summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Add ability to send/receive file descriptors via management interfaceArne Schwabe2013-05-012-0/+91
| | | | | | | | | | | | | Used for communicating with the Java side on Android to send to-be-protected socket fd, and to receive tun fd. For now under #ifdef ANDROID Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1367006045-13576-2-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7557 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Allow routes to be set before opening tun, similar to ifconfig before ↵Arne Schwabe2013-05-012-2/+20
| | | | | | | | | | opening tun Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1367159559-22947-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7564 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Improve the git revision trackingDavid Sommerseth2013-04-194-8/+10
| | | | | | | | | | | | | | | | | | | | This removes the single 'git revision' line from the --version screen and moves this information on the top, together with the OpenVPN version. In addition this patch adds two git flags after the git committish. If there exists changed but unstaged files when the build was done, a '+' is appended after the committish. If there exists staged files (files which have been added with 'git add') a '*' will be appended. These flags are not exclusive. This also simplifies the config-version.h generation by not using sed parsing a template. It's just two lines which are generated, so no need to complicate things more than needed. Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: 1366375212-14886-1-git-send-email-dazo@users.sourceforge.net URL: http://article.gmane.org/gmane.network.openvpn.devel/7522
* Fixed usage of stale define USE_SSL to ENABLE_SSLSteffan Karger2013-04-152-3/+5
| | | | | | | | Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <516BCEA2.6000608@fox-it.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/7509 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Print "Virtual IPv6 Address" on management interface queries [v4]Gert Doering2013-04-122-3/+6
| | | | | | | | | | | Add extra column to management queries for "status 2" or "status 3" after "Virtual Address", empty if no IPv6 address assigned to this client (or IPv6 not active at all). Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20130411150918.GW569@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/7503
* Print client id only if compiled with man agent support. OtherwiseArne Schwabe2013-04-111-2/+11
| | | | | | | | | | | | print an empty string. Also use %lu instead of %u for printing unsigned long int Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1365687278-3921-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7498 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Add the client id (CID) to the output of the status commandArne Schwabe2013-04-111-4/+5
| | | | | | | | | | | | This add adds CID which is needed by a few other management commands to the status output. This will change the output of status in the same way commit ca18a638aa7cf316611f893127ba44131e57083c did. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1346422753-19520-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7021 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fixed tls-cipher translation bug in openssl-buildSteffan Karger2013-04-051-2/+5
| | | | | | | | Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1CED409804E2164C8104F9E623B08B9013BC28A538@FOXDFT02.FOX.local> URL: http://article.gmane.org/gmane.network.openvpn.devel/7480 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix directly connected routes for "topology subnet" on Solaris.Gert Doering2013-03-271-6/+9
| | | | | | | | | | | | | | This basically brings back the previously-working metric setting for directly connected routes (add a "0" to the "route add" command) on Solaris/OpenSolaris. It was working in f0eac1a59790, and got broken by the route.c/route.h refactoring in 576dc96ca1ef1 - the patch un-does that change to the TARGET_SOLARIS code, plus adds some more descriptive comments. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Josh Cepek <josh.cepek@usa.net> Message-Id: <1364314175-20758-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/7460
* Add MIN() compatibility macroGert Doering2013-03-231-0/+7
| | | | | | | | | | | commit 3b23b18dddb8f8f4a introduced usage of MIN(), and not all platforms have the macro in "readily usable" system header files, most notably it's missing on OpenSolaris and Android. Add macro if not defined yet. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20130323112234.GM17727@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/7450
* Use constant time memcmp when comparing HMACs in openvpn_decrypt.Steffan Karger2013-03-222-1/+27
| | | | | | | | | | | | Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Signed-off-by: Gert Doering <gert@greenie.muc.de> Notes: This issue has been assigned to CVE-2013-2061 URL: http://www.openwall.com/lists/oss-security/2013/05/06/6 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=2013-2061
* Fixed autoconf script to properly detect missing pkcs11 with polarssl.Steffan Karger2013-03-221-11/+43
| | | | | | | | | | | | When polarssl is compiled without pkcs11 support, or a required pkcs11-helper library is missing, configure will now issue an error. Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1363942465-3251-7-git-send-email-steffan.karger@fox-it.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/7441 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Switch to IANA names for TLS ciphers.Steffan Karger2013-03-224-4/+251
| | | | | | | | | | | | | Added translation table and functions to translate between TLS OpenSSL and IANA (IETF) cipher suite names. The previously used OpenSSL names are still accepted, but a deprecation warning is issued. Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1363942465-3251-6-git-send-email-steffan.karger@fox-it.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/7439 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Config compatibility patch. Added translate_cipher_name.Steffan Karger2013-03-224-3/+75
| | | | | | | | | | | | | | | Added translate_cipher name to crypto_openssl.c and crypto_polarssl.c to translate between OpenVPN(/OpenSSL) and PolarSSL data channel cipher algorithm names. OpenSSL does not require any translating, PolarSSL does for a small number of algorithms. This improves on config file compatibility between the OpenSSL and PolarSSL builds. Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1363942465-3251-5-git-send-email-steffan.karger@fox-it.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/7435 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Improve verify_callback messagesSteffan Karger2013-03-221-3/+3
| | | | | | | | | | | | Print the *flags argument, which - for PolarSSL-1.2 - contains the reasons that the certificate failed (pre-)verification. Signed-off-by: Joachim Schipper <joachim.schipper@fox-it.com> Acked-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1363942465-3251-4-git-send-email-steffan.karger@fox-it.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/7437 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Improve PolarSSL key_state_read_{cipher, plain}text messagesSteffan Karger2013-03-221-2/+6
| | | | | | | | | | | | Instead of logging the fact that an error occured, log the error code and description (when available in the PolarSSL build). Signed-off-by: Joachim Schipper <joachim.schipper@fox-it.com> Acked-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1363942465-3251-3-git-send-email-steffan.karger@fox-it.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/7440 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* PolarSSL-1.2 supportSteffan Karger2013-03-227-58/+31
| | | | | | | | | | | | | | Add support for PolarSSL-1.2, which has changed the API in several places. This is a minimal port, new features have not been enabled. Only PolarSSL 1.2.5 and newer are accepted, as earlier versions contain unresolved (security) issues. Signed-off-by: Joachim Schipper <joachim.schipper@fox-it.com> Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Adriaan de Jong <dejong@fox-it.com> Message-Id: <1363942465-3251-2-git-send-email-steffan.karger@fox-it.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/7436 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* (updated) [PATCH] Warn when using verb levels >=7 without debugJosh Cepek2013-03-201-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On 3/20/2013 11:42, Arne Schwabe wrote: > ACK. But I would change "debug verb" to "debug verbosity" and I think > there should be no comma before "but" This text change makes sense: I've adjusted it to read "NOTE: debug verbosity..." and saved another byte removing the comma. Updated patch attached. -- Josh >From d41a0237220f2fea6647a508a2ab07263e0f160b Mon Sep 17 00:00:00 2001 From: Josh Cepek <josh.cepek@usa.net> Date: Tue, 19 Mar 2013 22:52:12 -0500 Subject: [PATCH] Warn when using verb levels >=7 without debug This patch adds a log warning when using --verb levels at 7 or higher when running on builds lacking debug support. Since official builds are now built with enable_debug=no, this warning will help developers identify why expected debug messages may not be present in log output. The test and message output code is omitted when built with enable_debug=yes or enable_small=yes. Signed-off-by: Josh Cepek <josh.cepek@usa.net> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <kicup2$gfv$1@ger.gmane.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7425 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix parameter listing in non-debug builds at verb 4Josh Cepek2013-03-145-11/+11
