summaryrefslogtreecommitdiffstats
path: root/options.h
Commit message (Collapse)AuthorAgeFilesLines
* Made some options connection-entry specificJan Just Keijser2012-02-131-18/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The following options may now be used in a connection block: fragment mssfix tun-mtu tun-mtu-extra link-mtu mtu_discover_type explicit-exit-notification In order to support stuff like <connection> remote host proto udp fragment explicit-exit-notification 3 </connection> <connection> remote host proto tcp </connection> Signed-off-by: Jan Just Keijser <janjust@nikhef.nl> Acked-by: David Sommerseth <davids@redhat.com> Signed-off-by: David Sommerseth <davids@redhat.com>
* Add --route-pre-down/OPENVPN_PLUGIN_ROUTE_PREDOWN script/plug-in hookDavid Sommerseth2012-01-251-0/+1
| | | | | | | | | | | | | This patchs adds a script/plug-in hook which is called right before the network routes are taken down. This gives external processes a possibility to tear down communication over the VPN before the VPN disappears. One use case can be to mount a networked file system over the VPN via --route-up. And then to unmount this file system via --route-pre-down Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de>
* Fix build-up of duplicate IPv6 routes on reconnect.Gert Doering2012-01-041-0/+3
| | | | | | | | | | | | options.c: extend pre_pull_save() and pre_pull_restore() to save/restore options->routes_ipv6 as well options.h: add routes_ipv6 to "struct options_pre_pull" route.h, route.c: add clone_route_ipv6_option_list() and copy_route_ipv6_option_list() helper functions Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <davids@redhat.com> Signed-off-by: David Sommerseth <davids@redhat.com>
* Added "memstats" option to maintain real-time operating statsJames Yonan2011-12-141-0/+4
| | | | | | | | in a memory-mapped file. Version 2.1.16 git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7653 e7ae566f-a301-0410-adde-c780ea21d3b5
* Fixed disabling crypto and SSLAdriaan de Jong2011-10-241-1/+1
| | | | | | Signed-off-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: David Sommerseth <davids@redhat.com> Signed-off-by: David Sommerseth <davids@redhat.com>
* Disable CryptoAPI when not using OpenSSL, and document that fact.Adriaan de Jong2011-10-221-1/+1
| | | | | | | Signed-off-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: James Yonan <james@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Signed-off-by: David Sommerseth <davids@redhat.com>
* Refactored: Netscape certificate type verificationAdriaan de Jong2011-10-211-1/+1
| | | | | | Signed-off-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: James Yonan <james@openvpn.net> Signed-off-by: David Sommerseth <davids@redhat.com>
* Added a check for Openssl or PolarSSL definesAdriaan de Jong2011-10-191-0/+3
| | | | | | Signed-off-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: David Sommerseth <davids@redhat.com> Signed-off-by: David Sommerseth <davids@redhat.com>
* New feauture: Add --stale-routes-checkDavide Guerri2011-09-301-0/+2
| | | | | | | | | | | | | | | | | | This patch adds a stale-routes-check option that takes 2 parameters: a ageing time (in seconds) and a check interval (in seconds). The latter defaults to the former if it's not present. Internally, a new "check" is added in multi_process_per_second_timers_dowork(). This check deletes stale routes and it is inspired to the function multi_reap_range(). We're running a very large connectivity infrastructure based on openVPN (more than 4000 different clients connected per day per server), so we can throughly check this patch (or, of course, any variant of it). Signed-off-by: Davide Guerri <d.guerri@caspur.it> Reviewed-by: David Sommerseth <davids@redhat.com> Acked-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Signed-off-by: David Sommerseth <davids@redhat.com>
* add --mark option to set SO_MARK sockoptHeiko Hund2011-08-311-0/+3
| | | | | | Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Acked-by: David Sommerseth <davids@redhat.com> Signed-off-by: David Sommerseth <davids@redhat.com>
* Merge remote branch SVN 2.1 into the git treeDavid Sommerseth2011-08-191-1/+24
