summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
| | * Added redirect-gateway block-local flag, with support forJames Yonan2011-06-129-604/+820
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Linux, Mac OS X, and Linux. This flag (which is pushable from server) blocks client access to local LAN while VPN session is active. Added standalone --show-gateway option to show info about default gateway. Extensively refactored get_default_gateway function in route.c to ease implementation of block-local. Removed "Experimental" disclaimer from redirect-gateway man page. Version 2.1.3y. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7334 e7ae566f-a301-0410-adde-c780ea21d3b5
| | * r7316 fixes.James Yonan2011-06-103-4/+5
| | | | | | | | | | | | | | | | | | | | | Version 2.1.3x1. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7332 e7ae566f-a301-0410-adde-c780ea21d3b5
| | * Added support for static challenge/response protocol.James Yonan2011-06-0314-68/+274
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This includes the new "static-challenge" directive. See management/management-notes.txt for details on both static and dynamic challenge/response protocols. All client-side challenge/response code is #ifdefed on ENABLE_CLIENT_CR and can be removed from the build by commenting out the definition of ENABLE_CLIENT_CR in syshead.h. Version 2.1.3x. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7316 e7ae566f-a301-0410-adde-c780ea21d3b5
| | * Fixed compile issues on Windows.James Yonan2011-04-254-4/+4
| | | | | | | | | | | | | | | | | | | | | Version 2.1.3w git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7219 e7ae566f-a301-0410-adde-c780ea21d3b5
| | * Added new "extra-certs" and "verify-hash" options (see man page forJames Yonan2011-04-257-1/+128
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | details). Increase the timeout after SIGUSR1 restart when restart is not due to server_poll_timeout. Version 2.1.3v git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7215 e7ae566f-a301-0410-adde-c780ea21d3b5
| | * Added 'dir' flag to "crl-verify" (see man page for info).James Yonan2011-04-247-61/+96
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Don't call SSL_CTX_set_client_CA_list or SSL_CTX_set_client_CA_list if not running in server mode (these functions are only useful for TLS/SSL servers). Modified openvpn_snprintf to return false on overflow, and true otherwise. When AUTH_FAILED,... is received, log the full string. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7213 e7ae566f-a301-0410-adde-c780ea21d3b5
| | * Revert r7092 and r7151, i.e. remove --enable-osxipconfigJames Yonan2011-04-193-35/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | configure option. ipconfig on Mac has certain behavior that makes it unsuitable for use by OpenVPN to configure tun/tap interface. Version 2.1.3u git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7191 e7ae566f-a301-0410-adde-c780ea21d3b5
| | * Version 2.1.3tJames Yonan2011-04-121-1/+1
| | | | | | | | | | | | git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7152 e7ae566f-a301-0410-adde-c780ea21d3b5
| | * For Mac OSX, when DARWIN_USE_IPCONFIG is defined, retry ipconfigJames Yonan2011-04-121-1/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | command on failure once every second for up to 15 seconds. This is necessary to work around an issue observed on OSX 10.5 where the ipconfig command sometimes fails if executed immediately after the tun device open. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7151 e7ae566f-a301-0410-adde-c780ea21d3b5
| | * Fixed bug in port-share that could cause port share process toJames Yonan2011-04-032-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | crash with output like this: TCP connection established with 85.190.0.3:41781 85.190.0.3:41781 SIGTERM[soft,port-share-redirect] received, client-instance exiting MANAGEMENT: TCP recv error: Socket operation on non-socket MANAGEMENT: Client disconnected MANAGEMENT: Triggering management exit Exiting due to fatal error EVENT: epoll_ctl EPOLL_CTL_MOD failed, sd=6: Bad file descriptor (errno=9) Then an error like this for every incoming connection that should be proxied: 76.120.71.74:55302 PORT SHARE: sendmsg failed -- unable to communicate with background process (6,8,-1,-1): Connection refused (errno=111) Version 2.1.3s git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7127 e7ae566f-a301-0410-adde-c780ea21d3b5
| | * Fixed bug that incorrectly placed stricter TCP packet replay rules onJames Yonan2011-04-026-14/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | UDP sessions when the client daemon was running in UDP/TCP adaptive mode, and transitioned from TCP to UDP. The bug would cause a single dropped packet in UDP mode to trigger a barrage of packet replay errors followed by a disconnect and reconnect. Version 2.1.3r git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7125 e7ae566f-a301-0410-adde-c780ea21d3b5
| | * Added more packet ID debug info at debug level 3 for debuggingJames Yonan2011-03-316-28/+142
