| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
|
|
|
| |
Move things to the proper place, ensure that line_ptr is actually properly
initialized for *every* line read, not just for the first one
Acked-by: Lev Stipakov <lstipakov@gmail.com>
Message-Id: 1444827956-2169-1-git-send-email-arne@rfc2549.org
URL: http://article.gmane.org/gmane.network.openvpn.devel/10271
Signed-off-by: David Sommerseth <davids@redhat.com>
(cherry picked from commit cba33989101175ac07434b9c5cceba116bf38127)
|
|
|
|
|
|
|
|
|
|
|
| |
trac #569
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <1444493569-24026-1-git-send-email-janjust@nikhef.nl>
URL: http://article.gmane.org/gmane.network.openvpn.devel/10249
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit c67acea173dc9ee37220f5b9ff14ede081181992)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Instead of limiting the control channel TCP/UDP packet payload size at
'100 bytes + real control channel overhead' (~140 bytes ethernet payload),
increase the max TCP/UDP payload size to '1250 bytes - calculated overhead'
(~1210 bytes ethernet payload).
Note that this patch does *not* yield an optimal solution, but it is a
simple and rather safe change that will improve connection setup times
significantly.
v2: use the mininum value of --link-mtu and 1250 to give the user a way to
reduce control packet size if really needed.
trac #545
Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1435693496-10931-1-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9841
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit fc91d4b0071178e298052078431fb86f03be84fc)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
ms_error_text() may return NULL, and it is unclear (or, at least
undocumented) whether the OpenSSL ERR code (and our code using the ERR
code) can deal with esd->string being NULL. So, just to be sure, check
that ms_error_text() succeeded before passing the result to
ERR_load_strings().
Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <561130FC.8090008@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/10176
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 5584b738a332d0abc740d9303c275764c2ca13f1)
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
As reported by Bill Parker in trac #600, strdup() return values are not
always correctly checked for failed allocations. This patch adds missing
checks by using string_alloc(), which performs the required checks.
Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <561130FC.8090008@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/10176
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit ddc7692d245017c71adc40ad5cc195617e39fce0)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Intermediate result was stored in a "bool" variable, but the actual
range of results is 0/1/2 - so "2" (TLA_LOCAL) never worked. Change
to "int".
Diagnosed by "dferbas" in trac #609 (thanks).
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <1443162970-38210-1-git-send-email-gert@greenie.muc.de>
URL: http://article.gmane.org/gmane.network.openvpn.devel/10168
(cherry picked from commit c40f088e52132273f6d4e83d05fa64bbaedd860f)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
TCP options are not always word-aligned, and accessing a 16bit value
at an odd memory address will cause a "bus error" crash on some
architectures, e.g. Linux/Sparc(64)
Trac #497
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <1440680402-96548-1-git-send-email-gert@greenie.muc.de>
URL: http://article.gmane.org/gmane.network.openvpn.devel/10056
(cherry picked from commit 2e2a34181962b33d70c34c28dcb1e1977c2fd54e)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
In most of situations admin of OpenVPN server needs to know which
particular certificate is used by client.
In the case when certificate is OK, environment variable can be used for
that but once it is revoked, no user scripts are invoked so there is
no way to get serial number: only subject is printed in logs.
So we log certificate serial in case it is revoked.
Sponsored-by: Yandex LLC
Signed-off-by: Boris Lytochkin <lytboris@yandex-team.ru>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <55FEBF7E.3010209@yandex-team.ru>
URL: http://article.gmane.org/gmane.network.openvpn.devel/10154
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 767e4c56becbfeea525e4695a810593f373883cd)
|
|
|
|
|
|
|
|
|
|
|
| |
Closes ticket #591
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1438859835-3977-1-git-send-email-arne@rfc2549.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/10005
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 291c227d2ccecaa92602eaa5259a23c7093e30e5)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Commit b131c7b974d9d4d3f0 introduced a check to create a meaningful
warning if we try to read a password after daemon()izing (by checking
whether stdin or stderr is connected to a tty). For some reason this
breaks on Windows builds if run under GUI control - but since Windows
doesn't have this particular daemon() issue anyway, just #ifndef WIN32
the offending code.
