aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2024-03-21Preparing release 2.5.10v2.5.10Gert Doering
version.m4, ChangeLog, Changes.rst Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-03-20interactive.c: Fix potential stack overflow issueLev Stipakov
When reading message from the pipe, we first peek the pipe to get the size of the message waiting to be read and then read the message. A compromised OpenVPN process could send an excessively large message, which would result in a stack-allocated message buffer overflow. To address this, we terminate the misbehaving process if the peeked message size exceeds the maximum allowable size. This commit is backported from 9b2693f in release/2.6 branch, fixing merge conflicts around &ring_buffer_handles and wins_cfg_message_t. CVE: 2024-27459 Microsoft case number: 85932 Reported-by: Vladimir Tokarev <vtokarev@microsoft.com> Change-Id: Ib5743cba0741ea11f9ee62c4978b2c6789b81ada Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Heiko Hund <heiko@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20240320082000.284-2-lev@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28433.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-03-19interactive.c: disable remote access to the service pipeLev Stipakov
Remote access to the service pipe is not needed and might be a potential attack vector. For example, if an attacker manages to get credentials for a user which is the member of "OpenVPN Administrators" group on a victim machine, an attacker might be able to communicate with the privileged interactive service on a victim machine and start openvpn processes remotely. CVE: 2024-24974 Microsoft case number: 85925 Reported-by: Vladimir Tokarev <vtokarev@microsoft.com> Change-Id: I8739c5f127e9ca0683fcdbd099dba9896ae46277 Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Heiko Hund <heiko@openvpn.net> Message-Id: <20240319151723.936-2-lev@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28419.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 2c1de0f0803360c0a6408f754066bd3a6fb28237)
2024-03-19win32: Enforce loading of plugins from a trusted directoryLev Stipakov
Currently, there's a risk associated with allowing plugins to be loaded from any location. This update ensures plugins are only loaded from a trusted directory, which is either: - HKLM\SOFTWARE\OpenVPN\plugin_dir (or if the key is missing, then HKLM\SOFTWARE\OpenVPN, which is installation directory) - System directory Loading from UNC paths is disallowed. Note: This change affects only Windows environments. CVE: 2024-27903 Change-Id: I154a4aaad9242c9253a64312a14c5fd2ea95f40d Reported-by: Vladimir Tokarev <vtokarev@microsoft.com> Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Selva Nair <selva.nair@gmail.com> Message-Id: <20240319135355.1279-2-lev@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28416.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit aaea545d8a940f761898d736b68bcb067d503b1d)
2023-07-17fix typo: dhcp-options to dhcp-option in vpn-network-options.rstGeorge Pchelkin
Closes: OpenVPN/openvpn#313 Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20230714092557.229260-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26855.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 9d2e947e7358c7998f13b142d8bf17a2ce9eb7a3)
2023-05-03Add Apache2 linking with for new commitsArne Schwabe
After first round of mailing people with more than 10 commits we have almost all committers have agreed. This put this license in the realm of having a realistic change to work. Had any of these contributers disagreed, rewriting all their code might have been not feasible. The rationale of adding this exception now is to avoid having to have a second round of agreement for new contributers and ensure that all new code will include the exemption. patch v2: add explaination and use exception rather than excemption patch v3: actually send v3 Change-Id: Ide83f914f383b53ef37ddf628e4da5a78e241bf0 Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <20230426094931.1168078-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26610.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 7b21c69dbe1e1ecfb5bed564417387892b42108a)
2023-02-14Preparing release 2.5.9v2.5.9Gert Doering
version.m4, ChangeLog, Changes.rst Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-12-19Do not include auth-token in pulled option digestSelva Nair
As change in auth-token is common on restart and does not require tun-reopen, exclude it from the "pulled options digest" calculation. Without this tun is always re-opened on SIGUSR1 if auth-token is in use which breaks persist-tun. Github: Fixes OpenVPN/openvpn#200 v2: explcitly filter auth-token and auth-token-user Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20221219140405.1221341-1-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25768.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit f778f4f88e56851c0a68205e95110c021f3032b3)
2022-12-19git-version.py: proper support for tagsLev Stipakov