| | | | | | | | | | | | | | | | | | | | | | | | | | | false positive packet replays. Version 2.1.3q. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7109 e7ae566f-a301-0410-adde-c780ea21d3b5
| | * Added ./configure --enable-osxipconfig option for Mac OS X which willJames Yonan2011-03-273-2/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | enable the use of ipconfig (instead of ifconfig) for configuring the IP address and netmask of the tun/tap adapter. Version 2.1.3p git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7092 e7ae566f-a301-0410-adde-c780ea21d3b5
| | * Added "auth-token" client directive, which is intended to beJames Yonan2011-03-2611-13/+113
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | pushed by server, and that is used to offer a temporary session token to clients that can be used in place of a password on subsequent credential challenges. This accomplishes the security benefit of preventing caching of the real password while offering most of the advantages of password caching, i.e. not forcing the user to re-enter credentials for every TLS renegotiation or network hiccup. auth-token does two things: 1. if password caching is enabled, the token replaces the previous password, and 2. if the management interface is active, the token is output to it: >PASSWORD:Auth-Token:<token> Also made a minor change to HALT/RESTART processing when password caching is enabled. When client receives a HALT or RESTART message, and if the message text contains a flags block (i.e. [FFF]:message), if flag 'P' (preserve auth) is present in flags, don't purge the Auth password. Otherwise do purge the Auth password. Version 2.1.3o git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7088 e7ae566f-a301-0410-adde-c780ea21d3b5
| | * win/sign.py now accepts an optional tap-dir argument.James Yonan2011-03-251-4/+8
| | | | | | | | | | | | git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7086 e7ae566f-a301-0410-adde-c780ea21d3b5
| | * Version 2.1.3nJames Yonan2011-03-211-1/+1
| | | | | | | | | | | | git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7069 e7ae566f-a301-0410-adde-c780ea21d3b5
| | * Client will now try to reconnect if no push reply receivedJames Yonan2011-03-204-3/+20
| | | | | | | | | | | | | | | | | | | | | within handshake-window seconds. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7066 e7ae566f-a301-0410-adde-c780ea21d3b5
| | * Extended "client-kill" management interface command (server-side)James Yonan2011-03-207-19/+53
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | to accept an optional message string. The message string format is: RESTART|HALT,<human-readable-message> RESTART will tell the client to restart (i.e. SIGUSR1). HALT will tell the client to exit (i.e. SIGTERM). On the client, human-readable-message will be communicated via management interface: >NOTIFY,<severity>,<type>,<human-readable-message>" Version 2.1.3m git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7063 e7ae566f-a301-0410-adde-c780ea21d3b5
| | * Fixed bug introduced in r7031 that might cause this error message:James Yonan2011-03-201-6/+16
| | | | | | | | | | | | | | | | | | | | | PORT SHARE: sendmsg failed (unable to communicate with background process) git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7062 e7ae566f-a301-0410-adde-c780ea21d3b5
| | * Fixed issue where a client might receive multiple push replies fromJames Yonan2011-03-183-2/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | a server if it sent multiple push requests due to the server being slow to respond. This could cause the client to process pushed options twice, leading to duplicate pushed routes, among other issues. The fix, implemented server-side, is to reply only once to a push request even if multiple requests are received. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7060 e7ae566f-a301-0410-adde-c780ea21d3b5
| | * env_filter_match now includes the serial number of all certsJames Yonan2011-03-171-1/+1
| | | | | | | | | | | | | | | | | | | | | in chain (as tls_serial_n vars), rather than only tls_serial_0. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7055 e7ae566f-a301-0410-adde-c780ea21d3b5
| | * Renamed branch to reflect that it is no longer beta.James Yonan2011-03-17355-0/+104511
| | | | | | | | git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7051 e7ae566f-a301-0410-adde-c780ea21d3b5
* | Moved doxygen-specific files to a separate directoryDavid Sommerseth2011-07-2816-1/+1
| | | | | | | | | | | | Signed-off-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: David Sommerseth <dazo@users.sourceforge.net> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* | Added main/control docsDavid Sommerseth2011-07-2816-117/+1476
| | | | | | | | | | | | Signed-off-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: James Yonan <james@openvpn.net> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* | Added data channel fragmentation docsDavid Sommerseth2011-07-282-73/+460