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <1438692796-14663-1-git-send-email-gert@greenie.muc.de>
URL: http://article.gmane.org/gmane.network.openvpn.devel/10000
(cherry picked from commit 0ffd744332f51878c4df430ab14aca3126bdfc8a)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Sebastian Krahmer from the SuSE security team reported that the buffer
overflow check in openvpn_decrypt() was too strict according to the
cipher update function contract:
"The amount of data written depends on the block alignment of the
encrypted data: as a result the amount of data written may be anything
from zero bytes to (inl + cipher_block_size - 1) so outl should contain
sufficient room."
This stems from the way CBC mode works, which caches input and 'flushes'
it block-wise to the output buffer. We do allocate enough space for this
extra block in the output buffer for CBC mode, but not for CFB/OFB modes.
This patch:
* updates the overflow check to also verify that the extra block required
according to the function contract is available.
* uses buf_inc_len() to double-check for overflows during en/decryption.
* also reserves the extra block for non-CBC cipher modes.
In practice, I could not find a way in which this would fail. The plaintext
is never longer than the ciphertext, and the implementations of CBC/OFB/CBC
for AES and BF in both OpenSSL and PolarSSL/mbed TLS do not use the buffer
beyond the plaintext length when decrypting. However, some funky OpenSSL
engine I did not check *might* use the buffer space required by the
function contract. So we should still make sure we have enough room
anyway.
v2 - always ASSERT() on buf_inc_len(). It is a double-check so should
really not fail, but if it fails there has been a buffer overflow.
At that point the best thing we can do is assert out. (The primary
check *is* handled gracefully, and just drops the packet.)
Signed-off-by: Steffan Karger <steffan.karger@fox-it.com>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <1438165826-32762-1-git-send-email-steffan.karger@fox-it.com>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9974
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit cc377dec820f9e6e7e72981013eb3857aa6ea5ce)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
buffer limit
The check does only for strlen(line) space and buf_printf will only use at
most space -1 and not print the final character ('\n') in this corner.
Since a missing \n only breaks certificates at the start and end marker,
missing line breaks otherwise do not trigger this error.
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <1438011191-19389-1-git-send-email-arne@rfc2549.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9956
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit d40cbf0e2601b35bfb1c0551c6f3907b5c5178ff)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Commits da9b292733e929a2900dc32d37f0424c3d588366 and
315f6fbc7f657a7f1127628bd714f468709d5185 broke the use case where we are
asking password from the management client. The password is always asked
before daemonization. With this fix we avoid this and ask it via management
interface in the same spot as before the mentioned commits. Tested on Linux.
v2: This patch was first submitted by Christian Pellegrin (from Google),
and reworked by Steffan Karger (from the OpenVPN team) to also work for
setups with --management-query-passwords but without --auth-user-pass.
Signed-off-by: Steffan Karger <steffan@karger.me>
Signed-off-by: Christian Pellegrin <chripell@google.com>
Tested-by: Christian Pellegrin <chripell@google.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <55A6C46C.5080601@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9927
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit d4fbe287fc2ddbef05fdfe22adc641859a8a7412)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This resolves --askpass treating stdin as a file during the file access
check. In turn, this leads to openvpn failing to start if this option is
set to stdin.
By default, --askpass reads the certificate's password from stdin rather
than a file. Without passing the CHKACC_ACPTSTDIN flag to
check_file_access(), stdin is marked as being a nonexistent file.
Trac #248
Signed-off-by: James Geboski <jgeboski@gmail.com>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <55A41225.2020705@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9918
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 4e1e3ba1d8582a1e95dd6f9564e97c99784959a7)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
passwords.
With the --daemon / SSL init reordering in da9b292733, we fail if we
daemonize first and then try to ask for a private key passphrase (or,
for that matter, username+password if --auth-nocache is set) - but
no meaningful error message was printed, instead depending on operating
system and library versions, either we looped around "ssl init failed"
or died with an unspecified "fatal error".
So: check if get_user_pass_cr() is called in a context that needs
"from_stdin", but both stdin and stderr are not connected to a tty
device (which getpass() needs). In that case, print a meaningful
error message pointing to --askpass, and die.
Trac #574 and #576
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <1436814607-16707-1-git-send-email-gert@greenie.muc.de>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9916
(cherry picked from commit 079e5b9c13bf81d7afc6f932b5417d2f08f8e64b)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The init sequence was changed to daemonize before the crypto init to fix
issues on FreeBSD some commits ago. This introduced a regression where
we would no longer query for passwords before daemonizing, as described
in trac #574 and #576.
