/
ChangeLog
4118 lines (3483 loc) · 166 KB
/
ChangeLog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
OpenVPN Change Log
Copyright (C) 2002-2012 OpenVPN Technologies, Inc. <sales@openvpn.net>
2013.01.07 -- Version 2.3.0
Gert Doering (2):
Fix parameter type for IP_TOS setsockopt on non-Linux systems.
Fix client crash on double PUSH_REPLY.
2012.12.17 -- Version 2.3_rc2
Adriaan de Jong (1):
Fix --show-pkcs11-ids (Bug #239)
Arne Schwabe (4):
Error message if max-routes used incorrectly
Properly require --key even if defined(MANAGMENT_EXTERNAL_KEY)
Remove dnsflags_to_socktype, it is not used anywhere
Fix the proto is used inconsistently warning
David Sommerseth (3):
Fix double-free issue in pf_destroy_context()
The get_default_gateway() function uses warn() instead of msg()
Avoid recursion in virtual_output_callback_func()
Gert Doering (2):
Implement --mssfix handling for IPv6 packets.
Fix option inconsistency warnings about "proto" and "tun-ipv6"
Joachim Schipper (2):
doc/management-notes.txt: fix typo
Fix typo in ./configure message
2012.10.31 -- Version 2.3_rc1
Adriaan de Jong (1):
Fixed a bug where PolarSSL gave an error when using an inline file tag.
Arne Schwabe (2):
Document man agent-external-key
Options parsing demands unnecessary configuration if PKCS11 is used
David Sommerseth (2):
Make git ignore some more files
Remove the support for using system() when executing external programs or scripts
Heiko Hund (2):
Fix display of plugin hook types
Support UTF-8 --client-config-dir
Kenneth Rose (1):
Fix v3 plugins to support returning values back to OpenVPN.
2012.09.12 -- Version 2.3_beta1
Arne Schwabe (7):
Fixes error: --key fails with EXTERNAL_PRIVATE_KEY: No such file or directory if --management-external-key is used
Merge almost identical create_socket_tcp and create_socket_tcp6
Document the inlining of files in openvpn and document key-direction
Merge getaddr_multi and getaddr6 into one function
Document --management-client and --management-signal a bit better
Document that keep alive will double the second value in server mode and give a short explanation why the value is chosen.
Add checks for external-key-managements
David Sommerseth (1):
Fix reconnect issues when --push and UDP is used on the server
Gert Doering (4):
Reduce --version string detail about IPv6 to just "[IPv6]".
Put actual OpenVPN command line on top of corresponding log file.
Keep pre-existing tun/tap devices around on *BSD
make "ipv6 ifconfig" on linux compatible with busybox ifconfig
Heiko Hund (6):
fix regression with --http-proxy[-*] options
add x_msg_va() log function
add API for plug-ins to write to openvpn log
remove stale _openssl_get_subject() prototype
remove unused flag SSLF_NO_NAME_REMAPPING
Add --compat-names option
2012.07.20 -- Version 2.3_alpha3
Arne Schwabe (1):
Fix compiling with --disable-management
Gert Doering (1):
Repair "tap server" mode brokenness caused by <stdbool.h> fallout
Heiko Hund (4):
make non-blocking connect work on Windows
don't treat socket related errors special anymore
remove unused show_connection_list debug function
add option --management-query-proxy
2012.06.29 -- Version 2.3_alpha2
Adriaan de Jong (11):
Fixed off-by-one in serial length calculation
Migrated x509_get_subject to use of the garbage collector
Migrated x509_get_serial to use the garbage collector
Migrated x509_get_sha1_hash to use the garbage collector
Ensure sys/un.h autoconf detection includes sys/socket.h
Added support for new PolarSSL 1.1 RNG
Added a configuration option to enable prediction resistance in the PolarSSL random number generator.
Use POLARSSL_CFLAGS instead of POLARSSL_CRYPTO_CFLAGS in configure.ac
Removed support for PolarSSL < 1.1
Updated README.polarssl with build system changes.
Removed stray "Fox-IT hardening" string.