| | | | | | | | | | | | Signed-off-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: James Yonan <james@openvpn.net> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* | Added memory management documentationDavid Sommerseth2011-07-282-9/+147
| | | | | | | | | | | | Signed-off-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: James Yonan <james@openvpn.net> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* | Added reliability layer documentationDavid Sommerseth2011-07-282-64/+430
| | | | | | | | | | | | Signed-off-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: James Yonan <james@openvpn.net> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* | Added compression docsDavid Sommerseth2011-07-283-49/+341
| | | | | | | | | | | | Signed-off-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: James Yonan <james@openvpn.net> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* | Added control channel crypto docsDavid Sommerseth2011-07-284-243/+841
| | | | | | | | | | | | Signed-off-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: James Yonan <james@openvpn.net> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* | Doxygen: Added data channel crypto docsDavid Sommerseth2011-07-282-25/+218
| | | | | | | | | | | | Signed-off-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: David Sommerseth <dazo@users.sourceforge.net> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* | Added Doxygen doxyfileAdriaan de Jong2011-07-281-0/+279
|/ | | | | | Signed-off-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: David Sommerseth <dazo@users.sourceforge.net> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* Fixes to easy-rsa/2.0Samuli Seppänen2011-07-013-6/+309
| | | | | | | | | | | | | | As support for OpenSSL 1.0.0 requires a modified openssl.cnf file, it was decided to rename openssl.cnf to openssl-1.0.0.cnf for clarity and better support of different OpenSSL versions. The old openssl.cnf was renamed as openssl-0.9.8.cnf. This patch makes sure that all openssl*.cnf files are copied when running 'make install' in easy-rsa and makes the whichopensslcnf script aware of them as well. Signed-off-by: Samuli Seppänen <samuli@openvpn.net> Acked-by: David Sommerseth <davids@redhat.com> Signed-off-by: David Sommerseth <davids@redhat.com>
* Made domake-win builds to use easy-rsa/2.0/openssl-1.0.0.cnfSamuli Seppänen2011-07-012-5/+5
| | | | | | Signed-off-by: Samuli Seppänen <samuli@openvpn.net> Acked-by: David Sommerseth <davids@redhat.com> Signed-off-by: David Sommerseth <davids@redhat.com>
* Updated "easy-rsa" for OpenSSL 1.0.0Samuli Seppänen2011-07-015-22/+27
| | | | | | | | | | | | | | | | | This patch fixes remaining issues with Trac ticket #125. It does the following: - Update easy-rsa/2.0/README - Rename easy-rsa/2.0/openssl.cnf as openssl-0.9.8.cnf - Add easy-rsa/2.0/openssl-1.0.0.cnf - Updated vars.bat.sample to use openssl-1.0.0.cnf - Updated win/openvpn.nsi to use openssl-1.0.0.cnf - Add a few undefined variables to vars and vars.bat.sample: required by OpenSSL 1.0.0 (at least on Windows) Signed-off-by: Samuli Seppänen <samuli@openvpn.net> Tested-by: Samuli Seppänen <samuli@openvpn.net> Acked-by: David Sommerseth <davids@redhat.com> Signed-off-by: David Sommerseth <davids@redhat.com>
* Revert "Add new openssl.cnf to easy-rsa/Windows"David Sommerseth2011-06-201-350/+0
| | | | | | | | | This reverts commit 663860ad04dd4190fddbee63e724d3fdceafd937. Accoding to Jan Just Keijser [1] there are issues with this new openssl.cnf file, so reverting this commit and wait for a new patch. [1] http://thread.gmane.org/gmane.network.openvpn.devel/4729/focus=4735
* Add new openssl.cnf to easy-rsa/WindowsSamuli Seppänen2011-06-201-0/+350
| | | | | | | This is required for patch "Fix a build-ca issue on Windows" to work Signed-off-by: Samuli Seppänen <samuli@openvpn.net> Acked-by: David Sommerseth <davids@redhat.com>
* Fix a build-ca issue on WindowsSamuli Seppänen2011-06-202-3/+3
| | | | | | | | Fixes Trac ticket #125 Signed-off-by: Samuli Seppänen <samuli@openvpn.net> Acked-by: David Sommerseth <davids@redhat.com> Signed-off-by: David Sommerseth <davids@redhat.com>
* Remove support for Linux 2.2 configuration fallbackDavid Sommerseth2011-06-152-20/+3
| | | | | | | | | | | | | | | | | | When configuring OpenVPN nowadays, the TUN/TAP configuration can sometimes jump into the Linux 2.2 fallback code paths, which will also fails. The reason it jumps into fallback mode is that the tun/tap device already exists or that /dev/net/tun does not exist. This can be very confusing, as /dev/tunX which the fallback mode tries to use, does not exist on Linux 2.4 and newer. Considering that the last Linux 2.2 update was released 25-Feb-2004 and the first Linux 2.4 release came 04-Jan-2001, there are no reasonable reasons to help users to stay on outdated kernels. I consider this extra code path just waste of bytes ... so lets make the world simpler. Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de>
* Documented --x509-username-field optionRobert Fischer2011-06-142-1/+9