Git magic to get branch name git rev-parse --symbolic-full-name HEAD doesn't work when we're on tag, which is the case when we build releases. First, try to get tag name with git describe --exact-match and if this fails, get branch name as before. Use subprocess.Popen() to suppress stdout/stderr output. Github: Fixes OpenVPN/openvpn#199 Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20221219155638.497-1-lstipakov@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25773.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 91ab3d022e2652a46e6d6f25ab62f7c903e583c1)
2022-12-16Fix corner case that might lead to leaked file descriptorArne Schwabe
Reported-By: Trail of Bits Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20221215190143.2107896-8-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25730.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit a034dc8153522713c3cfda90b2cda114cea70e2d)
2022-12-16Remove unused gc_arenaArne Schwabe
Reported-By: Trail of Bits Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20221215190143.2107896-7-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25736.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 97929d16a4eb05cb521a469ff4eaca32761699f3)
2022-12-16Improve documentation on user/password requirement and unicodize functionArne Schwabe
Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20221215190143.2107896-5-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25733.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 4b6854881c36e16054878e0467ef87d925e20cae)
2022-12-16Ensure that argument to parse_line has always space for final sentinelArne Schwabe
This fixes two places were we do not have enough space in the array of parameters given to parse_line for the final NULL parameter that signal the end of the parsed argument errors. Both these cases can lead to a buffer overflow. But both of these cases require root/admin access to OpenVPN: - parse_argv, only able to trigger if starting openvpn from the command line, at this point you cannot gain more privileges than you already have. Way to reproduce, compile with ASAN and run: openvpn --tls-verify a a a a a a a a a a a a a a a - remove_iroutes_from_push_route_list This operates on the list of pushed entries that is generated by the server itself. So trigger this, you need to have control over config, management interface, a plugin or cdd files. The parse_argv problem was found by Trial of Bits. I found the remove_iroutes_from_push_route_list problem by looking for similar problems. Reported-By: Trial of Bits (TOB-OVPN-4) Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20221215190143.2107896-4-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25734.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 749beb6d0cb9f8628997bb656ba2f64e31cac377)
2022-11-30pull-filter: ignore leading "spaces" in option namesSelva Nair
It seems sometimes comma-separated pulled options have an offending leading space. Not sure whether that is an error, but the change here matches the behaviour of option parsing. v2: fix typo in commit message v3: space() --> isspace() Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20221130105502.662374-1-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25582.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit f02946ff9900a37dd36f61748173d53eca01adf9)
2022-11-30Do not add leading space to pushed optionsSelva Nair
This makes auth-token push during reneg consistent with regular PUSH_REPLY. Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20221130105609.662402-1-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25583.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit d0672e7a06437c730e27df645b9b9a5407b44ccf)
2022-11-23Check if pkcs11_cert is NULL before freeing itMax Fillinger
When running openvpn --show-tls with mbedtls, it showed a null pointer error at the end because of this. Signed-off-by: Max Fillinger <maximilian.fillinger@foxcrypto.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20221123154912.28394-1-maximilian.fillinger@foxcrypto.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25530.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 19c64f16baebbce966d55c62135d1ef066f7c8c2)
2022-11-11Fix handling an optional invalid cipher at the end of data-ciphersArne Schwabe
If an optional cipher was found at the end of --data-cipher that was not available, it would reset the error and allow non optional ciphers to be ignored. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20211206150852.3142891-1-arne@rfc2549.org> URL: https://www.mail-archive.com/search?l=mid&q=20211206150852.3142891-1-arne@rfc2549.org Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 868433857fbf8d71515ac0ffecb98eae893515dc)
2022-11-11Implement optional cipher in --data-ciphers prefixed with ?Arne Schwabe
This allows to use the same configuration multiple platforms/ssl libraries and include optional algorithms that are not available on all platforms For example "AES-256-GCM:AES-128-GCM:?CHACHA20-POLY1305" can be used to emulate the default behaviour of OpenVPN 2.6. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20211201180727.2496903-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23279.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 766044507497c41f0319159c37992788ecb681e6)
2022-11-11msvc: always call git-version.pyFrank Lichtenheld
