aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2024-02-12preparing release 2.6.9v2.6.9Gert Doering
version.m4, ChangeLog, Changes.rst
2024-02-07dco-freebsd: dynamically re-allocate buffer if it's too smallKristof Provost
It's possible for the buffer we provide for OVPN_GET_PEER_STATS to be too small. Handle the error, re-allocate a larger buffer and try again rather than failing. Signed-off-by: Kristof Provost <kprovost@netgate.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20240124152739.28248-1-kprovost@netgate.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28128.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 62676935d738f74908845ca96819a36a8c0c230e)
2024-02-06documentation: Fixes for previous fixes to --push-peer-infoFrank Lichtenheld
- Clarify compression IV_ settings - Clarify which settings might come from --setenv Change-Id: Id8615515c8df6e38e931e357396811234faad796 Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20240206174745.74828-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28184.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit c1e1d132f6368a6f4b77fe956a9329a60331b63e)
2024-02-06documentation: Update and fix documentation for --push-peer-infoFrank Lichtenheld
- description of IV_PROTO was outdated, missing a lot of flags - complete list of compression flags, but separate them out - various other style/grammar/typo fixes Change-Id: I7f854a5a14d2a2a391ebb78a2a92b3e14cfd8be6 Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20240206141057.46249-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28178.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit b66d545ce25689588c4dbd1fb525204c78871ed0)
2024-02-02README.cmake.md: Document minimum required CMake version for --presetFrank Lichtenheld
CMakePreset.json is supported since 3.19, but we have a version 3 preset file, so need at least 3.21. Github: OpenVPN/openvpn#489 Change-Id: I44c555f6ffa08f2aee739c7f687fa3b678c86231 Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20240201123039.174176-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28160.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 53b16d07e889b69128203d3b50ed47ceb77c5771)
2024-01-22--http-proxy-user-pass: allow to specify in either order with --http-proxyFrank Lichtenheld
Previously, when using a third argument to --http-proxy other than auto/auto-nct, order did matter between --http-proxy and --http-proxy-user-pass. Always prefer --http-proxy-user-pass when given. Change-Id: I6f402db2fb73f1206fbc1139c47d2bf4378376fa Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20240122092122.8591-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28099.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit a634cc5eccd55f1d14197da7376bb819bdf72cb6)
2024-01-19buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'Frank Lichtenheld
As Coverity says: An unsigned value can never be negative, so this test will always evaluate the same way. Was changed from int to size_t in commit 7fc608da4ec388c9209bd009cd5053ac0ff7df38 which triggered warning, but the check did not make sense before, either. Change-Id: I64f094eeb0ca8c3953a94d742adf468faf27dab3 Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Arne Schwabe <arne-openvpn@rfc2549.org> Message-Id: <20240119120341.22933-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28093.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit bc29bd6a3376158b73d069758122739fbf93c022)
2024-01-18proxy-options.rst: Add proper documentation for --http-proxy-user-passFrank Lichtenheld
And extend examples section for authenticated HTTP proxies because is was misleading. Change-Id: I7a754d0b4a76a9227bf922f65176cd9ec4d7670c Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20240118164903.22519-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28083.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit d3f84afedd33734416704d5d92e8d3ac639ef491)
2024-01-18Remove conditional text for Apache2 linking exceptionArne Schwabe
With the reimplementation of the tls-export feature and removal/approval or being trivial of the rest of the code, now all the code falls under new license. Remove the conditional text of the license to be only valid for parts of OpenVPN. Change-Id: Ia9c5453dc08679ffb73a275ddd4f28095ff1c1f8 Acked-by: dazo <dazo@eurephia.org> Message-Id: <20240118135530.3911-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28077.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 275aa892c30e91adfec9276f6d6845756b141c62)
2024-01-17Enable key export with mbed TLS 3.x.yMax Fillinger
Change-Id: I8e90530726b7f7ba3cee0438f2d81a1ac42e821b Signed-off-by: Max Fillinger <maximilian.fillinger@foxcrypto.com> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20231117091401.25793-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27458.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit b5faf1b2e90fd44c5137a2b8f3da98c7ae482fc1)
2024-01-17Disable TLS 1.3 support with mbed TLSMax Fillinger
