summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* Fix directly connected routes for "topology subnet" on Solaris.Gert Doering2013-03-271-6/+9
| | | | | | | | | | | | | | | This basically brings back the previously-working metric setting for directly connected routes (add a "0" to the "route add" command) on Solaris/OpenSolaris. It was working in f0eac1a59790, and got broken by the route.c/route.h refactoring in 576dc96ca1ef1 - the patch un-does that change to the TARGET_SOLARIS code, plus adds some more descriptive comments. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Josh Cepek <josh.cepek@usa.net> Message-Id: <1364314175-20758-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/7460 (cherry picked from commit 792e8956b999b6932d472e4ab592bff160e52888)
* Add MIN() compatibility macroGert Doering2013-03-231-0/+7
| | | | | | | | | | | | commit 3b23b18dddb8f8f4a introduced usage of MIN(), and not all platforms have the macro in "readily usable" system header files, most notably it's missing on OpenSolaris and Android. Add macro if not defined yet. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20130323112234.GM17727@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/7450 (cherry picked from commit 15ca5c297b556fbbfdee6152af26ee158222614f)
* Use constant time memcmp when comparing HMACs in openvpn_decrypt.Steffan Karger2013-03-222-1/+27
| | | | | | | | | | | Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 11d21349a4e7e38a025849479b36ace7c2eec2ee) Notes: Please see commit 11d21349a4e7e38a025849479b36ace7c2eec2ee for more info.
* Switch to IANA names for TLS ciphers.Steffan Karger2013-03-224-4/+251
| | | | | | | | | | | | | | Added translation table and functions to translate between TLS OpenSSL and IANA (IETF) cipher suite names. The previously used OpenSSL names are still accepted, but a deprecation warning is issued. Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1363942465-3251-6-git-send-email-steffan.karger@fox-it.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/7439 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 3b23b18dddb8f8f4a6ac6959b844b63356b59e87)
* Config compatibility patch. Added translate_cipher_name.Steffan Karger2013-03-224-3/+75
| | | | | | | | | | | | | | | | Added translate_cipher name to crypto_openssl.c and crypto_polarssl.c to translate between OpenVPN(/OpenSSL) and PolarSSL data channel cipher algorithm names. OpenSSL does not require any translating, PolarSSL does for a small number of algorithms. This improves on config file compatibility between the OpenSSL and PolarSSL builds. Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1363942465-3251-5-git-send-email-steffan.karger@fox-it.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/7435 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit f499b921344272eec6405955b9bad2f162f7a2f9)
* Improve verify_callback messagesSteffan Karger2013-03-221-3/+3
| | | | | | | | | | | | | Print the *flags argument, which - for PolarSSL-1.2 - contains the reasons that the certificate failed (pre-)verification. Signed-off-by: Joachim Schipper <joachim.schipper@fox-it.com> Acked-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1363942465-3251-4-git-send-email-steffan.karger@fox-it.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/7437 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit d572959d35e8920efb8d95d253ededee5d8a34bd)
* Improve PolarSSL key_state_read_{cipher, plain}text messagesSteffan Karger2013-03-221-2/+6
| | | | | | | | | | | | | Instead of logging the fact that an error occured, log the error code and description (when available in the PolarSSL build). Signed-off-by: Joachim Schipper <joachim.schipper@fox-it.com> Acked-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1363942465-3251-3-git-send-email-steffan.karger@fox-it.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/7440 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 0219f115f3a2711d5c51457d6e97d6930916653b)
* PolarSSL-1.2 supportSteffan Karger2013-03-226-56/+29
| | | | | | | | | | | | | | | Add support for PolarSSL-1.2, which has changed the API in several places. This is a minimal port, new features have not been enabled. Only PolarSSL 1.2.5 and newer are accepted, as earlier versions contain unresolved (security) issues. Signed-off-by: Joachim Schipper <joachim.schipper@fox-it.com> Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Adriaan de Jong <dejong@fox-it.com> Message-Id: <1363942465-3251-2-git-send-email-steffan.karger@fox-it.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/7436 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 4a56d19fc3aa59d0eebd99f102ecaaa3665c5088)
