aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2017-05-11Prepare v2.3.15 releasev2.3.15David Sommerseth
Signed-off-by: David Sommerseth <davids@openvpn.net>
2017-05-11Don't assert out on receiving too-large control packets (CVE-2017-7478)Steffan Karger
Commit 358f513c changed the maximum size of accepted control channel packets. This was needed for crypto negotiation (which is needed for a nice transition to a new default cipher), but exposed a DoS vulnerability. The vulnerability was found during the OpenVPN 2.4 code audit by Quarkslab (commisioned by OSTIF). To fix the issue, we should not ASSERT() on external input (in this case the received packet size), but instead gracefully error out and drop the invalid packet. CVE: 2017-7478 Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <1494493257-8125-1-git-send-email-steffan.karger@fox-it.com> URL: http://www.mail-archive.com/search?l=mid&q=1494493257-8125-1-git-send-email-steffan.karger@fox-it.com Signed-off-by: David Sommerseth <davids@openvpn.net>
2017-05-11Drop packets instead of assert out if packet id rolls over (CVE-2017-7479)Steffan Karger
Previously, if a mode was selected where packet ids are not allowed to roll over, but renegotiation does not succeed for some reason (e.g. no password entered in time, certificate expired or a malicious peer that refuses the renegotiaion on purpose) we would continue to use the old keys. Until the packet ID would roll over and we would ASSERT() out. Given that this can be triggered on purpose by an authenticated peer, this is a fix for an authenticated remote DoS vulnerability. An attack is rather inefficient though; a peer would need to get us to send 2^32 packets (min-size packet is IP+UDP+OPCODE+PID+TAG (no payload), results in (20+8+1+4+16)*2^32 bytes, or approx. 196 GB). This is a fix for finding 5.2 from the OSTIF / Quarkslab audit. CVE: 2017-7479 Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <1494358209-4568-1-git-send-email-steffan.karger@fox-it.com> URL: http://www.mail-archive.com/search?l=mid&q=1494358209-4568-1-git-send-email-steffan.karger@fox-it.com Signed-off-by: David Sommerseth <davids@openvpn.net>
2017-05-11Introduce and use secure_memzero() to erase secretsSteffan Karger
This is a cherry-pick of commit 009521ac (master). As described in trac #751, and shortly after reported by Zhaomo Yang, of the University of California, San Diego, we use memset() (often through the CLEAR() macro) to erase secrets after use. In some cases however, the compiler might optimize these calls away. This patch replaces these memset() calls on secrets by calls to a new secure_memzero() function, that will not be optimized away. Since we use CLEAR() a LOT of times, I'm not changing that to use secure_memzero() to prevent performance impact. I did annotate the macro to point people at secure_memzero(). This patch also replaces some CLEAR() or memset() calls with a zero- initialization using "= { 0 }" if that has the same effect. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <1494449775-22199-1-git-send-email-steffan@karger.me> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14628.html Signed-off-by: David Sommerseth <davids@openvpn.net>
2017-05-11Document that OpenVPN 2.3 does not check the CRL signatureSteffan Karger
Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <1494445844-8327-1-git-send-email-steffan@karger.me> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14626.html Signed-off-by: David Sommerseth <davids@openvpn.net>
2017-05-09cleanup: merge packet_id_alloc_outgoing() into packet_id_write()Steffan Karger
The functions packet_id_alloc_outgoing() and packet_id_write() were always called in tandem. Instead of forcing the caller to allocate a packet_id_net to do so, merge the two functions. This simplifies the API and reduces the chance on mistakes in the future. This patch adds unit tests to verify the behaviour of packet_id_write(). Verifying that we assert out correctly required the change to mock_msg.c. This patch was cherry-picked from a87e1431 (master). Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <1494357036-3529-1-git-send-email-steffan.karger@fox-it.com> URL: http://www.mail-archive.com/search?l=mid&q=1494357036-3529-1-git-send-email-steffan.karger@fox-it.com Signed-off-by: David Sommerseth <davids@openvpn.net>
2017-05-09Add missing includes in error.hSteffan Karger
error.h depends on these, but is apparently never used by files that do not include them. Cherry-picked from b7e51b13 (master). Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <1494355962-21545-1-git-send-email-steffan.karger@fox-it.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14612.html Signed-off-by: David Sommerseth <davids@openvpn.net>