This commit restores the correct order, and adds a bit of const
correctness since we're touching this now code anyway.
Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1436477759-5884-1-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9901
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 315f6fbc7f657a7f1127628bd714f468709d5185)
|
|
|
|
|
|
|
|
|
|
|
|
| |
Because even VS2013 is incapable of doing C99.
Signed-off-by: Steffan Karger <steffan@karger.me>
Tested-by: Fish Wang <fish.thss@gmail.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <CAA1AbxKrPXnc1+PPH4dQV1OksY_0t3ewqRnqVrjhZL+i2Pbkmw@mail.gmail.com>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9859
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 9884e20810bda737c7708ff587e09cc0bb8475c7)
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
(2.3 reports as warning only, 2.4 reports as M_FATAL)
trac #568
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1435581995-11820-1-git-send-email-arne@rfc2549.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9830
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 68eecf76978a80bd5d88e944e4ed5e42bf2fd8e4)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
When a linux tun interface is closed (e.g. on disconnect)
an optional ipv6 addr that was previously set is deleted now.
Without this patch a later reconnect could fail with
'Linux ip -6 addr add failed: external program exited with error status: 2'
and openvpn would exit.
This is mainly relevant for persistant tun devices (staying around
after openvpn exits) but can also happen at reconnect.
If addresses are *supposed* to stay around on openvpn exit, run
openvpn with --ifconfig-noexec and configure IPv4/IPv6 addresses
manually before openvpn starts (or using an --up script).
Trac #141
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1435248080-12670-1-git-send-email-Holger.Kummert@Sophos.com>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9810
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit e5f71d674e3b119d6a252d7cef1c17b5c2b36a9a)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Since we split daemonizing from changing directory in commit da9b292
(f025de005d719201a69ad0313d545a1ddd244752 in release/2.3), we can
now simply write the pid file immediately after daemonizing.
This not only fixes the bug reported in trac #563, but also further
simplifies the code.
trac #563
Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1434665325-3225-1-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9793
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 659eae7b79e5565bb0c93f6d6d04e2163fea1141)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
For "topology subnet", we only pretend to have a subnet and keep
using the tun if in point-to-point mode - but for that to fully
work, the "remote" address needs to be different from the "local"
address. So just arbitrarily construct one from the on-link
subnet - base+1, if "that is not us", base+2, otherwise.
Fix trac #481
See also: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=194745
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Tested-By: Anton Sayetsky <vsasjason@gmail.com>
Lazy-ACK-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1430071438-31675-1-git-send-email-gert@greenie.muc.de>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9606
(cherry picked from commit 60fd44e501f2002459a49c6c9bc64370ea26ca87)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
A non-working nameserver in /etc/resolv.conf could lead to endless
loops inside openvpn_getaddrinfo(), because many systems will only
pick up changes to resolv.conf if res_init() is called again.
To reproduce, run openvpn with --resolv-retry infinite (2.3) or
--resolv-retry "a high number" (master) on a BSD system. Linux
glibc seems to stat() resolv.conf on calls to getaddrinfo() and
pick up changes automatically.
Trac #523
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <1433080749-6892-1-git-send-email-gert@greenie.muc.de>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9763
(cherry picked from commit 288a819af7d3a6fab9e0b69ae8dbaac74b36307b)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
When specifying redirect-private option and not specifying route-gateway
or ifconfig options, OpenVPN fails to add the route to the remote host
with the following message:
NOTE: unable to redirect default gateway -- VPN gateway parameter
(--route-gateway or --ifconfig) is missing
In redirect_default_route_to_vpn() the check for remote endpoint happens
even though it is not used by redirect-private - make check conditional
on RG_REROUTE_GW (= --redirect-gateway).
Trac #261
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20150531120327.GE382@greenie.muc.de>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9761
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 1e2b229e5140b784820906feb8446e47c1ecc62e)
|
|
|
|
|
|
|
|
|
|
|
|
| |
Windows has no EAI_SYSTEM (introduced by 5f6c01ea6172ed), but everyone
has EAI_AGAIN - which also fits ("a temporary failure in name resolution").
Trac #276
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <1433178914-7842-1-git-send-email-gert@greenie.muc.de>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9768
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
A signal (except SIGUSR1) received while waiting for getaddrinfo() is
considered fatal, so openvpn_getaddrinfo() is destroying the returned
information with freeaddrinfo(), but still signalled "success" (0)
to the caller - so if the caller accessed *res before checking
*signal_received, it would access just-free()ed memory, which on some
platforms still worked and on others caused a crash.
