containing command lines to execute before and after the test case is run. Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1384615074-22345-1-git-send-email-dazo@users.sourceforge.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/7990 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* t_client.sh: Write errors to stderr and document requirementsDavid Sommerseth2013-11-162-2/+6
| | | | | | | | | Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Matthias Andree <matthias.andree@gmx.de> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1384597423-11136-1-git-send-email-dazo@users.sourceforge.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/7984 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* t_client.sh: Check for fping/fping6 availabilityDavid Sommerseth2013-11-151-0/+12
| | | | | | | | | | | Check if fping and fping6 is available before running the real tests, to avoid misleading test failures. Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1384535524-6366-1-git-send-email-dazo@users.sourceforge.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/7981 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Document authfile for socks serverDavide Brini2013-11-151-1/+4
| | | | | | | | | | | | | It looks like it's possible to specify an optional authfile as third argument of the "socks-proxy" directive. This patch updates the man page to document that. Signed-off-by: Davide Brini <dave_br@gmx.com> Acked-by: Heiko Hund <heiko.hund@sophos.com> Message-Id: <0MTjMy-1VU1I42Lo0-00QV4k@mail.gmx.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/7875 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* tls_ctx_load_ca: Improve certificate error messagesKlee Dienes2013-11-151-3/+24
| | | | | | | | | | | | | If a CA certificate file includes intermediate certificates, and any of them fail to verify, the current code will file with "Cannot load CA certificate file". Instead, generate a more specific error message identifying the specific sub-certificate(s) which did not validate. Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <CAK6ywbLVtSgRZEt4N+02fz+vQ0GNp==5KdsbqWtZ+fgUzrZq+g@mail.gmail.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/7837 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix argument type warning introduced by http extra proxy header patch.Gert Doering2013-11-151-1/+1
| | | | | | | | | | | d0cb816cf8be68359617b61a55799f6330901f6a introduced add_proxy_headers(), passing "port" as "const char *" - but it should be an "int". As port is not yet actually used inside add_proxy_headers(), it's just a warning. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1384526517-6020-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/7973
* Add reporting of UI version to basic push-peer-info set.Arne Schwabe2013-11-151-7/+9
| | | | | | | | | | | | | | | If a GUIs sets IV_OPENVPN_GUI_VERSION the version will be pushed to the server. Usage convention for IV_OPENVPN_GUI_VERSION is "<gui_id><space><version>", for example "de.blinkt.openvpn 0.5.47" for the ICS Android version. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Acked-by: James Yonan <james@openvpn.net> Message-Id: <1370005175-14871-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7646 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Implement custom HTTP header for http-proxy, and always send user-agent:Arne Schwabe2013-11-154-21/+118
| | | | | | | | | | | | | | | | There are some patched OpenVPN versions out there without source code (e.g. NDMVPN) that support adding custom http header. This patch adds custom header to OpenVPN and supports the syntax that the "in the wild" variants use. Patch v3 also prints all custom headers with other http options in --verb 5 Patch v4 does clean up the add_proxy_header function Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1382688143-17247-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7946 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Require a 1.2.x PolarSSL versionJosh Cepek2013-11-141-2/+2
| | | | | | | | | | | | | | Upstream policy on PolarSSL API compatibility does not guarantee stability between point-releases. For OpenVPN, we must verify a 1.2.x version with the current codebase. This fixes bug#343. Signed-off-by: Josh Cepek <josh.cepek@usa.net> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <5284F32D.3000206@usa.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/7968 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Require polarssl >= 1.2.10 for polarssl-builds, which fixes CVE-2013-5915.Steffan Karger2013-10-241-2/+2
| | | | | | | | | | | | | PolarSSL 1.2.9 fixes a possible timing attack in PolarSSL's RSA-CRT implementation. See CVE-2013-5915 for details. This commit bumps the minimum polarssl version required by configure.ac to 1.2.10, because 1.2.9 also introduced a memory leak, which is fixed in 1.2.10. Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1382445917-2974-1-git-send-email-steffan.karger@fox-it.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/7925 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Support non-ASCII TAP adapter names on WindowsHeiko Hund2013-10-231-5/+10
