summaryrefslogtreecommitdiffstats
path: root/src/openvpn/options.c
Commit message (Collapse)AuthorAgeFilesLines
* Fix commit a3160fc1bd7368395745b9cee6e40fb819f5564crelease/2.3Arne Schwabe2015-10-151-1/+1
| | | | | | | | | | | Move things to the proper place, ensure that line_ptr is actually properly initialized for *every* line read, not just for the first one Acked-by: Lev Stipakov <lstipakov@gmail.com> Message-Id: 1444827956-2169-1-git-send-email-arne@rfc2549.org URL: http://article.gmane.org/gmane.network.openvpn.devel/10271 Signed-off-by: David Sommerseth <davids@redhat.com> (cherry picked from commit cba33989101175ac07434b9c5cceba116bf38127)
* Fix "White space before end tags can break the config parser"janjust2015-10-111-1/+4
| | | | | | | | | | | trac #569 Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1444493569-24026-1-git-send-email-janjust@nikhef.nl> URL: http://article.gmane.org/gmane.network.openvpn.devel/10249 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit c67acea173dc9ee37220f5b9ff14ede081181992)
* Replace strdup() calls for string_alloc() callsSteffan Karger2015-10-041-1/+1
| | | | | | | | | | | | | As reported by Bill Parker in trac #600, strdup() return values are not always correctly checked for failed allocations. This patch adds missing checks by using string_alloc(), which performs the required checks. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <561130FC.8090008@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/10176 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit ddc7692d245017c71adc40ad5cc195617e39fce0)
* Show extra-certs in current parameters.Arne Schwabe2015-08-081-0/+1
| | | | | | | | | | | Closes ticket #591 Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1438859835-3977-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/10005 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 291c227d2ccecaa92602eaa5259a23c7093e30e5)
* Fix commit e473b7c if an inline file happens to have a line break exactly at ↵Arne Schwabe2015-07-271-1/+1
| | | | | | | | | | | | | | | | buffer limit The check does only for strlen(line) space and buf_printf will only use at most space -1 and not print the final character ('\n') in this corner. Since a missing \n only breaks certificates at the start and end marker, missing line breaks otherwise do not trigger this error. Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1438011191-19389-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/9956 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit d40cbf0e2601b35bfb1c0551c6f3907b5c5178ff)
* Fix --askpass not allowing for password input via stdinJames Geboski2015-07-131-2/+2
| | | | | | | | | | | | | | | | | | | This resolves --askpass treating stdin as a file during the file access check. In turn, this leads to openvpn failing to start if this option is set to stdin. By default, --askpass reads the certificate's password from stdin rather than a file. Without passing the CHKACC_ACPTSTDIN flag to check_file_access(), stdin is marked as being a nonexistent file. Trac #248 Signed-off-by: James Geboski <jgeboski@gmail.com> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <55A41225.2020705@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9918 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 4e1e3ba1d8582a1e95dd6f9564e97c99784959a7)
* Report missing endtags of inline files as warningsArne Schwabe2015-06-301-1/+8
| | | | | | | | | | | | | (2.3 reports as warning only, 2.4 reports as M_FATAL) trac #568 Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1435581995-11820-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/9830 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 68eecf76978a80bd5d88e944e4ed5e42bf2fd8e4)
* Disallow usage of --server-poll-timeout in --secret key mode.Gert Doering2015-05-241-0/+3
| | | | | | | | | | | | | | | | The internal machinery wants TLS for this to work, so just add this to the (long) list of options not allowed unless either --tls-client or --tls-server is active. For added sanity, add an ASSERT() call to the place where this combination caused a NULL ptr reference, and document the restriction. Fix trac #373 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1432472554-24666-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9736 (cherry picked from commit 6478c1f359e6b0ea2046d9e2801830753e53c06a)
* Fix null pointer dereference in options.cJonathan K. Bullard2015-05-231-1/+1
| | | | | | | | | Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <CAEsd45SHoEtahdVT95a+N-zmjRG4nH3QPxBZoGpnh1pykjSU4A@mail.gmail.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/9723 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 025d611fc68aa0c651c391bd6178d062246f36f0)
* Remove size limit for files inlined in configSteffan Karger2015-05-021-1/+10
| | | | | | | | | | | | | | | | | As described in trac #484, the current inline file size limit of 10000 bytes is becoming an issue for some users. Since RSA keys and signature sizes are increasing, we need to adjust our limits. As #484 reports, 10000 can be too small for PKCS#12 files with 4K RSA keys. Instead of postponing this issue by increasing the static limit, dynamically increase the buffer size while reading. This keeps the memory usage limited but does allow for larger inlined files. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1430122342-11742-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9607 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit e473b7c4ce41a450645e0f89579bc25b4a7f7d49)
* Print helpful error message on --mktun/--rmtun if not available.Gert Doering2015-04-281-2/+0
| | | | | | | | | | | | | | | | OpenVPN only supports --mktun/--rmtun to create/destroy persistant tunnels on Linux. On BSD OSes, "ifconfig tun0 create" can do the same job, so we do not actually need to support it - but the previous error message ("unknown option") wasn't helpful. So always accept the option now, and on non-supported systems, direct user to manpage. Trac #85 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <dazo@users.sourceforge.net> Message-Id: <1430219063-12291-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9617 (cherry picked from commit 4ad2b65d9deb3197d847d7dcc36715aa5394836f)
* Fix incorrect use of get_ipv6_addr() for iroute options.Gert Doering2015-03-081-1/+1
| | | | | | | | | | get_ipv6_addr() returns "bool/false", not "int < 0" to signal error. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1425819401-18465-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9532 (cherry picked from commit e8562d5531277ee4dd7c517ef68e87af077ac948)
* Fix mssfix default value in connection_list contextLev Stipakov2015-03-071-1/+1
| | | | | | | | | | | | | | | | | | | | Due to this bug, mssfix hasn't been assigned to fragment value and used default value (1450) instead. As a consequence, TCP packets get fragmented, which causes performance penalty. Since dual stack patch (commit 23d61c56b9fd218c39ad151b01b7e2d6690e6093) OpenVPN uses options->connection_list, even for single remote. This fix assigns mssfix value to fragment value for connection_entry inside connection_list instead of connection_entry inside options struct (which does not work for connection_list case). Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1425587636-23338-1-git-send-email-lstipakov@gmail.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/9507 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit d384a9587951617d12e31e0a18050bd86402d5df)
* Set tls-version-max to 1.1 if cryptoapicert is usedSteffan Karger2014-12-281-0/+18
| | | | | | | | | | | | | | | | | | | | OpenVPN's current cryptoapicert implementation does not support TLS 1.2 (and newer). Fixing this requires a rewrite of our cryptoapi code to use Microsofts' "Cryptography API: Next Generation", and several hacks to work around that API. As long as we don't fix that, make openvpn automatically cap the TLS version to 1.1 when using cryptoapi (and tell the user we're doing so). This enables the user to use cryptoapi + TLS version negotiation (upto TLS 1.1) without having to change his configuration. This patch has been tested on Windows 8.1 for both the master and release/2.3 branches. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1419762313-31233-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9361 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 04dcb96cc1f525afee3f830248ecaa22d1b4a4c2)
* Make 'provider' option to --show-pkcs11-ids optional where p11-kit is presentDavid Woodhouse2014-12-271-2/+29
| | | | | | | | | Trac: 490 Signed-off-by: David Woodhouse <David.Woodhouse@intel.com> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1418905506.21260.6.camel@infradead.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/9355 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* pkcs11: Load p11-kit-proxy.so module by defaultDavid Woodhouse2014-12-271-0/+9
