summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* Make __func__ work with Visual Studio tooSteffan Karger2015-07-021-0/+4
| | | | | | | | | | | Because even VS2013 is incapable of doing C99. Signed-off-by: Steffan Karger <steffan@karger.me> Tested-by: Fish Wang <fish.thss@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <CAA1AbxKrPXnc1+PPH4dQV1OksY_0t3ewqRnqVrjhZL+i2Pbkmw@mail.gmail.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/9859 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Increase control channel packet size for faster handshakesSteffan Karger2015-07-011-2/+3
| | | | | | | | | | | | | | | | | | | | | | Instead of limiting the control channel TCP/UDP packet payload size at '100 bytes + real control channel overhead' (~140 bytes ethernet payload), increase the max TCP/UDP payload size to '1250 bytes - calculated overhead' (~1210 bytes ethernet payload). Note that this patch does *not* yield an optimal solution, but it is a simple and rather safe change that will improve connection setup times significantly. v2: use the mininum value of --link-mtu and 1250 to give the user a way to reduce control packet size if really needed. trac #545 Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1435693496-10931-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9841 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Report missing end-tags of inline files as errorsArne Schwabe2015-06-301-1/+8
| | | | | | | | | | | | (2.3 reports as warning only, 2.4 reports as M_FATAL) trac #568 Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1435581995-11820-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/9830 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Del ipv6 addr on close of linux tun interfaceHolger Kummert2015-06-261-0/+26
| | | | | | | | | | | | | | | | | | | | | | | When a linux tun interface is closed (e.g. on disconnect) an optional ipv6 addr that was previously set is deleted now. Without this patch a later reconnect could fail with 'Linux ip -6 addr add failed: external program exited with error status: 2' and openvpn would exit. This is mainly relevant for persistant tun devices (staying around after openvpn exits) but can also happen at reconnect. If addresses are *supposed* to stay around on openvpn exit, run openvpn with --ifconfig-noexec and configure IPv4/IPv6 addresses manually before openvpn starts (or using an --up script). Trac #141 Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1435248080-12670-1-git-send-email-Holger.Kummert@Sophos.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/9810 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fail if options have extra parameters [v2]Jonathan K. Bullard2015-06-211-267/+276
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Throw an error if an option has extra parameters; previously they were silently ignored (see also trac #557) This feature was discussed on the openvpn-devel mailing list (http://thread.gmane.org/gmane.network.openvpn.devel/9599). The (modified) message "Unrecognized option or missing or extra parameter(s)" is used except for a few options: * The --help option: An extra parameter for --help generates a specific error message after showing the syntax message. This is done to help a user who tries "--help tls-cipher" or similar, hoping to get more information about the "tls-cipher" option. * The --dhcp-option option: It has its own similar message, into which " or extra" has been inserted. * Ten options such as --up that accept a command (instead of a path) already detect extra parameters and generate specific error messages that mention double-quoting commands which contain embedded spaces. Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <CAEsd45RvRfmqetu-EoFjSdyBk5F9X1K5muPGu-+_+30TMNOU_A@mail.gmail.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/9783 URL: https://community.openvpn.net/openvpn/ticket/557 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* write pid file immediately after daemonizingSteffan Karger2015-06-215-36/+14
| | | | | | | | | | | | | | | | | Since we split daemonizing from changing directory in commit da9b292 (f025de005d719201a69ad0313d545a1ddd244752 in release/2.3), we can now simply write the pid file immediately after daemonizing. This not only fixes the bug reported in trac #563, but also further simplifies the code. trac #563 Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1434665325-3225-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9793 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix FreeBSD ifconfig for topology subnet tunnels.Gert Doering2015-06-021-1/+23
| | | | | | | | | | | | | | | | | | For "topology subnet", we only pretend to have a subnet and keep using the tun if in point-to-point mode - but for that to fully work, the "remote" address needs to be different from the "local" address. So just arbitrarily construct one from the on-link subnet - base+1, if "that is not us", base+2, otherwise. Fix trac #481 See also: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=194745 Signed-off-by: Gert Doering <gert@greenie.muc.de> Tested-By: Anton Sayetsky <vsasjason@gmail.com> Lazy-ACK-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1430071438-31675-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9606
* Move res_init() call to inner openvpn_getaddrinfo() loopGert Doering2015-06-021-4/+3