Alon Bar-Lev (94):
build: version should not contain '-'
package: rpm: strip should be handled by package management
cleanup: options.c: remove redundant include
cleanup: remove C++ warnings
cleanup: win32.c: wrong printf format
cleanup: remove redundant ';'
cleanup: crypto_openssl.c: remove support for pre-openssl-0.9.6
cleanup: tun.c: fix incorrect option in message (ip-win32)
cleanup: memcmp.c: remove unused source
fixup: init.c: add missing conditional for ENABLE_CLIENT_CR
build: correct place to alter WINVER is at build system
Update .gitignore
build: handle printf style format in mingw
build: rename plugin directory to plugins
build: plugins: properly use CC, CFLAGS and LDFLAGS
build: we need the sample.ovpn in future
Remove install-win32
Remove easy-rsa
Remove tap-win32
cleanup: rename tap-windows function from win32 to win
build: remove windows specific build system
build: split acinclude.m4 into m4/*
build: m4/ax_varargs.m4: cleanup
build: m4/ax_emptyarray.m4: cleanup
build: m4/ax_socklen_t.m4: cleanup
build: autotools: first pass of trivial autotools changes
build: autoconf: remove OPENVPN_ADD_LIBS useless macro
build: remove awk and non-standard autoconf output processing
build: standard directory layout
build: add libtool + windows resources for executables
build: autoconf: commands as environment
build: libdl usage
build: properly detect and use socket libs
build: autoconf: minor cleanups
build: proper selinux detection and usage
build: distribute pkg.m4
build: proper pkcs11-helper detection and usage
build: properly process lzo-stub
build: proper lzo detection and usage
build: proper crypto detection and usage
build: autoconf: update defaults for options
build: win-msvc: msbuild format
build: move out config.h include from syshead
build: split out compat
build: move gettimeofday() emulation to compat
build: move daemon() emulation into compat
build: move inet_ntop(), inet_pton() emulation into compat
cleanup: move console related function into its own module
build: move wrappers into platform module
build: windows: install version.sh to allow installer read version
build: distribute samples in windows
build: use tap-windows.h as external dependency
build: ax_varargs.m4: fixups
build: autoconf: misc sockets fixups
build: enable lzo by default
build: windows: set vendor to openvpn project + cleanups
build: assume dlfcn is available on all supported platforms
build: openbsd: detect netinet/ip.h correctly
build: tap: search for tap header
build: msvc: upgrade to Visual Studio 2010 + fixups
Enable pedantic in windows compilation
cleanup: flags should not be bool
cleanup: avoid using ~0 - generic
cleanup: avoid using ~0 - ipv6
cleanup: avoid using ~0 - netmask
cleanup: avoid using ~0 - windows
cleanup: gc usage
build: fix some statement left from conversion
build: properly detect netinet/ip.h structs
build: properly detect TUNSETPERSIST
cleanup: plugin: support C++ plugin
cleanup: remove C++ comments
cleanup: add .gitattributes to control eol style explicitly
crash: packet_id_debug_print: sl may be null
build: use stdbool.h if available
build: fix typo in --enable-save-password
build: windows: convert resources to UTF-8
build: check minimum polarssl version
cleanup: update .gitignore
cleanup: spec: make space/tab consistent
build: spec: we support openssl >= 0.9.7
build: insall README* document using build system
build: detect sys/wait.h required for *bsd
build: add git revision to --version output if build from git repository
build: cleanup: yet another forgotten brackets
build: update INSTALL to recent changes
build: support platforms that does not need explicit tun headers
build: do not support <polarssl-1.1.0
build: add --with-special-build to provide special build string
cleanup: pkcs11.c: resolve wanings
build: integrate plugins build into core build
build: plugins: set defaults based on platform
cleanup: windows: convert argv (UCS-2 to UTF-8) at earliest
build: msvc: chdir with change drive to script location
Arne Schwabe (7):
Add the query to the error message.
Explain that route-nopull also causes the client to ignore dhcp options.
Add the name of the context where option is not allowed to the error message.
Only use tmpdir if tmp_dir is really used.
Completely remove ancient IANA port warning.
Remove ENABLE_INLINE_FILES conditionals
Remove ENABLE_CONNECTIONS ifdefs
David Sommerseth (5):
Clean-up: Presume that Linux is always IPv6 capable at build time
Simplify check_cmd_access() function
Change version to indicate the master branch is not a version
Some filesystems don't like ':', which is a path 'make dist' would use
Remove two unused functions
Frank de Brabander (1):
Fix reported compile issues on OSX 10.6.8
Gert Doering (10):
repair t_client.sh test after build system revolution
t_client.sh iproute2 script fixes
t_client.sh - fix for iproute2, print summary line
Implement search for "first free" tun/tap device on Solaris
cleanup and redefine metric handling for IPv6 routes
remove "*option" element in "struct route_ipv6"
Remove warning about explicit support for IPv6 support not provided MacOS X
Add missing pieces to IPv6 route gateway handling.