Also, ensure that *ai is also NULLed in the caller now.
Trac #276
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <1433104918-9523-1-git-send-email-gert@greenie.muc.de>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9764
(cherry picked from commit 5f6c01ea6172ed1d8ed04e31f9f6c3f8e4696109)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
But keep the chdir to / at the place where deamon() was before, to preserve
the current behaviour wrt relative paths in the config.
This should fix the issue reported in trac #480, without changing the
behaviour visible to the end user.
Note that by moving the daemon() call to an earlier stage of the init
process, we no longer have to call platform_mlockall() again, or do a
pkcs11_forkFixup().
Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1430144937-4149-1-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9609
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit da9b292733e929a2900dc32d37f0424c3d588366)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The internal machinery wants TLS for this to work, so just add this
to the (long) list of options not allowed unless either --tls-client
or --tls-server is active. For added sanity, add an ASSERT() call
to the place where this combination caused a NULL ptr reference, and
document the restriction.
Fix trac #373
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <1432472554-24666-1-git-send-email-gert@greenie.muc.de>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9736
(cherry picked from commit 6478c1f359e6b0ea2046d9e2801830753e53c06a)
|
|
|
|
|
|
|
|
|
| |
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <CAEsd45SHoEtahdVT95a+N-zmjRG4nH3QPxBZoGpnh1pykjSU4A@mail.gmail.com>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9723
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 025d611fc68aa0c651c391bd6178d062246f36f0)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Previously, the code tried to find res_init(), and on some systems
got it wrong in configure, silently not-using res_init(), leading
to unexpected failures to re-init the resolver.
We know that all supported OSes (except Windows) have res_init(), so
change the call to "#ifndef WIN32", and adjust configure.ac to just
find the library to link (if any). With that, failures to find
res_init() are no longer "hidden" but clearly visible at link time.
AC_SEARCH_LIBS() bits inspired by CUPS' cups_network.m4 (GPLv2)
Fix (part of) trac #523
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Lazy-ACK-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1430162841-5840-1-git-send-email-gert@greenie.muc.de>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9614
(cherry picked from commit 403dc434d245e5df5ae262935aa2e7364547e260)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Fixes trac #225 ('--auth-user-pass FILE' and '--auth-nocache' problem).
This patch is based on the changes suggested by ye_olde_iron in the trac
ticket. Also added a note to the manpage to inform people to use
absolute paths when combining --auth-user-pass file and --auth-nocache.
Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1432386145-15045-1-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9717
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit ac1cb5bfbb9e09e79fd737bc57999d968d77c5ad)
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
"make check" self-test was broken after commit db950be85d37 due to
do_ifconfig_setenv() not checking whether tt->did_ifconfig_setup
was set (which isn't, for "dev null" type setups)
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Steffan Karger <steffan@karger.me>
Message-Id: <1432404098-29401-1-git-send-email-gert@greenie.muc.de>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9718
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 970c4bd2e473f625699bd56db44c1970a9e10ed9)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
here's my patch for bug #93: missing ifconfig_* env vars after
up-restart. Tested with both IPv4, IPv6, topology subnet and topology net30
Document differences between --up-restart and --up in openvpn.8
See trac #93 and the discussion starting with <555BF270.3090706@nikhef.nl>
on the openvpn-devel mailing list.
fix trac #93
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <555BF270.3090706@nikhef.nl>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9705
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit db950be85d37eab40d8fffe0bc2060059f8a7e10)
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Fixes compilation error on linux with musl libc because of
conflicting ethhdr declarations in <netinet/if_ether.h> and
<linux/if_ether.h> which is included from <linux/if_tun.h>
Signed-off-by: Felix Janda <felix.janda@posteo.de>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <20150516134604.GA2302@euler>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9690
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit ddb1f20a9ddbb94956c9f7b1115c89543d9b411a)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
As reported in trac tickets #304, #358 and #359 (and possibly more), the
usage and interpretation of --tls-cipher (and --show-tls) is tricky. This
patch extends the man page to explain those a bit better and point out
that --tls-cipher is an expert feature (i.e. easy to get wrong). Also add
a notice to the --show-tls output, referring to the man page explanation.
Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <1430840857-6123-1-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9651
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 5f66f907cfc57b89110c08e50c7aab228e090911)
Conflicts:
doc/openvpn.8
src/openvpn/ssl_polarssl.c
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
As described in trac #484, the current inline file size limit of 10000
bytes is becoming an issue for some users. Since RSA keys and signature
sizes are increasing, we need to adjust our limits. As #484 reports,
10000 can be too small for PKCS#12 files with 4K RSA keys. Instead of
postponing this issue by increasing the static limit, dynamically increase
the buffer size while reading. This keeps the memory usage limited but does
allow for larger inlined files.
Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1430122342-11742-1-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9607
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit e473b7c4ce41a450645e0f89579bc25b4a7f7d49)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
OpenVPN only supports --mktun/--rmtun to create/destroy persistant
tunnels on Linux. On BSD OSes, "ifconfig tun0 create" can do the
same job, so we do not actually need to support it - but the previous
error message ("unknown option") wasn't helpful. So always accept
the option now, and on non-supported systems, direct user to manpage.
Trac #85
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: David Sommerseth <dazo@users.sourceforge.net>
Message-Id: <1430219063-12291-1-git-send-email-gert@greenie.muc.de>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9617
(cherry picked from commit 4ad2b65d9deb3197d847d7dcc36715aa5394836f)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Re-enable TLS version negotiation by default, so that users
benefit from the stronger and better crypto of TLSv1.1 and
TLSv1.2, without having to add 'tls-version-min' to their
config files.
We tried this before in 2.3.3, but got various reports of people
no longer being able to connect. Back then, we did not have a
way for users to control the TLS version. We now have
--tls-version-min and --tls-version-max, and even automatically
set --tls-version-max to 1.1 if --cryptoapi is used, because
the cryptoapi code is incompatible with TLS 1.2.
To make sure users can fall back to the _exact_ old default
behaviour, not only limit the TLS version to 1.0 if
--tls-version-max 1.0 is set, but also keep using the API calls
TLSv1_{client,server}_method(), instead of the ones that support
negotiation (SSLv23_{client,server}_method()). (Yes, the naming
is awkward, but 'SSLv23' really means 'enable negotiation' in
OpenSSL-API language.
This patch is for the release/2.3 branch only.
Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Matthias Andree <matthias.andree@gmx.de>
Message-Id: <1426015605-4068-1-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9542
Signed-off-by: Gert Doering <gert@greenie.muc.de>
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The static helper function possibly_become_daemon() is called only once,
by do_init_first_time(), which checks 'first_time' to be true before
calling possibly_become_daemon(). This makes the parameter useless.
Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1427328089-886-1-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9555
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 857c04ef06cd13d59c5b45332f07996e71372576)
|
|
|
|
|
|
|
|
|
|
| |
get_ipv6_addr() returns "bool/false", not "int < 0" to signal error.
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <1425819401-18465-1-git-send-email-gert@greenie.muc.de>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9532
(cherry picked from commit e8562d5531277ee4dd7c517ef68e87af077ac948)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Due to this bug, mssfix hasn't been assigned to fragment value
and used default value (1450) instead. As a consequence, TCP packets
get fragmented, which causes performance penalty.
Since dual stack patch (commit 23d61c56b9fd218c39ad151b01b7e2d6690e6093)
OpenVPN uses options->connection_list, even for single remote.
This fix assigns mssfix value to fragment value for connection_entry
inside connection_list instead of connection_entry inside options struct
(which does not work for connection_list case).
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1425587636-23338-1-git-send-email-lstipakov@gmail.com>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9507
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit d384a9587951617d12e31e0a18050bd86402d5df)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This is an alternative patch to fix the issue reported in trac #515 by
Jorge Peixoto. Instead of increasing the TLS_USERNAME_LEN define, do +1 at
the relevant places in the code.
Also see Jorge's original patch and the discussion on the maillinglist:
http://thread.gmane.org/gmane.network.openvpn.devel/9438
Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <54F8CC9B.9040104@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9508
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit ecd934b1ef83eec58eb2df5d3a98309ca56d5812)
Conflicts:
src/openvpn/ssl_verify.c
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Instead of statically increasing link-mtu by +3, keep the old value for
OCC compatibility with old servers/clients, and only increase link-mtu
if peer-id option is enabled (right now: is pushed by server).
If link-mtu has been set in the config, keep configured value, and log
warning (because the extra overhead has to decrease tun-mtu).