| | | | | | | | | | | | | | | | | | A non-working nameserver in /etc/resolv.conf could lead to endless loops inside openvpn_getaddrinfo(), because many systems will only pick up changes to resolv.conf if res_init() is called again. To reproduce, run openvpn with --resolv-retry infinite (2.3) or --resolv-retry "a high number" (master) on a BSD system. Linux glibc seems to stat() resolv.conf on calls to getaddrinfo() and pick up changes automatically. Trac #523 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1433080749-6892-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9763
* Fix --redirect-private in --dev tap mode.Guy Yur2015-06-011-1/+1
| | | | | | | | | | | | | | | | | | | | When specifying redirect-private option and not specifying route-gateway or ifconfig options, OpenVPN fails to add the route to the remote host with the following message: NOTE: unable to redirect default gateway -- VPN gateway parameter (--route-gateway or --ifconfig) is missing In redirect_default_route_to_vpn() the check for remote endpoint happens even though it is not used by redirect-private - make check conditional on RG_REROUTE_GW (= --redirect-gateway). Trac #261 Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20150531120327.GE382@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9761 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Use EAI_AGAIN instead of EAI_SYSTEM for openvpn_getaddrinfo().Gert Doering2015-06-011-1/+1
| | | | | | | | | | | | Windows has no EAI_SYSTEM (introduced by 5f6c01ea6172ed), but everyone has EAI_AGAIN - which also fits ("a temporary failure in name resolution"). Trac #276 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1433178914-7842-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9768
* On signal reception, return EAI_SYSTEM from openvpn_getaddrinfo().Gert Doering2015-06-011-1/+4
| | | | | | | | | | | | | | | | | | A signal (except SIGUSR1) received while waiting for getaddrinfo() is considered fatal, so openvpn_getaddrinfo() is destroying the returned information with freeaddrinfo(), but still signalled "success" (0) to the caller - so if the caller accessed *res before checking *signal_received, it would access just-free()ed memory, which on some platforms still worked and on others caused a crash. Also, ensure that *ai is also NULLed in the caller now. Trac #276 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1433104918-9523-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9764
* Call daemon() before initializing crypto librarySteffan Karger2015-05-265-29/+17
| | | | | | | | | | | | | | | | | | But keep the chdir to / at the place where deamon() was before, to preserve the current behaviour wrt relative paths in the config. This should fix the issue reported in trac #480, without changing the behaviour visible to the end user. Note that by moving the daemon() call to an earlier stage of the init process, we no longer have to call platform_mlockall() again, or do a pkcs11_forkFixup(). Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1430144937-4149-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9609 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Disallow usage of --server-poll-timeout in --secret key mode.Gert Doering2015-05-242-0/+4
| | | | | | | | | | | | | | | The internal machinery wants TLS for this to work, so just add this to the (long) list of options not allowed unless either --tls-client or --tls-server is active. For added sanity, add an ASSERT() call to the place where this combination caused a NULL ptr reference, and document the restriction. Fix trac #373 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1432472554-24666-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9736
* Fix null pointer dereference in options.cJonathan K. Bullard2015-05-231-1/+1
| | | | | | | | Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <CAEsd45SHoEtahdVT95a+N-zmjRG4nH3QPxBZoGpnh1pykjSU4A@mail.gmail.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/9723 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* assume res_init() is always there.Gert Doering2015-05-231-1/+1
| | | | | | | | | | | | | | | | | | | | Previously, the code tried to find res_init(), and on some systems got it wrong in configure, silently not-using res_init(), leading to unexpected failures to re-init the resolver. We know that all supported OSes (except Windows) have res_init(), so change the call to "#ifndef WIN32", and adjust configure.ac to just find the library to link (if any). With that, failures to find res_init() are no longer "hidden" but clearly visible at link time. AC_SEARCH_LIBS() bits inspired by CUPS' cups_network.m4 (GPLv2) Fix (part of) trac #523 Signed-off-by: Gert Doering <gert@greenie.muc.de> Lazy-ACK-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1430162841-5840-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9614
* Re-read auth-user-pass file on (re)connect if requiredSteffan Karger2015-05-233-2/+4
| | | | | | | | | | | | | | Fixes trac #225 ('--auth-user-pass FILE' and '--auth-nocache' problem). This patch is based on the changes suggested by ye_olde_iron in the trac ticket. Also added a note to the manpage to inform people to use absolute paths when combining --auth-user-pass file and --auth-nocache. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1432386145-15045-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9717 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* repair --dev null breakage caused by db950be85d37Gert Doering2015-05-231-10/+14
| | | | | | | | | | | | "make check" self-test was broken after commit db950be85d37 due to do_ifconfig_setenv() not checking whether tt->did_ifconfig_setup was set (which isn't, for "dev null" type setups) Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan@karger.me> Message-Id: <1432404098-29401-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9718 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* cleanup: remove md5 helper functionsSteffan Karger2015-05-236-117/+33