* (updated) [PATCH] Warn when using verb levels >=7 without debugJosh Cepek2013-03-201-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On 3/20/2013 11:42, Arne Schwabe wrote: > ACK. But I would change "debug verb" to "debug verbosity" and I think > there should be no comma before "but" This text change makes sense: I've adjusted it to read "NOTE: debug verbosity..." and saved another byte removing the comma. Updated patch attached. -- Josh >From d41a0237220f2fea6647a508a2ab07263e0f160b Mon Sep 17 00:00:00 2001 From: Josh Cepek <josh.cepek@usa.net> Date: Tue, 19 Mar 2013 22:52:12 -0500 Subject: [PATCH] Warn when using verb levels >=7 without debug This patch adds a log warning when using --verb levels at 7 or higher when running on builds lacking debug support. Since official builds are now built with enable_debug=no, this warning will help developers identify why expected debug messages may not be present in log output. The test and message output code is omitted when built with enable_debug=yes or enable_small=yes. Signed-off-by: Josh Cepek <josh.cepek@usa.net> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <kicup2$gfv$1@ger.gmane.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7425 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 58fbb8046b203ca23708c1765ee84330d8809266)
* Fix parameter listing in non-debug builds at verb 4Josh Cepek2013-03-145-11/+11
| | | | | | | | | | | | | | | | | | | | | | | | When built with enable_debug=no, the parameter output expected at --verb 4 is not printed due to use of #ifdef ENABLE_DEBUG in the responsible code sections. This appears to be a mistake when looking at the configure help text for enable_small and enable_debug. This change keys the relevant code off of enable_small instead, including the parameter listing when enale_small=no (the configure-script default.) Most of this code is in options.c, with some callers present in plugin.c/h and route.c/h. No function code is changed, just the #ifdef values to use the small feature instead of debug. This means builds no longer need enable_debug=yes in order to get the expected log output at verb 4. Signed-off-by: Josh Cepek <josh.cepek@usa.net> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <437RBuq1U8032S07.1361465626@web07.cms.usa.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/7361 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 6c61d0dd339084175f6911d8b713faaf4967ca03)
* Permit pool size of /64.../112 for ifconfig-ipv6-poolGert Doering2013-03-141-2/+2
| | | | | | | | | | | (Leftover check from the early days where --server-ipv6 also only accepted /64 - nowadays we handle smaller pools just fine) Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20130120185030.GR22465@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/7269 (cherry picked from commit 704d9273b6e0e253b62eb728fddd5bbb02503eea)
* Repair "tcp server queue overflow" brokenness, more <stdbool.h> fallout.Gert Doering2013-03-121-1/+1
| | | | | | | | | | | | | | | | | Return value of mbuf_len() wrong - it's returning a length value, not a yes/no value - so when the queue length approached 65 (full!), it still only returned "1", leading to MBUF overflow later on. Change from "bool" to "unsigned int", misbehaviour gone... This fixes OpenVPN trac ticket #263. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Peter Caprioli <petercap@kth.se> Message-Id: <20130312100706.GN953@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/7396 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 0eb398501fab9c016b9b6008682c43873c4a6188)
* Remove unused function no_tap_ifconfigArne Schwabe2013-03-121-10/+0
| | | | | | | | | Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1363032651-23934-4-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7388 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit dc63e06b2c366f74752c8baa61b0f173d62511ad)
* Move static prototype definition from header into c fileArne Schwabe2013-03-122-2/+2
| | | | | | | | | Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1363032651-23934-3-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7389 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 46d402f6513a6745daeaf08e9b260258e912f184)
* Remove unused function xorArne Schwabe2013-03-121-10/+0