Update TODO.IPv6 list
Remove #include "config.h" from ssl_polarssl.h
Heiko Hund (3):
remove wrapper code for Windows CryptoAPI function
fix warnings in event.c when building for win32-64
remove the --auto-proxy option from openvpn
Igor Novgorodov (1):
Remove calls to OpenSSL when building with --disable-ssl
Jonathan K. Bullard (2):
Fix file access checks on commands
Clarified the docs and help screen about what a 'cmd' is
Samuli Seppänen (1):
Added notes about upgrading from 2.3-alpha1 and earlier to INSTALL-win32.txt
2012.02.21 -- Version 2.3-alpha1
Adriaan de Jong (127):
Added Doxygen doxyfile
Changed configure to accept --with-ssl-type=openssl
Refactored to rand_bytes for OpenSSL-independency
Refactored OpenSSL-specific constants
Refactored maximum cipher and hmac length constants
Refactored show_available_* functions
Refactored SSL_clear_error()
Refactored crypto initialisation functions
Refactored DES key manipulation functions
Refactored NTLM DES key generation
Refactored message digest type functions
Refactored message digest functions
Refactored HMAC functions
Refactored cipher key types
Refactored cipher functions
Added PRNG doxygen
Refactored: Moved crypto.h inline functions to end of file
Removed stale OpenSSL defines from crypto.h
Added a check for Openssl or PolarSSL defines
Refactored: Added stubs for new files
Refactored SSL initialisation functions
Refactored TLS_PRF to new hmac and md primitives
Refactored tls_show_available_ciphers
Refactored get_highest_preference_tls_cipher
Refactored root SSL context initialisation
Refactored new external key code
Refactored DH paramater loading
Refactored root TLS option settings
Refactored PKCS#12 key loading
Refactored PKCS#11 loading
Refactored windows cert loading
Refactored load certificate functions
Refactored private key loading code
Refactored external key loading from management
Refactored CA and extra certs code
Refactored cipher restriction code
Refactored tls_options, key_state, and key_source data structures
Refactored initalisation of key_states
Refactored key_state free code
Refactored print_details
Refactored key_state read code (including bio_read())
Refactored key_state write functions
Refactored: Moved BIO debug functions to OpenSSL backend
Refactored: removed ks and ks_lame macro for clarity
Refactored: moved write_empty_string function back
Refactored Doxygen for tls_multi functions
Migrated data structures needed by verification functions to ssl_common.h
Refactored client_config_dir_exclusive function
Refactored certificate hash lock checks
Refactored common name locking functions
Refactored username and password authentication code
Add some extra comments
Refactored: split verify_callback into two parts
Added function to extract and verify the subject from a certificate
Added function to verify and extract the username
Refactored: removed global x509_username_field
Refactored: separated environment setup during verification
Refactored: Netscape certificate type verification
Refactored key usage verification code
Refactored EKU verification
Refactored tls-remote checking
Refactored tls-verify-plugin code
Refactored tls-verify script code
Refactored CRL checks
Minor cleanup in verify_cert:
Refactored: Moved verify_cert to ssl_verify
Cleaned up ssl.h
Refactored: made M_SSL dependent on USE_OPENSSL
Refactored: renamed X509 functions from verify_*
Separated OpenSSL-specific parts of the PKCS#11 driver
Modified base64 code in preparation for PolarSSL merge
Final cleanup before PolarSSL addition:
Refactored X509 track feature to be contained within the openssl backend
Added PolarSSL support:
Fixed a missing include in ssl_backend.h
Fixed a bug in the hash generation in ssl_verify_openssl.c
Added SHA_DIGEST_SIZE definition
Changed PolarSSL crypto backend to support v0.99-pre5
Updated ssl_polarssl.c to work with 0.99-pre5
Fixed a compilation warning for size_t key sizes
Added a warning that the PolarSSL library does not support pkcs12 files.
Added warning that --capath is not available with PolarSSL
Disable CryptoAPI when not using OpenSSL, and document that fact.
Removed support for management external keys in PolarSSL
Removed stray X509_free from ssl.c
Refactored (and disabled for PolarSSL) support for writing external cert files in scripts
Added an extra define to allow building without PKCS#11
Added SSL library to title string
Disabled X.509 track and username selection for PolarSSL
Hardening: periodically reset the PRNG's nonce value
Fixes for the plugin system:
Further improvements to plugin support:
Fixed an unintentional change in the options calculated key size.
Moved print messages back to generic crypto.c from cipher backends
Moved HMAC prints back to main crypto module
Added back checks for ks->authenticated in verify_user_pass
Moved gc_new and gc_free to begin end of function
Fixed a bug in the return value of ssl_verify when pre_verify failed
Unified verification function return values:
Removed a stray Fox-IT tag
Fixed a typo: print the subject instead of the serial for verification errors
Made SSL_CIPHER const in print_details, to fix warning
Moved to PolarSSL 1.0.0:
Added missing #ifdef to allow --disable-managent to work again
Fixed disabling crypto and SSL
Got rid of a few magic numbers in ntlm.c
Removed obsolete des_cblock and des_keyschedule
Further removal of des_old.h based calls
Fixed missing comma in plugin.h
Moved prng_uninit out of crypto_uninit_lib
Moved CryptoAPI header include to the ssl_openssl.c
Reordered functions to ensure warning-free Windows build
Added options to switch between OpenSSL and PolarSSL and PKCS11...
Moved from strsep to strtok, for Windows compatibility
Minor cleanup to enable warning-free Windows build:
Fixed a typo when initialising cryptoapi certs
Minor code cleanup: cleaned up error handling in verify_cert.
Moved out of memory prototype to error.h, as the definition is in error.c
Removed support for calling gc_malloc with a NULL gc_arena struct
(The follwing patches from Adriaan was mistakenly merged with
the wrong commit author in the git tree)
Doxygen: Added data channel crypto docs
Added control channel crypto docs
Added compression docs
Added reliability layer documentation
Added memory management documentation
Added data channel fragmentation docs
Added main/control docs
Moved doxygen-specific files to a separate directory
Byron Ellacott (1):
autoconf fixes for building on OSX
David Sommerseth (50):
Provide 'dev_type' environment variable to plug-ins and script hooks
Define the new openvpn_plugin_{open,func}_v3() API
Implement the core v3 plug-in function calls.