There is no way to detect whether this information is outdated in nmake itself. So leave it up to the Python script to decide. While here, change some leading whitespace to tabs as expected in Makefile. Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Lev Stipakov <lstipakov@gmail.com> Message-Id: <20221111121212.25167-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25508.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 3951ed8479c01e79bd8fae5c7d4b5f6b07d1f0fb)
2022-10-28Preparing release 2.5.8v2.5.8Gert Doering
version.m4, ChangeLog, Changes.rst Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-10-28Do not copy auth_token username to itselfSelva Nair
- Fixes a potential mis-behaviour (strncpy with dest == src) introduced by commits ecad4839c (2.6) and 3d792ae955 (2.5). Reported by: Gert Doering <gert@greenie.muc.de> Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20221027160619.11894-1-selva.nair@gmail.com> URL: https://www.mail-archive.com/search?l=mid&q=20221027160619.11894-1-selva.nair@gmail.com Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit dbf142ffe597b21aa09a47677ea2061b74a9354e)
2022-10-27Purge auth-token as well while purging passwordsSelva Nair
Starting from commit e61b401a auth-token is saved in a separate struct from auth-user-pass and is not cleared when ssl_purge_auth() is called. This makes "forget-passwords" sent to the management interface or "--management-forget-disconnect" option not to work as expected. Purging caused by --auth-nocache is not affected (auth-token is retained in that case as it should be). Use case: For Pre-Logon access and persistent connections on Windows, use of "forget-passwords" before disconnect is probably the only way to ensure that no credentials are left behind. Note that openvpn.exe continues to run after disconnect in these cases. Also, the original intent of "forget-passwords" appears to be to clear all "passwords" that can be used to reconnect. v2: - call ssl_clean_auth_token() directly from manage.c instead of amending ssl_purge_auth() - Add a comment that ssl_purge_auth() does not clear auth-token Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20221026185543.5378-1-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25460.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit ecad4839caf4c2fab9c6627ceeca9b9cb32e8929)
2022-10-26Ensure --auth-nocache is handled during renegotiationSelva Nair
Currently, clearing auth_user_pass struct is delayed until push-reply processing to support auth-token. This results in username/password not purged after renegotiations that may not accompany any pushed tokens -- say, when auth-token is not in use. Fix by always clearing auth_user_pass soon after it is used, instead of delaying the purge as in pre-token days. But, when "pull" is true, retain the username in auth_token in anticipation of a token that may or may not arrive later. Remove ssl_clean_user_pass() as there is no delayed purge any longer -- auth-nocache handling is now done immediately after writing username/password to the send-buffer. Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20221023195105.31714-1-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25452.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 3a4fb17d103be37599d72d072bbee42cc121a39d)
2022-10-09Fix OpenVPN querying user/password if auth-token with user expiresArne Schwabe
The problematic behaviour happens when starting a profile without auth-user-pass and then connecting to a server that pushes auth-token. When the auth token expires OpenVPN asks for auth User and password again (but it shouldn't). The problem is that the auth_user_pass_setup sets auth_user_pass_enabled = true; This function is called from two places. In ssl.c it is only called with an auth-token present or that variable already set. The other one is init_query_passwords. Move setting auth_user_pass_enabled to the second place to ensure it is only set if we really want passwords. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: David Sommerseth <davids@openvpn.net> Acked-by: Heiko Hund <heiko@ist.eigentlich.net> Message-Id: <20221009130805.1556517-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25367.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry-picked from commit 7d291e10bccd1d6b9e584307fb5fe3ebfb114ec9)
2022-09-26msvc: add branch name and commit hash to version outputLev Stipakov
Add a simple python script which generates header with branch name and commit hash #defines. While on it, fix filename in msvc-generate.vcxproj and add proper copyright header to Makefile.mak. Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20220926070843.717-1-lstipakov@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25314.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-09-08Change command help to match man page and implementationArne Schwabe
Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20220908161435.327109-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25151.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 2b4f3ea880377401275baf965ff603f30cde36f1)
2022-08-25t_client.sh: do not require fping6Frank Lichtenheld
