summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* Update TLSv1 error messages to SSLv23 to reflect changes from commit 4b67f98Steffan Karger2014-01-031-2/+2
| | | | | | | | | | | | Commit 4b67f98 changed call to TLSv1_{client,server}_method() to SSLv23_{client,server}_method(), this commit updates the corresponding error messages to match the changes in the code. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1388607026-12297-3-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/8147 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Also update TLSv1_method() calls in support code to SSLv23_method() calls.Steffan Karger2014-01-031-2/+2
| | | | | | | | | | | | Commit 4b67f98 changed calls to TLSv1_{sever,client}_method() to SSLv23_{client,server}_method() to enable TLS version negotiation. This commit does the same for two calls of TLSv1_method() from support code. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1388607026-12297-2-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/8148 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Add warning for using connection block variables after connection blocksArne Schwabe2013-12-171-7/+23
| | | | | | | | | | | | | | | In 2.3 some options that were allowed only in global config before have been moved to connection blocks. This changes the behaviour if the variables were defined after connection block. This patch adds a warning to catch these mistakes. Also let warnings errors show [CONNECTION-OPTIONS] instead of [CMD-LINE] for connection blocks Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1387275767-10303-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8117 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix file checks when --chroot is being usedDavid Sommerseth2013-12-161-21/+61
| | | | | | | | | | | | | | | | | | | | | | | | | Commit 0f2bc0dd92f43c9 started to introduce some file sanity checking before OpenVPN started to avoid harder to explain issues due to missing files or directories later on. But that commit did not consider --chroot at all. Which would basically cause OpenVPN to complain on non-missing files, because it would not consider that the files where inside a chroot. This patch is based on the thoughts in a patch by Josh Cepek [1], but trying to simplify it at bit. [1] <http://thread.gmane.org/gmane.network.openvpn.devel/7873>, (Message-ID: l142b7$15v$1@ger.gmane.org) [v2 - Simplify the changes in check_cmd_access(), let the chroot tackling happen only in check_file_access_chroot() only] Trac-ticket: 330 Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1385382778-4723-1-git-send-email-dazo@users.sourceforge.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/8060 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* pkcs11: use generic evp key instead of rsaAlon Bar-Lev2013-12-161-7/+7
| | | | | | | | | | | Enables DSA, ECDSA key usages with newer pkcs11-helper. Signed-off-by: Alon Bar-Lev <alon.barlev@gmail.com> Tested-By: Sanaullah <sanaullah82@gmail.com> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1384209366-26170-1-git-send-email-alon.barlev@gmail.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/7960 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Support non-ASCII characters in Windows tmp pathHeiko Hund2013-12-051-13/+21
| | | | | | | | | | | | | Get the temporary path from the system as UCS-2 and convert it to UTF-8 and return that for internal use. Fix trac#278. Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1384882574-28242-1-git-send-email-heiko.hund@sophos.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/8002 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix IPv6_V6ONLY logic.Gert Doering2013-12-011-1/+2
| | | | | | | | | | | The "ipv6only" setsockopt logic introduced by 8832c6c4cf was inverted, fix. Also add a msg() to show what value is set, as that makes strange v4/v6 connectivity problems much easier to spot. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1385847508-32248-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/8079
* Implement listing on IPv4/IPv6 dual socket on all platformArne Schwabe2013-11-296-10/+34
| | | | | | | | | | With this patch OpenVPN will listen on Ipv4 as well as IPv6 when an IPv6 socket is used. Using bind ipv6only will disable this behavior Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1385382680-5912-7-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8052 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Move ASSERT so external-key with OpenSSL works againArne Schwabe2013-11-291-1/+2
| | | | | | | | Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1385728360-32127-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8069 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Implement dual stack client support for OpenVPNArne Schwabe2013-11-2914-632/+671