Extend the v3 plug-in API to send over X509 certificates
Added a simple plug-in demonstrating the v3 plug-in API.
Separate the general plug-in version constant and v3 plug-in structs version
Use a version-less version identifier on the master branch
Fix the --client-cert-not-required feature
Change the default --tmp-dir path to a more suitable path
Improve the mysprintf() issue in openvpnserv.c
Add a simple comment regarding openvpn_snprintf() is duplicated
Merge branch 'feat_ipv6_transport'
Merge branch 'feat_ipv6_payload'
Merge branch 'svn-branch-2.1' into merge
Solved hidden merge conflicts between master and svn-branch-2.1
Fix const declarations in plug-in v3 structs
Merge remote-tracking branch 'cron2/feat_ipv6_payload_2.3'
Don't define ENABLE_PUSH_PEER_INFO if SSL is not available
Fix compiling issues with pkcs11 when --disable-management is configured
Remove support for Linux 2.2 configuration fallback
Revert "Add new openssl.cnf to easy-rsa/Windows"
Merge remote branch SVN 2.1 into the git tree
Merge branch 'svn-merger'
Fix Microsoft Visual Studio incompatibility in plugin.c
Fixed compile issues on FreeBSD and Solaris
Fix PolarSSL and --pkcs12 option issues
Fix FreeBSD/OpenBSD/NetBSD compiler warnings in get_default_gateway()
Make '--win-sys env' default
Do some file/directory tests before really starting openvpn
Fix bug after removing Linux 2.2 support
Don't look for 'stdin' file when using --auth-user-pass
Fix compiling with --disable-crypto and/or --disable-ssl
Fix a couple of issues in openvpn_execve()
Move away from openvpn_basename() over to platform provided basename()
Enable access() when building in Visual Studio
New Windows build fixes
Fix compilation errors on Linux platforms without SO_MARK
autotools ./configure don't like compat.h
Fix pool logging when IPv6 is not enabled
Don't check for file presence on inline files
Add --route-pre-down/OPENVPN_PLUGIN_ROUTE_PREDOWN script/plug-in hook
Enhance the error handling in _openssl_get_subject()
Fix assert() situations where gc_malloc() is called without a gc_arena object
Fix compile issues when plug-ins are disabled.
Remove --show-gateway if debug info is not enabled (--disable-debug)
Fix compile issues with status.c
Connection entry {tun,link}_mtu_defined not set correctly
Makefile.am referenced a now non-existing config-win32.h
Makefile.am was missing ssl_common.h
Revamp check_file_access() checks in stdin scenarios
Davide Guerri (1):
New feauture: Add --stale-routes-check
Frank de Brabander (1):
Fixed wrong return type of cipher_kt_mode
Frederic Crozat (1):
Add support to forward console query to systemd
Gert Doering (45):
Add more detailed explanation regarding the function of "--rdns-internal"
Enable IPv6 Payload in OpenVPN p2mp tun server mode. 20100104-1 release.
remove NOTES file from commit - private scribbling
NetBSD fixes - on 4.0 and up, use multi-af mode.
new feature: "ifconfig-ipv6-push" (from ccd/ config)
add some TODOs to TODO.IPv6
undo accidential duplication of existing "--iroute" line in the help text
basic documentation of IPv6 related options and their syntax
Enable IPv6 Payload in OpenVPN p2mp tun server mode.
remove NOTES file from commit - private scribbling
env_block(): if PATH is not set, add standard PATH setting to env
add IPv6 route add / route delete code for windows (using "netsh")
- Win32 IPv6 ifconfig support, using "netsh" calls
drop "book ipv6" from open_tun() and tuncfg() prototypes
document recent changes and open TODOs, adapt --version info, tag release
Win32: set next-hop for IPv6 routes according to TUN/TAP mode
when deleting a route on win32, also add gateway address
WIN32: if IPv6 requested in TUN mode, check if TUN/TAP driver < 9.7
revert unconditionally-enabling of setenv_es() logging
implement IPv6 ifconfig + route setup/deletion on OpenBSD
full "VPN client connect" test framework for OpenVPN t_client.rc-sample
renamed t_client.sh to t_client.sh.in
2.2-beta3 has a signed TAP driver with the IPv6 code - test for 9.8
correct URL for "more information about IPv6 patch is *here*"
bugfix for linux/iproute2: IPv6 ifconfig code block was not called for "dev tun"+"topology subnet"
bump IPv6 version number (openvpn --version) to 20100922-1
Implement "ipv6 ifconfig" for TAP interfaces on Solaris interfaces
rebased to 2.2RC2 (beta 2.2 branch)
Windows IPv6 cleanup - properly remove IPv6 routes and interface config
For all accesses to "struct route_list * rl", check first that rl is non-NULL
Replace 32-bit-based add_in6_addr() implementation by an 8-bit based one
Platform cleanup for NetBSD
Move block for "stale-routes-check" config inside #ifdef P2MP_SERVER block
add missing break between "case IPv4" and "case IPv6"
bump tap driver version from 9.8 to 9.9
log error message and exit for "win32, tun mode, tap driver version 9.8"
work around inet_ntop/inet_pton problems for MSVC builds on WinXP
Fix build-up of duplicate IPv6 routes on reconnect.