| | | | | | | | | | | | | | | | | | | | | | | When built with enable_debug=no, the parameter output expected at --verb 4 is not printed due to use of #ifdef ENABLE_DEBUG in the responsible code sections. This appears to be a mistake when looking at the configure help text for enable_small and enable_debug. This change keys the relevant code off of enable_small instead, including the parameter listing when enale_small=no (the configure-script default.) Most of this code is in options.c, with some callers present in plugin.c/h and route.c/h. No function code is changed, just the #ifdef values to use the small feature instead of debug. This means builds no longer need enable_debug=yes in order to get the expected log output at verb 4. Signed-off-by: Josh Cepek <josh.cepek@usa.net> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <437RBuq1U8032S07.1361465626@web07.cms.usa.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/7361 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Permit pool size of /64.../112 for ifconfig-ipv6-poolGert Doering2013-03-141-2/+2
| | | | | | | | | | (Leftover check from the early days where --server-ipv6 also only accepted /64 - nowadays we handle smaller pools just fine) Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20130120185030.GR22465@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/7269
* Repair "tcp server queue overflow" brokenness, more <stdbool.h> fallout.Gert Doering2013-03-121-1/+1
| | | | | | | | | | | | | | | | Return value of mbuf_len() wrong - it's returning a length value, not a yes/no value - so when the queue length approached 65 (full!), it still only returned "1", leading to MBUF overflow later on. Change from "bool" to "unsigned int", misbehaviour gone... This fixes OpenVPN trac ticket #263. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Peter Caprioli <petercap@kth.se> Message-Id: <20130312100706.GN953@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/7396 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Remove unused function no_tap_ifconfigArne Schwabe2013-03-121-10/+0
| | | | | | | | Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1363032651-23934-4-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7388 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Move static prototype definition from header into c fileArne Schwabe2013-03-122-2/+2
| | | | | | | | Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1363032651-23934-3-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7389 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Remove unused function xorArne Schwabe2013-03-121-10/+0
| | | | | | | | | | The function name xor is also a reserved keyword in C++ Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1363032651-23934-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7390 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* add new option for X.509 name verificationHeiko Hund2013-03-077-36/+174
| | | | | | | | | | | | | | Add the option --verify-x509-name to provide the functionality of the now deprecated --tls-remote. The new option accepts RFC 2253 subject DNs only and compares RDN or RDN prefix only if configured explicitly. Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: 1362670601-18660-1-git-send-email-heiko.hund@sophos.com URL: http://article.gmane.org/gmane.network.openvpn.devel/7376 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* make --tls-remote compatible with pre 2.3 configsHeiko Hund2013-03-071-0/+6
| | | | | | | | | | | | | | In openvpn 2.3.0 the semantics of the --tls-remote option changed. That broke more configurations than anticipated. To not break configurations that use --tls-remote with a legacy OpenSSL style DN anymore, it is now detected when such a DN is configured. When necessary the --compat-names option is then automatically enabled. Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: 1361526263-1740-3-git-send-email-heiko.hund@sophos.com URL: http://article.gmane.org/gmane.network.openvpn.devel/7366 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* reintroduce --no-name-remapping optionHeiko Hund2013-03-072-16/+37
| | | | | | | | | | | The option is just an alias for --compat-names no-remapping and is introduced so pre-2.3 server configurations don't break. Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: 1361526263-1740-2-git-send-email-heiko.hund@sophos.com URL: http://article.gmane.org/gmane.network.openvpn.devel/7364 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix corner case in NTLM authentication (trac #172)Christian Niessner2013-03-071-2/+2