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch contains a number of changes. I did not further spit this since some changes make only sense being changed together. Always use connection_list, simplifies the reconnection logic. Change meaning of --connect-retry-max and --connect-retry to be used all connections. This now allows OpenVPN to quit after n unsuccessful udp connection attempts Remove the tcp reconnection logic. Failing a TCP connection will now cause a USR1 like a UDP connection. Also extend sig->source from bool to int to specify signal source. This allows a finer grained reconnection logic if necessary in the future. Dual-Stack support: if an address resolves to multiple records each address is tried in sequential order. Then proceed to next connection entry. Introduce the field current_remote to represent the current connecting remote. Also change some fields to struct addrinfo* form openvn_addr to store multiple addresses needed for the dual stack support. Change meaning from udp and tcp to allow both IPv4 and IPv6. Introducue new udp4 and tcp4 to force IPv4. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1385382680-5912-6-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8058 Signed-off-by: Gert Doering <gert@greenie.muc.de> Message-ID: <20131129194258.GL161@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8071 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* When resolving fails print the error message from socket layerArne Schwabe2013-11-271-5/+7
| | | | | | | | Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1385382680-5912-5-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8059 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* change the type of 'remote' to addrinfo*, and rename to 'remote_list'.Arne Schwabe2013-11-275-39/+111
| | | | | | | | | | | | | | | | | Warning: this is work in progress, preparing for the full dual-stack client patch. With this commit in place, connecting via "--proto udp" or "--proto tcp-client" to a host that has IPv4+IPv6 in place, on an OS that will prefer IPv6 to IPv4 will always fail. The remote_list will have IPv6 in it's first entry, while the socket will try to do AF_INET, and that will not work. This will be fixed by the upcoming change to handle multiple remote IP addresses (as returned by getaddrinfo()) as multiple <connection> blocks, with appropriate retry and AF selection logic. Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1385382680-5912-4-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8053 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Remove the ip-remote-hint option.Arne Schwabe2013-11-263-21/+2
| | | | | | | | | | | | | | | | | | | | | The ip-remote-hint option overrides the remote hostname of every remote/connection entry unless management-query-remote is also defined and the management interfaces overrides the option with remote MOD. The remote name is even overridden when when management interface issues remote ACCEPT after being presented with the non overridden remote. Overriding all remote options can also be done by management-query-remote and issuing remote MOD or by changing alll remote statements in the configuration. Also: remove unused variable newcycle Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1385382680-5912-3-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8057 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Change proto_remote() function to return a constant stringArne Schwabe2013-11-263-12/+14
| | | | | | | | | | | | | Instead of using the implicit protocol string that is returned by the proto/af to names function return a constant string. The strings have become part of the wire protocl and we do not want them to change if the printing of proto/af changes. Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1385382680-5912-2-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8055 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Split link_socket_init_phase1 and link_socket_init_phase2 intoArne Schwabe2013-11-261-207/+256
| | | | | | | | | smaller more managable/readable functions. No functional changes Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1385382680-5912-1-git-send-email-arne@rfc2549.org> Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix assertion when SIGUSR1 is received while getaddrinfo is successfulArne Schwabe2013-11-241-6/+8
| | | | | | | | Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1385064495-25877-4-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8019 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix two instances of asserting AF_INETArne Schwabe2013-11-241-3/+2
| | | | | | | | | The http-proxy and socks-proxy work fine with IPv6 but assert having IPv4 Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1385064495-25877-6-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8010 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Split the PROTO_UDP_xx options into AF_INET/AF_INET6 and PROTO_TCP/PROTO_UDP ↵Arne Schwabe2013-11-248-167/+144
| | | | | | | | | | | | | part. Splitting will make the code a little bit cleaner and prepares for dual stack Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1385236624-3776-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8043 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Simplify print_sockaddr_ex function, merge duplicate ipv4/ipv6 logic.Arne Schwabe2013-11-233-65/+67
| | | | | | | | Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1385064495-25877-2-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8023 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix compile error in ssl_openssl introduced by polar external-management patchArne Schwabe2013-11-231-2/+2
| | | | | | | | | Acked-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1385210434-28364-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8039 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* external_pkcs1_sign: Support non-RSA_SIG_RAW hash_idsJoachim Schipper2013-11-231-7/+69
| | | | | | | | | | | For TLSv1.2, we need to support various hashes. (GPL) code taken from PolarSSL pkcs11_sign(). Signed-off-by: Joachim Schipper <joachim.schipper@fox-it.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1379587649-25506-4-git-send-email-steffan.karger@fox-it.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/7887 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* --management-external-key for PolarSSLJoachim Schipper2013-11-233-5/+102
| | | | | | | | | | | | | Add --management-external-key support, compatible with the OpenSSL implementation. Needs the flexibility of ssl_set_own_cert_alt(), which is new in PolarSSL-1.2. Signed-off-by: Joachim Schipper <joachim.schipper@fox-it.com> Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1379587649-25506-3-git-send-email-steffan.karger@fox-it.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/7886 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Refactor tls_ctx_use_external_private_key()Joachim Schipper2013-11-234-46/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | OpenSSL's tls_ctx_load_cert_file() had a parameter in which a copy of the context's certificate chain was stored on return, used by tls_ctx_use_external_private_key() only and free()d immediately thereafter. PolarSSL also supported this output parameter, but returned a pointer to the context's certificate chain (rather than to a copy of the certificate, as OpenSSL does) - which meant that we would have to #ifdef the free(). PolarSSL cannot make a copy of a certificate chain, and OpenSSL cannot store a pointer to (instead of a copy of) the cert. So remove the output parameter from tls_ctx_load_cert_file() and incorporate the needed functionality directly into tls_ctx_use_external_private_key() (which is straightforward for both OpenSSL and PolarSSL, as long as you don't try to support both at once.) Signed-off-by: Joachim Schipper <joachim.schipper@fox-it.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1379587649-25506-2-git-send-email-steffan.karger@fox-it.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/7888 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Change the type of all ports in openvpn to const char* and let getaddrinfo ↵Arne Schwabe2013-11-2214-242/+177
| | | | | | | | | | | | | | | | | resolve the port together with the hostname. This delays error reporting from config parsing to resolving of host addresses. But it allows statements like remote openvpn.example.org openvpn port https management localhost ntp Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1385064495-25877-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8018 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Remove duplicate cipher entries from TLS translation table.Max Muster2013-11-201-4/+0
| | | | | | | | | Patch from trac#304 - the translation table OpenSSL<->IANA contained duplicates for four IANA names, causing translation backwards to fail. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-By: Steffan Karger <steffan.karger@fox-it.com> URL: https://community.openvpn.net/openvpn/ticket/304
* Fix slow memory drain on each client renegotiation.Gert Doering2013-11-173-12/+21
| | | | | | | | | | | | | | | | | | | | This reverts commit bee92b479414d12035b0422f81ac5fcfe14fa645 and parts of commit dc7be6d078ba106f9b0de12f3e879c3561c3c537, as these introduced a subtle memory drain on client renegotiations (es->gc got initialized, which led to "unused" gc_entry records accumulating while a client is connected). Setting es->gc=NULL causes env_set_add_nolock() / remove_env_item() to free() allocated and no longer used strings in the es, while an active gc would leave them for cleanup with gc_free() at client disconnect time. Signed-off-by: Gert Doering <gert@greenie.muc.de> Conflicts: src/openvpn/buffer.c Acked-by: David Sommerseth <dazo@users.sourceforge.net> Message-Id: <20131023162618.GP161@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/7939
* tls_ctx_load_ca: Improve certificate error messagesKlee Dienes2013-11-151-3/+24
| | | | | | | | | | | | | If a CA certificate file includes intermediate certificates, and any of them fail to verify, the current code will file with "Cannot load CA certificate file". Instead, generate a more specific error message identifying the specific sub-certificate(s) which did not validate. Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <CAK6ywbLVtSgRZEt4N+02fz+vQ0GNp==5KdsbqWtZ+fgUzrZq+g@mail.gmail.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/7837 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix argument type warning introduced by http extra proxy header patch.Gert Doering2013-11-151-1/+1