| | | | | | | | | | | | | | If the user specifies --pkcs11-id or --pkcs-id-management but neglects to explicitly provide a --pkcs11-provider argument, and if the system has p11-kit installed, then load the p11-kit proxy module so that the system-configured tokens are available. Trac: 490 Signed-off-by: David Woodhouse <David.Woodhouse@intel.com> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1418303015.31745.78.camel@infradead.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/9342 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* sockets: Remove the limitation of --tcp-nodelay to be server-onlyDavid Sommerseth2014-12-091-1/+3
| | | | | | | | | | | | | | | | | | | The assert(0) happening if trying to use --tcp-nodelay in a client config is really not helpful at all. When this assert(0) was removed, another warning appeared that this could only be used in server configs. That itself is also quite silly, as clients can choose to use --socket-flags TCP_NODELAY in the client config instead. This behaviour does not help the user in any way. This patch removes the server-only restriction and rather provides a more helpful warning when using --tcp-nodelay on the client side. Trac: 489 Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: 1418118764-17846-1-git-send-email-openvpn.list@topphemmelig.net URL: http://article.gmane.org/gmane.network.openvpn.devel/9334 (cherry picked from commit 706283d3765d1ee62dbd913fbfc191855b92528d)
* Add client-only support for peer-id.Gert Doering2014-11-241-0/+6
| | | | | | | | | | | | | This is a reduced version of the peer-id patch from Lev Stipakov implementing only the client side bits - send IV_PROTO=2, accept "peer-id <n>" as pushed option, support P_DATA_V2 packets. v2: remove addition of "struct tls_multi;" to options.h, not needed Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1416770250-92680-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9274
* Add --tls-version-maxSteffan Karger2014-11-141-3/+19
| | | | | | | | | | | | | | | Because using TLS 1.2 breaks certain setups, a user might want to enforce a maximum TLS version to use. This patch adds that option. This patch removes a number of #ifdefs from ssl_polarssl.c, because the polarssl versions we currently support (polar 1.2 for openvpn 2.3, and polar 1.3 for openvpn-master) have all versions unconditionally enabled. Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <544EC052.3080809@fox-it.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/9210 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Do not upcase x509-username-field for mixed-case arguments.Andris Kalnozols2014-07-101-4/+22
| | | | | | | | | | | | | | | I revisited options.c to refine its brute-force upcasing behavior. Now, the upcasing is done only if the option argument is all lowercase. Mixed-case arguments and those with the "ext:" prefix are left unchanged. This preserves the original intent of the "helpful" upcasing feature for backwards compatibility while limiting its scope in a straightforward way. Signed-off-by: Andris Kalnozols <andris@hpl.hp.com> Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <53B1BDD8.8020705@karger.me> Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit f4e0ad82b0eaccce965074c1ceec2b7e3853dc0d)
* Fixed some compile issues with show_library_versions()James Yonan2014-05-201-6/+9
| | | | | | | | | | | | | | | | | | * Refactored show_library_versions to work around the fact that some compilers (such as MSVC 2008) can't handle #ifdefs inside of macro references. * Declare show_library_versions() in options.h because it's referenced by other files such as openvpn.c. * Declare get_ssl_library_version() as returning const char *, to avoid loss of const qualifier in ssl_openssl.c. Signed-off-by: James Yonan <james@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1399589436-8730-7-git-send-email-james@openvpn.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/8711 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Conditionalize calls to print_default_gateway on !ENABLE_SMALLGert Doering2014-04-301-1/+1
| | | | | | | | | | | | | | Calls to print_default_gateway() depended on #ifdef ENABLE_DEBUG, but the actual function wasn't compiled in #ifdef ENABLE_SMALL, so the combination "configure --enable-small --enable-debug" didn't work. Fix. Fix trac #397 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1398805779-29376-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/8670 (cherry picked from commit c29e08a2f33234fb705a8323c0d9e1e07b0773fd)