Fix list-overrun checks in copy_route_[ipv6_]option_list()
add "print test titles" and "use sudo" functionality to t_client.rc
Platform cleanup for FreeBSD
Implement IPv6 interface config with non-/64 prefix lengths.
Fix RUN_SUDO functionality for t_client.sh
Document IPv6-related environment variables.
Platform cleanup for OpenBSD
Gisle Vanem (1):
Avoid re-defining uint32_t when using mingw compiler
Gustavo Zacarias (1):
Fix compile issues when using --enable-small and --disable-ssl/--disable-crypto
Heiko Hund (16):
add .gitignore to official repository
remove function is_proto_tcp()
remove legacy code to query IE proxy information
lowercase include header name in syshead.h
define IN6_ARE_ADDR_EQUAL macro for WIN32
add --mark option to set SO_MARK sockopt
Windows UTF-8 input/output
UTF-8 X.509 distinguished names
set Windows environment variables as UCS-2
handle Windows unicode paths
replace check for TARGET_WIN32 with WIN32
do not use mode_t on Windows
use the underscore version of stat on Windows
make MSVC link against shell32 as well
move variable declaration to top of function
define access mode flag X_OK as 0 on Windows
Igor Novgorodov (1):
The code blocks enabled by ENABLE_CLIENT_CR depends on management
James Yonan (57):
Added "management-external-key" option.
Minor addition of logging info before and after execution of Windows net commands.
Misc fixes to r6708.
Added --x509-track option.
* added --management-up-down option to allow management interface to be notified of tunnel up/down events.
Fixed minor compile issue triggered on builds where MANAGEMENT_DEF_AUTH is not enabled.
Implemented get_default_gateway_mac_addr for Mac OS X
Fixes to r6925.
Properly handle certificate serial numbers > 32 bits.
Added "client-nat" option for stateless, one-to-one NAT on the client side.
Renamed branch to reflect that it is no longer beta.
env_filter_match now includes the serial number of all certs
Fixed issue where a client might receive multiple push replies from a server
Fixed bug introduced in r7031 that might cause this error message:
Extended "client-kill" management interface command (server-side)
Client will now try to reconnect if no push reply received within handshake-window seconds.
Version 2.1.3n
Fixed compiling issues when using --disable-crypto
Added "management-external-key" option.
Misc fixes to r6708.
win/sign.py now accepts an optional tap-dir argument.
Added "auth-token" client directive
Added ./configure --enable-osxipconfig option for Mac OS X
Added more packet ID debug info at debug level 3 for debugging false positive packet replays.
Fixed bug that incorrectly placed stricter TCP packet replay rules on UDP sessions
Fixed bug in port-share that could cause port share process to crash
For Mac OSX, when DARWIN_USE_IPCONFIG is defined, retry ipconfig command on failure
Version 2.1.3t
Revert r7092 and r7151, i.e. remove --enable-osxipconfig configure option.
Added 'dir' flag to "crl-verify" (see man page for info).
Added new "extra-certs" and "verify-hash" options
Fixed compile issues on Windows.
Added --enable-lzo-stub configure option to build an OpenVPN client without LZO
Added optional journal directory argument to "port-share" directive
Reduce log verbosity at level 3, with a focus on removing excessive log verbosity generated by port-share activity.
env_filter_match now includes the serial number of all certs in chain
Added support for static challenge/response protocol.
r7316 fixes.
Added redirect-gateway block-local flag, with support for Linux, Mac OS X
Extended x509-track to allow SHA1 certificate hash to be extracted
Added "management-query-remote" directive (client) to allow the management interface to override the "remote" directive.
Version 2.1.5.
Fixed MSVC compile error related to r7408.
Redact "echo" directive strings from log, since these strings (going forward) could conceivably contain security-sensitive data.
Modified sanitize_control_message to remove redacted data from control string rather than blotting it out with "_" chars.
Changed CC_PRINT character class to allow UTF-8 chars.
Increased the --verb threshold for "PID_ERR replay" messages to 4 from 3.
Fixed issue where redirect-gateway block-local code was not correctly calculating...
CC_PRINT character class now allows any 8-bit character value >= 32.
"status" management interface command (version >= 2) will now include the username for each connected user.
Minor fix to CC_PRINT char class
Fixed management interface bug where >FATAL notifications were not being output properly
Raised D_PID_DEBUG_LOW from level 3 to 4 to reduce replay error verbosity at level 3.
Added "memstats" option to maintain real-time operating stats in a memory-mapped file.
Fixed client issues with DHCP Router option extraction/deletion when using layer 2 with DHCP proxy:
Allow "tap-win32 dynamic <offset>" to be used in topology subnet mode.