| | | | | | | | | | | | | | | | | The problem is located in the file proxy.c within "establish_http_proxy_passthru": To keep buffers small long base64-encoded NTLM-Strings are truncated. But the truncating is done on a wrong place: base 64 strings can be cut every 4 chars. the buffer is 128 bytes - including the terminating \0, so the usable data is only 127 bytes. And decoding a 127 char base64 string fails... this is why the ntlm authentication fails in certain cases (long strings)... Acked-by: Joerg Willmann <joe@clnt.de> URL: https://community.openvpn.net/openvpn/ticket/172 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* fix build with automake 1.13(.1)Christian Hesse2013-03-061-1/+1
| | | | | | | | | | | | AM_CONFIG_HEADER has been deprecated for some time, finally it is removed on automake 1.13. The attached patch replaces it with AC_CONFIG_HEADERS and fixes build process with latest automake. Acked-by: Matthias Andree <matthias.andree@gmx.de> Message-Id: 20130108093912.7ae7c6f8@leda URL: http://article.gmane.org/gmane.network.openvpn.devel/7222 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Ignore UTF-8 byte order markHeiko Hund2013-02-061-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | Currently openvpn exits when reading configuration from a file that has an UTF-8 byte order mark (EF BB BF) at its start. While it is useless to put a BOM into UTF-8 encoded files, the Unicode standard [1] permits it (on page 36): "Use of a BOM is neither required nor recommended for UTF-8, but may be encountered in contexts where UTF-8 data is converted from other encoding forms that use a BOM or where the BOM is used as a UTF-8 signature." Notepad.exe, the default text editor on Windows, always puts the BOM into UTF-8 encoded files when saving them. Others may do as well. Just ignoring the UTF-8 BOM will make config files with UTF-8 BOM readable. [1] http://www.unicode.org/versions/Unicode5.0.0/ch02.pdf Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Acked-by: David Sommerseth <davids@redhat.com> Message-Id: 1359977966-31724-1-git-send-email-heiko.hund@sophos.com URL: http://article.gmane.org/gmane.network.openvpn.devel/7342 Signed-off-by: David Sommerseth <davids@redhat.com>
* Cleaned up and updated INSTALLSamuli Seppänen2013-02-031-97/+62
| | | | | | | | | | | | | | | | | | | | - Changed "Supported platforms" to reflect current support status of the mentioned operatingsystems - Removed mentions of the obsolete Python and domake-win buildsystems - Added mention of official Debian/RPM packages - Added links to the Wiki - Added mention of the new openvpn-build cross-compile environment - Added PolarSSL to and removed pthreads from the "Optional" section - Added mention of t_client.sh test framework - Removed some very old (pre-2005) nuggets of (obsolete) information - Other minor cleanups - Some reorganization Signed-off-by: Samuli Seppänen <samuli@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: 1359107974-1481-1-git-send-email-samuli@openvpn.net URL: http://article.gmane.org/gmane.network.openvpn.devel/7303 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Updated READMESamuli Seppänen2013-02-031-19/+16
| | | | | | | | | | Added links to easy-rsa, tap-windows and openvpn-build and fixes some paths Signed-off-by: Samuli Seppänen <samuli@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: 1359101540-976-4-git-send-email-samuli@openvpn.net URL: http://article.gmane.org/gmane.network.openvpn.devel/7296 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Added cross-compilation information INSTALL-win32.txtSamuli Seppänen2013-02-031-0/+29
| | | | | | | | Signed-off-by: Samuli Seppänen <samuli@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: 1359101540-976-3-git-send-email-samuli@openvpn.net URL: http://article.gmane.org/gmane.network.openvpn.devel/7295 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Removed ChangeLog.IPv6Samuli Seppänen2013-02-031-440/+0
| | | | | | | | | Acked-by: Gert Doering <gert@greenie.muc.de> Signed-off-by: Samuli Seppänen <samuli@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: 1359101540-976-2-git-send-email-samuli@openvpn.net URL: http://article.gmane.org/gmane.network.openvpn.devel/7297 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Enable TCP_NODELAY configuration on FreeBSD.Matthias Andree2013-02-031-0/+4