| | | | | | | | | | | d0cb816cf8be68359617b61a55799f6330901f6a introduced add_proxy_headers(), passing "port" as "const char *" - but it should be an "int". As port is not yet actually used inside add_proxy_headers(), it's just a warning. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1384526517-6020-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/7973
* Add reporting of UI version to basic push-peer-info set.Arne Schwabe2013-11-151-7/+9
| | | | | | | | | | | | | | | If a GUIs sets IV_OPENVPN_GUI_VERSION the version will be pushed to the server. Usage convention for IV_OPENVPN_GUI_VERSION is "<gui_id><space><version>", for example "de.blinkt.openvpn 0.5.47" for the ICS Android version. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Acked-by: James Yonan <james@openvpn.net> Message-Id: <1370005175-14871-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7646 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Implement custom HTTP header for http-proxy, and always send user-agent:Arne Schwabe2013-11-153-21/+111
| | | | | | | | | | | | | | | | There are some patched OpenVPN versions out there without source code (e.g. NDMVPN) that support adding custom http header. This patch adds custom header to OpenVPN and supports the syntax that the "in the wild" variants use. Patch v3 also prints all custom headers with other http options in --verb 5 Patch v4 does clean up the add_proxy_header function Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1382688143-17247-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7946 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Support non-ASCII TAP adapter names on WindowsHeiko Hund2013-10-231-5/+10
| | | | | | | | | | | | | | | Currently the TAP adapter name is fetched as an OEM string, which is problematic if it contains non-ASCII characters and is to used with netsh. The logfile also contains these non UTF-8 characters. This patch fetches the name from the registry as UCS-2 and converts it right into UTF-8 before it's used. Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Acked-by: Josh Cepek <josh.cepek@usa.net> Message-Id: <1381829022-15244-1-git-send-email-heiko.hund@sophos.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/7913 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Correct error text when no Windows TAP device is presentJosh Cepek2013-08-221-1/+1
| | | | | | | | | | | | | | | | Starting with the 2.3-series, the TAP-Windows driver/utilities and OpenVPN are separately installed components. The error message given to users without available TAP devices uses the pre-2.3 path that does not exist. The path should be listed under the TAP-Windows program group that the tap-windows project installer uses. Resolves bug #320 Signed-off-by: Josh Cepek <josh.cepek@usa.net> Acked-by: David Sommerseth <dazo@users.sourceforge.net> Message-Id: <kv4ece$s8s$1@ger.gmane.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7825 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Always load intermediate certificates from a PKCS#12 fileHeikki Hannikainen2013-08-161-1/+19
| | | | | | | | | | | | | | | | | | | | | | | | Load intermediate certificates from a PKCS#12 file and place them in the extra certs chain, when trusted CA certs are loaded from an external PEM file with the --ca option, and the CA certs in PKCS#12 are not to be trusted. Required when client PKCS#12 file is provided by a different CA than the server CA, the PKCS#12 file contains intermediate certificates required for client auth, but the server CA is not in the PKCS#12 file. When --ca is set, the PKCS#12 provided CA certs are not trusted. Without this patch, they were ignored completely - with this patch, they're loaded in the extra certs chain which makes them available for chain verification but still does not make them trusted if --ca is set. Unless when, of course, a trusted root is found from the --ca file. Acked-by: James Yonan <james@openvpn.net> Acked-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <alpine.DEB.2.02.1306201400320.10116@jazz.he.fi> URL: http://article.gmane.org/gmane.network.openvpn.devel/7721 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Add support to ignore specific options.Arne Schwabe2013-08-162-2/+55
| | | | | | | | Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1376640664-26379-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7799 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* MSVC fixesJames Yonan2013-08-1610-71/+79