2017-04-11Make --cipher/--auth none more explicit on the risksDavid Sommerseth
The warning provided to --cipher and --auth using the 'none' setting may not have been too clearly understandable to non-developers or people not fully understanding encryption and cryptography. This tries to improve that. While at it, also break up the long source lines. Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20170410222828.23612-1-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14436.html Signed-off-by: David Sommerseth <davids@openvpn.net> (cherry picked from commit 7a1b6a0dd706a81897457b0456a951c0b30bbcfb)
2017-03-20Document --proto udp6, tcp6, etc.Gert Doering
Trac #793 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20170319193451.24289-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14283.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-01-23git: Merge .gitignore files into a single fileDavid Sommerseth
We already track a lot of files over the whole directory structure in the main .gitignore file. But a few additional ones had been added into some of the subdirectories. This unifies all these files into a master file for the whole project, making it easier to know where to look at and edit if changes needs to be done. Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Steffan Karger <steffan@karger.me> Message-Id: <20170120210457.3383-1-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg13916.html Signed-off-by: David Sommerseth <davids@openvpn.net> (cherry picked from commit d14b3c60c7796736e07bc3cddb0ab3a58475793e)
2017-01-04Fix implicit declarations when HAVE_OPENSSL_ENGINE is unsetJulien Muchembled
This fixes a regression in commit 8e95e20913: on amd64, an implicit declaration of ERR_error_string leads to segfaults if the returned pointer does not fit in an 'int'. Trac: #792 Signed-off-by: Julien Muchembled <jm@nexedi.com> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20161216163218.25449-1-jm@nexedi.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg13591.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2016-12-23docs: Further improve --reneg-bytes and SWEET32 informationDavid Sommerseth
There are still some support tickets related to SWEET32 and our defult enforced --reneg-bytes 64 when using weaker ciphers (less than 128-bits cipher blocks). Try to clarify this even more. Also fix a few mistakes, saying less than 128-bits and not 128-bits and less. Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Steffan Karger <steffan@karger.me> Message-Id: <1482353691-27088-2-git-send-email-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg13662.html
2016-12-21Update copyrightsDavid Sommerseth
Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Steffan Karger <steffan@karger.me> Message-Id: <1482350454-27280-3-git-send-email-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg13656.html
2016-12-21dev-tools: Added script for updating copyright years in filesDavid Sommerseth
Very simple tool which modifies the Copyright lines in all git checked-in files with an updated year. Lines only listing a single year (2016) will be modified to list a range instead. Only the Copyright lines owners of specific owners will be modified. The script will need to be slightly updated to cover more owners. See the UPDATE_COPYRIGHT_LINES line in the script for the currently set owners. v2 - On-the-fly-commit-update: use vendor/ instead of cmocka and add @sophos.com to the list of copyright holders to update Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Steffan Karger <steffan@karger.me> Message-Id: <1482173532-25132-1-git-send-email-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg13645.html (cherry picked from commit da8f11f895bb78174d4412d82a6992c398da495a)
2016-12-06Preparing release of v2.3.14v2.3.14Gert Doering
Signed-off-by: Gert Doering <gert@greenie.muc.de>
2016-12-06Correctly state the default dhcp server address in man pageSelva Nair
Also correct the default ifconfig-pool end in docs and comments Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1480707729-19578-1-git-send-email-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg13387.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 251cc8f2042cc0cb8281230f7fb33f2cdec5b809)
2016-11-30Map restart signals from event loop to SIGTERM during exit-notification waitSelva Nair