| | | | | | | | | | | | | | | Currently the TAP adapter name is fetched as an OEM string, which is problematic if it contains non-ASCII characters and is to used with netsh. The logfile also contains these non UTF-8 characters. This patch fetches the name from the registry as UCS-2 and converts it right into UTF-8 before it's used. Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Acked-by: Josh Cepek <josh.cepek@usa.net> Message-Id: <1381829022-15244-1-git-send-email-heiko.hund@sophos.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/7913 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix configure interaction with static OpenSSL librariesPeter Sagerson2013-08-231-1/+3
| | | | | | | | | | | | | Add "-lcrypto" to configure OpenSSL "-lssl" test (if no pkg-config found), otherwise linking with static OpenSSL libraries will fail. Trac ticket #305 Message-Id: <521668C9.5070003@openvpn.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/7835 URL: https://community.openvpn.net/openvpn/ticket/305 Acked-By: Heiko Hund <heiko.hund@sophos.com> Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Allow use of NetBeans without saving nbproject/ directory.Jesse Glick2013-08-221-0/+1
| | | | | | | | | | | .gitignore | 1 + 1 file changed, 1 insertion(+) Acked-by: Samuli Seppänen <samuli@openvpn.net> Message-Id: <CANfRfr0GEw0KJT2XpFu6zGmhKpWOQah_PU2hdROD0FDRktZfVQ@mail.gmail.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/7794 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Correct error text when no Windows TAP device is presentJosh Cepek2013-08-221-1/+1
| | | | | | | | | | | | | | | | Starting with the 2.3-series, the TAP-Windows driver/utilities and OpenVPN are separately installed components. The error message given to users without available TAP devices uses the pre-2.3 path that does not exist. The path should be listed under the TAP-Windows program group that the tap-windows project installer uses. Resolves bug #320 Signed-off-by: Josh Cepek <josh.cepek@usa.net> Acked-by: David Sommerseth <dazo@users.sourceforge.net> Message-Id: <kv4ece$s8s$1@ger.gmane.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7825 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Always load intermediate certificates from a PKCS#12 fileHeikki Hannikainen2013-08-161-1/+19
| | | | | | | | | | | | | | | | | | | | | | | | Load intermediate certificates from a PKCS#12 file and place them in the extra certs chain, when trusted CA certs are loaded from an external PEM file with the --ca option, and the CA certs in PKCS#12 are not to be trusted. Required when client PKCS#12 file is provided by a different CA than the server CA, the PKCS#12 file contains intermediate certificates required for client auth, but the server CA is not in the PKCS#12 file. When --ca is set, the PKCS#12 provided CA certs are not trusted. Without this patch, they were ignored completely - with this patch, they're loaded in the extra certs chain which makes them available for chain verification but still does not make them trusted if --ca is set. Unless when, of course, a trusted root is found from the --ca file. Acked-by: James Yonan <james@openvpn.net> Acked-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <alpine.DEB.2.02.1306201400320.10116@jazz.he.fi> URL: http://article.gmane.org/gmane.network.openvpn.devel/7721 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Add a note what setenv opt does for OpenVPN < 2.3.3Arne Schwabe2013-08-161-0/+4
| | | | | | | | Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1376640680-26468-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7798 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Add support to ignore specific options.Arne Schwabe2013-08-163-2/+77
| | | | | | | | Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1376640664-26379-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7799 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* MSVC fixesJames Yonan2013-08-1610-71/+79
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes to allow compilation with Microsoft Visual Studio 2008 * Fixed several instances of declarations after statements. * In socket.c, fixed issue where uninitialized value (err) is being passed to to gai_strerror. * ssl.c is trying to access multi_output_peer_info_env function in multi.c, causing an undefined symbol warning at compile time. ssl.c is strictly a client of multi.c (but not the other way around), therefore ssl.c does not include multi.h and should not depend on multi.h API. To fix, moved validate_peer_info_line and multi_output_peer_info_env from multi.c to misc.c. * MSVC doesn't support %z as a printf format specifier for size_t * MSVC doesn't support a const variable being used to dimension an array. * Explicitly cast the third parameter to setsockopt to const void * Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1375049135-21444-1-git-send-email-james@openvpn.