| | | | | | | | | | | | | | | | | | | The missing #include <netinet/tcp.h> causes a defined(TCP_NODELAY) to fail. I have added the patch to the FreeBSD ports OpenVPN 2.2.2 and 2.3.0, and confirmed (with strings ... | grep) that the TCP_NODELAY code is now part of the executable on amd64, and results in this log output: Sat Jan 12 13:39:18 2013 Listening for incoming TCP connection on [undef] Sat Jan 12 13:39:18 2013 Socket flags: TCP_NODELAY=1 succeeded Obtained from: https://community.openvpn.net/openvpn/ticket/158 Credits to: M. Nottebrock Signed-off-by: Matthias Andree <matthias.andree@gmx.de> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: 1357994477-29981-1-git-send-email-matthias.andree@gmx.de URL: http://article.gmane.org/gmane.network.openvpn.devel/7230 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* man page patch for missing optionsJan Just Keijser2013-02-031-2/+9
| | | | | | | | | man page patch to include the options that were made connection-entry specific in 2.3.0 Acked-by: Gert Doering <gert@greenie.muc.de> Message-ID: 510E4344.6010608@nikhef.nl Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Remove dead code path and putenv functionalityArne Schwabe2013-02-032-51/+7
| | | | | | | | | | | | | | The construct_name_value function call will always fail so this code path is never used. Since we now always have a valid environment in static_context->c2.es it is better to have a ASSERT(es) than to call this code patch. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: 1359889951-3369-1-git-send-email-arne@rfc2549.org URL: http://article.gmane.org/gmane.network.openvpn.devel/7323 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Update README.IPv6 to match what is in 2.3.0Gert Doering2013-02-031-85/+53
| | | | | | | | | | | IPv6 is no longer provided by external patches - all has been integrated. Document that fact, point at the new configuration options, and at potential caveats. Acked-by: David Sommerseth <davids@redhat.com> Message-Id: 1359113954-25768-1-git-send-email-gert@greenie.muc.de URL: http://article.gmane.org/gmane.network.openvpn.devel/7305 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* close more file descriptors on execHeiko Hund2013-02-022-0/+5
| | | | | | | | | | | | Don't inherit the --status and --ifconfig-pool-persist, and on Linux the epoll(7), file descriptors to scripts and other processes that may be forked by plugins. Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Acked-by: David Sommerseth <davids@redhat.com> Message-Id: 1359728354-9405-1-git-send-email-heiko.hund@sophos.com URL: http://article.gmane.org/gmane.network.openvpn.devel/7312 Signed-off-by: David Sommerseth <davids@redhat.com>
* Fix client crash on double PUSH_REPLY.Gert Doering2013-01-022-1/+7
| | | | | | | | | | | | | | | Introduce an extra bool variable c2.pulled_options_md5_init_done to keep track of md5_init state of pulled_options_state - avoid accessing uninitialized state when a second PUSH_REPLY comes in (which only happens under very particular circumstances). Bug tracked down by Arne Schwabe <arne@rfc2549.rrg>. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: 20121225124856.GT22465@greenie.muc.de URL: http://article.gmane.org/gmane.network.openvpn.devel/7216 Signed-off-by: David Sommerseth <davids@redhat.com>
* Fix parameter type for IP_TOS setsockopt on non-Linux systems.Gert Doering2012-12-201-0/+4
| | | | | | | | | | | | | Linux uses uint8_t, all BSD based stacks and Solaris use "int" (Windows documentation says "DWORD" and "do not use, use QoS API instead"). Bug reported and fix provided by Torsten Vielhak and Jeremie Le Hen. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <davids@redhat.com> Message-Id: 20121219212619.GN22465@greenie.muc.de URL: http://article.gmane.org/gmane.network.openvpn.devel/7207 Signed-off-by: David Sommerseth <davids@redhat.com>
* Fix option inconsistency warnings about "proto" and "tun-ipv6"Gert Doering2012-12-171-1/+14
| | | | | | | | | | | | | | | | | "tun-ipv6" is only sent in option string if running in point-to-point mode (= not --server and not --client or --pull), because in those scenarios it's usually pushed by the server, and the client does not yet have it when comparing options -> needless warning. Completely ignore "proto" values when comparing option strings - this is in preparation for removing proto from the option string in a future release, and to avoid warnings when 2.3 talks to this future release. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <davids@redhat.com> Message-Id: 1355692520-24362-1-git-send-email-gert@greenie.muc.de URL: http://article.gmane.org/gmane.network.openvpn.devel/7194 Signed-off-by: David Sommerseth <davids@redhat.com>
* Implement --mssfix handling for IPv6 packets.Gert Doering2012-12-137-21/+97
| | | | | | | | | | | | | | | | Rename process_ipv4_header() to process_ip_header() and PIPV4_MSSFIX flag to PIP_MSSFIX, to make visible that it's no longer IPv4-only. Inside process_ip_header(), call out to mss_fixup_ipv6() if --mssfix is active and IPv6 packet seen. Rename mss_fixup() to mss_fixup_ipv4(), implement mss_fixup_ipv6(). Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: 1354482672-16136-2-git-send-email-gert@greenie.muc.de URL: http://article.gmane.org/gmane.network.openvpn.devel/7173 Signed-off-by: David Sommerseth <davids@redhat.com>