| | | | | | | | | | | The function name xor is also a reserved keyword in C++ Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1363032651-23934-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7390 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 462b6d5228660d664c3158902ee50687edf3475d)
* add new option for X.509 name verificationHeiko Hund2013-03-076-23/+105
| | | | | | | | | | | | | | | Add the option --verify-x509-name to provide the functionality of the now deprecated --tls-remote. The new option accepts RFC 2253 subject DNs only and compares RDN or RDN prefix only if configured explicitly. Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: 1362670601-18660-1-git-send-email-heiko.hund@sophos.com URL: http://article.gmane.org/gmane.network.openvpn.devel/7376 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 9f0fc745664fd0fc6a1c6785e101bf912088db16)
* make --tls-remote compatible with pre 2.3 configsHeiko Hund2013-03-071-0/+6
| | | | | | | | | | | | | | | In openvpn 2.3.0 the semantics of the --tls-remote option changed. That broke more configurations than anticipated. To not break configurations that use --tls-remote with a legacy OpenSSL style DN anymore, it is now detected when such a DN is configured. When necessary the --compat-names option is then automatically enabled. Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: 1361526263-1740-3-git-send-email-heiko.hund@sophos.com URL: http://article.gmane.org/gmane.network.openvpn.devel/7366 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit ad532bba896875e56488e69ec16212a77787c57b)
* reintroduce --no-name-remapping optionHeiko Hund2013-03-071-7/+14
| | | | | | | | | | | | The option is just an alias for --compat-names no-remapping and is introduced so pre-2.3 server configurations don't break. Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: 1361526263-1740-2-git-send-email-heiko.hund@sophos.com URL: http://article.gmane.org/gmane.network.openvpn.devel/7364 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 26b0433c4a642f8d2197f3fd371759f0047bd0bd)
* Fix corner case in NTLM authentication (trac #172)Christian Niessner2013-03-071-2/+2
| | | | | | | | | | | | | | | | | | The problem is located in the file proxy.c within "establish_http_proxy_passthru": To keep buffers small long base64-encoded NTLM-Strings are truncated. But the truncating is done on a wrong place: base 64 strings can be cut every 4 chars. the buffer is 128 bytes - including the terminating \0, so the usable data is only 127 bytes. And decoding a 127 char base64 string fails... this is why the ntlm authentication fails in certain cases (long strings)... Acked-by: Joerg Willmann <joe@clnt.de> URL: https://community.openvpn.net/openvpn/ticket/172 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit f8ac53b98ed2513f1d80363b6fd2351f1b4ae511)
* Ignore UTF-8 byte order markHeiko Hund2013-02-061-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently openvpn exits when reading configuration from a file that has an UTF-8 byte order mark (EF BB BF) at its start. While it is useless to put a BOM into UTF-8 encoded files, the Unicode standard [1] permits it (on page 36): "Use of a BOM is neither required nor recommended for UTF-8, but may be encountered in contexts where UTF-8 data is converted from other encoding forms that use a BOM or where the BOM is used as a UTF-8 signature." Notepad.exe, the default text editor on Windows, always puts the BOM into UTF-8 encoded files when saving them. Others may do as well. Just ignoring the UTF-8 BOM will make config files with UTF-8 BOM readable. [1] http://www.unicode.org/versions/Unicode5.0.0/ch02.pdf Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Acked-by: David Sommerseth <davids@redhat.com> Message-Id: 1359977966-31724-1-git-send-email-heiko.hund@sophos.com URL: http://article.gmane.org/gmane.network.openvpn.devel/7342 Signed-off-by: David Sommerseth <davids@redhat.com> (cherry picked from commit 6e6f55f4ba5deda5649679a13e4e323e07b3e661)
* Enable TCP_NODELAY configuration on FreeBSD.Matthias Andree2013-02-031-0/+4
