aboutsummaryrefslogtreecommitdiff
path: root/sample
AgeCommit message (Collapse)Author
2023-01-10Update copyright year to 2023Frank Lichtenheld
Manually excluded ovpn_dco_win.h because it is an imported file. ovpn_dco_linux.h is already excluded because it still says 2021. Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20230110160531.81010-1-frank@lichtenheld.com> URL: https://patchwork.openvpn.net/project/openvpn2/patch/20230110160531.81010-1-frank@lichtenheld.com/ Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit ccf9d57249acb9bc9a450aec3e613bda631415f5)
2022-12-01documentation: avoid recommending --user nobodyFrank Lichtenheld
Recommend to create an user dedicated to openvpn so that there is no priviledge escalation between different services using that user. cf. https://wiki.ubuntu.com/nobody Trac: #1335 CC: tincantech <tincantech@protonmail.com> Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20221129144731.35105-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25573.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-09-11Add example script demonstrating TOTP via auth-pendingArne Schwabe
Signed-off-by: Arne Schwabe <arne@rfc2549.org> Patch v3: Some minor cleanups in the script (rename CNs, add more comments) Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <20210304114018.8442-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg21603.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-05-22Reformat for sp_after_comma=addFrank Lichtenheld
It is our usual style. Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Antonio Quartulli <a@unstable.cc> Message-Id: <20220519085428.6783-2-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24399.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-04-21The Great Reformatting of 2022David Sommerseth
It was agreed it was time to do a full reformat fix-up of the whole source tree again. Over time (since late 2016) small changes has not adhered to our uncrustify defined coding style. This realigns to our current standards. Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20220420143050.52790-1-openvpn@sf.lists.topphemmelig.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24123.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-03-15plugins: Remove defer/simple.c sample pluginDavid Sommerseth
The use case for this plug-in is dubious now with the new multi-auth.c plugin available. This new plugin is based on simple.c, but allows far more flexibility for testing. Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <20220313193154.9350-4-openvpn@sf.lists.topphemmelig.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23933.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-03-15sample-plugin: New plugin for testing multiple auth pluginsDavid Sommerseth
This plugin allows setting username/passwords as well as configure deferred authentication behaviour as part of the runtime initialization. With this plug-in it is easier to test various scenarios where multiple authentication plug-ins are active on the server side. A test documentation was also added to describe various test cases and the expected results. Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <20220313193154.9350-2-openvpn@sf.lists.topphemmelig.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23932.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-02-03keyingmaterialexporter.c: include strings.hAntonio Quartulli
strcasecmp() was initially declared in string.h and subsequently moved to strings.h. For historical reasons it still exists in string.h, but would require _DEFAULT_SOURCE to be defined. Due to the above, just include strings.h as currently dictated by the manpage. Fixes the following warning: keying-material-exporter-demo/keyingmaterialexporter.c:155:14: warning: implicit declaration of function strncasecmp’; did you mean ‘strncmp’? [-Wimplicit-function-declaration] 155 | if (!strncasecmp(objbuf, "CN", 2)) | ^~~~~~~~~~~ | strncmp Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20220203082620.8186-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23702.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-01-26update copyright year to 2022Antonio Quartulli
Update performed by means of: dev-tools/update-copyright.sh Cc: David Sommerseth <davids@openvpn.net> Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <20220125142456.18176-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23650.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-11-09Fix error in example firewall.sh scriptAdrian
The man page says: [!] -s, --source address[/mask][,...] Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <20211107174000.16210-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23128.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-09-12Remove support for PF (Packet Filter)Antonio Quartulli
OpenVPN shipped a small packet filtering tool called PF. It has never been straightforward as it required a plugin to work. On top of that, keeping PF support, makes the code more complicated and increases the maintenance cost of OpenVPN. PF itself is not actually maintained at all and there is little motivation in keeping it alive. Some years ago an IPv6 extension for PF was proposed, but it was never picked up for the reasons above. External (and more appropriate) tools can still be used to implement packet filtering on the OpenVPN interface. Drop PF support for good. Note that IDs used for external communication (i.e. to the plugin or management interface) have been commented out, but not removed, as they should not be used in the future. v2: * changed // to /* */ * changed "NOT IMPLEMENTED" to "REMOVED FEATURE" * removed extra empty lines after removing ifdef blocks * clarified on IRC that tls_final has to be removed and therefore that hunk is correct * removed mi_prefix() function as it is now unused Cc: Arne Schwabe <arne@rfc2549.org> Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20210827190014.12640-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22780.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-06-15Update copyrightsDavid Sommerseth