* Add SSL library version reporting.Gert Doering2014-04-181-0/+18
| | | | | | | | | | | | | Print the version of the SSL and LZO library (if any) used. SSL library version is also sent as IV_SSL=<version> to the server if --push-peer-info is enabled. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20140416152456.GI16637@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/8537 (cherry picked from commit 1ec984b154aa3247ef58c9d44e7e477880b632b1)
* Introduce safety check for http proxy optionsArne Schwabe2014-03-171-0/+2
| | | | | | | | | Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1395061013-1802-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8353 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 087b510365d9aad8f656a8fb0cc07d51511be9d0)
* Fix spurious ignoring of pushed config options (trac#349).Jens Wagner2014-01-071-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | The function incoming_push_message(...) in push.c uses a local variable option_types_found, that gets passed to do_up(...). If the server push got split into several parts, only the last part (PUSH_MSG_REPLY) option_types_found is used for do_up (initilized as 0 locally), the previous ones (PUSH_MSG_CONTINUATION) are ignored. So e.g. a ping config, pushed by the server in the first push, followed by a lot of "push route" configs, causing a second push message, will have the do_up() called, but without e.g. the OPT_P_TIMER flag, so those options will be silently ignored. The patch resolves that, by introducing "push_option_types_found" in "c->options" and using that as storage. Fix trac bug #349. Acked-by: Gert Doering <gert@greenie.muc.de> URL: https://community.openvpn.net/openvpn/ticket/349 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 1aac9a0b7a4046822a0134cd8693a828f2e16576)
* Add warning for using connection block variables after connection blocksArne Schwabe2013-12-171-7/+23
| | | | | | | | | | | | | | | | In 2.3 some options that were allowed only in global config before have been moved to connection blocks. This changes the behaviour if the variables were defined after connection block. This patch adds a warning to catch these mistakes. Also let warnings errors show [CONNECTION-OPTIONS] instead of [CMD-LINE] for connection blocks Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1387275767-10303-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8117 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit cd6555e0159987ef264789f4976053ce2aa5fc20)
* Fix file checks when --chroot is being usedDavid Sommerseth2013-12-161-21/+61
| | | | | | | | | | | | | | | | | | | | | | | | | | Commit 0f2bc0dd92f43c9 started to introduce some file sanity checking before OpenVPN started to avoid harder to explain issues due to missing files or directories later on. But that commit did not consider --chroot at all. Which would basically cause OpenVPN to complain on non-missing files, because it would not consider that the files where inside a chroot. This patch is based on the thoughts in a patch by Josh Cepek [1], but trying to simplify it at bit. [1] <http://thread.gmane.org/gmane.network.openvpn.devel/7873>, (Message-ID: l142b7$15v$1@ger.gmane.org) [v2 - Simplify the changes in check_cmd_access(), let the chroot tackling happen only in check_file_access_chroot() only] Trac-ticket: 330 Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1385382778-4723-1-git-send-email-dazo@users.sourceforge.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/8060 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit b77bffe8186647c6fd1f2f76aac41fd45719edb8)
* Add support to ignore specific options.Arne Schwabe2013-08-161-2/+53
| | | | | | | | | Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1376640664-26379-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7799 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit b685a1e6b012682ce7d6fb31960273b8f5213714)
