summaryrefslogtreecommitdiffstats
path: root/options.c
Commit message (Collapse)AuthorAgeFilesLines
* cleanup: rename tap-windows function from win32 to winAlon Bar-Lev2012-03-221-4/+4
| | | | | | Signed-off-by: Alon Bar-Lev <alon.barlev@gmail.com> Acked-by: Samuli Seppänen <samuli@openvpn.net> Signed-off-by: David Sommerseth <davids@redhat.com>
* cleanup: remove C++ warningsAlon Bar-Lev2012-03-221-2/+2
| | | | | | Signed-off-by: Alon Bar-Lev <alon.barlev@gmail.com> Acked-by: Samuli Seppänen <samuli@openvpn.net> Signed-off-by: David Sommerseth <davids@redhat.com>
* cleanup: options.c: remove redundant includeAlon Bar-Lev2012-03-221-1/+0
| | | | | | | Signed-off-by: Alon Bar-Lev <alon.barlev@gmail.com> Acked-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: Samuli Seppänen <samuli@openvpn.net> Signed-off-by: David Sommerseth <davids@redhat.com>
* Revamp check_file_access() checks in stdin scenariosDavid Sommerseth2012-02-201-4/+12
| | | | | | | | | | | | | It was discovered that --management also can take stdin as argument instead of a file. Enabled this by revamping the check_file_access() flags by adding CHKACC_ACPTSTDIN. Setting this flag will then consider filenames as 'stdin' as always present. The other place where 'stdin' was accepted is also modified to use this flag instead. Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de>
* Connection entry {tun,link}_mtu_defined not set correctlyDavid Sommerseth2012-02-141-15/+17
| | | | | | | | | | | | | | Commit 76809cae0eae07817160b423d3f9551df1a1d68e enabled setting MTU variables inside <connection> blocks. But in that process, the tun_mtu_defined and link_mtu_defined was not set as it should. By moving this out of the options_postprocess_mutate_invariant() function and into options_postprocess_mutate_ce(), these {tun,link}_mtu_defined variables are set correctly in each connection entry. Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de>
* Made some options connection-entry specificJan Just Keijser2012-02-131-61/+64
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The following options may now be used in a connection block: fragment mssfix tun-mtu tun-mtu-extra link-mtu mtu_discover_type explicit-exit-notification In order to support stuff like <connection> remote host proto udp fragment explicit-exit-notification 3 </connection> <connection> remote host proto tcp </connection> Signed-off-by: Jan Just Keijser <janjust@nikhef.nl> Acked-by: David Sommerseth <davids@redhat.com> Signed-off-by: David Sommerseth <davids@redhat.com>
* Remove --show-gateway if debug info is not enabled (--disable-debug)David Sommerseth2012-02-131-0/+4
| | | | | | | | | | The --show-gateway feature depends on functions only being enabled when --disable-debug is _not_ used. As this I consider --show-gateway more a handy function for debugging, removing this feature when --disable-debug is used seems like the proper approach. Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de>
* handle Windows unicode pathsHeiko Hund2012-02-131-5/+32
| | | | | | | | | | | | | | | | | | | | | | Openvpn for Windows is not compiled as a Unicode binary and thus cannot handle paths which contain non-ASCII characters using the argv vector. Characters that are not present in the system codepage are simply replaced with a question mark, e.g. if started as 'openvpn --config домой.ovpn' the file '?????.ovpn' is tried to be opened as configuration. The same applies to paths in config files which need to be UTF-8 encoded if they contain non ASCII characters. The option line 'key лев.pem' will lead to openvpn trying to open 'лев.pem' on a system with codepage 1252. This patch makes openvpn read the command line in UCS-2 and convert it to UTF-8 internally. Windows stores names in the filesystem in UCS-2. When using a paths openvpn converts it from UTF-8 to UCS-2 and uses the wide character Windows API function. Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Acked-by: David Sommerseth <davids@redhat.com> Signed-off-by: David Sommerseth <davids@redhat.com>
* Fix assert() situations where gc_malloc() is called without a gc_arena objectDavid Sommerseth2012-02-081-1/+6