- Update the update-copyright script to include more contributors as well as correcting a few typos - Correct a copyright address in the source code to now used address (dazo) - Update copyright year to 2021 Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20210609213231.22576-1-openvpn@sf.lists.topphemmelig.net> URL: https://www.mail-archive.com/search?l=mid&q=20210609213231.22576-1-openvpn@sf.lists.topphemmelig.net URL: https://sourceforge.net/p/openvpn/mailman/message/37299719/ Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-02-03Explain structver usage in sample defer plugin.Greg Cox
sample-plugins/defer/simple.c uses OPENVPN_PLUGINv3_STRUCTVER settings that may not be obvious to a new author. Add a comment to reduce possible confusion. Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <1612163389-16421-1-git-send-email-gcox@mozilla.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg21540.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-01-30Remove inetd support from OpenVPNArne Schwabe
This code is from another time and has almost no relevance today. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20201214172407.30451-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg21360.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-01-30More explicit versioning compatibility in sample-plugins/defer/simple.cGreg Cox
While not required, adding openvpn_plugin_min_version_required_v1 helps by making an example for others to copy, and helps to explicitly call attention to the difference between the API version number and the struct version number in v3 calls. Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <1611778909-20630-2-git-send-email-gcox@mozilla.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg21508.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-01-30Update openvpn_plugin_func_v2 to _v3 in sample-plugins/defer/simple.cGreg Cox
This isn't strictly required, but it modernizes the functions used. This change makes _open the same parameter form as _func (for better parallelism in function writing) and includes a check for the correct struct version, as recommended by openvpn-plugin.h Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <1611778909-20630-1-git-send-email-gcox@mozilla.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg21507.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-01-25Fix naming error in sample-plugins/defer/simple.cGreg Cox
Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1611558957-2958-1-git-send-email-gcox@mozilla.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg21482.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-01-23clean up / rewrite sample-plugins/defer/simple.cGert Doering
If we ship something that we consider a form of documentation "this is how to write an OpenVPN plugin" it should meet our standards for secure and modern code. This plugin did neither. - get rid of system() calls, especially those that enabled a remote-root exploit if this code was used "as is" - change logging from printf() to OpenVPN's plugin_log() - this requires changing to openvpn_plugin_open_v3() to get to the function pointers - change wacky "background and sleep in the shell call" to the double-fork/waitpid model we use in plugins/auth-pam (copy-paste code reuse) - OpenVPN 2.5 and later react badly to OPENVPN_PLUGIN_FUNC_ERROR returns to OPENVPN_PLUGIN_ENABLE_PF calls (SIGSEGV crash), so always return SUCCESS. Only hook ENABLE_PF if that functionality is actually requested ("setenv test_packet_filter NN"). - change deeply-nested functions auth_user_pass_verify() and tls_final() to use early-return style - actually make defered PF setup *work* with recent OpenVPNs (pre-creating temp files broke this, so unlink() the pre-created file in the ENABLE_PF hook, and re-create asyncronously later) - add lots of comments explaining why we do things this way Security issue reported by "oxr463" on HackerOne. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20210121172536.32500-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg21466.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-10-24Remove NULL checks before calling freeArne Schwabe
We (and OpenSSL) already use calling free on null pointers in a number of places and also C99 standards says free(NULL) does nothing. The if (x) free(x) calls more often make code harder to read, instead of easier, remove these NULL checks in favour of directly calling free(x). The OpenSSL *_free methods are also safe to call with NULL and pkcs11h_certificate_freeCertificateIdList is also safe to be called with NULL. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20201023113431.26691-5-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg21216.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-09-18Add demo plugin that excercises "CLIENT_CONNECT" and "CLIENT_CONNECT_V2" pathsGert Doering