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Hopefully the last SVN merge we need to do, as these merges are getting more and more difficult. Most of the files had minor changes, but due to the CRLF unification patch (commit 6b2883a637fe73492) we got an increased number of conflicts. In addition inclusion of IPv6 support makes the creates a lot of merge issues in route.c and socket.c This merge also reverts commit 7c18c6353904f8c6e7 which merged add_bypass_address() into add_host_route_if_nonlocal(). However the SVN tree began to use add_bypass_address() another place, where at first glance it did not be appropriate to use add_host_route_if_nonlocal(). This merge has gone through a 'make check' without any errors, but have not been tested more thoroughly yet. Conflicts: ChangeLog INSTALL INSTALL-win32.txt Makefile.am acinclude.m4 base64.c buffer.c buffer.h common.h configure.ac contrib/pull-resolv-conf/client.down contrib/pull-resolv-conf/client.up crypto.c cryptoapi.c easy-rsa/2.0/Makefile easy-rsa/2.0/README easy-rsa/2.0/build-ca easy-rsa/2.0/build-dh easy-rsa/2.0/build-inter easy-rsa/2.0/build-key easy-rsa/2.0/build-key-pass easy-rsa/2.0/build-key-pkcs12 easy-rsa/2.0/build-key-server easy-rsa/2.0/build-req easy-rsa/2.0/build-req-pass easy-rsa/2.0/clean-all easy-rsa/2.0/inherit-inter easy-rsa/2.0/list-crl easy-rsa/2.0/pkitool easy-rsa/2.0/revoke-full easy-rsa/2.0/sign-req easy-rsa/2.0/vars easy-rsa/2.0/whichopensslcnf easy-rsa/Windows/build-ca-pass.bat easy-rsa/Windows/build-key-pass.bat easy-rsa/Windows/build-key-server-pass.bat easy-rsa/Windows/init-config.bat easy-rsa/Windows/vars.bat.sample error.c error.h forward.c helper.c httpdigest.c httpdigest.h ieproxy.c init.c init.h install-win32/Makefile.am install-win32/makeopenvpn install-win32/openssl/openssl097.patch install-win32/openssl/openssl098.patch install-win32/openvpn.nsi list.c list.h manage.c manage.h management/management-notes.txt mbuf.c mbuf.h misc.c misc.h mroute.c mroute.h msvc/autodefs.h.in msvc/config.py msvc/msvc.mak mtcp.c mudp.c multi.c multi.h occ.c openvpn-plugin.h openvpn.8 openvpn.h options.c options.h otime.c otime.h perf.c pf.c ping.c pkcs11.c plugin.c plugin.h plugin/auth-pam/README plugin/auth-pam/auth-pam.c pool.c pool.h proto.h proxy.c ps.c push.c reliable.c route.c route.h sample-config-files/firewall.sh sample-scripts/bridge-start sample-scripts/bridge-stop sample-scripts/openvpn.init sample-scripts/verify-cn schedule.c schedule.h service-win32/openvpnserv.c sig.c socket.c socket.h socks.c socks.h ssl.c ssl.h status.c syshead.h tap-win32/SOURCES.in tap-win32/common.h tap-win32/proto.h tap-win32/tapdrvr.c tap-win32/types.h tun.c tun.h version.m4 win/autodefs.h.in win/build.py win/build_all.py win/build_ddk.py win/build_exe.py win/config.py win/config_all.py win/config_tap.py win/config_ti.py win/js.py win/make_dist.py win/msvc.mak.in win/settings.in win/show.py win/sign.py win/tap_span.py win/wb.py win32.c win32.h Signed-off-by: David Sommerseth <davids@redhat.com> Reviewed-by: Gert Doering <gert@greenie.muc.de> Reviewed-by: James Yonan <james@openvpn.net> Reviewed-by: Adriaan de Jong <dejong@fox-it.com>
| * Added "management-query-remote" directive (client) to allowJames Yonan2011-07-051-1/+21
| | | | | | | | | | | | | | | | | | | | | | | | the management interface to override the "remote" directive. See "remote" command in management/management-notes.txt for documentation. Version 2.1.4. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7410 e7ae566f-a301-0410-adde-c780ea21d3b5
| * r7316 fixes.James Yonan2011-06-101-3/+3
| | | | | | | | | | | | | | Version 2.1.3x1. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7332 e7ae566f-a301-0410-adde-c780ea21d3b5
| * Added support for static challenge/response protocol.James Yonan2011-06-031-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This includes the new "static-challenge" directive. See management/management-notes.txt for details on both static and dynamic challenge/response protocols. All client-side challenge/response code is #ifdefed on ENABLE_CLIENT_CR and can be removed from the build by commenting out the definition of ENABLE_CLIENT_CR in syshead.h. Version 2.1.3x. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7316 e7ae566f-a301-0410-adde-c780ea21d3b5