| | | | | | | | | | | | | | | | | | | | | In commit bee92b479414d12035b0422f81ac5fcfe14fa645 the gc_malloc() was hardened to always require a gc_arena object for garbage collection. Some places in the code expected the old behaviour of a normal malloc() in these cases, that is a memory allocation without garbage collection. This old behaviour is partly restored by allowing string_alloc() to do a non-gc based allocation if no gc_arena object is available. In addition some other places string_alloc() will now be called with a gc_arena pointer where such an object is available. The alloc_buf() function has also been refactored to not use gc_malloc() at all. v2: - removes a memleak when --ifconfig-ipv6 is used several times - makes string_alloc() behave properly if DMALLOC is enabled Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de>
* UTF-8 X.509 distinguished namesHeiko Hund2012-02-041-11/+1
| | | | | | | | | | | | | | | | | | The UTF-8 support that came with commit 2627335 does allow international usernames and passwords. This patch introduces UTF-8 support for X.509 DNs. Additionally, instead of using the legacy openssl format, DNs are now displayed in RFC 2253 format; "/C=ru/L=\xD0\x9C\xD0\xBE\xD1\x81\xD0\xBA\xD0 \xB2\xD0\xB0/O=\xD0\x9A\xD1\x80\xD0\xB5\xD0\xBC\xD0\xBB\xD1\x8C/CN=kreml.ru" becomes "C=ru, L=Москва, O=Кремль, CN=kreml.ru". Since the specific character classes for X.509 names are removed, the "no-name-remapping" configuration option has no use anymore and is removed as well. Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Acked-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: David Sommerseth <davids@redhat.com> Signed-off-by: David Sommerseth <davids@redhat.com>
* Implement IPv6 interface config with non-/64 prefix lengths.Gert Doering2012-02-041-2/+3
| | | | | | | | | | | | | | | | | | | | | Add "ifconfig_ipv6_netbits_parm" parameter to init_tun(), use that to initialize tt->netbits_ipv6 (previously: always /64). Actual interface setup code already used tt->netbits_ipv6, so no changes needed there. Remove restrictions on "/netbits" value for --server-ipv6 config option (can now be /64.../112, previously had to be exactly /64). Supporting even smaller networks could cause problems with ipv6-pool handling and are only allowed for explicit "ifconfig-ipv6", not for "server-ipv6". Add /netbits to pushed "ifconfig-ipv6" values on server side (client side always accepted this, but ignored it so far, so this does not break compatibility). Tested on Linux/ifconfig, Linux/iproute2 and FreeBSD 7.4 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <davids@redhat.com> Signed-off-by: David Sommerseth <davids@redhat.com>
* Add --route-pre-down/OPENVPN_PLUGIN_ROUTE_PREDOWN script/plug-in hookDavid Sommerseth2012-01-251-0/+11
| | | | | | | | | | | | | This patchs adds a script/plug-in hook which is called right before the network routes are taken down. This gives external processes a possibility to tear down communication over the VPN before the VPN disappears. One use case can be to mount a networked file system over the VPN via --route-up. And then to unmount this file system via --route-pre-down Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de>
* Don't check for file presence on inline filesDavid Sommerseth2012-01-161-8/+15
| | | | | | | | | | | | | | The configuration file supports inline files for --ca, --cert, --dh, --extra-certs, --key, --pkcs12, --secret and --tls-auth. When this is used, the filename is set to [[INLINE]] (defined by INLINE_FILE_TAG). If the filename is set to INLINE_FILE_TAG for these options, don't call check_file_access(). [v2 Simplify the code, using a flag to check_file_access()] Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de>
* Fix compilation errors on Linux platforms without SO_MARKDavid Sommerseth2012-01-111-3/+3
| | | | | | | | | | | | When trying to compile OpenVPN on RHEL5/CentOS5, it would fail due to missing declaration of SO_MARK. SO_MARK is a feature which first arrived in 2.6.26, and was never backported to RHEL5's 2.6.18 kernel base. This patch adds a check at configure time, to see if SO_MARK is available or not. Signed-off-by: David Sommerseth <davids@redhat.com>
* Enable access() when building in Visual StudioDavid Sommerseth2012-01-101-1/+0
| | | | | | | | | | | | | | | | | Visual Studio does not enable certiain standard Unix functions, such as access(). By defining _CRT_NONSTDC_NO_WARNINGS and _CRT_SECURE_NO_WARNINGS, these functions are enabled. This patch also adds a ./configure check for access() as well, in case this needs to be implemented on other platforms lacking this feature. Which is why HAVE_ACCESS is defined in win/config.h.in Thanks to Alon Bar-Lev for helping solving this. Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Alon Bar-Lev <alon.barlev@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> URL: http://thread.gmane.org/gmane.network.openvpn.devel/5179/focus=5200