As of version 3.5.0 the TLS-Exporter function is not yet implemented in mbed TLS, and the exporter_master_secret is not exposed to the application either. Falling back to an older PRF when claiming to use TLS1.3 seems like false advertising. Change-Id: If4e1c4af9831eb1090ccb3a3c4d3e76b413f0708 Signed-off-by: Max Fillinger <maximilian.fillinger@foxcrypto.com> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20231115151740.23948-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27453.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit efad93d049c318a3bd9ea5956c6ac8237b8d6d70)
2024-01-17Update README.mbedtlsMax Fillinger
Change-Id: Ia61c467d85d690752011bafcf112e39d5b252aa7 Signed-off-by: Max Fillinger <max@max-fillinger.net> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20231025121928.1031109-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27295.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit f53f06316dbb804128fc5cbee1d8edb274ce81df)
2024-01-17Add support for mbedtls 3.X.YMax Fillinger
Most struct fields in mbedtls 3 are private and now need accessor functions. Most of it was straightforward to adapt, but for two things there were no accessor functions yet: * Netscape certificate type * key usage (you can check key usage, but not get the raw bytes) I decided to remove Netscape certificate type checks when using OpenVPN with mbedtls. The key usage bytes were printed in an error message, and I removed that part from it. Adding the random number functions to the load private key function may look weird, but the purpose is to make side channels for elliptic curve operations harder to exploit. Change-Id: I445a93e84dc54b865b757038d22318ac427fce96 Signed-off-by: Max Fillinger <max@max-fillinger.net> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20231025121830.1030959-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27295.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit ace7a4f1c271550bb8ad276663e045ab97a46f16)
2024-01-17NTLM: increase size of phase 2 response we can handleFrank Lichtenheld
With NTLMv2 the target information buffer can be rather large even with normal domain setups. In my test setup it was 152 bytes starting at offset 71. Overall the base64 encode phase 2 response was 300 byte long. The linked documentation has 98 bytes at offset 60. 128 byte is clearly too low. While here improve the error messaging, so that if the buffer is too small at least one can determine that in the log. Change-Id: Iefa4930cb1e8c4135056a17ceb4283fc13cc75c8 Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20240117094952.25938-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28052.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-01-17NTLM: add length check to add_security_bufferFrank Lichtenheld
Especially ntlmv2_response can be very big, so make sure we not do exceed the size of the phase3 buffer. Change-Id: Icea931d29e3e504e23e045539b21013b42172664 Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20240117091711.5366-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28042.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-01-16Implement the --tls-export-cert featureArne Schwabe
This is a re-implementation of the --tls-export-cert feature. This was necessary to due to missing approval to re-license the old (now removed) code. The re-implementation is based on the following description of the feature provided by David: Add an option to export certificate in PEM format of the remote peer to a given directory. For example: --tls-export-cert /var/tmp This option should use a randomised filename, which is provided via a "peer_cert" environment variable for the --tls-verify script or the OPENVPN_PLUGIN_TLS_VERIFY plug-in hook. Once the script or plugin call has completed, OpenVPN should delete this file. Change-Id: Ia9b3f1813d2d0d492d17c87348b4cebd0bf19ce2 Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20240116101556.2257-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28014.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit c58c7c3c669461805956dabc703c1279fe58eeee)
2024-01-06fix uncrustify complaints about previous patchGert Doering
cherry-picking the previous patch (9abf74c92c) picked the "raw patch" as it came in from the mailing list, not the whitespace-fixed version that ended up in master - so fix release/2.6 here. Only whitespace changes. Signed-off-by: Gert Doering <gert@greenie.muc.de>
2024-01-05Fix IPv6 route add/delete message log levelSteffan Karger
We have D_ROUTE for route addition/deletion messages, which prints at loglevel 3. Use that for IPv6, like we do for IPv4 to reduce terminal spam for non-legacy-networking setups. Prvious code would print the messages at --verb 1. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20240105135742.21174-1-steffan@karger.me> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27954.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit b959b02b4f607628896b4092f7ddfa675e87d929)
2024-01-05Clarify that the tls-crypt-v2-verify has a very limited env setArne Schwabe