fping and fping6 were merged in version 4.0, released in 2017. Many recent distributions do not include the compatibility symlink anymore. So if we find fping but not fping6 do not error out but assume that fping is capable of IPv6. Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Antonio Quartulli <a@unstable.cc> Message-Id: <20220822141806.39406-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25058.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit fb06c9f026a78b879f264ab8e67de09d725b5540)
2022-08-25t_client: Allow to force FAIL on prerequisite failsFrank Lichtenheld
In automated tests we want the build to fail if the worker node is configured incorrectly. Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20220722134902.22092-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24723.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 79932b94513303567fdd5d1c4e0abb79e6642b6e)
2022-08-23Allow a few levels of recursion in virtual_output_callback()Selva Nair
Without this, replies to commands from the management client are sometimes lost if the server is writing when a command comes in and leads to a recursive call to this function. For some reason I've not been able to trigger this on Linux, but it does sometimes happen on Windows during intense write activity by openvpn.exe sending log lines to the management client. Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20220728034508.15180-2-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24751.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 4dfd592ff1ee18aa4859264c8a341dfa1a291988)
2022-08-19Fix auth-token usage with management-def-authSelva Nair
When auth-token verify succeeds during a reauth, other auth methods (plugin, script, management) are skipped unless external-auth is in effect (skip_auth gets set to true). However, in this case, the status of management-def-auth (ks->mda_status) stays at its default value of ACF_PENDING and will never change. This causes TLS keys to go out of sync and an eventual client disconnect. Further, a message saying username/password authentication is "deferred" gets logged which is misleading. For example: test/127.0.0.1:35874 TLS: Username/auth-token authentication succeeded for username 'test' followed by test/127.0.0.1:35874 TLS: Username/Password authentication deferred for username 'test' [CN SET] Fix by setting ks->mda_status to ACF_DISABLED, and do not set ks->authenticated = KS_AUTH_DEFERRED when skip_auth is true. Also log a warning message when token is marked as expired on missing the reneg window. Reported by: Connor Edwards <connor.edwards@b2c2.com> Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20220704025840.2558-1-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24627.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit ddbe6a6fc26586d09f5a9105f13124c479b4d993)
2022-08-02Do not skip ERROR:/SUCCESS: response from management interfaceSelva Nair
Generally we expect a response of SUCCESS: or ERROR: to every command sent to the management interface. But, while in the management-hold state, sending "signal foo" returns only the following reply (with foo = SIGHUP, SIGUSR1 etc.): >HOLD:Waiting for hold release:0 Fix by always responding ERROR: signal 'foo' is currently ignored" followed by the above line. Though this is seldom seen in practice[*], such violation of the protocol could stall clients like the GUI. So fix it. [*] One way this happens is with SIGHUP sent before the daemon is on hold state which it enters before the SIGHUP is received. Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20220728034508.15180-1-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24750.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 579b78e22feab7fe7cc627355cbb270cd91aebb4)
2022-06-28tls-crypt-v2: bail out if the client key is too smallAntonio Quartulli
The tls-crypt-v2 key should be at least 2 bytes long in order to read the actual length. Bail out if the key is too short. This looks like it could be abused to trigger a read of uninitialized memory, but after close checking it won't: We read from BEND(), so this is defined for TCP since the minimum length there is 3 bytes (pkt len + opcode) For UDP we might read past the beginning of the packet but since they are buffers coming from the packet stack we have the headroom/tailroom, so might read some random data (but not out of bound!). So we copy some more or less random number into net_len/wkc_len but without actually reading from undefined memory. The next line will then almost definitively fail (buf_advance()). While at it improve the error message a bit. Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20220628094144.17471-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24580.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 462339a45089ef655faf02232d7d792def9b8afb)
2022-06-21Update the replay-window backtrack log messageMartin Janů
The man pages reference a logging message which has been rephrased in ac1310528a248c99e039e7afaf48724ad1b7f10e. This commit updates the man page message to reflect the change for improved grep-ability. Signed-off-by: Martin Janů <martin.janu@protonmail.com> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <SVrvuTydxR6Qs_mvwvG7mqT8iLV0inlcCMXoenZTMI8M0LkosV4pZsH9m_XCTwcRWAPN5H8Zdro0ubhJrnSp6v5KC2ZNAL9So0Y2SKiSe7g=@protonmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24472.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 98cbd2914cb728bfaa6ce36a968e944555c57d53)