| | | | | | | | | | | | | | | | | | | | | | The MD5 wrapper functions were used in just a few places, which imho is not worth the extra code. Instead of using these wrappers, just use the generic md_ctx_*() functions directly. The md5sum() function was only used for logging information that was not useful to a user; first the full options string would be printed, and later just the hash. That hash is less informative than the full string, so why print it at all? Finally, also removed save_pulled_options_digest(). The two times it was called, it executed either one of the possible branches in the function, where one of these needed a comment to explain what passing NULL as newdigest is supposed to do... Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1430665631-4022-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9642 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* include ifconfig_ environment variables in --up-restart env setJan Just Keijser2015-05-233-43/+50
| | | | | | | | | | | | | | | | | here's my patch for bug #93: missing ifconfig_* env vars after up-restart. Tested with both IPv4, IPv6, topology subnet and topology net30 Document differences between --up-restart and --up in openvpn.8 See trac #93 and the discussion starting with <555BF270.3090706@nikhef.nl> on the openvpn-devel mailing list. fix trac #93 Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <555BF270.3090706@nikhef.nl> URL: http://article.gmane.org/gmane.network.openvpn.devel/9705 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Use OPENVPN_ETH_P_* so that <netinet/if_ether.h> is unecessaryFelix Janda2015-05-162-6/+2
| | | | | | | | | | | | Fixes compilation error on linux with musl libc because of conflicting ethhdr declarations in <netinet/if_ether.h> and <linux/if_ether.h> which is included from <linux/if_tun.h> Signed-off-by: Felix Janda <felix.janda@posteo.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20150516134604.GA2302@euler> URL: http://article.gmane.org/gmane.network.openvpn.devel/9690 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* polarssl: disable 1/n-1 record splittingSteffan Karger2015-05-091-0/+8
| | | | | | | | | | | | | | | | | | Disable record splitting (for now). OpenVPN assumes records are sent unfragmented, which is no longer a valid assumption when record splitting is enabled (which polarssl/mbedtls did in 1.3.10, see trac #524). Changing the code to deal with record splitting will require intrusive changes that need thorough review and testing. Since OpenVPN is not susceptible to BEAST (the data transmitted over the control channel is very hard to influence for a remote attacker), we can just disable record splitting as a quick fix. This gives us the time to develop a proper solution in the mean time, and test that thoroughly. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1430766398-17209-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9646 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Improve --tls-cipher and --show-tls man page descriptionSteffan Karger2015-05-093-2/+7
| | | | | | | | | | | | | | As reported in trac tickets #304, #358 and #359 (and possibly more), the usage and interpretation of --tls-cipher (and --show-tls) is tricky. This patch extends the man page to explain those a bit better and point out that --tls-cipher is an expert feature (i.e. easy to get wrong). Also add a notice to the --show-tls output, referring to the man page explanation. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1430840857-6123-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9651 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* polarssl: remove code duplication in key_state_write_plaintext{, _const}()Steffan Karger2015-05-031-33/+5
| | | | | | | | | | | | | Both functions had almost exactly the same code. Instead of the code duplication, have key_state_write_plaintext() call key_state_write_plaintext_const() to do the actual work. This is just a bit of cleanup, it should not change any behaviour. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1430654761-26563-2-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9640 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Remove size limit for files inlined in configSteffan Karger2015-05-021-1/+10
| | | | | | | | | | | | | | | | As described in trac #484, the current inline file size limit of 10000 bytes is becoming an issue for some users. Since RSA keys and signature sizes are increasing, we need to adjust our limits. As #484 reports, 10000 can be too small for PKCS#12 files with 4K RSA keys. Instead of postponing this issue by increasing the static limit, dynamically increase the buffer size while reading. This keeps the memory usage limited but does allow for larger inlined files. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1430122342-11742-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9607 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Print helpful error message on --mktun/--rmtun if not available.Gert Doering2015-04-282-4/+8
| | | | | | | | | | | | | | | OpenVPN only supports --mktun/--rmtun to create/destroy persistant tunnels on Linux. On BSD OSes, "ifconfig tun0 create" can do the same job, so we do not actually need to support it - but the previous error message ("unknown option") wasn't helpful. So always accept the option now, and on non-supported systems, direct user to manpage. Trac #85 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <dazo@users.sourceforge.net> Message-Id: <1430219063-12291-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9617