Change-Id: Ida4d22455c51773b6713caf94a4b4fbe136a6ded Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20240105142432.26298-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27944.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit a9fe012ca64d81af37a08666d3e4e74250113db2)
2024-01-05Make it more explicit and visible when pkg-config is not foundArne Schwabe
Users seem to struggle to read the full error message. This adds an indication if pkg-config is actually found to the warning/error message that use pkg-config. On platforms that do not require pkg-config and for optional libraries, the existence of pkg-config is mentioned as part of the error/warning message. When found: configure: error: libnl-genl-3.0 package not found or too old. Is the development package and pkg-config (/usr/bin/pkg-config) installed? Must be version 3.4.0 or newer for DCO not found: configure: error: libnl-genl-3.0 package not found or too old. Is the development package and pkg-config (not found) installed? Must be version 3.4.0 or newer for DCO On platforms where pkg-config is required (only Linux at the moment), configure will abort when not detecting pkg-config: checking for pkg-config... no configure: error: pkg-config is required Change-Id: Iebaa35a23e217a4cd7739af229cbfc08a3d8854a Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Antonio Quartulli <a@unstable.cc> Message-Id: <20240105140540.14757-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27939.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit c0f38019b4a2044c1fe873d7d33c13ce571d3386)
2024-01-04Check PRF availability on initialisation and add --force-tls-key-material-exportArne Schwabe
We now warn a user if the TLS 1.0 PRF is not supported by the cryptographic library of the system. Also add the option --force-tls-key-material-export that automatically rejects clients that do not support TLS Keying Material Export and automatically enable it when TLS 1.0 PRF support is not available. Change-Id: I04f8c7c413e7cb62c726262feee6ca89c7e86c70 Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20240104140214.32196-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27924.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit fa7960961415fa4f368e9bbb39dc4047680ff30c)
2024-01-01get_default_gateway() HWADDR overhaulGert Doering
commit f13331005d5a7 (gerrit/454) most painfully works around the limitations of the SIOCGIFCONF API, with struct member access on an unaligned buffer, possibly overrunning sockaddr structures, etc. - and the result still did not work on OpenSolaris and OpenBSD (no AF_LINK in the returned elements). Reading through OpenBSD "ifconfig" source, I found getifaddrs(3), which is exactly what we want here - it works on FreeBSD, NetBSD, OpenBSD and MacOS, and all returned pointers are properly aligned, so the code gets shorter, easier to read, and UBSAN is still happy. OpenSolaris does have getifaddrs(3), but (surprise) it does not work, as in "it does not return AF_LINK addresses". It does have SIOCGIFHWADDR, instead, and "man if_tcp" claims "should behave in a manner compatible with Linux" - so TARGET_SOLARIS gets a copy of the Linux code now (works). Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20240101092714.18992-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27891.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 76d11614797617708c31dc3db22e3568fee3de6d)
2024-01-01OpenBSD: repair --show-gatewayGert Doering
OpenBSD route sockets do not want to be passed RTA_IFP on RTM_GET - if we do this, we get back EINVAL. On other platforms, if we do not request RTA_IFP, we will not get back interface information for queried routes - on OpenBSD, RTA_IFP comes back always... So we need to #ifdef this, RTA_IFP on all platforms except OpenBSD. (Found this fix in OpenBSD's ports tree, in their patches for OpenVPN 2.6.8 - but they just remove RTA_IFP, no #ifdef, so we can't just apply their patch) While at it, add M_ERRNO to the "write to routing socket" error message. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20240101094054.38869-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27892.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit acf6f33987c72d9151f68eb618bbaf2d10e61877)
2023-12-31Fix unaligned access in macOS, FreeBSD, Solaris hwaddrArne Schwabe
The undefined behaviour USAN clang checker found this. This fix is a bit messy but so are the original structures. Since the API on Solaris/Illuminos does not return the AF_LINK sockaddr type we are interested in, there is little value in fixing the code on that platform to iterate through a list that does not contain the element we are looking for. Add includes stddef.h for offsetof and integer.h for max_int. Change-Id: Ia797c8801fa9a9bc10b6674efde5fdbd7132e4a8 Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20231231173431.31356-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27885.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit f13331005d5a75f2788685485d46be1fe2f133a1)
2023-12-26documentation: improve documentation of --x509-trackFrank Lichtenheld