* Added "setenv opt" directive prefix. If present, and if theJames Yonan2013-08-161-1/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | directive that follows is recognized, it will be processed as if the "setenv opt" prefix was absent. If present and if the directive that follows is not recognized, the directive will be ignored rather than cause a fatal error. For example, suppose you are distributing a client configuration file and want to set the minimum TLS version that the client requires from the server to 1.2. By using the following directive, setenv opt tls-version-min 1.2 or-highest only newer clients that understand the tls-version-min directive would process it, while older clients would ignore it. (cherry picked from commit 27713761e4110bb92f1c6dfe85db291e8c6e0f56) Signed-off-by: James Yonan <james@openvpn.net> URL: http://thread.gmane.org/gmane.network.openvpn.devel/7771 URL: http://thread.gmane.org/gmane.network.openvpn.devel/7744 URL: https://github.com/jamesyonan/openvpn/commit/27713761e4110bb92f1c6dfe85db291e8c6e0f56 Acked-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Signed-off-by: David Sommerseth <davids@redhat.com> (cherry picked from commit 2a92fba756d4c1e73300a12ff9e80028a6ab7c09) Signed-off-by: Gert Doering <gert@greenie.muc.de>
* TLS version negotiationJames Yonan2013-08-161-0/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Updated the TLS negotiation logic to adaptively try to connect using the highest TLS version supported by both client and server. Previously, OpenVPN (when linked with OpenSSL) would always connect using TLS 1.0. Also added tls-version-min directive to force a higher TLS version than 1.0: tls-version-min <version> ['or-highest'] -- sets the minimum TLS version we will accept from the peer. Examples for version include "1.0" (default), "1.1", or "1.2". If 'or-highest' is specified and version is not recognized, we will only accept the highest TLS version supported by the local SSL implementation. Examples: tls-version-min 1.1 -- fail the connection unless peer can connect at TLS 1.1 or higher. tls-version-min 1.2 or-highest -- require that the peer connect at TLS 1.2 or higher, however if the local SSL implementation doesn't support TLS 1.2 (as it wouldn't if linked with an older version of OpenSSL), reduce the minimum required version to the highest version supported by the local SSL implementation (such as TLS 1.0). This is intended to allow client configurations to target higher TLS versions that are supported on the server, even if some older clients don't support these versions yet. [ This is a merged patch from on the following commits on git://github.com/jamesyonan/openvpn.git 03a5599202bdc3ba07983dc4efdae387fb8fb436 d23005413b0e0f28a3c48a6342f494763d5c9b40 ] Signed-off-by: James Yonan <james@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> URL: http://thread.gmane.org/gmane.network.openvpn.devel/7743 URL: http://thread.gmane.org/gmane.network.openvpn.devel/7744 Message-Id: 51C77F12.1090802@openvpn.net Signed-off-by: David Sommerseth <davids@redhat.com> (cherry picked from commit 4b67f9849ab3efe89268e01afddc7795f38d0f64) Signed-off-by: Gert Doering <gert@greenie.muc.de> Conflicts: src/openvpn/ssl_common.h
* Remove the --disable-eurephia configure optionDavid Sommerseth2013-07-031-6/+1
| | | | | | | | | | | | | | | | | This "feature" has been enabled since OpenVPN 2.2 without any reports that this has been causing issues. All it does is to add an extra environment variable 'tls_digest_{n}' with the certificate SHA1 fingerprint/digest hash. Lets just simplify things by removing the possibility to disable this environment variable. Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1370600123-6029-1-git-send-email-dazo@users.sourceforge.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/7660 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit e3d388652f59fd2ddd9c7f470f7ef62ee6b35595)
* Move checking of script file access into set_user_scriptArne Schwabe2013-05-311-22/+11
| | | | | | | | | | | At the moment script are only checked if P2MP_SERVER is defined. For CLIENT_ONLY openvpn script were never checked. Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1369947737-26081-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7635 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit e55681a9d802bf1639115d325c1685e5962865d0)
* Move settings of user script into set_user_script functionArne Schwabe2013-05-311-25/+34
| | | | | | | | | | | This also fixes commit 567bfc06d051b60e9cdca1f5bb468631b899682a if not all script options are available by setting options->user_script_used Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1369945603-17169-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7634 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 9b6a5028111cd915b0342fbd2ecd0b9dfd4aa94a)
* make 'explicit-exit-notify' pullable againJan Just Keijser2013-05-241-2/+1
| | | | | | | | | Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <519F5ED0.4070109@nikhef.nl> URL: http://article.gmane.org/gmane.network.openvpn.devel/7605 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 49f714942d5afd5f274aea52c790c896babc8c05)