* Fix leftover 'if (false) ;' statementsGert Doering2015-04-221-6/+2
| | | | | | | | | | | Commit a4b8f653ee5be9c2292c removed the #ifdefs for ENABLE_HTTP_PROXY and ENABLE_SOCKS, thus making this "if (false) ; else if (...)" construct superfluous. Spotted by David Sommerseth. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1429649352-21034-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9603
* Remove unneeded parameter 'first_time' from possibly_become_daemon()Steffan Karger2015-04-131-3/+3
| | | | | | | | | | | | The static helper function possibly_become_daemon() is called only once, by do_init_first_time(), which checks 'first_time' to be true before calling possibly_become_daemon(). This makes the parameter useless. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1427328089-886-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9555 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Mac OS X Keychain management clientVasily Kulikov2015-04-137-35/+177
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds support for using certificates stored in the Mac OSX Keychain to authenticate with the OpenVPN server. This works with certificates stored on the computer as well as certificates on hardware tokens that support Apple's tokend interface. The patch is based on the Windows Crypto API certificate functionality that currently exists in OpenVPN. This patch version implements management client which handles RSA-SIGN command for RSA offloading. Also it handles new 'NEED-CERTIFICATE' request to pass a certificate from the keychain to OpenVPN. OpenVPN itself gets new 'NEED-CERTIFICATE" command which is called when --management-external-cert is used. It is implemented as a multiline command very similar to an existing 'RSA-SIGN' command. The patch is against commit 3341a98c2852d1d0c1eafdc70a3bdb218ec29049. v4: - added '--management-external-cert' argument - keychain-mcd now parses NEED-CERTIFICATE argument if 'auto' is passed as cmdline's identity template - fixed typo in help output option name - added '--management-external-cert' info in openvpn(8) manpage - added 'certificate' command documentation into doc/management-notes.txt v3: - used new 'NEED-CERTIFICATE' command for certificate data request instead of 'NEED-OK' - improved option checking - improved invalid certificate selection string handling - added man page for keychain-mcd - handle INFO, FATAL commands from openvpn and show them to user * ACK from Arne Schwabe for OpenVPN part * ACK from James based on Arne's testing v2 (http://sourceforge.net/p/openvpn/mailman/message/33225603/): - used management interface to communicate with OpenVPN process v1 (http://sourceforge.net/p/openvpn/mailman/message/33125844/): - used RSA_METHOD to extend openvpn itself Signed-off-by: Vasily Kulikov <segoon@openwall.com> -- Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20150225160718.GA6306@cachalot> URL: http://article.gmane.org/gmane.network.openvpn.devel/9486 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Remove count_netmask_bits(), convert users to use netmask_to_netbits2()Gert Doering2015-03-085-34/+5
| | | | | | | | | | | | The previous Linux/iproute2 code converted binary netmasks to string representation (print_in_addr_t()), just to immediately scanf() it back to binary to count bits. netmask_to_netbits2() directly works on the in_addr_t. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1419713983-16272-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9360
* Fix incorrect use of get_ipv6_addr() for iroute options.Gert Doering2015-03-081-1/+1
| | | | | | | | | get_ipv6_addr() returns "bool/false", not "int < 0" to signal error. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1425819401-18465-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9532
* Change float log message to include common name, if available.Steffan Karger2015-03-081-2/+5
| | | | | | | | | | Makes it a lot easier to see which client is floating. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Lev Stipakov <lstipakov@gmail.com> Message-Id: <1425745391-8069-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9526 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix mssfix default value in connection_list contextLev Stipakov2015-03-071-1/+1
| | | | | | | | | | | | | | | | | | | Due to this bug, mssfix hasn't been assigned to fragment value and used default value (1450) instead. As a consequence, TCP packets get fragmented, which causes performance penalty. Since dual stack patch (commit 23d61c56b9fd218c39ad151b01b7e2d6690e6093) OpenVPN uses options->connection_list, even for single remote. This fix assigns mssfix value to fragment value for connection_entry inside connection_list instead of connection_entry inside options struct (which does not work for connection_list case). Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1425587636-23338-1-git-send-email-lstipakov@gmail.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/9507 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Allow for CN/username of 64 characters (fixes off-by-one)Steffan Karger2015-03-061-3/+3
| | | | | | | | | | | | | | | This is an alternative patch to fix the issue reported in trac #515 by Jorge Peixoto. Instead of increasing the TLS_USERNAME_LEN define, do +1 at the relevant places in the code. Also see Jorge's original patch and the discussion on the maillinglist: http://thread.gmane.org/gmane.network.openvpn.devel/9438 Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <54F8CC9B.9040104@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9508 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* polarssl: make sure to always null-terminate the cnSteffan Karger2015-03-061-1/+4