| | | | | | | | | | | | | | | | | | | | The missing #include <netinet/tcp.h> causes a defined(TCP_NODELAY) to fail. I have added the patch to the FreeBSD ports OpenVPN 2.2.2 and 2.3.0, and confirmed (with strings ... | grep) that the TCP_NODELAY code is now part of the executable on amd64, and results in this log output: Sat Jan 12 13:39:18 2013 Listening for incoming TCP connection on [undef] Sat Jan 12 13:39:18 2013 Socket flags: TCP_NODELAY=1 succeeded Obtained from: https://community.openvpn.net/openvpn/ticket/158 Credits to: M. Nottebrock Signed-off-by: Matthias Andree <matthias.andree@gmx.de> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: 1357994477-29981-1-git-send-email-matthias.andree@gmx.de URL: http://article.gmane.org/gmane.network.openvpn.devel/7230 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 3e86f688757529f8b33f9e6b49e31ba8d8564c5e)
* Remove dead code path and putenv functionalityArne Schwabe2013-02-032-51/+7
| | | | | | | | | | | | | | The construct_name_value function call will always fail so this code path is never used. Since we now always have a valid environment in static_context->c2.es it is better to have a ASSERT(es) than to call this code patch. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: 1359889951-3369-1-git-send-email-arne@rfc2549.org URL: http://article.gmane.org/gmane.network.openvpn.devel/7323 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* close more file descriptors on execHeiko Hund2013-02-022-0/+5
| | | | | | | | | | | | | Don't inherit the --status and --ifconfig-pool-persist, and on Linux the epoll(7), file descriptors to scripts and other processes that may be forked by plugins. Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Acked-by: David Sommerseth <davids@redhat.com> Message-Id: 1359728354-9405-1-git-send-email-heiko.hund@sophos.com URL: http://article.gmane.org/gmane.network.openvpn.devel/7312 Signed-off-by: David Sommerseth <davids@redhat.com> (cherry picked from commit 09ee4192b1d16bbd7c3c138cc2d46760a11797bf)
* Fix client crash on double PUSH_REPLY.Gert Doering2013-01-022-1/+7
| | | | | | | | | | | | | | | | Introduce an extra bool variable c2.pulled_options_md5_init_done to keep track of md5_init state of pulled_options_state - avoid accessing uninitialized state when a second PUSH_REPLY comes in (which only happens under very particular circumstances). Bug tracked down by Arne Schwabe <arne@rfc2549.rrg>. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: 20121225124856.GT22465@greenie.muc.de URL: http://article.gmane.org/gmane.network.openvpn.devel/7216 Signed-off-by: David Sommerseth <davids@redhat.com> (cherry picked from commit 1978db4b9657f0db134f1deaeb1e8400bf6a033e)
* Fix parameter type for IP_TOS setsockopt on non-Linux systems.Gert Doering2012-12-201-0/+4
| | | | | | | | | | | | | | Linux uses uint8_t, all BSD based stacks and Solaris use "int" (Windows documentation says "DWORD" and "do not use, use QoS API instead"). Bug reported and fix provided by Torsten Vielhak and Jeremie Le Hen. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <davids@redhat.com> Message-Id: 20121219212619.GN22465@greenie.muc.de URL: http://article.gmane.org/gmane.network.openvpn.devel/7207 Signed-off-by: David Sommerseth <davids@redhat.com> (cherry picked from commit d39f31d96378aa5eeade74670ffd9e08bf4c7234)
* Fix option inconsistency warnings about "proto" and "tun-ipv6"Gert Doering2012-12-171-1/+14
| | | | | | | | | | | | | | | | | | "tun-ipv6" is only sent in option string if running in point-to-point mode (= not --server and not --client or --pull), because in those scenarios it's usually pushed by the server, and the client does not yet have it when comparing options -> needless warning. Completely ignore "proto" values when comparing option strings - this is in preparation for removing proto from the option string in a future release, and to avoid warnings when 2.3 talks to this future release. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <davids@redhat.com> Message-Id: 1355692520-24362-1-git-send-email-gert@greenie.muc.de URL: http://article.gmane.org/gmane.network.openvpn.devel/7194 Signed-off-by: David Sommerseth <davids@redhat.com> (cherry picked from commit 3b860cf27b9374f6ebe67ff21011661f8ec391c6)
* Implement --mssfix handling for IPv6 packets.Gert Doering2012-12-137-21/+97
| | | | | | | | | | | | | | | | | Rename process_ipv4_header() to process_ip_header() and PIPV4_MSSFIX flag to PIP_MSSFIX, to make visible that it's no longer IPv4-only. Inside process_ip_header(), call out to mss_fixup_ipv6() if --mssfix is active and IPv6 packet seen. Rename mss_fixup() to mss_fixup_ipv4(), implement mss_fixup_ipv6(). Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: 1354482672-16136-2-git-send-email-gert@greenie.muc.de URL: http://article.gmane.org/gmane.network.openvpn.devel/7173 Signed-off-by: David Sommerseth <davids@redhat.com> (cherry picked from commit f0e8997a874a89b3fe1f82109c443232e8967b01)