* Fix proto tcp6 for server & non-P2MP modesJosh Cepek2013-05-031-0/+4
| | | | | | | | | | | | | | This fix adds support for using tcp6 as a proto in server or non-P2MP modes, resolving a failed ASSERT in such cases. Fixes the crash in trac#288. Signed-off-by: Josh Cepek <josh.cepek@usa.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <klul5d$8ta$1@ger.gmane.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7578 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit d0ccb982e1714c8dfefd6eacf0c6f899eb71b582)
* (updated) [PATCH] Warn when using verb levels >=7 without debugJosh Cepek2013-03-201-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On 3/20/2013 11:42, Arne Schwabe wrote: > ACK. But I would change "debug verb" to "debug verbosity" and I think > there should be no comma before "but" This text change makes sense: I've adjusted it to read "NOTE: debug verbosity..." and saved another byte removing the comma. Updated patch attached. -- Josh >From d41a0237220f2fea6647a508a2ab07263e0f160b Mon Sep 17 00:00:00 2001 From: Josh Cepek <josh.cepek@usa.net> Date: Tue, 19 Mar 2013 22:52:12 -0500 Subject: [PATCH] Warn when using verb levels >=7 without debug This patch adds a log warning when using --verb levels at 7 or higher when running on builds lacking debug support. Since official builds are now built with enable_debug=no, this warning will help developers identify why expected debug messages may not be present in log output. The test and message output code is omitted when built with enable_debug=yes or enable_small=yes. Signed-off-by: Josh Cepek <josh.cepek@usa.net> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <kicup2$gfv$1@ger.gmane.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7425 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 58fbb8046b203ca23708c1765ee84330d8809266)
* Fix parameter listing in non-debug builds at verb 4Josh Cepek2013-03-141-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | When built with enable_debug=no, the parameter output expected at --verb 4 is not printed due to use of #ifdef ENABLE_DEBUG in the responsible code sections. This appears to be a mistake when looking at the configure help text for enable_small and enable_debug. This change keys the relevant code off of enable_small instead, including the parameter listing when enale_small=no (the configure-script default.) Most of this code is in options.c, with some callers present in plugin.c/h and route.c/h. No function code is changed, just the #ifdef values to use the small feature instead of debug. This means builds no longer need enable_debug=yes in order to get the expected log output at verb 4. Signed-off-by: Josh Cepek <josh.cepek@usa.net> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <437RBuq1U8032S07.1361465626@web07.cms.usa.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/7361 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 6c61d0dd339084175f6911d8b713faaf4967ca03)
* Permit pool size of /64.../112 for ifconfig-ipv6-poolGert Doering2013-03-141-2/+2
| | | | | | | | | | | (Leftover check from the early days where --server-ipv6 also only accepted /64 - nowadays we handle smaller pools just fine) Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20130120185030.GR22465@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/7269 (cherry picked from commit 704d9273b6e0e253b62eb728fddd5bbb02503eea)
* add new option for X.509 name verificationHeiko Hund2013-03-071-12/+82
| | | | | | | | | | | | | | | Add the option --verify-x509-name to provide the functionality of the now deprecated --tls-remote. The new option accepts RFC 2253 subject DNs only and compares RDN or RDN prefix only if configured explicitly. Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: 1362670601-18660-1-git-send-email-heiko.hund@sophos.com URL: http://article.gmane.org/gmane.network.openvpn.devel/7376 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 9f0fc745664fd0fc6a1c6785e101bf912088db16)
* make --tls-remote compatible with pre 2.3 configsHeiko Hund2013-03-071-0/+6
| | | | | | | | | | | | | | | In openvpn 2.3.0 the semantics of the --tls-remote option changed. That broke more configurations than anticipated. To not break configurations that use --tls-remote with a legacy OpenSSL style DN anymore, it is now detected when such a DN is configured. When necessary the --compat-names option is then automatically enabled. Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: 1361526263-1740-3-git-send-email-heiko.hund@sophos.com URL: http://article.gmane.org/gmane.network.openvpn.devel/7366 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit ad532bba896875e56488e69ec16212a77787c57b)