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/7777 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Added "setenv opt" directive prefix. If present, and if theJames Yonan2013-07-152-1/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | directive that follows is recognized, it will be processed as if the "setenv opt" prefix was absent. If present and if the directive that follows is not recognized, the directive will be ignored rather than cause a fatal error. For example, suppose you are distributing a client configuration file and want to set the minimum TLS version that the client requires from the server to 1.2. By using the following directive, setenv opt tls-version-min 1.2 or-highest only newer clients that understand the tls-version-min directive would process it, while older clients would ignore it. (cherry picked from commit 27713761e4110bb92f1c6dfe85db291e8c6e0f56) Signed-off-by: James Yonan <james@openvpn.net> URL: http://thread.gmane.org/gmane.network.openvpn.devel/7771 URL: http://thread.gmane.org/gmane.network.openvpn.devel/7744 URL: https://github.com/jamesyonan/openvpn/commit/27713761e4110bb92f1c6dfe85db291e8c6e0f56 Acked-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Signed-off-by: David Sommerseth <davids@redhat.com>
* TLS version negotiationJames Yonan2013-07-117-4/+148
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Updated the TLS negotiation logic to adaptively try to connect using the highest TLS version supported by both client and server. Previously, OpenVPN (when linked with OpenSSL) would always connect using TLS 1.0. Also added tls-version-min directive to force a higher TLS version than 1.0: tls-version-min <version> ['or-highest'] -- sets the minimum TLS version we will accept from the peer. Examples for version include "1.0" (default), "1.1", or "1.2". If 'or-highest' is specified and version is not recognized, we will only accept the highest TLS version supported by the local SSL implementation. Examples: tls-version-min 1.1 -- fail the connection unless peer can connect at TLS 1.1 or higher. tls-version-min 1.2 or-highest -- require that the peer connect at TLS 1.2 or higher, however if the local SSL implementation doesn't support TLS 1.2 (as it wouldn't if linked with an older version of OpenSSL), reduce the minimum required version to the highest version supported by the local SSL implementation (such as TLS 1.0). This is intended to allow client configurations to target higher TLS versions that are supported on the server, even if some older clients don't support these versions yet. [ This is a merged patch from on the following commits on git://github.com/jamesyonan/openvpn.git 03a5599202bdc3ba07983dc4efdae387fb8fb436 d23005413b0e0f28a3c48a6342f494763d5c9b40 ] Signed-off-by: James Yonan <james@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> URL: http://thread.gmane.org/gmane.network.openvpn.devel/7743 URL: http://thread.gmane.org/gmane.network.openvpn.devel/7744 Message-Id: 51C77F12.1090802@openvpn.net Signed-off-by: David Sommerseth <davids@redhat.com>
* autoconf: Fix typoDavid Sommerseth2013-07-031-1/+1
| | | | | | | | | | | | | | | | | | In config.h, it would state: /* Enable systemd support */ #define ENABLE_PLUGIN 1 instead of /* Enable plug-in support */ #define ENABLE_PLUGIN 1 Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1370600130-6075-1-git-send-email-dazo@users.sourceforge.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/7658 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* plugin: Extend the plug-in v3 API to identify the SSL implementation usedDavid Sommerseth2013-07-035-6/+38
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OpenVPN would segfault unexpectedly if it would be compiled against PolarSSL and the plug-in would expect OpenSSL, or vice-versa. This segfault would not appear before the plug-in would try to access functions which would be available if the plug-in and OpenVPN uses the same SSL implementation. This patch adds a member to the plug-in initialisation function, which identifies the SSL implementation. The log_v3 plug-in is updated accordingly + a simple fix to make it buildable again using the ./build script. A minor documentation error in the openvpn-plugin.h was also corrected, where it mentioned OPENVPN_PLUGIN_VERSION instead of OPENVPN_PLUGINv3_STRUCTVER. v2 - add const ovpnSSLAPI ssl_api at the end of struct openvpn_plugin_args_open_in and not in the "middle" v3 - fix bug in plug-in init, as the SSLAPI was located wrong in the args struct sent to the openvpn_plugin_open_v3() function. v4 - Ensure SSLAPI got a sane/known value if SSL is disabled or unknown Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1372879030-10576-1-git-send-email-dazo@users.sourceforge.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/7754 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Remove the --disable-eurephia configure optionDavid Sommerseth2013-07-035-22/+2