Commit 63b3e000c9.. fixed SIGTERM getting lost during exit notification by ignoring any restart signals triggered during this interval. However, as reported in Trac 777, this could result in repeated triggering of restart signals when the event loop cannot continue without restart due to IO errors or timeout. Avoid by converting soft SIGUSR1 and SIGHUP signals received during exit-notify wait period to SIGTERM. cherry-picked from commit f25a0217e35f53c3110ebb226e1d1f3528152cb5 with (c->sig->source == SIG_SOURCE_HARD) changed to c->sig->hard Trac: #777 Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1480470535-6287-1-git-send-email-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg13310.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2016-11-30When parsing '--setenv opt xx ..' make sure a third parameter is presentSelva Nair
When no parameters are present, set it to "setenv opt" to trigger a descriptive error message. And, thus get rid of the pesky NULL pointer dereferencing. Trac: #779 Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1480470794-6349-1-git-send-email-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg13311.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 997795353916ffcb413a2da02dc7f210fd621954)
2016-11-28update year in copyright messageChristian Hesse
This line has not been touched in a long time... Let's update the copyright message with recent year. Signed-off-by: Christian Hesse <mail@eworm.de> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20161128170820.20371-1-list@eworm.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg13270.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 7f7d6b2eb0f69f0e8952028488d7aa02619ad76f)
2016-11-28Clean up format_hex_ex()Steffan Karger
Cherry-pick of commit 29404010 from master, slightly reworked to match the 2.3 codebase (no flags inside space_break here), and pulled in the new static_assert() fallback we also have in master now. Fix a potential null-pointer dereference, and make the code a bit more readable while doing so. The NULL dereference could not be triggered, because the current code never called format_hex_ex() with maxouput == 0 and separator == NULL. But it's nicer to not depend on that. Our use of int vs size_t for lengths needs some attention too, but I'm not pulling that into this patch. Instead I decided to just make the (previously existing) assumption that INT_MAX <= SIZE_MAX explicit by adding a static_assert(). Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1480352107-19652-1-git-send-email-steffan.karger@fox-it.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg13269.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2016-11-23Document the --auth-token optionDavid Sommerseth
This isn't an option to be used directly in any configuration files, but to be used via --client-connect scripts or --plugin making use of OPENVPN_PLUGIN_CLIENT_CONNECT or OPENVPN_PLUGIN_CLIENT_CONNECT_V2. [v2 - Added lacking .B styling of options - Clarified the token life time ] Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1474118415-14666-1-git-send-email-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg12506.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit f8a367f7c51af5482013fa3d783cade376b047ed)
2016-11-13Support --block-outside-dns on multiple tunnelsSelva Nair
v2: Simplified "add sublayer" code Currently each instance of openvpn adds WFP filters into an independent sublayer. As a block in one sublayer can over-ride a permit in another, this causes all DNS traffic to block when --block-outside-dns is used in multiple tunnels. Fix using a common sublayer for adding firewall rules (filters) from all instances of openvpn and interactive service. - The sublayer is added in a persistent session so that it could be accessed from multiple sessions. - The sublayer is identified by a fixed UUID defined in block_dns.c - Permit filters for tun/tap interfaces are added with explicitly higher priority than filters that block all DNS traffic. This is not strictly necessary as WFP assigns higher priority to specific filters over generic ones, but it may be safer not to rely on that feature. - All filters are added in dynamic sessions as before. They get automatically removed when the process exits. The sublayer will, however, persist until reboot. Resolves Trac 718 - While at it also make sure the WFP session is closed on error in win_wfp_block_dns(). - Also fix the function prototype typedefs in win32_wfp.h for run-time-resolved fwpm functions Tested on Windows 7, 10 Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1474085439-28766-2-git-send-email-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg12466.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2016-11-11Repair topology subnet on OpenBSDGert Doering