| * Fixed compile issues on Windows.James Yonan2011-04-251-1/+1
| | | | | | | | | | | | | | Version 2.1.3w git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7219 e7ae566f-a301-0410-adde-c780ea21d3b5
| * Added new "extra-certs" and "verify-hash" options (see man page forJames Yonan2011-04-251-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | details). Increase the timeout after SIGUSR1 restart when restart is not due to server_poll_timeout. Version 2.1.3v git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7215 e7ae566f-a301-0410-adde-c780ea21d3b5
| * Renamed branch to reflect that it is no longer beta.James Yonan2011-03-171-0/+774
| | | | git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7051 e7ae566f-a301-0410-adde-c780ea21d3b5
* Fix compile issues when using --enable-small and --disable-ssl/--disable-cryptoGustavo Zacarias2011-04-271-1/+2
| | | | | | | | | The tmp_dir string is required in the options struct regardless of options so spin it out of #if conditionals. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Acked-by: David Sommerseth <dazo@users.sourceforge.net> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* Merge branch 'svn-branch-2.1' into mergeDavid Sommerseth2011-04-261-1/+22
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Pulling in changes from James' 2.1/openvpn branch in SVN. Conflicts: buffer.c init.c manage.h multi.c openvpn.8 options.c ssl.c version.m4 win/sign.py Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * Fixed compile issues on Windows.James Yonan2011-04-261-1/+1
| | | | | | | | | | | | | | Version 2.1.3w git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7219 e7ae566f-a301-0410-adde-c780ea21d3b5
| * Added new "extra-certs" and "verify-hash" options (see man page forJames Yonan2011-04-261-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | details). Increase the timeout after SIGUSR1 restart when restart is not due to server_poll_timeout. Version 2.1.3v git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@7215 e7ae566f-a301-0410-adde-c780ea21d3b5
| * Added optional journal directory argument to "port-share" directive, for ↵James Yonan2011-04-251-0/+1
| | | | | | | | | | | | reporting client IP origins of proxied connections. git-svn-id: http://svn.openvpn.net/projects/branches/BETA21@7031 e7ae566f-a301-0410-adde-c780ea21d3b5
| * Added "client-nat" option for stateless, one-to-oneJames Yonan2011-02-181-0/+13
| | | | | | | | | | | | | | | | | | NAT on the client side. Version 2.1.3i. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6944 e7ae566f-a301-0410-adde-c780ea21d3b5
| * Added --x509-track option.James Yonan2011-01-051-0/+4
| | | | | | | | | | | | | | Version 2.1.3e git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6780 e7ae566f-a301-0410-adde-c780ea21d3b5
* | new feature: "ifconfig-ipv6-push" (from ccd/ config)Gert Doering2011-04-241-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | affects options.h, options.c, multi.c benefit: static IPv6 address assignment from radiusplugin (etc) rewritten get_ipv6_addr() to handle IPv6 addresses with and without "/bits" affects route.c and mainly options.c benefit: ifconfig-ipv6, ifconfig-ipv6-pool can now be accept configurations with networks != /64 (the rest of the implementation is not yet completely there, but this is imporant preparation work to be able to add /bits to "push 'ifconfig-ipv6 ...'" later on without breaking clients do not try to add/delete IPv6 routes if no IPv6 on tunnel affects: route.c benefit: avoid error messages, and make IPv6 troubleshooting easier flag as "config error" if --ifconfig-ipv6-pool used without --ifconfig-ipv6 flag as "config error" if --ifconfig-ipv6-pool used without --server print warning if --ifconfig-ipv6 is used without --tun-ipv6 changes documented in more detail in ChangeLog.IPv6 * release patch set 20100114-1 (cherry picked from commit c04f774c7e9bed602818b1fe2ff4e83cf913d471)
* | Enable IPv6 Payload in OpenVPN p2mp tun server mode. 20100104-1 release.Gert Doering2011-04-241-0/+15
| | | | | | | | (cherry picked from commit ec9dce6387afd198881493bfebf13bb121e8a56b)