In the current state it was completely unclear to me how you would use this. Extended the description based on reading the code and experimentation. Change-Id: Ibf728f9d624e64ecda094d66fa562bd3916829d2 Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20231213143324.226443-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27804.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 139607286ce5d618ece8b17923ce12f418695f4c)
2023-12-26fix(ssl): init peer_id when init tls_multiyatta
When openvpn run in UDP server mode, if ssl connections reach the max clients, the next connection would be failed in `multi_create_instance` and the half connection will be close in `multi_close_instance`, which may lead array `m->instances[0]` covered unexpectedly and make the first connection interrupt, this patch fix this problem by init `peer_id` with `MAX_PEER_ID` in `tils_multi_init`. Signed-off-by: yatta <ytzhang01@foxmail.com Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <tencent_C49D67EAA5678D180C293706A9469EFE8307@qq.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27260.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 3e30504d86f0fe5556acc0cb8e6975c5b2277661)
2023-12-26Extend the error message when TLS 1.0 PRF failsArne Schwabe
This error will probably become more and more common in the future when more and more systems will drop TLS 1.0 PRF support. We are already seeing people stumbling upon this (see GitHub issue #460) The current error messages TLS Error: PRF calcuation failed TLS Error: generate_key_expansion failed are not very helpful for people that do not have deep understanding of TLS or the OpenVPN protocol. Improve this message to give a normal user a chance to understand that the peer needs to be OpenVPN 2.6.x or newer. Change-Id: Ib3b64b52beed69dc7740f191b0e9a9dc9af5b7f3 Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20231213105308.121460-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27796.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 6ff816142c1acdaee149c4daabb297fefc2ccde0)
2023-12-21tun.c: don't attempt to delete DNS and WINS servers if they're not setLev Stipakov
Commits 1c4a47f7 ("wintun: set adapter properties via interactive service") 18826de5 ("Set WINS servers via interactice service") added functionality of add/remove DNS/WINS via interactive service, which is used mostly by dco-win and wintun (tap-windows6 normally uses DHCP). There is a check in code - if DNS/WINS addresses are not pushed, nothing is added. However, due to bug we always attempted to remove DNS/WINS, even if nothing was added. Removing WINS, for example, could take up to 3 seconds. This change fixes this by improving check "has DNS/WINS been pushed?". While on it, convert do_XXX_service() functions to "void" from "bool", since we never check their return values. Change-Id: I21a36d24f8e213c780f55acbe3e4df555c93542a Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20231220133637.60996-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27843.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit c590868a721881dd21bfb77ecf846e6c8720e4ef)
2023-12-09unit_tests: remove includes for mock_msg.hFrank Lichtenheld
Not actually used. Change-Id: I5e394bb73702d87562ed354100eaff9b41f5389e Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Arne Schwabe <arne-openvpn@rfc2549.org> Message-Id: <20231208173529.95023-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27727.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 9b4ed6d801b3c67f6b5f5341e5a1b161778d0d32)
2023-12-06Remove superfluous x509_write_pem()David Sommerseth
After removing --tls-export-cert, this function was left in the code base with no other users. This was an oversight in the previous change. Removing it to avoid leaving dead code behind. Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20231122190057.120384-1-dazo+openvpn@eurephia.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27561.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit f015643fe23d7847ad45b7763f31bfc6baed2159)
2023-12-06Remove --tls-export-certDavid Sommerseth
As OpenVPN 2.6+ is doing some adoptions to the license text, all prior contributors need to accept this new text. Unfortunately, Mathieu Giannecchini who implemented the --tls-export-cert feature did not respond at all. Without an explicit acceptance we need to remove this feature to avoid potential legal complications. If this is still a wanted feature, it will need to be re-implemented from scratch. Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20231122143101.58483-1-dazo+openvpn@eurephia.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27557.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 12c5ef1fe6a6010362f3098d11b554566687c1f7)
2023-12-05vcpkg-ports/pkcs11-helper: bump to version 1.30Marc Becker
update metadata references for pkcs11-helper v1.30 remove local patches incorporated in new upstream Signed-off-by: Marc Becker <marc.becker@astos.de> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20231204153345.1146-1-marc.becker@astos.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27678.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit a78b0e45dff3a0f0332de47c55aadd76c5919370)