Turns out that "topology subnet" never worked totally right on OpenBSD - the "netmask" parameter to ifconfig is ignored, and one needs to add a subnet route (and this issue is hidden if an encompassing route is pushed, like, by using --redirect-gateway). While add it, apply the hack used for FreeBSD where "an arbitrary address from the subnet" is used to set the "remote" end of the tunnel, and point the route to that - so if OpenBSD decides to change their kernel routing structure the same way, our code still works (copying from commit 433b3813d8c38b4, trac #425 and commit 60fd44e501f2002, trac #481). Tested on OpenBSD 6.0 and 4.9 Trac: #710 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <20161109201932.80991-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg12983.html Signed-off-by: David Sommerseth <davids@openvpn.net> (cherry picked from commit 7f444dee52321c0f0294e99695150a7f69522715)
2016-11-09Repair topology subnet on FreeBSD 11Gert Doering
We used to add "route for this subnet" by using our own address as the gateway address, which used to mean "connected to the interface, no gateway". FreeBSD commit 293159 changed the kernel side of that assumption so "my address" is now always bound to "lo0" - thus, our subnet route also ended up pointing to "lo0", breaking connectivity for all hosts in the subnet except the one we used as "remote". commit 60fd44e501f200 already introduced a "remote address" we use for the "ifconfig tunX <us> <remote>" part - extend that to be used as gateway address for the "tunX subnet" as well, and things will work more robustly. Tested on FreeBSD 11.0-RELEASE and 7.4-RELEASE (client and server) (this particular issue is not present before 11.0, but "adding the subnet route" never worked right, not even in 7.4 - 11.0 just made the problem manifest more clearly) Trac #425 URL: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=207831 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20161108124506.32559-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg12950.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit a433b3813d8c38b491d2baa7b433973f2d6cd7c6)
2016-11-04Drop recursively routed packetsLev Stipakov
v4: - Account for IP header offset in TAP mode - Correct handle of non-IP protocols in TAP mode v3: Use better way of figuring out IP proto version which does not break TAP mode. Add an option to allow recursive routing, could be useful when packets sent by openvpn itself are not subject to the routing tables that would move packets into the tunnel. v2: better method naming On certain OSes (Windows, OS X) when network adapter is disabled (ethernet cable pulled off, Wi-Fi hardware switch disabled), operating system starts to use tun as an external interface. Outgoing packets are routed to tun, UDP encapsulated, given to routing table and sent to.. tun. As a consequence, system starts talking to itself on full power, traffic counters skyrocket and user is not happy. To prevent that, drop packets which have gateway IP as destination address. Tested on Win7/10, OS X, Linux. Trac #642 Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1478208503-25929-1-git-send-email-lstipakov@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg12894.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit e8c42658ff8df10ad56659788a73900648b9d92d)
2016-11-02Preparing release of v2.3.13v2.3.13David Sommerseth
Signed-off-by: David Sommerseth <davids@openvpn.net>
2016-11-01man: Improve the --keepalive sectionDavid Sommerseth
Just minor clarifications and corrections of the --keepalive option. v2 - Changed from ps/pto to interval/timeout - Rephrased the server-side timeout doubling parapgraph Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1478007489-17163-1-git-send-email-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg12866.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit beaa6564a7ce3e48473a8bde7b4f9291df490d62)
2016-10-28Add a revoked cert to the sample keysSteffan Karger
Allows for easier testing of the revocation functionality. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1477510159-5067-1-git-send-email-steffan@karger.me> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg12784.html Signed-off-by: David Sommerseth <davids@openvpn.net> (cherry picked from commit a64d76e246042fde40189033b87b126627db5b6b)
2016-10-28Limit --reneg-bytes to 64MB when using small block ciphersSteffan Karger