Added support for "on-link" routes on Linux client
Jan Just Keijser (1):
Made some options connection-entry specific
Joe Patterson (1):
common_name passing in auth_pam plugin
JuanJo Ciarlante (40):
* rebased openvpn-2.1_rc1b.jjo.20061206.d.patch
* created getaddr6(), use it from resolve_remote()
* migrated all getaddrinfo() to getaddr6
* socket.c: use USE_PF_INET6 in switch constructs to actually toss them out,
* support --disable-ipv6 build properly:
* important fix for tcp6 reconnection was incorrectly creating a PF_INET socket
* added README.ipv6.txt
* fixed win32 non-ipv6 build
* ipv6 on win32 "milestone": 1st snapshot that passes all unittests
* document ipv6 milestone status
* doc update w/unittests results
* make possible to x-compile openvpn/win32 in Linux
* correctly setup hints.ai_socktype for getaddrinfo(), althought sorta hacky, see TODO.ipv6.
* renamed README.ipv6{.txt,}
* updated {README,TODO}.ipv6 from feedback at openvpn-devel mlist
* init.c: document the ENABLE_MANAGEMENT place to work on
* init.c: small in-doc tweaks
* fix multi-tcp crash (corrected assertion)
* TODO.ipv6 update
* socket.c: better buf logic in print_sockaddr_ex
* fixed segfault for undef address family in print_sockaddr_ex (thanks Marcel!)
* doc updates
* openbsd: no IFF_MULTICAST, #ifdef around it
* no new funcionality, just small cleanups
* (prototype) fix for supporting "redirect-gateway" for tunneled ipv4 over ipv6 endpoints
* polished redirect-gateway (ipv4 on ipv6 endpoints) support
* updated doc
* fix --disable-ipv6 build
* doc updates
* rebased to v2.1.1 release
* undo mroute.c changes related to ipv6 payload
* fix --multihome for ipv4
* fix --multihome for ipv6
* ipv6-0.4.14: fix xinetd usage
* ipv6-0.4.15: add --multihome support to xBSD
* ipv6-0.4.15b: rebase over openvpn-testing-master
* ipv6-0.4.16: fix mingw32 build
* make ipv6_payload compile under windowze
USE_PF_INET6 by default for v2.3
fix ipv6 compilation under macosx >= 1070 - v3
Markus Koetter (1):
Add extv3 X509 field support to --x509-username-field
Matthew L. Creech (1):
Fix 2.2.0 build failure when management interface disabled
Matthias Andree (1):
Skip rather than fail test in addressless FreeBSD jails.
Robert Fischer (8):
Update man page with info about --capath
Update man page with info about --connect-timeout
Added info about --show-proxy-settings
Documented --x509-username-field option
Documented --errors-to-stderr option
Documented --push-peer-info option
Update man page with info about --remote-random-hostname
Added man page entry for --management-client
Samuli Seppänen (19):
Add man page entry for --redirect-private
Change all CRLF linefeeds to LF linefeeds
Fix a bug in devcon source code handling
Removed Win2k from supported platforms list in INSTALL and win/openvpn.nsi
Fixed copying of tapinstall.exe to dist/bin when using prebuilt TAP-drivers
Fixed a bug with GUI icon deletion on upgrade from 2.2-RC or earlier
Fix a build-ca issue on Windows
Add new openssl.cnf to easy-rsa/Windows
Updated "easy-rsa" for OpenSSL 1.0.0
Made domake-win builds to use easy-rsa/2.0/openssl-1.0.0.cnf
Fixes to easy-rsa/2.0
Merged TODO.IPv6 with TODO.ipv6 and README.IPv6 with README.ipv6
Fixed a number of fatal build errors on Visual Studio 2008
Fix a Visual Studio 2008 build issue in socket.c
Additional Visual Studio 2008 build fixes to tun.c
Fixed a typo in win32.h that prevented building with Visual Studio
Fixed a regression causing VS2008/Python build failure
Fix a Visual Studio 2008 build error in tun.c
Fix a Visual Studio 2008 build error in options.c
Simon Matter (1):
Fix issues with some older GCC compilers
Stefan Hellermann (2):
plugin.h: update prototype of plugin_call dummy in !ENABLE_PLUGIN case
Fixed typo in plugin.h
chantra (1):
Clarify --tmp-dir option
smos (1):
Change the netsh.exe command from "add" to "set".
2011.12.25 -- Version 2.x-master
James Yonan (1):
Added support for "on-link" routes on Linux client -- these are
routes where the gateway is specified as an interface rather than
an address. This allows redirect-gateway to work on Linux clients
whose connection to the internet is via a point-to-point link
such as PPP.
Note that at the moment, this capability is incompatible with
the "redirect-gateway block-local" directive -- this is because
the block-local directive blocks all traffic from the local LAN
except for the local and gateway addresses. Since a PPP link
is essentially a subnet of two addresses, local and remote (i.e.
gateway), the set of addresses that would be blocked by block-local
is empty. Therefore, the "redirect-gateway block-local" directive
will be ignored on PPP links.
To view the OpenVPN client's current determination of the default
gateway, use this command:
./openvpn --show-gateway
2011.03.24 -- Version 2.2-RC2
Alon Bar-Lev (1):
Windows cross-compile cleanup
David Sommerseth (2):
Open log files as text files on Windows
Clarify default value for the --inactive option.
Gert Doering (1):
Implement IPv6 in TUN mode for Windows TAP driver.
Samuli Seppänen (6):
Added support for prebuilt TAP-drivers. Automated embedding manifests.