* Move away from openvpn_basename() over to platform provided basename()David Sommerseth2012-01-101-1/+0
| | | | | | | | | | | | | | | | | This kicks out the openvpn_basename() function from misc.[ch] and puts glibc equivalents into compat.[ch]. This is to provide the same functionality on platforms not having a native basename() function available. In addition this patch adds dirname() which commit 0f2bc0dd92f43c91e depends. Without dirname(), openvpn won't build in Visual Studio. v2: Move all functions from compat.h to compat.c v3: Use glibc versions of basename() and dirname() instead Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Alon Bar-Lev <alon.barlev@gmail.com> URL: http://thread.gmane.org/gmane.network.openvpn.devel/5178/focus=5215
* Fix build-up of duplicate IPv6 routes on reconnect.Gert Doering2012-01-041-0/+13
| | | | | | | | | | | | options.c: extend pre_pull_save() and pre_pull_restore() to save/restore options->routes_ipv6 as well options.h: add routes_ipv6 to "struct options_pre_pull" route.h, route.c: add clone_route_ipv6_option_list() and copy_route_ipv6_option_list() helper functions Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <davids@redhat.com> Signed-off-by: David Sommerseth <davids@redhat.com>
* Fix compiling with --disable-crypto and/or --disable-sslDavid Sommerseth2011-12-151-5/+5
| | | | | | | | The checks introduced in commit 0f2bc0dd92f43c91e33bba8a66b06b98f281efc1 didn't properly remove checks if crypto or SSL was disabled at compile time. Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de>
* Added "memstats" option to maintain real-time operating statsJames Yonan2011-12-141-0/+10
| | | | | | | | in a memory-mapped file. Version 2.1.16 git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7653 e7ae566f-a301-0410-adde-c780ea21d3b5
* Don't look for 'stdin' file when using --auth-user-passDavid Sommerseth2011-12-051-2/+3
| | | | | | | | | This argument allows the keyword 'stdin' to indicate that the input is to be read from the stdin. Don't check for file existence if the file name is set to 'stdin' Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de>
* Do some file/directory tests before really starting openvpnDavid Sommerseth2011-11-251-0/+151
| | | | | | | | | | | | | | | OpenVPN can handle over 30 different files and directories, and it is easy to misconfigure some of them. In many situations OpenVPN will even start running, even with a wrong file path or without the proper permissions, and then it will complain much later on. In some cases the error being seen at this late point might even be difficult to relate to a configuration option. This patch tries to catch as many of these files as soon as possible, kind of to "smoke-test" the files and directories to avoid the most likely errors. Trac-ticket: 73 Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de>
* Make '--win-sys env' defaultDavid Sommerseth2011-11-231-3/+5
| | | | | | | | | | | | | | | | Without this patch, the default path used by OpenVPN is hard coded to C:\WINDOWS. As users might install Windows in a different directory, this approach will cause OpenVPN to malfunction in some configurations. OpenVPN have supported using the system path, by adding --win-sys env. This patch removes the hard coded approach and uses the --win-sys env approach by default instead. Trac-ticket: 66 URL: http://thread.gmane.org/gmane.network.openvpn.user/32508 Signed-off-by: David Sommerseth <davids@redhat.com> Tested-by: Samuli Seppänen <samuli@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de>
* Fix PolarSSL and --pkcs12 option issuesDavid Sommerseth2011-11-081-1/+7
| | | | | | | | | | | | PolarSSL does not support PKCS#12 certificate/key bundles, but had a typo where #ifdef USE_POLARSSL was used, and it should have been #ifndef instead. Also added a few extra exclusions of PKCS#12 messages where appropriate, to avoid confusing users. Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Adriaan de Jong <dejong@fox-it.com>
* Fixed an unintentional change in the options calculated key size.Adriaan de Jong2011-10-221-1/+1
| | | | | | | | It is now in bits again. Signed-off-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: David Sommerseth <davids@redhat.com> Signed-off-by: David Sommerseth <davids@redhat.com>