2023-12-04documentation: remove reference to removed option --show-proxy-settingsFrank Lichtenheld
This option was removed in 2.3.0. Change-Id: I243ba135ce36cff36ba77eead7dcd9354bd94ab7 Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20231204153444.56906-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27677.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit e569b16d5c456e1f89c9de2d19938b38c3914020)
2023-12-02Remove compat versionhelpers.h and remove cmake/configure check for itArne Schwabe
The cmake file defined that file to be never present in contrast to the old msvc-config.h that always had it present. Remove also the compat implementation taken from mingw. All our current build environments already have that header in place. Change-Id: I9c85ccab6d51064ebff2c391740ba8c2d044ed1a Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Signed-off-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20231128103950.62407-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27573.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit a68595a582b2c6c220b4f4502753d5f4154000d8)
2023-12-02Add check for nice in cmake configArne Schwabe
Change-Id: I2cc8f9b82079acca250db5871ffd9fad2997d1a8 Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Signed-off-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20231128104129.62761-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27574.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 4d8ee61ce2c2a8b387773d33b4dd01bc2e147941)
2023-12-02configure.ac: Remove unused AC_TYPE_SIGNAL macroFrank Lichtenheld
Recent autoconf warns: configure.ac:448: warning: The macro `AC_TYPE_SIGNAL' is obsolete. And it turns out that we do not actually use RETSIGTYPE. Additionally, there is no reason to do so since as the autoconf documentation says: "These days, it is portable to assume C89, and that signal handlers return void, without needing to use this macro or RETSIGTYPE." Change-Id: I7da7c2d7d34c7e5efd52d448646b4398a1005e77 Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Arne Schwabe <arne-openvpn@rfc2549.org> Message-Id: <20231128103740.61160-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27572.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit be05b590e8d5edebd8e35d97af34b0ba7e5350e6)
2023-12-02Add missing check for nl_socket_alloc failureArne Schwabe
This can happen if the memory alloc fails. Patch V2: add goto error Patch V3: return -ENOMEM instead of going to error Change-Id: Iee66caa794d267ac5f8bee584633352893047171 Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <20231121170603.886801-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27541.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit d1c31e428120bb0fc9488c62c1691c92a37d94c3)
2023-12-02Fix check_session_buf_not_used using wrong indexArne Schwabe
The inner loop used i instead of j when iterating through the buffers. Since i is always between 0 and 2 and ks->send_reliable->size is (when it is defined) always 6 (TLS_RELIABLE_N_SEND_BUFFERS) this does not cause an index of out bounds. So while the check was not doing anything really useful with i instead of j, at least it was not crashing or anything similar. Noticed-By: Jon Williams (braindead-bf) on Github issue #449 Change-Id: Ia3d5b4946138df322ebcd9e9e77d04328dacbc5d Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20231128104359.62967-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27576.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 59551b93cdb55397d63b2fe58ad99612821c0faf)
2023-12-02Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gatewayArne Schwabe
This debug code is not very useful as it is outdated and the same functionality is provided by --show-gateway Change-Id: Ie7fd59cc84e2eb024086c28c2ec2a5606a2b2e7c Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20231201111717.14940-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27624.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 6158228f16836f56a564d4533e7b513dc6170854)
2023-12-02Document tls-exit option mainly as test optionArne Schwabe
Change-Id: I93afff2372c4150d6bddc8c07fd4ebc8bfb0cc3e Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20231201111937.15214-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27626.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit ee6417e9d602d7d2db018739f07724b4660bf980)
2023-12-02GHA: clean up libressl builds with newer libresslFrank Lichtenheld
- Update to latest stable release - Work-around patches not required anymore - Official URL of repo has changed Change-Id: I9b8e69f2b9838cea4cb9001f4e8960b8a39724ef Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Arne Schwabe <arne-openvpn@rfc2549.org> Message-Id: <20231201123649.18127-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27635.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 664dde85be91a5432efe52c90089fcf2bf5d6a3c)
2023-11-21Log SSL alerts more prominentlyArne Schwabe