| | | | | | | | | | | | | | | | This "feature" has been enabled since OpenVPN 2.2 without any reports that this has been causing issues. All it does is to add an extra environment variable 'tls_digest_{n}' with the certificate SHA1 fingerprint/digest hash. Lets just simplify things by removing the possibility to disable this environment variable. Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1370600123-6029-1-git-send-email-dazo@users.sourceforge.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/7660 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* man page: Update man page about the tls_digest_{n} environment variableDavid Sommerseth2013-07-031-0/+10
| | | | | | | | Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1370600111-5983-1-git-send-email-dazo@users.sourceforge.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/7659 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Add support of utun devices under Mac OS XArne Schwabe2013-07-034-68/+286
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Mac OS X 10.7+ natively supports tun devices (called utun). The "standard" utun.ko driver is sometimes problematic (e.g. VmWare Fusion 5 and tun.ko do not work together). When OpenVPN is compiled with utun support it will if no dev-node is given first try to use utun and if that is not available will try the traditional tun devices v2: Fixed tap support, get device name via ioctl, add manage v3.1: Fix compiling without if/utun.h, fix manage errors v4/v5: Don't try open to dynamically open utun0 -255 when early utun initialization fails, fix fallback to tun, give fatal error message when utun fails but no tun fallback should be done v6: add commit message change log, replace strstr with strncmp, move v7: Throw error if a user does the strange combination of --dev tun --dev-type tap and --dev-node utun A lot good input on earlier patches by Jonathan K. Bullard <jkbullard@gmail.com> Parts of the patches are inspired from Peter Sagerson's <psagers@ignorare.net> utun patch Signed-off-by: Arne Schwabe <arne@rfc2549.org> Tested-by: Jonathan K. Bullard <jkbullard@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1371811708-8528-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7739 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* PATCHv3 Remove unused variables or put them to the defines they are being ↵Arne Schwabe2013-06-208-19/+2
| | | | | | | | | | used in Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1366059999-31731-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7511 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Improve documentation and help text for --route-ipv6.Gert Doering2013-06-112-2/+6
| | | | | | | | Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <davids@redhat.com> Message-Id: 1368873781-29552-1-git-send-email-gert@greenie.muc.de URL: http://article.gmane.org/gmane.network.openvpn.devel/7598 Signed-off-by: David Sommerseth <davids@redhat.com>
* Add support for client-cert-not-required for PolarSSL.Tamas TEVESZ2013-06-111-2/+14
| | | | | | | | Signed-off-by: Tamas TEVESZ <ice@extreme.hu> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: alpine.GSO.2.03.1306080732510.23277@extreme.hu URL: http://article.gmane.org/gmane.network.openvpn.devel/7667 Signed-off-by: David Sommerseth <davids@redhat.com>
* Do not pass struct tls_session* as void* in key_state_ssl_init().Steffan Karger2013-06-073-3/+7
| | | | | | | | Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: David Sommerseth <davids@redhat.com> Message-Id: 51B1DBEF.1090705@fox-it.com URL: http://article.gmane.org/gmane.network.openvpn.devel/7664 Signed-off-by: David Sommerseth <davids@redhat.com>
* Fix another #ifdef/#if P2MP_SERVERArne Schwabe2013-06-011-1/+1
| | | | | | | | Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1370013992-18592-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7647 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Move checking of script file access into set_user_scriptArne Schwabe2013-05-311-22/+11
| | | | | | | | | | At the moment script are only checked if P2MP_SERVER is defined. For CLIENT_ONLY openvpn script were never checked. Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1369947737-26081-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7635 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Move settings of user script into set_user_script functionArne Schwabe2013-05-313-30/+37
| | | | | | | | | | This also fixes commit 567bfc06d051b60e9cdca1f5bb468631b899682a if not all script options are available by setting options->user_script_used Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1369945603-17169-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7634 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix #ifdefs for P2MP_SERVERArne Schwabe2013-05-312-2/+2
| | | | | | | | | | | (Fix check introduced by commit a8be73799be1639, testing with #ifdef instead of #if - P2MP_SERVER is always defined, and can be "0" or "1") Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1369949680-9499-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7637 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Provide more accurate warning messageDavide Brini2013-05-301-1/+1