* Fix the proto is used inconsistently warningArne Schwabe2012-12-131-4/+18
| | | | | | | | | | | | | | | Fix the "WARNING: 'proto' is used inconsistently, local='proto UDP', remote='proto UDPv6'." message. Note that the on wire strings are now always TCPv4 and UDPv4 to be compatible to pre2.3 Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: 1354650174-25601-1-git-send-email-arne@rfc2549.org URL: http://article.gmane.org/gmane.network.openvpn.devel/7175 Signed-off-by: David Sommerseth <davids@redhat.com> (cherry picked from commit 38727e09df35245ba0cfe335e23e6b43c817ce58)
* Remove dnsflags_to_socktype, it is not used anywhereArne Schwabe2012-12-132-6/+1
| | | | | | | | | Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: 1354303076-13606-1-git-send-email-arne@rfc2549.org URL: http://article.gmane.org/gmane.network.openvpn.devel/7160 Signed-off-by: David Sommerseth <davids@redhat.com> (cherry picked from commit 740137f6bb7b3565054c3a8e894ceca93f2ff0e4)
* Avoid recursion in virtual_output_callback_func()David Sommerseth2012-11-291-7/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This solves a SEGV situation when using the management API while OpenVPN is closing down. The situation happens when the management socket has closed and OpenVPN tries to write an error about this to the management socket. What happens is that virtual_output_callback_func() is called, which then calls -> man_output_list_push_finalize() -> man_output_standalone() -> man_write() <-- this does the socket write -> man_io_error() -> x_msg() -> virtual_output_print() -> virtual_output_callback_func() (recursion start) virtual_output_callback_func() do have a mechanism to avoid recursion, but that did not keep the recurse counter when man_output_list_push_finalize() is called. This patch just reorganise the recursion block to also keep the counter while calling the other functions from virtual_output_callback_func() Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: 1353063726-25113-1-git-send-email-dazo@users.sourceforge.net URL: http://article.gmane.org/gmane.network.openvpn.devel/7130 (cherry picked from commit b2b66179f6dcc37de9582d5c3044f0357dda3df3)
* The get_default_gateway() function uses warn() instead of msg()David Sommerseth2012-11-291-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A report on #openvpn pointed out that in his setup three warnings appeard on the console when starting up. $ sudo /usr/local/etc/rc.d/openvpn restart Stopping openvpn. Waiting for PIDS: 33031. Starting openvpn. openvpn: writing to routing socket: No such process openvpn: writing to routing socket: No such process openvpn: writing to routing socket: No such process $ This setup is on FreeBSD using jails with strict access to the routing table. After looking at the code path, this error was found in the BSD sections for get_default_gateway(). But it was using the warn() call instead of msg(M_WARN|M_ERRNO, ...) which causes these warnings to go to stderr instead of the log file. The warning string is also slightly modified to better explain what fails. Reported-by: Thomas Steen Rasmussen <thomas@gibfest.dk> Tested-by: Thomas Steen Rasmussen <thomas@gibfest.dk> Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: 1354194972-5388-1-git-send-email-dazo@users.sourceforge.net URL: http://article.gmane.org/gmane.network.openvpn.devel/7149 (cherry picked from commit b3f19cc4bec6978a128f5af3ab22d8cfa954b064)
* Properly require --key even if defined(MANAGMENT_EXTERNAL_KEY)Arne Schwabe2012-11-291-2/+2
| | | | | | | | | | | | | | | | | When specifying --tls-client --cert ... without a --key (or --pkcs11) option, OpenVPN should complain: "You must define private key file (--key)...". Ensure that this works even when compiling with MANAGMENT_EXTERNAL_KEY. Also fix the other instance where this logic is broken Orginal-Patch-by: Found by Joachim Schipper <joachim.schipper@fox-it.com> Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: 1353940389-31075-1-git-send-email-arne@rfc2549.org URL: http://article.gmane.org/gmane.network.openvpn.devel/7143 Signed-off-by: David Sommerseth <davids@redhat.com> (cherry picked from commit feca0900dd00577779ab02f2e52b41eb3dab935f)
* Error message if max-routes used incorrectlyArne Schwabe2012-11-221-0/+5