When we receive an SSL alert from a server we currently only log a very cryptic OpenSSL error message: OpenSSL: error:0A00042E:SSL routines::tlsv1 alert protocol version:SSL alert number 70 This also enables logging the much more readable SSL error message: Received fatal SSL alert: protocol version which previously needed --verb 8 to be displayed (now verb 3). Also rework the message to be better readable. Change-Id: I6bdab3028c9bd679c31d4177a746a3ea505dcbbf Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20231121103930.15175-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27523.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit a1cb1b47b138b9f654cd0bca5de6d08dbca61888)
2023-11-21sample-keys: renew for the next 10 yearsFrank Lichtenheld
Old expiration was October 2024, less than a year away. Give everyone the chance to get the new keys before tests start failing. Change-Id: Ie264ec1ec61fd71e8cc87987be3e2adc2735c201 Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20231121110430.16893-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27530.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 78e0c5f2f57a18e8ea60951696a458a4b3ff3621)
2023-11-21Remove unused function prototype crypto_adjust_frame_parametersArne Schwabe
Change-Id: I1141eb7740d8900ed4af0ff5ff52aa3659df99aa Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20231121104037.15307-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27524.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 66f109117649237947e3e5cd33a36f81bde71a2b)
2023-11-20protocol_dump: tls-crypt supportReynir Björnsson
Add support for tls-crypt packets in protocol_dump(). Currently, protocol_dump() will print garbage for tls-crypt packets. This patch makes protocol_dump print the clear text parts of the packet such as the auth tag and replay packet id. It does not try to print the wKc for HARD_RESET_CLIENT_V3 or CONTROL_WKC_V1 packets. It also intentionally does not print ENCRYPTED placeholders for ack list and DATA, to cut down on the noise. Signed-off-by: Reynir Björnsson <reynir@reynir.dk> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <8237adde-2523-9e48-5cd4-070463887dc1@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27310.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 227799b8345128dd3adf2029323457804209fe93)
2023-11-17preparing release 2.6.8v2.6.8Gert Doering
version.m4, ChangeLog, Changes.rst Signed-off-by: Gert Doering <gert@greenie.muc.de>
2023-11-15Warn if pushed options require DHCPLev Stipakov
Some pushed options (such as DOMAIN-SEARCH) require DHCP server to work. Warn user that such options will not work if the current driver (such as dco-win) doesn't support DHCP. Change-Id: Ie512544329a91fae15409cb18f29d8be617051a1 Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20231115120656.6825-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27403.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 85fc834b0229b87e466b4f60bd2618b2ecd27a5f)
2023-11-15Make --dns options apply for tap-windows6 driverLev Stipakov
When tap-windows6 driver is used, both --dhcp-option and --dns options are applied with DHCP. When processing --dns options, we don't set "tuntap_options.dhcp_options" member, which is required for DHCP string to be sent to the driver. As a result, --dns options are not applied at all. Fix by adding missing assignment of tuntap_options.dhcp_options. Github: fixes OpenVPN/openvpn#447 Change-Id: I24f43ad319bd1ca530fe17442d02a97412eb75c7 Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20231115120623.6442-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27402.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 60def50420b050e628f4388e3c9ff771eb70a549)
2023-11-15Do not check key_state buffers that are in S_UNDEF stateArne Schwabe
When a key_state is in S_UNDEF the send_reliable is not initialised. So checking it might access invalid memory or null pointers. Github: fixes OpenVPN/openvpn#449 Change-Id: I226a73d47a2b1b29f7ec175ce23a806593abc2ac [a@unstable.cc: add check for !send_reliable and message] Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20231115103331.18050-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27401.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit a903ebe9361d451daee71c225e141f4e1b67107d)
2023-11-14config.h: fix incorrect defines for _wopen()Lev Stipakov
This is a regression from commit 01341840 ("add basic CMake based build") S_IRUSR and S_IWUSR should NOT be defined as 0 but as _S_IREAD and _S_IWRITE, as it was already fixed in commit 077445d0 ("Fix some more wrong defines in config-msvc.h") Those are used as permission mode when opening a file. Passing zero makes file read-only, which break for example --status-file functionality. Github: fixes OpenVPN/openvpn#454 Trac: #1430 Change-Id: I53eaee85d7b284af6bc63da5f6d8f310ddd96c47 Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20231114141653.10486-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27393.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 2fcfb77a8111cce9308bb893f52ecdb77de91e7c)
generated by cgit v1.1 at 2024-10-06 10:24:13 +0000