Fixes to win/openvpn.nsi
Replaced config-win32.h with win/config.h.in
Updated INSTALL-win32.txt
Fixes to Makefile.am
Clarified --client-config-dir section on the man-page.
Ville Skyttä (1):
Fix line continuation in chkconfig init script description.
2011.02.28 -- Version 2.2-RC
David Sommerseth (3):
Make the --x509-username-field feature an opt-in feature
Fix compiler warning when compiling against OpenSSL 1.0.0
Fix packaging of config-win32.h and service-win32/msvc.mak
James Yonan (1):
Minor addition of logging info before and after execution of Windows net commands.
Matthias Andree (1):
Change variadic macros to C99 style.
Samuli Seppänen (15):
Added ENABLE_PASSWORD_SAVE to config-win32.h
Added a nmake makefile for openvpnserv.exe building
Moved TAP-driver version info to version.m4. Cleaned up win/settings.in.
Added helper functionality to win/wb.py
Added support for viewing config-win32.h paramters to win/show.py
Added comments and made small modifications to win/msvc.mak.in
Added command-line switch to win/build_all.py to skip TAP driver building
Added configure.h and version.m4 variable parsing to win/config.py
Added openvpnserv.exe building to win/build.py
Added comments to win/build_ddk.py
Several modifications to win/make_dist.py to allow building the NSI installer
Copied install-win32/setpath.nsi to win/setpath.nsi
Added first version of NSI installer script to win/openvpn.nsi
Changes to buildsystem patchset
Temporary snprintf-related fix to service-win32/openvpnserv.c
2010.11.25 -- Version 2.2-beta5
Samuli Seppänen (1):
Fixed an issue causing a build failure with MS Visual Studio 2008.
2010.11.18 -- Version 2.2-beta4
David Sommerseth (10):
Clarified --explicit-exit-notify man page entry
Clean-up: Remove pthread and mutex locking code
Clean-up: Remove more dead and inactive code paths
Clean-up: Removing useless code - hash related functions
Use stricter snprintf() formatting in socks_username_password_auth() (v3)
Fix compiler warnings about not used dummy() functions
Fixed potential misinterpretation of boolean logic
Only add some functions when really needed
Removed functions not being used anywhere
Merged add_bypass_address() and add_host_route_if_nonlocal()
Gert Doering (3):
Integrate support for TAP mode on Solaris, written by Kazuyoshi Aizawa <admin2@whiteboard.ne.jp>.
Make "topology subnet" work on Solaris
Improved man page entry for script_type
James Yonan (5):
Fixed initialization bug in route_list_add_default_gateway (Gert Doering).
Implement challenge/response authentication support in client mode
Make base64.h have the same conditional compilation expression as base64.c.
Fixed compiling issues when using --disable-crypto
In verify_callback, the subject var should be freed by OPENSSL_free, not free
Jesse Young (1):
Remove hardcoded path to resolvconf
Lars Hupel (1):
Add HTTP/1.1 Host header
Pierre Bourdon (1):
Adding support for SOCKS plain text authentication
Samuli Seppänen (2):
Added check for variable CONFIGURE_DEFINES into options.c
Added command-line option parser and an unsigned build option to build_all.py
2010.08.21 -- Version 2.2-beta3
* Attempt to fix issue where domake-win build system was not properly
signing drivers and .exe files.
Added win/tap_span.py for building multiple versions of the TAP driver
and tapinstall binaries using different DDK versions to span from Win2K
to Win7 and beyond.
* Community patches
David Sommerseth (2):
Test framework improvment - Do not FAIL if t_client.rc is missing
More t_client.sh updates - exit with SKIP when we want to skip
Gert Doering (4):
Fix compile problems on NetBSD and OpenBSD
Fix <net/if.h> compile time problems on OpenBSD for good
full "VPN client connect" test framework for OpenVPN
Build t_client.sh by configure at run-time.
chantra (1):
Fixes openssl-1.0.0 compilation warning
2010.08.16 -- Version 2.2-beta2
* Windows security issue:
Fixed potential local privilege escalation vulnerability in
Windows service. The Windows service did not properly quote the
executable filename passed to CreateService. A local attacker
with write access to the root directory C:\ could create an
executable that would be run with the same privilege level as
the OpenVPN Windows service. However, since non-Administrative
users normally lack write permission on C:\, this vulnerability
is generally not exploitable except on older versions of Windows
(such as Win2K) where the default permissions on C:\ would allow
any user to create files there.
Credit: Scott Laurie, MWR InfoSecurity
* Added Python-based based alternative build system for Windows using
Visual Studio 2008 (in win directory).
* When aborting in a non-graceful way, try to execute do_close_tun in
init.c prior to daemon exit to ensure that the tun/tap interface is
closed and any added routes are deleted.
* Fixed an issue where AUTH_FAILED was not being properly delivered
to the client when a bad password is given for mid-session reauth,
causing the connection to fail without an error indication.
* Don't advance to the next connection profile on AUTH_FAILED errors.
* Fixed an issue in the Management Interface that could cause
a process hang with 100% CPU utilization in --management-client
mode if the management interface client disconnected at the
point where credentials are queried.