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes to allow compilation with Microsoft Visual Studio 2008 * Fixed several instances of declarations after statements. * In socket.c, fixed issue where uninitialized value (err) is being passed to to gai_strerror. * ssl.c is trying to access multi_output_peer_info_env function in multi.c, causing an undefined symbol warning at compile time. ssl.c is strictly a client of multi.c (but not the other way around), therefore ssl.c does not include multi.h and should not depend on multi.h API. To fix, moved validate_peer_info_line and multi_output_peer_info_env from multi.c to misc.c. * MSVC doesn't support %z as a printf format specifier for size_t * MSVC doesn't support a const variable being used to dimension an array. * Explicitly cast the third parameter to setsockopt to const void * Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1375049135-21444-1-git-send-email-james@openvpn.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/7777 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Added "setenv opt" directive prefix. If present, and if theJames Yonan2013-07-151-1/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | directive that follows is recognized, it will be processed as if the "setenv opt" prefix was absent. If present and if the directive that follows is not recognized, the directive will be ignored rather than cause a fatal error. For example, suppose you are distributing a client configuration file and want to set the minimum TLS version that the client requires from the server to 1.2. By using the following directive, setenv opt tls-version-min 1.2 or-highest only newer clients that understand the tls-version-min directive would process it, while older clients would ignore it. (cherry picked from commit 27713761e4110bb92f1c6dfe85db291e8c6e0f56) Signed-off-by: James Yonan <james@openvpn.net> URL: http://thread.gmane.org/gmane.network.openvpn.devel/7771 URL: http://thread.gmane.org/gmane.network.openvpn.devel/7744 URL: https://github.com/jamesyonan/openvpn/commit/27713761e4110bb92f1c6dfe85db291e8c6e0f56 Acked-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Signed-off-by: David Sommerseth <davids@redhat.com>
* TLS version negotiationJames Yonan2013-07-116-4/+139
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Updated the TLS negotiation logic to adaptively try to connect using the highest TLS version supported by both client and server. Previously, OpenVPN (when linked with OpenSSL) would always connect using TLS 1.0. Also added tls-version-min directive to force a higher TLS version than 1.0: tls-version-min <version> ['or-highest'] -- sets the minimum TLS version we will accept from the peer. Examples for version include "1.0" (default), "1.1", or "1.2". If 'or-highest' is specified and version is not recognized, we will only accept the highest TLS version supported by the local SSL implementation. Examples: tls-version-min 1.1 -- fail the connection unless peer can connect at TLS 1.1 or higher. tls-version-min 1.2 or-highest -- require that the peer connect at TLS 1.2 or higher, however if the local SSL implementation doesn't support TLS 1.2 (as it wouldn't if linked with an older version of OpenSSL), reduce the minimum required version to the highest version supported by the local SSL implementation (such as TLS 1.0). This is intended to allow client configurations to target higher TLS versions that are supported on the server, even if some older clients don't support these versions yet. [ This is a merged patch from on the following commits on git://github.com/jamesyonan/openvpn.git 03a5599202bdc3ba07983dc4efdae387fb8fb436 d23005413b0e0f28a3c48a6342f494763d5c9b40 ] Signed-off-by: James Yonan <james@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> URL: http://thread.gmane.org/gmane.network.openvpn.devel/7743 URL: http://thread.gmane.org/gmane.network.openvpn.devel/7744 Message-Id: 51C77F12.1090802@openvpn.net Signed-off-by: David Sommerseth <davids@redhat.com>
* plugin: Extend the plug-in v3 API to identify the SSL implementation usedDavid Sommerseth2013-07-032-2/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OpenVPN would segfault unexpectedly if it would be compiled against PolarSSL and the plug-in would expect OpenSSL, or vice-versa. This segfault would not appear before the plug-in would try to access functions which would be available if the plug-in and OpenVPN uses the same SSL implementation. This patch adds a member to the plug-in initialisation function, which identifies the SSL implementation. The log_v3 plug-in is updated accordingly + a simple fix to make it buildable again using the ./build script. A minor documentation error in the openvpn-plugin.h was also corrected, where it mentioned OPENVPN_PLUGIN_VERSION instead of OPENVPN_PLUGINv3_STRUCTVER. v2 - add const ovpnSSLAPI ssl_api at the end of struct openvpn_plugin_args_open_in and not in the "middle" v3 - fix bug in plug-in init, as the SSLAPI was located wrong in the args struct sent to the openvpn_plugin_open_v3() function. v4 - Ensure SSLAPI got a sane/known value if SSL is disabled or unknown Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1372879030-10576-1-git-send-email-dazo@users.sourceforge.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/7754 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Remove the --disable-eurephia configure optionDavid Sommerseth2013-07-033-12/+2
| | | | | | | | | | | | | | | | This "feature" has been enabled since OpenVPN 2.2 without any reports that this has been causing issues. All it does is to add an extra environment variable 'tls_digest_{n}' with the certificate SHA1 fingerprint/digest hash. Lets just simplify things by removing the possibility to disable this environment variable. Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1370600123-6029-1-git-send-email-dazo@users.sourceforge.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/7660 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Add support of utun devices under Mac OS XArne Schwabe2013-07-032-67/+274