* Disabled X.509 track and username selection for PolarSSLAdriaan de Jong2011-10-221-0/+2
| | | | | | Signed-off-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: James Yonan <james@openvpn.net> Signed-off-by: David Sommerseth <davids@redhat.com>
* Added SSL library to title stringAdriaan de Jong2011-10-221-2/+14
| | | | | | | Signed-off-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: James Yonan <james@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Signed-off-by: David Sommerseth <davids@redhat.com>
* Refactored (and disabled for PolarSSL) support for writing external cert ↵Adriaan de Jong2011-10-221-0/+4
| | | | | | | | files in scripts Signed-off-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: James Yonan <james@openvpn.net> Signed-off-by: David Sommerseth <davids@redhat.com>
* Disable CryptoAPI when not using OpenSSL, and document that fact.Adriaan de Jong2011-10-221-4/+4
| | | | | | | Signed-off-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: James Yonan <james@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Signed-off-by: David Sommerseth <davids@redhat.com>
* Added warning that --capath is not available with PolarSSLAdriaan de Jong2011-10-221-0/+2
| | | | | | | Signed-off-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: James Yonan <james@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Signed-off-by: David Sommerseth <davids@redhat.com>
* Added a warning that the PolarSSL library does not support pkcs12 files.Adriaan de Jong2011-10-221-0/+4
| | | | | | | Signed-off-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: James Yonan <james@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Signed-off-by: David Sommerseth <davids@redhat.com>
* Added PolarSSL support:Adriaan de Jong2011-10-221-5/+20
| | | | | | | | | | | | | - Crypto library - SSL library - PKCS#11 support For missing features, please see README.polarssl Signed-off-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: James Yonan <james@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Signed-off-by: David Sommerseth <davids@redhat.com>
* Refactored: Netscape certificate type verificationAdriaan de Jong2011-10-211-2/+2
| | | | | | Signed-off-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: James Yonan <james@openvpn.net> Signed-off-by: David Sommerseth <davids@redhat.com>
* Refactored cipher key typesAdriaan de Jong2011-10-191-2/+2
| | | | | | | Signed-off-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: David Sommerseth <davids@redhat.com> Acked-by: James Yonan <james@openvpn.net> Signed-off-by: David Sommerseth <davids@redhat.com>
* Refactored message digest type functionsAdriaan de Jong2011-10-191-1/+1
| | | | | | Signed-off-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: David Sommerseth <davids@redhat.com> Signed-off-by: David Sommerseth <davids@redhat.com>
* Move block for "stale-routes-check" config inside #ifdef P2MP_SERVER blockGert Doering2011-10-091-19/+19
| | | | | | | | | options->stale_routes_ageing_time etc. are not defined otherwise, and compilation fails. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Davide Guerri <d.guerri@caspur.it> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* New feauture: Add --stale-routes-checkDavide Guerri2011-09-301-0/+25
| | | | | | | | | | | | | | | | | | This patch adds a stale-routes-check option that takes 2 parameters: a ageing time (in seconds) and a check interval (in seconds). The latter defaults to the former if it's not present. Internally, a new "check" is added in multi_process_per_second_timers_dowork(). This check deletes stale routes and it is inspired to the function multi_reap_range(). We're running a very large connectivity infrastructure based on openVPN (more than 4000 different clients connected per day per server), so we can throughly check this patch (or, of course, any variant of it). Signed-off-by: Davide Guerri <d.guerri@caspur.it> Reviewed-by: David Sommerseth <davids@redhat.com> Acked-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Signed-off-by: David Sommerseth <davids@redhat.com>
* add --mark option to set SO_MARK sockoptHeiko Hund2011-08-311-0/+14
| | | | | | Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Acked-by: David Sommerseth <davids@redhat.com> Signed-off-by: David Sommerseth <davids@redhat.com>