Reserve extra +3 bytes in frame->extra_link.
v2: use frame->extra_link, not frame->extra_buffer (receive path on server)
introduce frame_add_to_link_mtu() to manipulate frame->link_mtu value
rework comments to make more clear what is happening
Adaption to 2.3: reserve +8 bytes in frame->extra_buffer - if compression
is not enabled, the 2.3 code does not reserve space for compression
overhead (2.4 code does), so the buffer ends up being too small.
+3 is not sufficient because the buffer handling code also does some
alignment tricks...
This reverts commit 4ec70ca227370380011d072c09b739135e236183.
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 9e0963c11aa439deb382d7d6bc40b6ade999401c)
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <1424031695-10218-1-git-send-email-gert@greenie.muc.de>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9458
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
CBC mode is the only mode that OpenVPN supports that needs padding. So,
only include the worst case padding size in the frame size calculation when
using CBC mode.
While doing so, rewrite crypto_adjust_frame_parameters() to be better
readable, and provide debug output (for high debug levels).
Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1406667144-17674-1-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8952
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 669f898b8fcaf7a8d43825fa0255c2791cc0ef89)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
As reported in trac #502, SSL compression can cause problems in some corner
cases. OpenVPN does not need SSL compression, since the control channel is
low bandwidth. This does not influence the data channel compressen (i.e.
--comp or --comp-lzo).
Even though this has not yet been relevant for OpenVPN (since an attacker
can not easily control contents of control channel messages), SSL
compression has been used in the CRIME and BREACH attacks on TLS. TLS 1.3
will probably even remove support for compression all together, for
exactly this reason.
Since we don't need it, and SSL compression causes issues, let's just
disable it in OpenSSL builds. PolarSSL has no run-time flag to disable
compression, but is by default compiled without compression.
Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1424010266-5910-1-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9453
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 5d5233778868ddd568140c394adfcfc8e3453245)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Data channel packet using P_DATA_V2 will use three bytes extra for the
peer-id. This needs to be accounted for, otherwise OpenVPN will throw
TCP/UDP packet too large on write to [AF_INET]10.1.1.1:1194
warnings.
Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Lev Stipakov <lstipakov@gmail.com>
Message-Id: <1422042761-10014-1-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9418
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit f95010ad247a8998e0c39e394236251fca316849)
|
|
|
|
|
|
|
|
|
|
| |
The logic which is used on BSD is preserved. The only distinction
is that illumos doesn't provide sa_len field in sockaddr structures.
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1413315802-62359-4-git-send-email-alp@rsu.ru>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9128
Signed-off-by: Gert Doering <gert@greenie.muc.de>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
OpenVPN's current cryptoapicert implementation does not support TLS 1.2
(and newer). Fixing this requires a rewrite of our cryptoapi code to use
Microsofts' "Cryptography API: Next Generation", and several hacks to work
around that API. As long as we don't fix that, make openvpn automatically
cap the TLS version to 1.1 when using cryptoapi (and tell the user we're
doing so). This enables the user to use cryptoapi + TLS version
negotiation (upto TLS 1.1) without having to change his configuration.
This patch has been tested on Windows 8.1 for both the master and
release/2.3 branches.
Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1419762313-31233-1-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9361
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 04dcb96cc1f525afee3f830248ecaa22d1b4a4c2)
|
|
|
|
|
|
|
|
|
| |
Trac: 490
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <1418905506.21260.6.camel@infradead.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9355
Signed-off-by: Gert Doering <gert@greenie.muc.de>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
If the user specifies --pkcs11-id or --pkcs-id-management but neglects
to explicitly provide a --pkcs11-provider argument, and if the system
has p11-kit installed, then load the p11-kit proxy module so that the
system-configured tokens are available.
Trac: 490
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <1418303015.31745.78.camel@infradead.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9342
Signed-off-by: Gert Doering <gert@greenie.muc.de>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The coding style was somewhat chaotic. Cleaning it up using the astyle
tool. The style parameters are coherent to what was agreed upon at the
Munich Hackathon 2014 [1].
astyle --style=allman --indent=spaces=4 -c
Also included a "Local variables" section which some editors may pick
up automatically.
Signed-off-by: David Sommerseth <davids@redhat.com>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <1418078751-3614-1-git-send-email-openvpn.list@topphemmelig.net>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9331
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit e2e9a69c1ecc7142cc17d665076795215b6a8e9a)
|