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Mac OS X 10.7+ natively supports tun devices (called utun). The "standard" utun.ko driver is sometimes problematic (e.g. VmWare Fusion 5 and tun.ko do not work together). When OpenVPN is compiled with utun support it will if no dev-node is given first try to use utun and if that is not available will try the traditional tun devices v2: Fixed tap support, get device name via ioctl, add manage v3.1: Fix compiling without if/utun.h, fix manage errors v4/v5: Don't try open to dynamically open utun0 -255 when early utun initialization fails, fix fallback to tun, give fatal error message when utun fails but no tun fallback should be done v6: add commit message change log, replace strstr with strncmp, move v7: Throw error if a user does the strange combination of --dev tun --dev-type tap and --dev-node utun A lot good input on earlier patches by Jonathan K. Bullard <jkbullard@gmail.com> Parts of the patches are inspired from Peter Sagerson's <psagers@ignorare.net> utun patch Signed-off-by: Arne Schwabe <arne@rfc2549.org> Tested-by: Jonathan K. Bullard <jkbullard@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1371811708-8528-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7739 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* PATCHv3 Remove unused variables or put them to the defines they are being ↵Arne Schwabe2013-06-208-19/+2
| | | | | | | | | | used in Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1366059999-31731-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7511 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Improve documentation and help text for --route-ipv6.Gert Doering2013-06-111-1/+1
| | | | | | | | Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <davids@redhat.com> Message-Id: 1368873781-29552-1-git-send-email-gert@greenie.muc.de URL: http://article.gmane.org/gmane.network.openvpn.devel/7598 Signed-off-by: David Sommerseth <davids@redhat.com>
* Add support for client-cert-not-required for PolarSSL.Tamas TEVESZ2013-06-111-2/+14
| | | | | | | | Signed-off-by: Tamas TEVESZ <ice@extreme.hu> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: alpine.GSO.2.03.1306080732510.23277@extreme.hu URL: http://article.gmane.org/gmane.network.openvpn.devel/7667 Signed-off-by: David Sommerseth <davids@redhat.com>
* Do not pass struct tls_session* as void* in key_state_ssl_init().Steffan Karger2013-06-073-3/+7
| | | | | | | | Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: David Sommerseth <davids@redhat.com> Message-Id: 51B1DBEF.1090705@fox-it.com URL: http://article.gmane.org/gmane.network.openvpn.devel/7664 Signed-off-by: David Sommerseth <davids@redhat.com>
* Fix another #ifdef/#if P2MP_SERVERArne Schwabe2013-06-011-1/+1
| | | | | | | | Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1370013992-18592-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7647 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Move checking of script file access into set_user_scriptArne Schwabe2013-05-311-22/+11
| | | | | | | | | | At the moment script are only checked if P2MP_SERVER is defined. For CLIENT_ONLY openvpn script were never checked. Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1369947737-26081-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7635 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Move settings of user script into set_user_script functionArne Schwabe2013-05-313-30/+37
| | | | | | | | | | This also fixes commit 567bfc06d051b60e9cdca1f5bb468631b899682a if not all script options are available by setting options->user_script_used Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1369945603-17169-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7634 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix #ifdefs for P2MP_SERVERArne Schwabe2013-05-312-2/+2
| | | | | | | | | | | (Fix check introduced by commit a8be73799be1639, testing with #ifdef instead of #if - P2MP_SERVER is always defined, and can be "0" or "1") Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1369949680-9499-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7637 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Provide more accurate warning messageDavide Brini2013-05-301-1/+1
| | | | | | | | | | Very simple fix. Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <0LzcMG-1ULZ4T0Fuc-014gq9@mail.gmx.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/7628 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Only print script warnings when a script is used. Remove stray mention of ↵Arne Schwabe2013-05-302-7/+14
| | | | | | | | | | script-security system. Acked-by: Jan Just Keijser <janjust@nikhef.nl> Message-Id: <1369920428-11350-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7625 Signed-off-by: Gert Doering <gert@greenie.muc.de>
generated by cgit (git 2.34.1) at 2025-09-27 17:47:42 +0000