| | | | | | | | | | Very simple fix. Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <0LzcMG-1ULZ4T0Fuc-014gq9@mail.gmx.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/7628 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Only print script warnings when a script is used. Remove stray mention of ↵Arne Schwabe2013-05-302-7/+14
| | | | | | | | | | script-security system. Acked-by: Jan Just Keijser <janjust@nikhef.nl> Message-Id: <1369920428-11350-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7625 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix problem with UDP tunneling due to mishandled pktinfo structures.Gert Doering2013-05-301-6/+5
| | | | | | | | | | | | | | | | In link_socket_write_udp_posix_sendmsg(), pktinfo structures for ipv4 and ipv6 are going out of scope before actually calling sendmsg(), so depending on compiler optimization, garbage is passed to sendmsg() - fix by using "union openvpn_pktinfo" and having that in scope all the time. Problem reported and patch provided by "danta" in trac#297 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> URL: https://community.openvpn.net/openvpn/ticket/297 Message-ID: <20130530184427.GP20843@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/7629
* Make push-peer-info visible in "normal" per-instance environment.Gert Doering2013-05-275-44/+84
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Without this patch, peer-info pushed by clients in the TLS handshake is only visible on the management interface, and only if --management-client-auth is enabled. With this patch, received records are sanitized and put into the normal "multi instance" environment, where it can be evaluated by --client-connect or --auth-user-pass-verify scripts and plugins, etc. Only records matching a fairly strict "name=value" format are accepted, and only names starting with IV_ or UV_ are exported, to avoid clients sending funny stuff and playing havoc with script/plugin environments on the server. In the "value" part, spaces, non-printable characters and shell metacharacters are replaced by '_'. The change is somewhat invasive as reception of the peer_info string was only done when username+password are expected from the client, but the data is always there (if the client sends no username/password, it will send 0-length strings, so always extracting 3 strings is safe). Also, the sanitation function validate_peer_info_line() and the opts->peer_info field were only compiled in #ifdef MANGEMENT_DEF_AUTH... Patch v3: do not call the old man_output_peer_info_env() anymore, unless a management env-filter has been set (= ensure IV_ and UV_ stuff is sent at most *once*, and exactly the way OpenVPN AS expects it). Add substituting of "bad" characters in the environment values. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1367757373-31637-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/7582
* Always push basic set of peer info values to server.James Yonan2013-05-273-17/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | On the client, allow certain peer info fields to be pushed even if push-peer-info isn't specified in the config. This is needed to allow the compression handshake to work correctly (i.e. where the client indicates its support for LZO and/or Snappy). Fields that have privacy implications such as Mac Address and UV_* environment variables will not be pushed to the server as before unless push-peer-info is specified by client config. v1: equivalent to OpenVPN SVN r8225 (2.1.21c) v2: distinguish 3 levels of peer-info detail --push-peer-info specified --> send all we have --pull specified --> send basic set, as per r8225 default --> send nothing (do not leak from server) v3: undo extra whitespace changes in v1 and v2 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1369044801-7594-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/7604
* make 'explicit-exit-notify' pullable againJan Just Keijser2013-05-241-2/+1
| | | | | | | | Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <519F5ED0.4070109@nikhef.nl> URL: http://article.gmane.org/gmane.network.openvpn.devel/7605 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix usage of 'compression ...' from global config.Gert Doering2013-05-191-4/+0
| | | | | | | | | | | | | The new compression framework introduced by SVN r8206 only works for a P2MP server if the compression settings are re-installed for each client via management interface, ccd/ file or client-connect script, but the "global" settings get lost due to (needlessly) clearing the c2.comp_context in the per-client instance. Fixed. (also trac#273) Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1366393268-27392-6-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/7529
* Added support for the Snappy compression algorithmJames Yonan2013-05-1919-403/+975