This is a new "samples" plugin which does not do many useful things, besides - show how a plugin is programmed - how the various messages get dispatched - how to pass back information from a client-connect/v2 plugin - how to do async-cc plugins [not yet implemented] the operation of the plugin is controlled by UV_WANT_* environment variables controlled by the client ("--setenv UV_WANT_CC_FAIL 1 --push-peer-info"), to "fail CLIENT_CONNECT" or "use async-cc for CLIENT_CONNECT_V2" or "send 'disable' back from ...") - which is useful for automated testing of server success/defer/fail code paths for the CLIENT_CONNECT_* functions. See samples/sample-plugins/client-connect/README for details how to do this. v2: - implement async / deferred operation both for CLIENT_CONNECT and CLIENT_CONNECT_V2 plugin calls - implement returning openvpn-controlled (setenv) config snippets (so the client side can verify in automated testing that the plugin operated correctly, without hard-coding something in the plugin code) v3: - remove -Wno-unused-variable from Makefile - remove unused "char ** argv" (commented out, but kept as reference) v4: - upgrade to use the build infra brought by commit 0b5141d8f946 - remove local Makefile - include "config.h" to get what is needed to get rid of the strdup() warning Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <20200917161909.11573-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg21047.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-09-16build: Fix make distclean/distcheckDavid Sommerseth
In commit 0b5141d8f94 the sample-plugins got partially migrated to automake. But since it was not fully integrated within the full standard build, the sample/sample-plugins/Makefile was not removed by 'make distclean', which annoys 'make distcheck'. The simplest way is just to explicitly enlist this Makefile in the list of files 'make distclean' should remove. Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20200916195616.30633-1-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg21026.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-09-16sample-plugins: Partially autotoolize the sample-plugins buildDavid Sommerseth
The sample-plugins have their own set of build/winbuild scripts in each of these plugin directories. This does not give a good way to reuse various macros the autoconf/automake/configure process enables; which can contain important macros to make some code build without errors or warnings. Normally we would embrace the full autoconf/automake approach. But this is sample code which we only want to build per request and the built code should not be installed anywhere via 'make install'. But since we do use libtool other plug-ins being installed and automake gets kind of cranky when it comes to define certain build targets not following the expected use cases, we try to only embrace just enough of automake to get our main goals achieved. This changeset kicks out the build scripts and replaces them with a single Makefile.plugins file, which defines the plugins we want to build by default when running 'make from the sample-plugins directory. Neither of these plugins are otherwise built by default. No sample-plugins are being installed. But we have enough strings attached to automake to grab the CFLAGS and LDFLAGS used by the rest of the code. This also makes it easy to use #include "config.h" in sample code, to also get various macros defined by the ./configure run. This patch does not touch the winbuild scripts, as it seems building these sample-plugins on Windows requires a bit different compile and linking steps than *nix systems in general. Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20200916141956.1277-1-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg21020.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-09-11Handle NULL returns from calloc() in sample plugins.Gert Doering
This is basic housekeeping, adding NULL checks to context initialization of the sample plugin collection which are missing it. Realistically, this can never happen, but since these are supposed to be "good examples", not checking calloc() return isn't one. Trac: #587 Reported-By: Dogbert (in Trac) Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <20200909104837.6123-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg20922.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-07-27Rename ncp-ciphers to data-ciphersArne Schwabe
The change in name signals that data-ciphers is the preferred way to configure data channel (and not --cipher). The data prefix is chosen to avoid ambiguity and make it distinct from tls-cipher for the TLS ciphers. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Steffan Karger <steffan.karger@foxcrypto.com> Message-Id: <20200717134739.21168-8-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg20444.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-05-13Change client side of t_lpback.sh configs to use inline material.Gert Doering
We have no real test rig for "inline" key material (key, cert, ca, tls-auth, tls-crypt*) yet. This change adds the "sample" key set as inline config to the "loopback-client" config, while keeping file-based configs for "loopback-server" - that way, testing both methods of loading keys etc. in one go. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <20200513141147.17171-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19883.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-11-10Update sample configs to use modern cipher, remove static key examplesSteffan Karger
Since these are examples, people might use them as a basis for their own configs. In the non-push/pull configs, we should specify a decent cipher. Further, I don't think we should recommend anyone to still use a static key configuration, so remove the static key config examples. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20191109174235.20511-1-steffan@karger.me> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19081.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-07-05Implement --genkey type keyfile syntax and migrate tls-crypt-v2Arne Schwabe
This unifies our key generation and also migrates the generation of the tls-crypt-v2 keys. Since tls-crypt-v2 is not included in any released version, we remove the the old syntax without compatibility. PATCH V4: Introduce warning/error when using --secret with --genkey Update non code usages to use new --genkey syntax Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <20190613134834.5709-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg18524.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-02-06Fix various spelling mistakesJonathan Tooker