| | | | | | | | | | | | | | the route/route-ipv6/redirect-gateway options allocate the route structe with max_routes number of routes. A max-routes after any of this commands has no effect. This can be problematic (http://code.google.com/p/ics-openvpn/issues/detail?id=101) Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: 1353348737-21920-1-git-send-email-arne@rfc2549.org URL: http://article.gmane.org/gmane.network.openvpn.devel/7131 Signed-off-by: David Sommerseth <davids@redhat.com> (cherry picked from commit f83ccec6525179968b68696acb6ccf22182fc6de)
* Fix --show-pkcs11-ids (Bug #239)Adriaan de Jong2012-11-221-1/+1
| | | | | | | | | | | | Broken by 00b973f8af85c3ea8fa3cef80eec55e8dc139b27 Signed-off-by: Joachim Schipper <joachim.schipper@fox-it.com> Acked-by: David Sommerseth <davids@redhat.com> Trac-ticket: 239 Message-Id: 1CED409804E2164C8104F9E623B08B901323A48384@FOXDFT02.FOX.local URL: http://article.gmane.org/gmane.network.openvpn.devel/7129 Signed-off-by: David Sommerseth <davids@redhat.com> (cherry picked from commit 5fd3e56430678bee3e6e3a3cf8dfd6db7e105676)
* Fix double-free issue in pf_destroy_context()David Sommerseth2012-11-061-1/+0
| | | | | | | | | | | | | | | | | | | In commit dc7be6d078ba106f9b0de12f3e879c3561c3c537 the string_alloc() call in pf_init_context() was modified to use the gc_arena object for memory allocation. What was not taken into consideration was that pf_destroy_context() was also freeing memory allocated by string_alloc(), and when pf_init_context() is calling gc_free() a double-free situation showed up. Lets remove the explict free, and let gc_free take care of all the memory handling. Reported-by: cuzz@163.com Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: 1352196216-11560-1-git-send-email-dazo@users.sourceforge.net URL: http://article.gmane.org/gmane.network.openvpn.devel/7124 (cherry picked from commit 1f300fe94f1bd521966bb05dea40edc1fae82b84)
* Remove the support for using system() when executing external programs or ↵David Sommerseth2012-10-317-223/+57
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | scripts This patch removes the support for the system() call, and enforces the usage of execve() on the *nix platform and CreateProcessW() on Windows. This is to enhance the overall security when calling external scripts. Using system() is prone to shell expansions, which may lead to security breaches. Which is also why the execve() approach has been the default since commit a82813527551f0e79c6d6ed5a9c1162e3c171bcf which re-introduced the system() in Nov. 2008. After having asked on the mailing list and checked around on the IRC channels, the genereal consensus is that very few uses system() these days. The only annoyance I've been made aware of is that this will now require adding a full path to the script interpreter together with the script, and not just put in the script name alone. But to just use the script name in Windows, you had to configure --script-security with the 'system' flag earlier too. So my conclusion is that it's better to add a full path to the script interpreter in Windows and raise the overal security with OpenVPN, than to continue to have a possible potentially risky OpenVPN configuration just to make life "easier" for Windows script users. Removal of the system() call, also solves a nasty bug related to the usage of putenv() on the *nix platforms. For more information please see: http://thread.gmane.org/gmane.network.openvpn.devel/7090 https://community.openvpn.net/openvpn/ticket/228 Trac-ticket: 228 Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1351539352-17371-1-git-send-email-dazo@users.sourceforge.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/7114 (cherry picked from commit 0563473601abfbf2142bfa0ca5b863c5aa7953a2)
* Support UTF-8 --client-config-dirHeiko Hund2012-10-293-1/+22
| | | | | | | | | | | | | | | | | | | | If a common name (or user name, when used in conjunction with --username-as-common-name) contains UTF-8 encoded characters their octets get replaced by underscores. This becomes problematic when user "Müller" and "Möller" need to have a CCD file and both would receive options from the file "M__ller". The situation is even worse for non-latin alphabets, where CCD file names consist of underscores entirely. This patch removes that limitation and also allows the file names to contain any punctuation characters besided the resevered ones. Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Acked-by: David Sommerseth <davids@redhat.com> Message-Id: 1351516597-11128-1-git-send-email-heiko.hund@sophos.com URL: http://article.gmane.org/gmane.network.openvpn.devel/7110 Signed-off-by: David Sommerseth <davids@redhat.com> (cherry picked from commit 9885f57e3ac8d2e32ba20ca84f6bdd0a1a995eac)