| | | | | | | | Also fixed a typo in the --help screen. Signed-off-by: Robert Fischer <ml-openvpn@trispace.org> Acked-by: David Sommerseth <davids@redhat.com> Signed-off-by: David Sommerseth <davids@redhat.com>
* Added info about --show-proxy-settingsRobert Fischer2011-06-142-0/+6
| | | | | | Signed-off-by: Robert Fischer <ml-openvpn@trispace.org> Acked-by: David Sommerseth <davids@redhat.com> Signed-off-by: David Sommerseth <davids@redhat.com>
* Fix compiling issues with pkcs11 when --disable-management is configuredDavid Sommerseth2011-05-311-0/+2
| | | | | | | | pkcs11.c seems to miss some header files which gets implicitly added when the management interface is enabled. Signed-off-by: David Sommerseth <davids@redhat.com> Tested-by: Mr Dash Four <mr.dash.four@googlemail.com>
* Don't define ENABLE_PUSH_PEER_INFO if SSL is not availableDavid Sommerseth2011-05-271-0/+2
| | | | | | | | | | The push_peer_info feature depends on the SSL infrastructure and openvpn will fail to build if ./configure --disable-crypto --disable-ssl is used. The solution is to not define ENABLE_PUSH_PEER_INFO if we don't have crypto/ssl. Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de>
* Merge remote-tracking branch 'cron2/feat_ipv6_payload_2.3'David Sommerseth2011-05-235-26/+109
|\ | | | | | | | | | | | | | | Conflicts: options.c - version string for IPv6 payload changed Signed-off-by: David Sommerseth <davids@redhat.com>
| * Windows IPv6 cleanup - properly remove IPv6 routes and interface configGert Doering2011-05-225-24/+107
| | | | | | | | | | | | | | | | | | | | | | | | | | | | after tunnel shutdown. Needs to make delete_route_ipv6() visible from tun.c (route.c, route.h) and to properly zero-out host bits from IPv6 "network" at interface route clearing. Further, add IPv6 routes with "store=active" to make sure nothing lingers after a system crash while OpenVPN was running. While at it, small Solaris cleanup - use CLEAR() to zero-out "ifr" struct. Tested on Windows XP SP3 and Win7 by Gert Doering and Tony Lim. Signed-off-by: Gert Doering <gert@greenie.muc.de>
| * Change the netsh.exe command from "add" to "set".smos2011-05-191-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | This prevents the netsh.exe command from exiting with a status 1 when the address already exists. By adding store=active the address will not survive a reboot and be assigned temporarily. Tested on Windows 7 and Windows XP SP 2. Signed-off-by: smos <seth.mos@dds.nl> Acked-by: Gert Doering <gert@greenie.muc.de> Signed-off-by: Gert Doering <gert@greenie.muc.de>
* | Fix const declarations in plug-in v3 structsDavid Sommerseth2011-05-191-4/+4
| | | | | | | | | | | | | | | | | | Microsoft Visual Studio complains about const char const **ptr declarations and expects them to be be const char ** const ptr. The latter is what was the intention, that neither the pointer nor the value(s) it points at can be changed. Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de>
* | Fix 2.2.0 build failure when management interface disabledMatthew L. Creech2011-05-191-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I just upgraded to 2.2.0, and my build fails with: ps.c: In function 'port_share_open': ps.c:778:7: error: 'management' undeclared (first use in this function) ps.c:778:7: note: each undeclared identifier is reported only once for each function it appears in make[5]: *** [ps.o] Error 1 [Comment by David Sommerseth: This happens only when building with --enable-small, --disable-management and --disable-pkcs11 Also changed MANAGEMENT_ENABLED to ENABLE_MANAGEMENT from the original patch. ] Mailing-list: http://thread.gmane.org/gmane.network.openvpn.devel/4639 Signed-off-by: Matthew L. Creech <mlcreech@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Signed-off-by: David Sommerseth <davids@redhat.com>
* | Fix issues with some older GCC compilersSimon Matter2011-05-101-3/+3
| | | | | | | | | | | | | | | | | | | | | | Some older GCC compilers don't like that variables are declared in the middle of the code, and expect them on the top in the block/scope. Trac-ticket: 99 Signed-off-by: Simon Matter <simon.matter@invoca.ch> Acked-by: David Sommerseth <davids@redhat.com> Signed-off-by: David Sommerseth <davids@redhat.com>
* | Fix compile issues when using --enable-small and --disable-ssl/--disable-cryptoGustavo Zacarias2011-04-271-1/+2
| | | | | | | | | | | | | | | | | | The tmp_dir string is required in the options struct regardless of options so spin it out of #if conditionals. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Acked-by: David Sommerseth <dazo@users.sourceforge.net> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* | Solved hidden merge conflicts between master and svn-branch-2.1David Sommerseth2011-04-262-4/+7
| | | | | | | | | | | | | | | | | | ps.c - The feat_ipv6_transport patch set modifies struct openvpn_sockaddr by adding a union named 'addr' in commit 8335caf929f21b31. ssl.c - A needed } and #endif had been dropped by a mistake Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
generated by cgit (git 2.34.1) at 2025-09-29 19:47:07 +0000