Following the earlier warning about small block ciphers, now limit the --reneg-bytes value when using a cipher that susceptible to SWEET32-like attacks. The 64 MB value has been selected with the researchers who published the SWEET32 paper. Note that this will not change a user-set --reneg-bytes value, to allow a user to align a gun with his feet^w^w^w^w^w^w override this behaviour if really needed. Furthermore, in contrast with the patch for master, this will not limit --reneg-bytes on the client side. This allows server administrators to revert to the old behaviour, or increase --reneg-bytes to something they believe is workable, without having to change client configs. (The master branch provides cipher negotiation as a real solution, so we can be stricter there.) v2: obey user-set --reneg-bytes 0 to revert to old behaviour, use more firm language in warning message, add URL to man page, and only limit at the server side. Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <1477656607-7440-1-git-send-email-steffan.karger@fox-it.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg12799.html Signed-off-by: David Sommerseth <davids@openvpn.net>
2016-10-10Fix compilation in pedantic modeLev Stipakov
Replace C++ style comments, which are not allowed in ISO C90 standard, with C style comments Signed-off-by: Lev Stipakov <lstipakov@gmail.com> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1475613736-1529-1-git-send-email-lstipakov@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg12600.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2016-10-10Exclude peer-id from pulled options digestLev Stipakov
v2: - Use md5_* methods - Move digest update to separate method Peer-id might change on restart and this should not trigger reopening tun. Trac #649 Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1475610786-25781-1-git-send-email-lstipakov@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg12598.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2016-10-09Fix --multihome for IPv6 on 64bit BSD systems.Gert Doering
The old code only worked if "struct openvpn*pktinfo" happened to use the same structure packing as the CMSG_SPACE() / CMSG_LEN() macros (which are part of the official API, see RFC 2292). Get rid of "struct openvpn_*_pktinfo" definitions, replace them by an opaque buffer sized large enough to fit IPv4 and IPv6 packet info messages, as defined by CMSG_SPACE(sizeof(struct ...)). On 32 bit platforms, the net result is the same. On 64 bit platforms, the new buffer is bigger than openvpn_pktinfo was, fixing an overflow with ipi6_ifindex corruption on reception, and EINVAL on sendmsg(). The IPv4 related changes are only side effects of using the new buffer. Fixes: FreeBSD 10.3/amd64, FreeBSD 9.3/sparc64, OpenBSD 6.0/amd64, NetBSD 7.0.1/i386. Note: --multihome for IPv4 on NetBSD is still broken and non-fixable(!) as NetBSD lacks the necessary kernel code for the sendmsg() side. Verified that "--multihome works as well as before" on FreeBSD 7.4/amd64, NetBSD 5.1/amd64, OpenBSD 4.9/i386, Linux/x86_64, Linux/i386, OpenSolaris 10 (--multihome needs -D_XPG4_2, see trac #750) See also: ip(4), ip6(4), recv(2) Trac #634, #327, #28 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20161009100929.46472-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg12626.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 3fb246e38fc670c7dfff8ce4521c75c95c766c9e)
2016-10-04add POSTINIT_CMD_suf to t_client.sh and sample configGert Doering
We have pre-init and cleanup commands, but some test cases might need or want to run a shell script after openvpn has initialized, but before executing any tests (ifconfig comparison and ping). Example: POSTINIT_CMD_4="sleep 5" on MacOS X for tap tests (IPv6 DAD) Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20161004113854.42470-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg12594.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit bae1ad7005fd9a1fadeed56370a9ac5422a33fee)
2016-10-04t_client.sh: Add prepare/cleanup possibilties for each test caseDavid Sommerseth
By adding PREPARE_$NUM and CLEANUP_$NUM variables containing command lines to execute before and after the test case is run. Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1384615074-22345-1-git-send-email-dazo@users.sourceforge.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/7990 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 8fedf86abaf8fca8d0e9e81f70d7a5888a98b9ee)
2016-10-04Update cipher-related man page textSteffan Karger