* | Make the --x509-username-field feature an opt-in featureDavid Sommerseth2010-12-171-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After some discussion [1] regarding an extension of this feature, James Yonan wanted this extension to be an opt-in feature. However, as it does not make sense to opt-in on a extension of a feature which was discussed, this patch makes the base feature an opt-in instead. The base feature comes from commit 2e8337de248ef0b5b48cbb2964 (beta2.2) and commit 935c62be9c0c8a256112 (feat_misc). [1] http://thread.gmane.org/gmane.network.openvpn.devel/4266 Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: James Yonan <james@openvpn.net> (cherry picked from commit 024972e2ced84c6e5cabc43620ab510e5693d1d4)
* | Merge branch 'feat_misc' into beta2.2David Sommerseth2010-11-181-5/+0
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: acinclude.m4 config-win32.h configure.ac misc.c thread.c thread.h - These conflicts was mainly due to feat_misc getting old and mostly caused by the pthread clean-up patches in feat_misc Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * | Clean-up: Remove pthread and mutex locking codeDavid Sommerseth2010-11-141-5/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This code was not activated at all, and hard coded as disabled in syshead.h with this code snippet: /* * Pthread support is currently experimental (and quite unfinished). */ #if 1 /* JYFIXME -- if defined, disable pthread */ #undef USE_PTHREAD #endif So no matter if --enable-pthread when running ./configure or not, this feature was never enabled in reality. Further, by removing the blocker code above made OpenVPN uncompilable in the current state. As the threading part needs to be completely rewritten and pthreading will not be supported in OpenVPN 2.x, removing this code seems most reasonable. In addition, a lot of mutex locking code was also removed, as they were practically NOP functions, due to pthreading being forcefully disabled Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: James Yonan <james@openvpn.net>
* | | Merge branch 'feat_misc' into beta2.2David Sommerseth2010-11-131-0/+1
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: Makefile.am openvpn.8 options.c socket.c ssl.c - feat_misc is missing a lot of bugfix2.1 changes Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * | Adding support for SOCKS plain text authenticationPierre Bourdon2010-11-121-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds support for SOCKS plain text (username/password) authentication as described in RFC 1929. It adds an optional third parameter to the socks-proxy option, which is a file containing the login credentials. I've been using this patch for two weeks now and it does not seem to cause any problem. The only modifications are in the SOCKS handshake handling and the options parser. Signed-Off-By: Pierre Bourdon <delroth@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <dazo@users.sourceforge.net> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * | Choose a different field in X509 to be usernameEmilien Mantel2010-06-171-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For my company, we use a PKI (linked to a LDAP) with OpenVPN. We can't use "CN" to be username (few people can have the same "CN"). In our case, we only use the UID. With my patch, you can choose another field to be username with a new option called --x509-username-field, the default value is "CN". Signed-off-by: Emilien Mantel <emilien.mantel@businessdecision.com> Acked-by: David Sommerseth <dazo@users.sourceforge.net> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * | enhance tls-verify possibilityMathieu GIANNECCHINI2010-03-021-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It should be nice to enhance tls-verify check possibilities against peer cert during a pending TLS connection like : - OCSP verification - check any X509 extensions of the peer certificate - delta CRL verification - ... This patch add a new "tls-export-cert" option which allow to get peer certificate in PEM format and to store it in an openvpn temporary file. Peer certificate is stored before tls-script execution and deleted after. The name of the related temporary