* Fixed an issue where if reneg-sec was set to 0 on the client,
so that the server-side value would take precedence,
the auth_deferred_expire_window function would incorrectly
return a window period of 0 seconds. In this case, the
correct window period should be the handshake window
period.
* Modified ">PASSWORD:Verification Failed" management interface
notification to include a client reason string:
>PASSWORD:Verification Failed: 'AUTH_TYPE' ['REASON_STRING']
* Enable exponential backoff in reliability layer
retransmits.
* Set socket buffers (SO_SNDBUF and SO_RCVBUF) immediately after
socket is created rather than waiting until after connect/listen.
* Management interface performance optimizations:
1. Added env-filter MI command to perform filtering on env vars
passed through as a part of --management-client-auth
2. man_write will now try to aggregate output into larger blocks
(up to 1024 bytes) for more efficient i/o
* Fixed minor issue in Windows TAP driver DEBUG builds
where non-null-terminated unicode strings were being
printed incorrectly.
* Fixed issue on Windows with MSVC compiler, where TCP_NODELAY support
was not being compiled in.
* Proxy improvements:
Improved the ability of http-auth "auto" flag to dynamically detect
the auth method required by the proxy.
Added http-auth "auto-nct" flag to reject weak proxy auth methods.
Added HTTP proxy digest authentication method.
Removed extraneous openvpn_sleep calls from proxy.c.
* Implemented http-proxy-override and http-proxy-fallback directives to make it
easier for OpenVPN client UIs to start a pre-existing client config file with
proxy options, or to adaptively fall back to a proxy connection if a direct
connection fails.
* Implemented a key/value auth channel from client to server.
* Fixed issue where bad creds provided by the management interface
for HTTP Proxy Basic Authentication would go into an infinite
retry-fail loop instead of requerying the management interface for
new creds.
* Added support for MSVC debugging of openvpn.exe in settings.in:
# Build debugging version of openvpn.exe
!define PRODUCT_OPENVPN_DEBUG
* Implemented multi-address DNS expansion on the network field of route
commands.
When only a single IP address is desired from a multi-address DNS
expansion, use the first address rather than a random selection.
* Added --register-dns option for Windows.
Fixed some issues on Windows with --log, subprocess creation
for command execution, and stdout/stderr redirection.
* Fixed an issue where application payload transmissions on the
TLS control channel (such as AUTH_FAILED) that occur during
or immediately after a TLS renegotiation might be dropped.
* Added warning about tls-remote option in man page.
2009.12.11 -- Version 2.1.1
* Fixed some breakage in openvpn.spec (which is required to build an
RPM distribution) where it was referencing a non-existent
subdirectory in the tarball, causing it to fail (patch from
David Sommerseth).
2009.12.11 -- Version 2.1.0
* Fixed a couple issues in sample plugins auth-pam.c and down-root.c.
(1) Fail gracefully rather than segfault if calloc returns NULL.
(2) The openvpn_plugin_abort_v1 function can potentially be called
with handle == NULL. Add code to detect this case, and if so, avoid
dereferencing pointers derived from handle (Thanks to David
Sommerseth for finding this bug).
* Documented "multihome" option in the man page.
2009.11.20 -- Version 2.1_rc22
* Fixed a client-side bug on Windows that occurred when the
"dhcp-pre-release" or "dhcp-renew" options were combined with
"route-gateway dhcp". The release/renew would not occur
because the Windows DHCP renew function is blocking and
therefore must be called from another process or thread
so as not to stall the tunnel.
* Added a hard failure when peer provides a certificate chain
with depth > 16. Previously, a warning was issued.
2009.11.12 -- Version 2.1_rc21
* Rebuilt OpenVPN Windows installer with OpenSSL 0.9.8l to address
CVE-2009-3555. Note that OpenVPN has never relied on the session
renegotiation capabilities that are built into the SSL/TLS protocol,
therefore the fix in OpenSSL 0.9.8l (disable SSL/TLS renegotiation
completely) will not adversely affect OpenVPN mid-session SSL/TLS
renegotation or any other OpenVPN capabilities.
* Added additional session renegotiation hardening. OpenVPN has always
required that mid-session renegotiations build up a new SSL/TLS
session from scratch. While the client certificate common name is
already locked against changes in mid-session TLS renegotiations, we
now extend this locking to the auth-user-pass username as well as all
certificate content in the full client certificate chain.
2009.10.01 -- Version 2.1_rc20
* Fixed a bug introduced in 2.1_rc17 (svn r4436) where using the
redirect-gateway option by itself, without any extra parameters,
would cause the option to be ignored.
* Fixed build problem when ./configure --disable-server is used.
* Fixed ifconfig command for "topology subnet" on FreeBSD (Stefan Bethke).
* Added --remote-random-hostname option.
* Added "load-stats" management interface command to get global server
load statistics.
* Added new ./configure flags:
--disable-def-auth Disable deferred authentication
--disable-pf Disable internal packet filter
* Added "setcon" directive for interoperability with SELinux (Sebastien
Raveau).
* Optimized PUSH_REQUEST handshake sequence to shave several seconds
off of a typical client connection initiation.