2022-06-09Allow running a default configuration with TLS libraries without BF-CBCArne Schwabe
Modern TLS libraries might drop Blowfish by default or distributions might disable Blowfish in OpenSSL/mbed TLS. We still signal OCC options with BF-CBC compatible strings. To avoid requiring BF-CBC for this, special this one usage of BF-CBC enough to avoid a hard requirement on Blowfish in the default configuration. This patch is cherry-picked from 79ff3f79 and the missing ciphername = "none"; has been added in the OCC code. Due to uncrustify complains, a few extra whitespace fixes had to be done to options.c. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20220603095219.637361-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24456.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-05-31Remove useless empty line from CR_RESPONSE messageArne Schwabe
The out buffer is not filled and this adds an extra empty line for CR_RESPONSE outputs. Also make minor style fixes. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20220530224149.201883-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24447.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 0dbcaba4f301c21e68a5cd032a4b56eb75c17c37)
2022-05-24Preparing release 2.5.7v2.5.7Gert Doering
version.m4, ChangeLog, Changes.rst Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-05-24Fix client-pending-auth error message to say ERROR instead of SUCCESSArne Schwabe
Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20220523091724.3418887-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24421.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit d681e9d42e11b08668fae6e7b61d6a040c93082d)
2022-05-23Translate OpenSSL 3.0 digest names to OpenSSL 1.1 digest namesArne Schwabe
Since we used the OpenSSL <=1.1 names as part of our OCC message, they are now unfortunately part of our wire protocol. OpenSSL 3.0 will still accept the "old" names so we do not need to use this translation table for forward lookup, only for returning the name with md_kt_name() Backport of master commit 88342ed8277c5797. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Antonio Quartulli <a@unstable.cc> Message-Id: <20220523103546.3425388-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24424.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-05-22cipher-negotiation.rst missing from doc/Makefile.amJan Mikkelsen
Trac: #1461 Signed-off-by: Jan Mikkelsen <janm@transactionware.com> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20220518183715.931-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24394.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 7c8dd98ec10f61c3b014b64c24090717cd6ebf05)
2022-05-18Add message when decoding PKCS12 file fails.Arne Schwabe
Currently we never display the OpenSSL error stack when decoding a PCKS12 file fails. With LibreSSL defaulting to RC2-40-CBC, the failure might not be a wrong password but can actually be an unsupported encoding, seeing the error stack is really helpful (example from OpenSSL 3.0): error:0308010C:digital envelope routines:inner_evp_generic_fetch: unsupported:crypto/evp/evp_fetch.c:346:Global default library context, Algorithm (RC2-40-CBC : 0), Properties () to pinpoint the issue Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20211019183127.614175-17-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23017.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 6ac4e63c577986ec11eae3519fe8516e8ca8ac0f)
2022-05-13Remove dependency on BF-CBC existance from test_ncpArne Schwabe
The test_check_ncp_ciphers_list test assumed that BF-CBC is always available, which is no longer the case with OpenSSL 3.0. Rewrite the test to not rely on BF-CBC to be available. This is a cherry-pick from c07f95f3 Patch V2: manually fix if condition. Somehow the git cherry-pick ended up with a broken if condition. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20220513083635.2199131-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24346.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-05-13Fix allowing/showing unsupported ciphers and digestsArne Schwabe
This is a minimal version to hide the non-supported ciphers in these show-cipher/show-digests listings. It also adds code to the kt_md_get/ kt_cipher_get functions to error out early instead of getting an ugly backtrace with OpenSSL errors later when actually trying to use the ciphers. This allows make check to work again on with OpenSSL 3.0. The changes are kept minimal to avoid pulling in all the other refactoring for OpenSSL 3.0. This commit is partly cherry-picked from ab3f32b9. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20220512121429.2096164-7-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24334.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-05-13Add --with-openssl-engine autoconf option (auto|yes|no)Arne Schwabe