New patch, omitted changes to copyrights/licenses & changelog. Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20190123201717.15048-1-jonathan@reliablehosting.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg18177.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2018-12-12Uncrustify sample-plugin sources according to code styleGert Doering
Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <20181130135641.11533-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg17969.html Signed-off-by: David Sommerseth <davids@openvpn.net>
2018-08-05plugin: Export base64 encode and decode functionsDavid Sommerseth
This patch builds on the "Export secure_memzero() to plug-ins" patch and adds export of openvpn_base64_encode() and openvpn_base64_decode() This also ships with a very simple plug-in which demonstrates how to use the new exported functions. Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Selva Nair <selva.nair@gmail.com> Message-Id: <20170505214624.11675-1-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14558.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2018-02-01Update copyright to include 2018 plus company name changeDavid Sommerseth
The autumn of 2017, OpenVPN Technologies, Inc changed name to just OpenVPN Inc. Otherwise, extend the copyright to cover 2018 as well. With the exception of the company name change, all changes have been performed by the dev-tools/update-copyright.sh script. Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20180131140314.11103-1-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg16418.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-12-04Remove option to disable crypto engineAntonio Quartulli
With this patch we remove the possibility to disable the crypto engine (ENABLE_CRYPTO define) at configuration time. [--disable-crypto has been removed from .travis.yml too] Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20171203124952.15220-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15979.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-08-17Use consistent version referencesDavid Sommerseth
A simple clean-up where the version references have been unified all those places I could find now. The versioning scheme used is: * OpenVPN 2.x * v2.x We want to avoid: * 2.x (2.4 can be just an ordindary decimal number, OID reference, a version number or anything else) * OpenVPN v2.x (OpenVPN indicates we're talking about a version) In addition, several places where it made sense I tried to ensure the first version reference uses "OpenVPN 2.x" and the following references in the same section/paragraph uses "v2.x", to set the context for the version reference. In Changes.rst modified paragraphs exceeding 80 chars lines where reformatted as well. Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Steffan Karger <steffan@karger.me> Message-Id: <20170815205301.14542-1-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15260.html Signed-off-by: David Sommerseth <davids@openvpn.net>
2017-08-14sample-plugins: fix ASN1_STRING_to_UTF8 return value checksSteffan Karger
As we did in 2d032c7f for the ASN1_STRING_to_UTF8() calls in the core code, we should also free(buf) if the function returns 0. Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <1501238302-16714-1-git-send-email-steffan.karger@fox-it.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15161.html Signed-off-by: David Sommerseth <davids@openvpn.net>
2017-06-18Add a DSA test key/cert pair to sample-keysSteffan Karger
Makes it easier to test changes to DSA-related code. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20170618105740.10090-1-steffan@karger.me> URL: https://www.mail-archive.com/search?l=mid&q=20170618105740.10090-1-steffan@karger.me Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-06-16copyright: Update GPLv2 license textsDavid Sommerseth
The COPYRIGHT.GPL file was slightly out-of-sync with the last GPLv2 license from Free Software Foundation, Inc. The changes are primarily a new address, which required touching almost all the project files. Except of that, it is just minor adjustments to formatting, removal of form-feed characters and referencing "GNU Lesser General Public License" instead of "GNU Library General Public License". Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20170329093648.10156-1-davids@openvpn.net> URL: https://www.mail-archive.com/search?l=mid&q=20170329093648.10156-1-davids@openvpn.net Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-04-11Require minimum OpenSSL 1.0.1David Sommerseth
As RHEL 5 has reached EOL, we no longer need to support OpenSSL v0.9.8. This also makes it possible to remove a few workaronds which was needed earlier, as well as some left overs from v0.9.6. This also makes ./configure really stop running unless a new enough OpenSSL library is found. Compile tested on RHEL7.3 and RHEL6.7 (mock chroot build), both shipping openssl-1.0.1e. Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20170411173133.18060-1-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14441.html Signed-off-by: David Sommerseth <davids@openvpn.net>
2017-01-23git: Merge .gitignore files into a single fileDavid Sommerseth
We already track a lot of files over the whole directory structure in the main .gitignore file. But a few additional ones had been added into some of the subdirectories. This unifies all these files into a master file for the whole project, making it easier to know where to look at and edit if changes needs to be done. Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Steffan Karger <steffan@karger.me> Message-Id: <20170120210457.3383-1-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg13916.html Signed-off-by: David Sommerseth <davids@openvpn.net>
2016-12-21Update copyrightsDavid Sommerseth
Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Steffan Karger <steffan@karger.me> Message-Id: <1482350454-27280-2-git-send-email-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg13653.html
2016-12-14The Great Reformatting - first phaseDavid Sommerseth
This is the first commit of the big reformatting task. This is performed by running the ./dev-tools/reformat-all.sh script. This is based upon the v3 reformat-all.sh/uncrustify.conf version which is now applied to git master. Signed-off-by: David Sommerseth <davids@openvpn.net>
2016-10-28Add a revoked cert to the sample keysSteffan Karger
Allows for easier testing of the revocation functionality. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1477510159-5067-1-git-send-email-steffan@karger.me> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg12784.html Signed-off-by: David Sommerseth <davids@openvpn.net>
2016-08-25Use AES ciphers in our sample configuration files and add a few modern 2.4 ↵Arne Schwabe
examples [ DS: Fixed typos and removed added extra blank line, all commented by Steffan ] Acked-by: Steffan Karger <steffan@karger.me> Message-Id: 1468314848-11820-1-git-send-email-arne@rfc2549.org URL: http://www.mail-archive.com/search?l=mid&q=1468314848-11820-1-git-send-email-arne@rfc2549.org Signed-off-by: David Sommerseth <davids@openvpn.net>
2015-10-10sample-plugin: TLS Keying Material Exporter [RFC-5705] demonstration plug-inDaniel Kubec
A simple plug-in with a corresponding HTTP server and client which can authenticate an HTTP user based on the authentication already done via an established OpenVPN connection [DS: Renamed the module at commit time from sso to keyingmaterialexporter to avoid confusion with other Single-Sign-On solutions. Updated documentation and commits accordingly. Added --pull to the client config] Signed-off-by: Daniel Kubec <niel@rtfm.cz> Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: David Sommerseth <davids@redhat.com>
2015-07-27Provide OpenVPN runtime version information to plug-insDavid Sommerseth
Also updated the log_v3 sample-plugin to demonstrate how this works. $ openvpn --plugin log_v3.so --dev tun Fri Jul 10 15:17:28 2015 OpenVPN 2.3_git [git:dev/plugin-version/f05d8623a29078bf+]..... ...more.openvpn.logging... log_v3: OpenVPN 2.3_git (Major: 2, Minor: 3, Patch: git:dev/plugin-version/f05d8623a29078bf+) ...more.openvpn.logging... $ Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1436534548-21507-3-git-send-email-openvpn.list@topphemmelig.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/9904 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2015-02-22Use tls-auth in sample config filesSteffan Karger
For two reasons: 1) May motivate people to use tls-auth in their setups 2) Verify tls-auth functionality when running 'make check' Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1424614268-5078-1-git-send-email-steffan.karger@fox-it.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/9467 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2014-12-31Remove ENABLE_SSL define (and --disable-ssl configure option)Steffan Karger
Remove the --disable-ssl configure option and accompanying ENABLE_SSL defines in the master/2.4 branch, to reduce the code and testing complexity a bit. This does not remove to runtime option to run without SSL, just the compile time option to not include any SSL-related code. During the community meeting in November 2014 there were no objections amongst he developers present. Also, this has been announced on the -users and -devel mailing lists two weeks ago, without any response whatsoever. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <54A4248A.1090501@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9371 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2014-11-15Modernize sample keys and sample configsSteffan Karger
I kept most of the certificate properties equal to the old certs, since some people's test scripts might rely on them (and it does not require any creativity from my part). Changes: * Add script to generate fresh test/sample keys (but keep sample keys in git for simple testing) * Switch from 1024 to 4096 bits RSA CA * Switch from 1024 to 2048 bits client/server RSA keys * Switch from 1024 to 2048 bits Diffie-Hellman parameters * Generate EC client and server cert, but sign with RSA CA (lets us test EC <-> RSA interoperability) * Remove 3DES cipher from 'sample' config * Add 'remote-cert-tls server' to client config * Update config files to deprecate nsCertType in favour of the keyUsage and extendedKeyUsage extensions. * Make naming more consistent Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Samuli Seppänen <samuli@openvpn.net> Message-Id: <CAA1AbxKZr_E6Wk9GBbB3xpLyJzyBxSa1k21UDXnC90d8refUzw@mail.gmail.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/9226 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2014-07-13Add topology in sample server configuration filePhilipp Hagemeister
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) On modern systems, topology subnet should always be set, but it's missing in the configuration file. Add it with a short explanation. Signed-off-by: Philipp Hagemeister <phihag@phihag.de> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <53BF9998.5020906@phihag.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/8878 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2014-04-25Add an elliptic curve testing cert chain to the sample keysSteffan Karger
Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1398293018-8581-3-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/8601 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2014-04-13Fix typo in sample build script to use LDFLAGSkangsterizer
Came in as github pull request #15 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-By: Arne Schwabe <arne@rfc2549.org>
generated by cgit v1.1 at 2024-10-06 18:19:11 +0000