* reintroduce --no-name-remapping optionHeiko Hund2013-03-071-7/+14
| | | | | | | | | | | | The option is just an alias for --compat-names no-remapping and is introduced so pre-2.3 server configurations don't break. Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: 1361526263-1740-2-git-send-email-heiko.hund@sophos.com URL: http://article.gmane.org/gmane.network.openvpn.devel/7364 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 26b0433c4a642f8d2197f3fd371759f0047bd0bd)
* Ignore UTF-8 byte order markHeiko Hund2013-02-061-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently openvpn exits when reading configuration from a file that has an UTF-8 byte order mark (EF BB BF) at its start. While it is useless to put a BOM into UTF-8 encoded files, the Unicode standard [1] permits it (on page 36): "Use of a BOM is neither required nor recommended for UTF-8, but may be encountered in contexts where UTF-8 data is converted from other encoding forms that use a BOM or where the BOM is used as a UTF-8 signature." Notepad.exe, the default text editor on Windows, always puts the BOM into UTF-8 encoded files when saving them. Others may do as well. Just ignoring the UTF-8 BOM will make config files with UTF-8 BOM readable. [1] http://www.unicode.org/versions/Unicode5.0.0/ch02.pdf Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Acked-by: David Sommerseth <davids@redhat.com> Message-Id: 1359977966-31724-1-git-send-email-heiko.hund@sophos.com URL: http://article.gmane.org/gmane.network.openvpn.devel/7342 Signed-off-by: David Sommerseth <davids@redhat.com> (cherry picked from commit 6e6f55f4ba5deda5649679a13e4e323e07b3e661)
* Fix option inconsistency warnings about "proto" and "tun-ipv6"Gert Doering2012-12-171-1/+14
| | | | | | | | | | | | | | | | | | "tun-ipv6" is only sent in option string if running in point-to-point mode (= not --server and not --client or --pull), because in those scenarios it's usually pushed by the server, and the client does not yet have it when comparing options -> needless warning. Completely ignore "proto" values when comparing option strings - this is in preparation for removing proto from the option string in a future release, and to avoid warnings when 2.3 talks to this future release. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <davids@redhat.com> Message-Id: 1355692520-24362-1-git-send-email-gert@greenie.muc.de URL: http://article.gmane.org/gmane.network.openvpn.devel/7194 Signed-off-by: David Sommerseth <davids@redhat.com> (cherry picked from commit 3b860cf27b9374f6ebe67ff21011661f8ec391c6)
* Properly require --key even if defined(MANAGMENT_EXTERNAL_KEY)Arne Schwabe2012-11-291-2/+2
| | | | | | | | | | | | | | | | | When specifying --tls-client --cert ... without a --key (or --pkcs11) option, OpenVPN should complain: "You must define private key file (--key)...". Ensure that this works even when compiling with MANAGMENT_EXTERNAL_KEY. Also fix the other instance where this logic is broken Orginal-Patch-by: Found by Joachim Schipper <joachim.schipper@fox-it.com> Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: 1353940389-31075-1-git-send-email-arne@rfc2549.org URL: http://article.gmane.org/gmane.network.openvpn.devel/7143 Signed-off-by: David Sommerseth <davids@redhat.com> (cherry picked from commit feca0900dd00577779ab02f2e52b41eb3dab935f)
* Error message if max-routes used incorrectlyArne Schwabe2012-11-221-0/+5
| | | | | | | | | | | | | | the route/route-ipv6/redirect-gateway options allocate the route structe with max_routes number of routes. A max-routes after any of this commands has no effect. This can be problematic (http://code.google.com/p/ics-openvpn/issues/detail?id=101) Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: 1353348737-21920-1-git-send-email-arne@rfc2549.org URL: http://article.gmane.org/gmane.network.openvpn.devel/7131 Signed-off-by: David Sommerseth <davids@redhat.com> (cherry picked from commit f83ccec6525179968b68696acb6ccf22182fc6de)