This is a cherry-pick to release2.5 from 0df2261da. The OpenSSL engine tests fail otherwise and it is good to have the same behaviour as in master/2.6 This allows to select engine support at configure time. For OpenSSL 1.1 the default is not changed and we detect if engine support is available. Engine support is deprecated in OpenSSL 3.0 and for OpenSSL 3.0 the default is to disable engine support as engine support is deprecated and generates compiler warnings which in turn also break -Werror. By using --with-openssl-engine=no or --with-openssl-engine=yes engine support can be forced on or off. If it is enabled but not detected an error will be thown. This commit cleans up the configure logic a bit and removes the ENGINE_cleanup checks as we can just assume that it will be also available as macro or function if the other engine functions are available. Before the cleanup we would only check for the existance of engine.h if ENGINE_cleanup was not found. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20220512121429.2096164-6-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24332.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-05-13Add macos OpenSSL 3.0 and ASAN buildsArne Schwabe
Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20220512121429.2096164-5-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24330.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-05-13Add ubuntu 22.04 to Github ActionsArne Schwabe
This adds Ubuntu 22.04 to the Github actions. mbed TLS in 22.04 is still old enough (2.28) to build with OpenVPN and GPL licensed. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20220512121429.2096164-4-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24329.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-05-13Allow loading of non default providersArne Schwabe
This allows OpenVPN to load non-default providers. This is mainly useful for loading the legacy provider with --providers legacy default Cherry-pick of 08081aa0a153 to release/2.5. Changes.rst has been adjust to better fit the changes in 2.5. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20220512121429.2096164-3-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24327.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-05-13Refactor early initialisation and uninitialisation into methodsArne Schwabe
This put the early initialisation and uninitialisation that needs to happen between option parsing and post processing into small methods. Cherry-pick of 97056dbf9 as prerequirement for the provider patch Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20220512121429.2096164-2-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24328.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-05-12Fix M_ERRNO behavior on WindowsLev Stipakov
We use M_ERRNO flag in logging to display error code and error message. This has been broken on Windows, where we use error code from GetLastError() and error description from strerror(). strerror() expects C runtime error code, which is quite different from last error code from WinAPI call. As a result, we got incorrect error description. The ultimate fix would be introducing another flag for WinAPI errors, like M_WINERR and use either that or M_ERRNO depends on context. However, the change would be quite intrusive and in some cases it is hard to say which one to use without looking into internals. Instead we stick to M_ERRNO and in Windows case we first try to obtain error code from GetLastError() and if it returns ERROR_SUCCESS (which is 0), we assume that we have C runtime error and use errno. To get error description we use strerror_win32() with GetLastError() and strerror() with errno. strerror_win32() uses FormatMessage() internally, which is the right way to get WinAPI error description. This commit is the backport of 54800aa975418fe3570f3206a5f9b277dc59bd47, adjusted for the different code base related to socket errors (print socket file descriptor) in x_check_status(). Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Selva Nair <selva.nair@gmail.com> Message-Id: <20220504091305.434-1-lstipakov@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24274.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-05-05vcpkg: switch to manifestLev Stipakov
Add vcpkg manifest file which lists dependencies and enable manifest usage in project file. This simplifies build process by eliminating separate "vcpkg install" step to install dependencies. Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20220505124205.435-1-lstipakov@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24286.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-05-04Add insecure tls-cert-profile optionsArne Schwabe
The recent deprecation of SHA1 certificates in OpenSSL 3.0 makes it necessary to reallow them in certain deployments. Currently this works by using the hack of using tls-cipher "DEFAULT:@SECLEVEL=0". Add "insecure" as option to tls-cert-profile to allow setting a seclevel of 0. Patch v4: fix default accidentially changed to insecure Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Max Fillinger <maximilian.fillinger@foxcrypto.com> Message-Id: <20211029112407.2004234-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23076.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 23efeb7a0bd9e0a6d997ae6e77e0e04170da3e67)
generated by cgit v1.1 at 2024-10-06 10:32:02 +0000