| | | | | | | | | | | Just a precaution, this could never fail in the current code since in the one place this function is called, the cn is already zero-initialized. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1425592716-14243-2-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9511 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Get rid of old OpenSSL workarounds.Steffan Karger2015-03-061-2/+2
| | | | | | | | | | | | We now only support OpenSSL 0.9.8+, so we don't have to work around the bug in 0.9.6b anymore. Also, OBJ_txt2nid() now takes a const char * (instead of a char *), so we no langer have to cast away const. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1425592716-14243-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9512 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Remove unused function sock_addr_setArne Schwabe2015-03-051-11/+0
| | | | | | | | Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1425479025-7573-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/9502 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix frame size calculation for non-CBC modes.Steffan Karger2015-02-271-5/+21
| | | | | | | | | | | | | | | CBC mode is the only mode that OpenVPN supports that needs padding. So, only include the worst case padding size in the frame size calculation when using CBC mode. While doing so, rewrite crypto_adjust_frame_parameters() to be better readable, and provide debug output (for high debug levels). Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1406667144-17674-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/8952 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Print remote IPv4 address on a dual-stack v6 socket in IPv4 formatGert Doering2015-02-152-5/+23
| | | | | | | | | | | | | | | | | | | Previously, the code would print IPv4-mapped format ("::ffff:1.2.3.4"), which is technically correct but adds no extra value, and is confusingly different from the output if using a v4 socket. Print "1.2.3.4" instead, whatever socket type is used. Affects client IP address in log file, status output (mroute_addr_print_ex), and environment (setenv_sockaddr). The fact that a dual-stack socket was used is still visible in the initial peer connect message in the log: '... Peer Connection Initiated with [AF_INET6]::ffff:1.1.3.4:53779' Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1419875325-96015-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9363
* New approach to handle peer-id related changes to link-mtu.Gert Doering2015-02-153-4/+36
| | | | | | | | | | | | | | | | | | | | | | Instead of statically increasing link-mtu by +3, keep the old value for OCC compatibility with old servers/clients, and only increase link-mtu if peer-id option is enabled (right now: is pushed by server). If link-mtu has been set in the config, keep configured value, and log warning (because the extra overhead has to decrease tun-mtu). Reserve extra +3 bytes in frame->extra_link. v2: use frame->extra_link, not frame->extra_buffer (receive path on server) introduce frame_add_to_link_mtu() to manipulate frame->link_mtu value rework comments to make more clear what is happening This reverts commit f95010ad247a8998e0c39e394236251fca316849. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1423390725-13438-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/9450
* Disable SSL compressionSteffan Karger2015-02-151-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | As reported in trac #502, SSL compression can cause problems in some corner cases. OpenVPN does not need SSL compression, since the control channel is low bandwidth. This does not influence the data channel compressen (i.e. --comp or --comp-lzo). Even though this has not yet been relevant for OpenVPN (since an attacker can not easily control contents of control channel messages), SSL compression has been used in the CRIME and BREACH attacks on TLS. TLS 1.3 will probably even remove support for compression all together, for exactly this reason. Since we don't need it, and SSL compression causes issues, let's just disable it in OpenSSL builds. PolarSSL has no run-time flag to disable compression, but is by default compiled without compression. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1424010266-5910-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9453 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix mismatch of fprintf format specifier and argument typeJonathan K. Bullard2015-02-071-1/+1
| | | | | | | | | | | | | | This fixes a warning about a mismatch between a fprintf format string and an argument type on Darwin-64-bit builds: %lu specifies type 'unsigned long' but the argument has type '__darwin_suseconds_t' (aka 'int') Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <CAEsd45SoC+h5tcDraZcQN_MUYzqWYOVvNpkwMo190DLpB32StQ@mail.gmail.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/9446 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix NULL dereferencingLev Stipakov2015-02-061-4/+5
| | | | | | | | | | | | In certain cases buf.len can be -1, which causes BPTR to return NULL and NULL pointer dereferencing on the next line. As a fix, process only packets with non-zero length. Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1423226280-9580-1-git-send-email-lstipakov@gmail.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/9444 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Account for peer-id in frame size calculationSteffan Karger2015-01-231-6/+4