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Added support for the Snappy compression algorithm which has shown to have considerably better compression speed than LZO at a comparable compression ratio. To enable Snappy add: compress snappy to both client and server config files. Alternatively, enable compression framing on the client: compress and have the server selectively push "compress snappy" to the client. This change also extends the client capability handshake to include IV_SNAPPY so the server can be aware that a connecting client supports Snappy. Note that the Snappy implementation also includes an improved framing approach where the first byte of the compressed payload is replaced by the compression control byte (the first payload byte is moved to the end of the packet). This solves off-by-one alignment issues, which improves performance on ARM. By default, the configure script will try to build with Snappy support. To disable, use the --disable-snappy option. The --enable-lzo-stub configure directive is now --enable-comp-stub (because it's not actually "lzo" but "compression-enabled packet framing") Add compression overhead to extra buffer unconditionally, as long as USE_COMP is defined. OpenVPN SVN r8206 (2.1.21a) and r8212 (2.1.21b) Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1366393268-27392-3-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/7531 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix Windows script execution when called from script hooksJosh Cepek2013-05-191-1/+4
| | | | | | | | | | | | | | | Console applications under Windows, such as batch scripts, require the CREATE_NO_WINDOW process flag when run without an actual console window present. This change allows such scripts to execute and impact the hook status by way of their return code. Fixes bug #240. Signed-off-by: Josh Cepek <josh.cepek@usa.net> Acked-by: Heiko Hund <heiko.hund@sophos.com> Message-Id: <kn2pao$5sv$1@ger.gmane.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7594 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix NULL-pointer crash in route_list_add_vpn_gateway().Gert Doering2013-05-182-3/+5
| | | | | | | | | | | | | | | Add ASSERT() check to route_list_add_vpn_gateway() to ensure that *rl is valid (and if not, crash with a somewhat more meaningful message than "segmentation violation"). For the actual bugfix, change init code to always allocate a "struct route_list" for IPv4, even if no --route options have been seen in the config. Fix trac#281 and trac#258. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Josh Cepek <josh.cepek@usa.net> Message-Id: <1367608404-2257-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/7581
* Use constrain_int() instead of MIN()+syshead.c compat definition - v2.Gert Doering2013-05-072-8/+1
| | | | | | | | | | | | | | Reverts commit 15ca5c297b556fbb, instead change ssl_openssl.c to use "constrain_int()", which already exists in "integer.h". Using this instead of min_int() ensures that the result is always bounded to 0...256 even in the case of a potential MAX_INT overflow. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <davids@redhat.com> Message-Id: 1367826941-22412-1-git-send-email-gert@greenie.muc.de URL: http://article.gmane.org/gmane.network.openvpn.devel/7586 Signed-off-by: David Sommerseth <davids@redhat.com>
* Fix segfault when enabling pf plug-inssvimik2013-05-061-1/+1
| | | | | | | | | | This fixes an issue where a segfault happens in pf_cn_test() if no packet filtering rules have been parsed. See the trac ticket for more details. Trac: 163 Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: David Sommerseth <davids@redhat.com>
* Fix proto tcp6 for server & non-P2MP modesJosh Cepek2013-05-031-0/+4
| | | | | | | | | | | | | This fix adds support for using tcp6 as a proto in server or non-P2MP modes, resolving a failed ASSERT in such cases. Fixes the crash in trac#288. Signed-off-by: Josh Cepek <josh.cepek@usa.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <klul5d$8ta$1@ger.gmane.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7578 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Document the Android implementation in OpenVPNArne Schwabe2013-05-012-0/+77
| | | | | | | | | | Also fix a minor mistake in the manpage. Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1367353997-6669-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7571 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Emulate persist-tun on AndroidArne Schwabe2013-05-011-1/+17
| | | | | | | | | | | | On Android changing the configuration of tun is not possible. So instead of reconfiguring the tun device, open a new tun device and close the old one if needed. Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1367006372-14815-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7558 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Android platform specific changes.Arne Schwabe2013-05-019-5/+144
| | | | | | | | | | | | | On Android 4.0 (TARGET_ANDROID) the real opening of the tun is handled by the (Java) application controlling OpenVPN. Instead of calling ifconfig/route call the management to do the work. When running openvpn as root openvpn should be compiled as TARGET_LINUX Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1367350151-23089-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7570 Signed-off-by: Gert Doering <gert@greenie.muc.de>
generated by cgit (git 2.34.1) at 2025-09-27 06:18:13 +0000