As reported in trac #732, the man page text for --cipher is no longer accurate. Update the text to represent current knowledge, about NCP and SWEET32. This does not hint at changing the default cipher, because we did not make a decision on that yet. If we do change the default cipher, we'll have to update the text to reflect that. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1473605477-20908-1-git-send-email-steffan@karger.me> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg12440.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2016-10-04make t_client robust against sudoers misconfigurationGert Doering
Instead of testing (and priming) sudo with "true", prime with "kill -0 $$" (just test signalling ourselves). If this fails, we won't be able to kill the openvpn process we're going to start later on -> thus, SKIP on failure. This helps with misconfigured setups (especially on the buildbots) that can correctly start openvpn but then not stop it later on - leaving openvpn processes dangling around, requiring manual intervention. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20161002131923.36681-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg12585.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 8ca29af7c6d4759ce019ec9d0cd3eae4511a6804)
2016-10-04Automatically cache expected IPs for t_client.sh on the first runSamuli Seppänen
Previously one had to manually define correct values for the EXPECT_IFCONFIG* variables based on what IPv4 and IPv6 addresses the test VPN server handed out. This was a tedious process especially with large number of tests, as the IPs changed for every test client and for every test. With this patch t_client.sh figures out the correct IP addresses using an --up script and caches them to a separate file for later use. Signed-off-by: Samuli Seppänen <samuli@openvpn.net> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1475491887-740-1-git-send-email-samuli@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg12587.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit df0b00c253e41cce9567be79dbd3faa14c60473b)
2016-09-20Fix t_client runs on OpenSolarisGert Doering
"grep -q" is not portable to non-GNU grep. Replace with ">/dev/null". Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: 20160920091914.37585-1-gert@greenie.muc.de URL: http://www.mail-archive.com/search?l=mid&q=20160920091914.37585-1-gert@greenie.muc.de Signed-off-by: David Sommerseth <davids@openvpn.net> (cherry picked from commit 38f98fdccd3eb6995b972fabb0ce4e00d3e3cb76)
2016-09-18Incorporate the Debian typo fixes where appropriate and make show_opt ↵Arne Schwabe
default message clearer Debian also incorrectly changes that the default for route parameters can be specified by using "nil" instead of "default. The confusion is probably coming from show_opt printing "nil" instead of "default". Change show_opt to show "default (not set)" instead of "nil" Original author: Alberto Gonzalez Iniesta <agi@inittab.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1468495519-25102-1-git-send-email-arne@rfc2549.org> URL: http://www.mail-archive.com/search?l=mid&q=1468495519-25102-1-git-send-email-arne@rfc2549.org Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit c42fcbfe708f4c97da063642cf8874f0d4d1a645)
2016-09-17t_client.sh: Improve detection if the OpenVPN process did start during testsDavid Sommerseth
This will check the OpenVPN log file if the process initialized successfully. It will check the log file for 30 seconds before aborting the test run. This also has the advantage of starting the testing quicker if the initialization goes faster than 10 seconds (which was the old sleep time). The umask is also set to a more permissive mode to ensure the test script is capable of reading the OpenVPN PID file, as that will be created by root. Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1474111085-10678-1-git-send-email-davids@openvpn.net> URL: http://www.mail-archive.com/search?l=mid&q=1474111085-10678-1-git-send-email-davids@openvpn.net Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 3712322ee1219e55640f2f4e5f822799edacd7cc)
2016-09-17t_client.sh: Add support for Kerberos/ksuDavid Sommerseth