* USE_PF_INET6 by default for v2.3JuanJo Ciarlante2011-08-251-62/+18
| | | | | | | | | | | | | | | | | - put all #ifdef'd code in place, kill the cpp symbol, - thus in v2.3 it's not actually possible to --disable-ipv6 :) RATIONALE: #1 some wacky compilers choke on #ifdef'd constructions for concatenated strings, and given that: #2 v2.3 has already transport ipv6 by default => doesn't justify putting effort on #1 to keep USE_PF_INET6 ifdef wraps. Signed-off-by: JuanJo Ciarlante <jjo+ml@google.com> Signed-off-by: Samuli Seppänen <samuli@openvpn.net> Acked-by: David Sommerseth <davids@redhat.com> Signed-off-by: David Sommerseth <davids@redhat.com>
* remove function is_proto_tcp()Heiko Hund2011-08-241-1/+1
| | | | | | | | | | | The implementation of is_proto_tcp() was invalid since the IPv6 stuff got merged into master. There's proto_is_tcp() that does the same job right. Remove is_proto_tcp() and make its only caller use proto_is_tcp() instead. Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Acked-By: Gert Doering <gert@greenie.muc.de> Signed-off-by: David Sommerseth <davids@redhat.com>
* Redact "echo" directive strings from log, sinceJames Yonan2011-08-241-0/+4
| | | | | | | | | these strings (going forward) could conceivably contain security-sensitive data. Version 2.1.7 git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7480 e7ae566f-a301-0410-adde-c780ea21d3b5
* Merge remote branch SVN 2.1 into the git treeDavid Sommerseth2011-08-191-0/+34
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Hopefully the last SVN merge we need to do, as these merges are getting more and more difficult. Most of the files had minor changes, but due to the CRLF unification patch (commit 6b2883a637fe73492) we got an increased number of conflicts. In addition inclusion of IPv6 support makes the creates a lot of merge issues in route.c and socket.c This merge also reverts commit 7c18c6353904f8c6e7 which merged add_bypass_address() into add_host_route_if_nonlocal(). However the SVN tree began to use add_bypass_address() another place, where at first glance it did not be appropriate to use add_host_route_if_nonlocal(). This merge has gone through a 'make check' without any errors, but have not been tested more thoroughly yet. Conflicts: ChangeLog INSTALL INSTALL-win32.txt Makefile.am acinclude.m4 base64.c buffer.c buffer.h common.h configure.ac contrib/pull-resolv-conf/client.down contrib/pull-resolv-conf/client.up crypto.c cryptoapi.c easy-rsa/2.0/Makefile easy-rsa/2.0/README easy-rsa/2.0/build-ca easy-rsa/2.0/build-dh easy-rsa/2.0/build-inter easy-rsa/2.0/build-key easy-rsa/2.0/build-key-pass easy-rsa/2.0/build-key-pkcs12 easy-rsa/2.0/build-key-server easy-rsa/2.0/build-req easy-rsa/2.0/build-req-pass easy-rsa/2.0/clean-all easy-rsa/2.0/inherit-inter easy-rsa/2.0/list-crl easy-rsa/2.0/pkitool easy-rsa/2.0/revoke-full easy-rsa/2.0/sign-req easy-rsa/2.0/vars easy-rsa/2.0/whichopensslcnf easy-rsa/Windows/build-ca-pass.bat easy-rsa/Windows/build-key-pass.bat easy-rsa/Windows/build-key-server-pass.bat easy-rsa/Windows/init-config.bat easy-rsa/Windows/vars.bat.sample error.c error.h forward.c helper.c httpdigest.c httpdigest.h ieproxy.c init.c init.h install-win32/Makefile.am install-win32/makeopenvpn install-win32/openssl/openssl097.patch install-win32/openssl/openssl098.patch install-win32/openvpn.nsi list.c list.h manage.c manage.h management/management-notes.txt mbuf.c mbuf.h misc.c misc.h mroute.c mroute.h msvc/autodefs.h.in msvc/config.py msvc/msvc.mak mtcp.c mudp.c multi.c multi.h occ.c openvpn-plugin.h openvpn.8 openvpn.h options.c options.h otime.c otime.h perf.c pf.c ping.c pkcs11.c plugin.c plugin.h plugin/auth-pam/README plugin/auth-pam/auth-pam.c pool.c pool.h proto.h proxy.c ps.c push.c reliable.c route.c route.h sample-config-files/firewall.sh sample-scripts/bridge-start sample-scripts/bridge-stop sample-scripts/openvpn.init sample-scripts/verify-cn schedule.c schedule.h service-win32/openvpnserv.c sig.c socket.c socket.h socks.c socks.h ssl.c ssl.h status.c syshead.h tap-win32/SOURCES.in tap-win32/common.h tap-win32/proto.h tap-win32/tapdrvr.c tap-win32/types.h tun.c tun.h version.m4 win/autodefs.h.in win/build.py win/build_all.py win/build_ddk.py win/build_exe.py win/config.py win/config_all.py win/config_tap.py win/config_ti.py win/js.py win/make_dist.py win/msvc.mak.in win/settings.in win/show.py win/sign.py win/tap_span.py win/wb.py win32.c win32.h Signed-off-by: David Sommerseth <davids@redhat.com> Reviewed-by: Gert Doering <gert@greenie.muc.de> Reviewed-by: James Yonan <james@openvpn.net> Reviewed-by: Adriaan de Jong <dejong@fox-it.com>