* Fix display of plugin hook typesHeiko Hund2012-10-291-1/+3
| | | | | | | | | | | | | | | The OPENVPN_PLUGIN_ROUTE_PREDOWN hook was missing and displayed as "PLUGIN_???" in the log. OPENVPN_PLUGIN_ENABLE_PF was the only one that displayed the OPENVPN_ prefix. Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Acked-by: David Sommerseth <davids@redhat.com> Message-Id: 1351517910-11414-1-git-send-email-heiko.hund@sophos.com URL: http://article.gmane.org/gmane.network.openvpn.devel/7111 Signed-off-by: David Sommerseth <davids@redhat.com> (cherry picked from commit ae303d444c11984b87e0046c4138982d7a41fd8b)
* Options parsing demands unnecessary configuration if PKCS11 is usedArne Schwabe2012-10-251-4/+6
| | | | | | | | | | | | | In the old patch the if incorrectly closed the outer if condition. (closes ticket #231) Trac-ticket: 231 Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: David Sommerseth <davids@redhat.com> Message-Id: 1350470774-12511-1-git-send-email-arne@rfc2549.org URL: http://article.gmane.org/gmane.network.openvpn.devel/7095 Signed-off-by: David Sommerseth <davids@redhat.com> (cherry picked from commit 70a07339f8d323d69cdcf8d59da1f331d39e4d0a)
* Fixed a bug where PolarSSL gave an error when using an inline file tag.Adriaan de Jong2012-10-171-1/+1
| | | | | | | | Signed-off-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: David Sommerseth <davids@redhat.com> Message-Id: 1350466765-23301-1-git-send-email-dejong@fox-it.com Signed-off-by: David Sommerseth <davids@redhat.com> (cherry picked from commit 2ebbe4c0b4f0f0b15b4c32180e906a545446c376)
* Fix v3 plugins to support returning values back to OpenVPN.Kenneth Rose2012-10-151-2/+2
| | | | | | | | | | | | | | | | | There's a small implementation issue with the V3 plugin API implementation. V3 plugins cannot return data back to OpenVPN using openvpn_plugin_args_func_return since openvpn_plugin_args_func_return.return_list is always NULL. This patch makes the behaviour identical to the V2 API (return_list is again a proper out parameter). Signed-off-by: Kenneth Rose <ken+openvpn@surfeasy.com> Acked-by: David Sommerseth <davids@redhat.com> Message-Id: CAAUdgR8VZjaO0-thFPVoQkbZ1DNG3rx+gtYYLqyfocp3yns==w@mail.gmail.com URL: http://article.gmane.org/gmane.network.openvpn.devel/7083 Signed-off-by: David Sommerseth <davids@redhat.com> (cherry picked from commit e92255f58bcfaec157c3ef59e01c40cbd04b1d43)
* Add --compat-names optionHeiko Hund2012-09-125-9/+94
| | | | | | | | | | | | | | | | | | | | | | | | With this option, users can basically undo the changes of the UTF-8 support commit 5e86fd93779482b90a191f929edebe414cd78a4f. It's here for short term compatibility and should be removed again as soon as possible. When OpenSSL is used, the subject strings will be in the proprietary format again. Generally username, X.509 CN, and X.509 subject will again be subject to '_' replacemant, unless the "no-remapping" flag is also specified. That flag ensures compatibility with setups using the --no-name-remapping option, that has been removed in 2.3. [v2: More comments related to compat_flags() added by DS plus using COMPAT_FLAG_QUERY expclit] [v3: Improved the man page entry for --compat-names, after suggestions from Bernhard R. Link] Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <davids@redhat.com> Message-Id: 1347377664-15462-1-git-send-email-dazo@users.sourceforge.net URL: http://article.gmane.org/gmane.network.openvpn.devel/7053
* Fix reconnect issues when --push and UDP is used on the serverDavid Sommerseth2012-09-112-3/+6
| | | | | | | | | | | | | | | | | | | | | When the server is configured with UDP and --push statements, reconnecting often fails by the client never receiving PUSH_REPLY. The client sends PUSH_REQUEST and the server logs these requests but does not send them. This bug got introduced in commit ff65da3a230b658b2c1d52dc1a48612e80a2eb42 which tries to avoid sending duplicated PUSH messages if the client/server connection is slow. This patch keeps this behaviour, but instead of a session wide PUSH_REPLY block it sets an expiry time for the PUSH_REPLY block. The expiry time is set to 30 seconds. Signed-off-by: David Sommerseth <davids@redhat.com> Cc: James Yonan <james@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Acked-by: James Yonan <james@openvpn.net> Message-Id: 1347154246-20143-1-git-send-email-dazo@users.sourceforge.net URL: http://article.gmane.org/gmane.network.openvpn.devel/7044