file is available under tls-verify script by an environment variable "peer_cert". The patch was made from OpenVPN svn Beta21 branches. Here is a very simple exemple of Tls-verify script which provide OCSP support to OpenVPN (with tls-export-cert option) without any OpenVPN "core" modification : X509=$2 openssl ocsp \ -issuer /etc/openvpn/ssl.crt/RootCA.pem \ -CAfile /etc/openvpn/ssl.capath/OpenVPNServeur-cafile.pem \ -cert $peer_cert \ -url http://your-ocsp-url if [ $? -ne 0 ] then echo "error : OCSP check failed for ${X509}" | logger -t "tls-verify" exit 1 fi This has been discussed here: <http://thread.gmane.org/gmane.network.openvpn.devel/2492> <http://thread.gmane.org/gmane.network.openvpn.devel/3150> <http://thread.gmane.org/gmane.network.openvpn.devel/3217> This patch has been modified by David Sommerseth, by fixing a few issues which came up to during the code review process. The man page has been updated and tmp_file in ssl.c is checked for not being NULL before calling delete_file(). Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Gert Doering <gert@greenie.muc.de>
* | | Choose a different field in X509 to be usernameEmilien Mantel2010-10-211-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For my company, we use a PKI (linked to a LDAP) with OpenVPN. We can't use "CN" to be username (few people can have the same "CN"). In our case, we only use the UID. With my patch, you can choose another field to be username with a new option called --x509-username-field, the default value is "CN". Signed-off-by: Emilien Mantel <emilien.mantel@businessdecision.com> Acked-by: David Sommerseth <dazo@users.sourceforge.net> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* | | enhance tls-verify possibilityMathieu GIANNECCHINI2010-10-211-0/+1
| |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It should be nice to enhance tls-verify check possibilities against peer cert during a pending TLS connection like : - OCSP verification - check any X509 extensions of the peer certificate - delta CRL verification - ... This patch add a new "tls-export-cert" option which allow to get peer certificate in PEM format and to store it in an openvpn temporary file. Peer certificate is stored before tls-script execution and deleted after. The name of the related temporary file is available under tls-verify script by an environment variable "peer_cert". The patch was made from OpenVPN svn Beta21 branches. Here is a very simple exemple of Tls-verify script which provide OCSP support to OpenVPN (with tls-export-cert option) without any OpenVPN "core" modification : X509=$2 openssl ocsp \ -issuer /etc/openvpn/ssl.crt/RootCA.pem \ -CAfile /etc/openvpn/ssl.capath/OpenVPNServeur-cafile.pem \ -cert $peer_cert \ -url http://your-ocsp-url if [ $? -ne 0 ] then echo "error : OCSP check failed for ${X509}" | logger -t "tls-verify" exit 1 fi This has been discussed here: <http://thread.gmane.org/gmane.network.openvpn.devel/2492> <http://thread.gmane.org/gmane.network.openvpn.devel/3150> <http://thread.gmane.org/gmane.network.openvpn.devel/3217> This patch has been modified by David Sommerseth, by fixing a few issues which came up to during the code review process. The man page has been updated and tmp_file in ssl.c is checked for not being NULL before calling delete_file(). Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Gert Doering <gert@greenie.muc.de>
* | Added --proto-force directive.James Yonan2010-09-011-0/+2
| | | | | | | | | | | | | | Version 2.1.3a git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6424 e7ae566f-a301-0410-adde-c780ea21d3b5
* | Allow PKCS12 file content to be included inline in configuration file,James Yonan2010-08-291-0/+1
| | | | | | | | | | | | | | rendered as base64. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6412 e7ae566f-a301-0410-adde-c780ea21d3b5
* | Implemented a key/value auth channel from client to server.James Yonan2010-06-011-0/+4
| | | | | | | | | | | | | | Version 2.1.1i git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@5668 e7ae566f-a301-0410-adde-c780ea21d3b5
* | Implemented http-proxy-override and http-proxy-fallback directives to make itJames Yonan2010-05-241-0/+36