| | | | | | | | | | | | | | | Data channel packet using P_DATA_V2 will use three bytes extra for the peer-id. This needs to be accounted for, otherwise OpenVPN will throw TCP/UDP packet too large on write to [AF_INET]10.1.1.1:1194 warnings. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Lev Stipakov <lstipakov@gmail.com> Message-Id: <1422042761-10014-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9418 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Disallow lameduck's float to an address taken by another clientLev Stipakov2015-01-223-6/+17
| | | | | | | | | | | | | | | Existing check didn't take into account the case when floated client is lame duck (CN for lame duck is NULL), which allowed lame duck to float to an address taken by another client. As a fix we use cert_hash_compare function which, besides fixing mentioned case, also allows lame duck to float to an address already taken by the same client. Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1420658798-29943-1-git-send-email-lstipakov@gmail.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/9386 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Add option to disable Diffie Hellman key exchange by setting '--dh none'Steffan Karger2015-01-043-6/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | As requested on the mailing list and in trac ticket #410, add an option to disable 'traditional' Diffie Hellman key exchange. People want to be able to create ecdh-only configurations. This patch also disables RSA key exchange by default for OpenSSL builds, to prevent that people who set "--dh none" but have an OpenSSL version that doesn't support ECDH end up with a less secure connection. Note that users that specify their own --tls-cipher override these defaults and thus can still use whatever OpenSSL supports (and might thus end up with less secure connections). PolarSSL does not allow to easily disable RSA key exchange during runtime, but its default compile options do not include RSA key exchange based cipher suites. Finally update the manpage to reflect the new behaviour, and while touching it change the text to motivate users towards a more secure configuration. v2 - disable RSA key exchange by default Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1420141569-11773-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9376 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* openssl: use crypto_msg(), get rid of openssl-specific code in error.cSteffan Karger2014-12-314-103/+89
| | | | | | | | | | | | | v2 - don't wrap string for a couple of words, and be more consistent with wrapping (use curly braces for ifs with wrapping statements) v3 - change an incorrect crypto_msg() call back to msg() Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <54A430A2.5000409@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9374 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Remove ENABLE_SSL define (and --disable-ssl configure option)Steffan Karger2014-12-3125-201/+64
| | | | | | | | | | | | | | | | | | | Remove the --disable-ssl configure option and accompanying ENABLE_SSL defines in the master/2.4 branch, to reduce the code and testing complexity a bit. This does not remove to runtime option to run without SSL, just the compile time option to not include any SSL-related code. During the community meeting in November 2014 there were no objections amongst he developers present. Also, this has been announced on the -users and -devel mailing lists two weeks ago, without any response whatsoever. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <54A4248A.1090501@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9371 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* openssl: add more descriptive message for 'no shared cipher' errorSteffan Karger2014-12-311-3/+17
| | | | | | | | | | | | | | | | Overzealous users using the --tls-cipher option, or users with actual incompatible crypto libaries often waste quite some time debugging the 'no shared cipher' error from openssl. See e.g. trac ticket #359: https://community.openvpn.net/openvpn/ticket/359 This change adds a more clear, verb 1 error message reporting the problem directly to the user, instead of just printing the openssl error. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <544EB12E.40200@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9209 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* openssl: add crypto_msg(), to easily log openssl errorsSteffan Karger2014-12-313-0/+40
| | | | | | | | | | | | | This works towards removing OpenSSL-specific error printing code from error.c. The crypto_msg() functions provide convenience wrappers, specific to OpenSSL. Instead of passing the magical 'M_SSLERR' flag to msg(), a developer now just calls crypto_msg() to get OpenSSL errors dumped to log. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1414269324-14102-5-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9199 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Default gateway can't be determined on illumos/Solaris platformsAlexander Pyhalov2014-12-311-2/+19
| | | | | | | | | | The logic which is used on BSD is preserved. The only distinction is that illumos doesn't provide sa_len field in sockaddr structures. Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1413315802-62359-5-git-send-email-alp@rsu.ru> URL: http://article.gmane.org/gmane.network.openvpn.devel/9129 Signed-off-by: Gert Doering <gert@greenie.muc.de>
generated by cgit (git 2.34.1) at 2024-05-01 10:41:59 +0000