* make "ipv6 ifconfig" on linux compatible with busybox ifconfigGert Doering2012-09-111-1/+1
| | | | | | | | | | | | | | | We used to call "ifconfig tun0 inet6 add...". The "inet6" part is optional, and not understood by busybox. So now we call "ifconfig tun0 add ...", which works on all supported Linux variants. Tested on Gentoo, RHEL5+, Debian Lenny & up. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <davids@redhat.com> Message-Id: 1347364615-26878-1-git-send-email-gert@greenie.muc.de URL: http://article.gmane.org/gmane.network.openvpn.devel/7052 Signed-off-by: David Sommerseth <davids@redhat.com>
* Add checks for external-key-managementsArne Schwabe2012-09-111-1/+24
| | | | | | | | | | | | | Commit 4806cc102655f1a829d656f6deb83e5953c5eab2 fixed only part of the problem. Since it removed the filename either the magic filename has to be resurrected or all checks against priv_key_file need to take to check for MF_EXTERNAL_KEY as well. This patch implements the extra checks Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: David Sommerseth <davids@redhat.com> Message-Id: 1347287973-12398-1-git-send-email-arne@rfc2549.org URL: http://article.gmane.org/gmane.network.openvpn.devel/7046 Signed-off-by: David Sommerseth <davids@redhat.com>
* Merge getaddr_multi and getaddr6 into one functionArne Schwabe2012-09-023-391/+166
| | | | | | | | | | | | | | | | | | | the getaddr6 and getaddr_mutli functions are duplicates of each other. Since we always require getaddrinfo to be present both function are merge into one openvpn_getaddrinfo. This functions also returns a standard struct addrinfo* so our resolve interface is closer to the standard unix interface. The getaddr function is a wrapper which provides backward compatibility for IPv4 addresses. Ipv6 calls and calls to getaddr_multi are replaced with the new interface. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: 1344333837-22076-1-git-send-email-arne@rfc2549.org URL: http://article.gmane.org/gmane.network.openvpn.devel/6959 Signed-off-by: David Sommerseth <davids@redhat.com> [DS: Applied proper indenting on the changes wherever needed]
* Keep pre-existing tun/tap devices around on *BSDGert Doering2012-09-022-6/+20
| | | | | | | | | | | | | | | This amends commit 62c613d46dc49 to check whether a named tun/tap device ("--dev tunX" instead of "--dev tun") exists before OpenVPN started - if yes, keep around at program end. If no, destroy. Also has a spelling fix, and changes clear_tuntap() to be "static" (only ever called from within tun.c). Tested on FreeBSD 7.4, FreeBSD 9.0, NetBSD 5.1, OpenBSD 4.9 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Eric Crist <ecrist@secure-computing.net> Signed-off-by: David Sommerseth <davids@redhat.com>
* remove unused flag SSLF_NO_NAME_REMAPPINGHeiko Hund2012-09-021-1/+0
| | | | | | | | | | | The flag was used with the --no-name-remapping option that was removed in commit 5e86fd93779482b90a191f929edebe414cd78a4f. Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Acked-by: David Sommerseth <davids@redhat.com> Message-Id: 1345197113-24636-1-git-send-email-heiko.hund@sophos.com URL: http://article.gmane.org/gmane.network.openvpn.devel/6986 Signed-off-by: David Sommerseth <davids@redhat.com>
* Reduce --version string detail about IPv6 to just "[IPv6]".Gert Doering2012-09-021-2/+1
| | | | | | | | | | | | For 2.3 release, we do not need to have more details, as there is no separate patch set anymore, and both IPv6 transport and IPv6 payload (PF_INET6) have been fully integrated. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <davids@redhat.com> Message-Id: 1345141883-9889-3-git-send-email-gert@greenie.muc.de URL: http://article.gmane.org/gmane.network.openvpn.devel/6985 Signed-off-by: David Sommerseth <davids@redhat.com>
* remove stale _openssl_get_subject() prototypeHeiko Hund2012-09-021-2/+0
| | | | | | | | | | | | The _openssl_get_subject() function was removed in commit 00b973f8af85c3ea8fa3cef80eec55e8dc139b27. The functionality moved to x509_get_subject(). Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: 1345197136-24708-1-git-send-email-heiko.hund@sophos.com URL: http://article.gmane.org/gmane.network.openvpn.devel/6987 Signed-off-by: David Sommerseth <davids@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-26 10:22:52 +0000