| | | | | | | | | | | | | | | | | | easier for OpenVPN client UIs to start a pre-existing client config file with proxy options, or to adaptively fall back to a proxy connection if a direct connection fails. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@5652 e7ae566f-a301-0410-adde-c780ea21d3b5
* | Updated copyright date to 2010.James Yonan2010-04-281-1/+1
|/ | | | git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@5599 e7ae566f-a301-0410-adde-c780ea21d3b5
* Added --server-poll-timeout option : when polling possible remotejames2009-09-281-0/+2
| | | | | | | | servers to connect to in a round-robin fashion, spend no more than n seconds waiting for a response before trying the next server. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@5010 e7ae566f-a301-0410-adde-c780ea21d3b5
* Eliminated the limitation on the number of options that can be pushedjames2009-09-271-12/+3
| | | | | | | | | | | | | to clients, including routes. Previously, all pushed options needed to fit within a 1024 byte options string. Remember that to make use of this feature to allow many routes to be pushed to clients, the client config file must specify the max-routes option, and the number of pushed routes cannot exceed this limit. Also, both server and client must include this commit. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@4991 e7ae566f-a301-0410-adde-c780ea21d3b5
* The maximum number of "route" directives (specified in the configjames2009-09-171-1/+2
| | | | | | | | | | | | | | | | | file or pulled from a server) can now be configured via the new "max-routes" directive. Previously, the limit was set to 100 and fixed by a compile-time constant. Now the limit is dynamic and can be modified by the "max-routes" directive. If max-routes is not specified, the default limit is 100. Note that this change does not address the maximum size of the pushed options string sent from server to client, which is still controlled by the TLS_CHANNEL_BUF_SIZE compile-time constant. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@4967 e7ae566f-a301-0410-adde-c780ea21d3b5
* Added "setcon" directive for interoperability with SELinuxjames2009-09-041-0/+3
| | | | | | | (Sebastien Raveau). git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@4932 e7ae566f-a301-0410-adde-c780ea21d3b5
* Update copyright to 2009.james2009-05-301-1/+1
| | | | git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@4477 e7ae566f-a301-0410-adde-c780ea21d3b5
* Added optional "nogw" (no gateway) flag to --server-bridgejames2008-11-201-0/+1
| | | | | | | | | | to inhibit the pushing of the route-gateway parameter to clients. Miscellaneous man page edits, fixed some formatting issues. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@3550 e7ae566f-a301-0410-adde-c780ea21d3b5
* Added --tcp-nodelay option: Macro that sets TCP_NODELAY socketjames2008-11-181-0/+1
| | | | | | | flag on the server as well as pushes it to connecting clients. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@3513 e7ae566f-a301-0410-adde-c780ea21d3b5
* Added --prng option to control PRNG (pseudo-randomjames2008-11-181-0/+2
| | | | | | | | | | | number generator) parameters. In previous OpenVPN versions, the PRNG was hardcoded to use the SHA1 hash. Now any OpenSSL hash may be used. This is part of an effort to remove hardcoded references to a specific cipher or cryptographic hash algorithm. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@3503 e7ae566f-a301-0410-adde-c780ea21d3b5
* Added config file option "setenv FORWARD_COMPATIBLE 1" to relaxjames2008-11-041-0/+3
| | | | | | | | config file syntax checking to allow directives for future OpenVPN versions to be ignored. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@3476 e7ae566f-a301-0410-adde-c780ea21d3b5
* Added server-side --auth-user-pass-optional directive, to allowjames2008-10-281-2/+1
| | | | | | | | | connections by clients that do not specify a username/password, when a user-defined authentication script/module is in place (via --auth-user-pass-verify, --management-client-auth, or a plugin module). git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@3461 e7ae566f-a301-0410-adde-c780ea21d3b5
generated by cgit (git 2.34.1) at 2024-06-17 22:23:13 +0000