If the t_client.rc have PREFER_KSU=1 configured, t_client.sh will check if you have a valid Kerberos ticket and if so it will do all execution via ksu instead of sudo. If PREFER_KSU is not set or a Kerberos ticket is not found, it will fallback to the configured RUN_SUDO approach. When using ksu it needs the full path to the program being executed, so there is also additional code to find the full path of true and kill. [ v2 - Remove $* from RUN_SUDO for ksu config. Old cruft which survived last review before patch submission. - Improve known state declaration of PREFER_KSU ] [ v3 - Kick out bashism - '&>' redirect ] This commit also includes commits f0892e6590cb247ef1012b0fe89f80eee2d56cc4 and f40f10ea9607934faeb2b8cd84aefff0e0790189 (via merge conflicts) Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1474109433-4710-1-git-send-email-davids@openvpn.net> URL: http://www.mail-archive.com/search?l=mid&q=1474109433-4710-1-git-send-email-davids@openvpn.net Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 6b25b99fe4b8bdf5cdba4a0fb247df40277d0525)
2016-09-17skip t_lpback.sh and t_cltsrv.sh if openvpn configured --disable-cryptoIlya Shipitsin
Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1474104789-31735-1-git-send-email-chipitsine@gmail.com> URL: http://www.mail-archive.com/search?l=mid&q=1474104789-31735-1-git-send-email-chipitsine@gmail.com Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit a85ba0e06badf9932e80deb53b68f50611943c6e)
2016-09-17t_client.sh: Make OpenVPN write PID file to avoid various sudo issuesDavid Sommerseth
This resolves an issue where $! returns the PID of the sudo process instead of the PID of OpenVPN and when sudo does not properly propagate signales down to OpenVPN. Trac: #738 Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1474104026-20615-1-git-send-email-davids@openvpn.net> URL: http://www.mail-archive.com/search?l=mid&q=1474104026-20615-1-git-send-email-davids@openvpn.net Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit e0926ebfe55347843af701216be9598827a1367a)
2016-09-16cleanup: remove code duplication in msg_test()Steffan Karger
Use check_debug_level() instead of writing out the exact same check in msg_test(). Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: 1472757207-17900-1-git-send-email-steffan@karger.me URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg00192.html Signed-off-by: David Sommerseth <davids@openvpn.net> (cherry picked from commit d7ce876841d1d5b01940251f92780fdbb05b4df0)
2016-09-16Make gnu89 support explicitSteffan Karger
In the release/2.3 branch we support gnu89, basically to keep pre-2015 MSVC happy. Old gcc (<5) defaulted to gnu89. But gcc 5+ and clang default to gnu11/c11. This patch makes our gnu89 support explicit, such these newer compilers will also point out gnu89 violations to developers. v2: only set -std=gnu89 if no -std flag is present in $CFLAGS Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: 1474040436-9855-1-git-send-email-steffan@karger.me URL: http://www.mail-archive.com/search?l=mid&q=1474040436-9855-1-git-send-email-steffan@karger.me Signed-off-by: David Sommerseth <davids@openvpn.net>
2016-09-16Do not abort t_client run if OpenVPN instance does not start.Gert Doering
Basically, an oversight - if one test instance does not start at all (due to "tap driver not loaded") the whole script would exit, instead of logging the failing instance and proceeding to the next test run. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: 20160913200458.9906-1-gert@greenie.muc.de URL: http://www.mail-archive.com/search?l=mid&q=20160913200458.9906-1-gert@greenie.muc.de Signed-off-by: David Sommerseth <davids@openvpn.net> (cherry picked from commit a7b02f7f660707f765881f35867b4d23d89b390f)
2016-08-25Use AES ciphers in our sample configuration files and add a few modern 2.4 ↵Arne Schwabe
examples Acked-by: Steffan Karger <steffan@karger.me> Message-Id: 1468314848-11820-1-git-send-email-arne@rfc2549.org URL: http://www.mail-archive.com/search?l=mid&q=1468314848-11820-1-git-send-email-arne@rfc2549.org Signed-off-by: David Sommerseth <davids@openvpn.net> (cherry picked from commit 6d036ebc221d933c0751107cea9efe4692c9d559)
2016-08-25Fix unittests for out-of-source buildsSteffan Karger
Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Matthias Andree <matthias.andree@gmx.de> Message-Id: 1471284156-2324-1-git-send-email-steffan@karger.me URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg00027.html Signed-off-by: David Sommerseth <davids@openvpn.net> (cherry picked from commit ee4f37c3533667aee87fd39ba131e80f3c1cfde7)
2016-08-23Preparing release of v2.3.12v2.3.12David Sommerseth
Signed-off-by: David Sommerseth <davids@openvpn.net>
2016-08-23Revert "Drop recursively routed packets"David Sommerseth
Need to revert this patch as it breaks TAP interfaces. This reverts commit 122469f5ad30b563cbefbc753d2a55af4227bb74. Signed-off-by: David Sommerseth <davids@openvpn.net>
generated by cgit v1.1 at 2024-10-06 12:26:34 +0000