| * Added "management-query-remote" directive (client) to allowJames Yonan2011-07-051-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | the management interface to override the "remote" directive. See "remote" command in management/management-notes.txt for documentation. Version 2.1.4. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7410 e7ae566f-a301-0410-adde-c780ea21d3b5
| * Added redirect-gateway block-local flag, with support forJames Yonan2011-06-121-0/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Linux, Mac OS X, and Linux. This flag (which is pushable from server) blocks client access to local LAN while VPN session is active. Added standalone --show-gateway option to show info about default gateway. Extensively refactored get_default_gateway function in route.c to ease implementation of block-local. Removed "Experimental" disclaimer from redirect-gateway man page. Version 2.1.3y. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7334 e7ae566f-a301-0410-adde-c780ea21d3b5
| * r7316 fixes.James Yonan2011-06-101-0/+1
| | | | | | | | | | | | | | Version 2.1.3x1. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7332 e7ae566f-a301-0410-adde-c780ea21d3b5
| * Added support for static challenge/response protocol.James Yonan2011-06-031-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This includes the new "static-challenge" directive. See management/management-notes.txt for details on both static and dynamic challenge/response protocols. All client-side challenge/response code is #ifdefed on ENABLE_CLIENT_CR and can be removed from the build by commenting out the definition of ENABLE_CLIENT_CR in syshead.h. Version 2.1.3x. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7316 e7ae566f-a301-0410-adde-c780ea21d3b5
| * Fixed compile issues on Windows.James Yonan2011-04-251-1/+1
| | | | | | | | | | | | | | Version 2.1.3w git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7219 e7ae566f-a301-0410-adde-c780ea21d3b5
| * Added new "extra-certs" and "verify-hash" options (see man page forJames Yonan2011-04-251-0/+52
| | | | | | | | | | | | | | | | | | | | | | | | details). Increase the timeout after SIGUSR1 restart when restart is not due to server_poll_timeout. Version 2.1.3v git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7215 e7ae566f-a301-0410-adde-c780ea21d3b5
| * Added 'dir' flag to "crl-verify" (see man page for info).James Yonan2011-04-241-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Don't call SSL_CTX_set_client_CA_list or SSL_CTX_set_client_CA_list if not running in server mode (these functions are only useful for TLS/SSL servers). Modified openvpn_snprintf to return false on overflow, and true otherwise. When AUTH_FAILED,... is received, log the full string. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7213 e7ae566f-a301-0410-adde-c780ea21d3b5
| * Added "auth-token" client directive, which is intended to beJames Yonan2011-03-261-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | pushed by server, and that is used to offer a temporary session token to clients that can be used in place of a password on subsequent credential challenges. This accomplishes the security benefit of preventing caching of the real password while offering most of the advantages of password caching, i.e. not forcing the user to re-enter credentials for every TLS renegotiation or network hiccup. auth-token does two things: 1. if password caching is enabled, the token replaces the previous password, and 2. if the management interface is active, the token is output to it: >PASSWORD:Auth-Token:<token> Also made a minor change to HALT/RESTART processing when password caching is enabled. When client receives a HALT or RESTART message, and if the message text contains a flags block (i.e. [FFF]:message), if flag 'P' (preserve auth) is present in flags, don't purge the Auth password. Otherwise do purge the Auth password. Version 2.1.3o git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7088 e7ae566f-a301-0410-adde-c780ea21d3b5
| * Renamed branch to reflect that it is no longer beta.James Yonan2011-03-171-0/+6053
| | | | git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7051 e7ae566f-a301-0410-adde-c780ea21d3b5
generated by cgit (git 2.34.1) at 2024-06-20 17:13:08 +0000