* Fix the proto is used inconsistently warningArne Schwabe2012-12-131-4/+18
| | | | | | | | | | | | | | Fix the "WARNING: 'proto' is used inconsistently, local='proto UDP', remote='proto UDPv6'." message. Note that the on wire strings are now always TCPv4 and UDPv4 to be compatible to pre2.3 Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: 1354650174-25601-1-git-send-email-arne@rfc2549.org URL: http://article.gmane.org/gmane.network.openvpn.devel/7175 Signed-off-by: David Sommerseth <davids@redhat.com>
* Remove dnsflags_to_socktype, it is not used anywhereArne Schwabe2012-12-132-6/+1
| | | | | | | | Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: 1354303076-13606-1-git-send-email-arne@rfc2549.org URL: http://article.gmane.org/gmane.network.openvpn.devel/7160 Signed-off-by: David Sommerseth <davids@redhat.com>
* The get_default_gateway() function uses warn() instead of msg()David Sommerseth2012-11-291-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A report on #openvpn pointed out that in his setup three warnings appeard on the console when starting up. $ sudo /usr/local/etc/rc.d/openvpn restart Stopping openvpn. Waiting for PIDS: 33031. Starting openvpn. openvpn: writing to routing socket: No such process openvpn: writing to routing socket: No such process openvpn: writing to routing socket: No such process $ This setup is on FreeBSD using jails with strict access to the routing table. After looking at the code path, this error was found in the BSD sections for get_default_gateway(). But it was using the warn() call instead of msg(M_WARN|M_ERRNO, ...) which causes these warnings to go to stderr instead of the log file. The warning string is also slightly modified to better explain what fails. Reported-by: Thomas Steen Rasmussen <thomas@gibfest.dk> Tested-by: Thomas Steen Rasmussen <thomas@gibfest.dk> Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: 1354194972-5388-1-git-send-email-dazo@users.sourceforge.net URL: http://article.gmane.org/gmane.network.openvpn.devel/7149
* Avoid recursion in virtual_output_callback_func()David Sommerseth2012-11-291-7/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This solves a SEGV situation when using the management API while OpenVPN is closing down. The situation happens when the management socket has closed and OpenVPN tries to write an error about this to the management socket. What happens is that virtual_output_callback_func() is called, which then calls -> man_output_list_push_finalize() -> man_output_standalone() -> man_write() <-- this does the socket write -> man_io_error() -> x_msg() -> virtual_output_print() -> virtual_output_callback_func() (recursion start) virtual_output_callback_func() do have a mechanism to avoid recursion, but that did not keep the recurse counter when man_output_list_push_finalize() is called. This patch just reorganise the recursion block to also keep the counter while calling the other functions from virtual_output_callback_func() Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: 1353063726-25113-1-git-send-email-dazo@users.sourceforge.net URL: http://article.gmane.org/gmane.network.openvpn.devel/7130
* Properly require --key even if defined(MANAGMENT_EXTERNAL_KEY)Arne Schwabe2012-11-291-2/+2
| | | | | | | | | | | | | | | | When specifying --tls-client --cert ... without a --key (or --pkcs11) option, OpenVPN should complain: "You must define private key file (--key)...". Ensure that this works even when compiling with MANAGMENT_EXTERNAL_KEY. Also fix the other instance where this logic is broken Orginal-Patch-by: Found by Joachim Schipper <joachim.schipper@fox-it.com> Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: 1353940389-31075-1-git-send-email-arne@rfc2549.org URL: http://article.gmane.org/gmane.network.openvpn.devel/7143 Signed-off-by: David Sommerseth <davids@redhat.com>
* Fix typo in ./configure messageJoachim Schipper2012-11-291-1/+1
| | | | | | | | Signed-off-by: Joachim Schipper <joachim.schipper@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: 1CED409804E2164C8104F9E623B08B901323D0B186@FOXDFT02.FOX.local URL: http://article.gmane.org/gmane.network.openvpn.devel/7142 Signed-off-by: David Sommerseth <davids@redhat.com>
* doc/management-notes.txt: fix typoJoachim Schipper2012-11-291-1/+1
| | | | | | | | Signed-off-by: Joachim Schipper <joachim.schipper@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: 1CED409804E2164C8104F9E623B08B901323D0B184@FOXDFT02.FOX.local URL: http://article.gmane.org/gmane.network.openvpn.devel/7141 Signed-off-by: David Sommerseth <davids@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-27 09:10:05 +0000