* Remove the support for using system() when executing external programs or ↵David Sommerseth2012-10-311-15/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | scripts This patch removes the support for the system() call, and enforces the usage of execve() on the *nix platform and CreateProcessW() on Windows. This is to enhance the overall security when calling external scripts. Using system() is prone to shell expansions, which may lead to security breaches. Which is also why the execve() approach has been the default since commit a82813527551f0e79c6d6ed5a9c1162e3c171bcf which re-introduced the system() in Nov. 2008. After having asked on the mailing list and checked around on the IRC channels, the genereal consensus is that very few uses system() these days. The only annoyance I've been made aware of is that this will now require adding a full path to the script interpreter together with the script, and not just put in the script name alone. But to just use the script name in Windows, you had to configure --script-security with the 'system' flag earlier too. So my conclusion is that it's better to add a full path to the script interpreter in Windows and raise the overal security with OpenVPN, than to continue to have a possible potentially risky OpenVPN configuration just to make life "easier" for Windows script users. Removal of the system() call, also solves a nasty bug related to the usage of putenv() on the *nix platforms. For more information please see: http://thread.gmane.org/gmane.network.openvpn.devel/7090 https://community.openvpn.net/openvpn/ticket/228 Trac-ticket: 228 Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1351539352-17371-1-git-send-email-dazo@users.sourceforge.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/7114 (cherry picked from commit 0563473601abfbf2142bfa0ca5b863c5aa7953a2)
* Options parsing demands unnecessary configuration if PKCS11 is usedArne Schwabe2012-10-251-4/+6
| | | | | | | | | | | | | In the old patch the if incorrectly closed the outer if condition. (closes ticket #231) Trac-ticket: 231 Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: David Sommerseth <davids@redhat.com> Message-Id: 1350470774-12511-1-git-send-email-arne@rfc2549.org URL: http://article.gmane.org/gmane.network.openvpn.devel/7095 Signed-off-by: David Sommerseth <davids@redhat.com> (cherry picked from commit 70a07339f8d323d69cdcf8d59da1f331d39e4d0a)
* Add --compat-names optionHeiko Hund2012-09-121-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | With this option, users can basically undo the changes of the UTF-8 support commit 5e86fd93779482b90a191f929edebe414cd78a4f. It's here for short term compatibility and should be removed again as soon as possible. When OpenSSL is used, the subject strings will be in the proprietary format again. Generally username, X.509 CN, and X.509 subject will again be subject to '_' replacemant, unless the "no-remapping" flag is also specified. That flag ensures compatibility with setups using the --no-name-remapping option, that has been removed in 2.3. [v2: More comments related to compat_flags() added by DS plus using COMPAT_FLAG_QUERY expclit] [v3: Improved the man page entry for --compat-names, after suggestions from Bernhard R. Link] Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <davids@redhat.com> Message-Id: 1347377664-15462-1-git-send-email-dazo@users.sourceforge.net URL: http://article.gmane.org/gmane.network.openvpn.devel/7053
* Add checks for external-key-managementsArne Schwabe2012-09-111-1/+24
| | | | | | | | | | | | | Commit 4806cc102655f1a829d656f6deb83e5953c5eab2 fixed only part of the problem. Since it removed the filename either the magic filename has to be resurrected or all checks against priv_key_file need to take to check for MF_EXTERNAL_KEY as well. This patch implements the extra checks Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: David Sommerseth <davids@redhat.com> Message-Id: 1347287973-12398-1-git-send-email-arne@rfc2549.org URL: http://article.gmane.org/gmane.network.openvpn.devel/7046 Signed-off-by: David Sommerseth <davids@redhat.com>
* Reduce --version string detail about IPv6 to just "[IPv6]".Gert Doering2012-09-021-2/+1
| | | | | | | | | | | | For 2.3 release, we do not need to have more details, as there is no separate patch set anymore, and both IPv6 transport and IPv6 payload (PF_INET6) have been fully integrated. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <davids@redhat.com> Message-Id: 1345141883-9889-3-git-send-email-gert@greenie.muc.de URL: http://article.gmane.org/gmane.network.openvpn.devel/6985 Signed-off-by: David Sommerseth <davids@redhat.com>
generated by cgit (git 2.34.1) at 2024-04-27 09:18:10 +0000