aboutsummaryrefslogtreecommitdiff
path: root/src/openvpn/options.h
AgeCommit message (Collapse)Author
2016-12-14The Great Reformatting - first phaseDavid Sommerseth
This is the first commit of the big reformatting task. This is performed by running the ./dev-tools/reformat-all.sh script. This is based upon the v3 reformat-all.sh/uncrustify.conf version which is now applied to git master. Signed-off-by: David Sommerseth <davids@openvpn.net>
2016-11-23Poor man's NCP for non-NCP peersSteffan Karger
Allows non-NCP peers (<= 2.3, or 2.4+ with --ncp-disable) to specify a --cipher that is different from the one in our config, as long as the new cipher value is allowed (i.e. in --ncp-ciphers at our side). This works both client-to-server and server-to-client. I.e. a 2.4 client with "cipher BF-CBC" and "ncp-ciphers AES-256-GCM:AES-256-CBC" can connect to both a 2.3 server with "cipher BF-CBC" as well as a server with "cipher AES-256-CBC" in its config. The other way around, a 2.3 client with either "cipher BF-CBC" or "cipher AES-256-CBC" can connect to a 2.4 server with e.g. "cipher BF-CBC" and "ncp-ciphers AES-256-GCM:AES-256-CBC" in its config. This patch was inspired by Gert's "Poor man's NCP for 2.3 clients" patch, but takes a different approach to avoid the need for server-side scripts or client-side 'setenv UV_*' tricks. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1479936104-4045-1-git-send-email-steffan@karger.me> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg13218.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2016-11-16Add control channel encryption (--tls-crypt)Steffan Karger
This adds a --tls-crypt option, which uses a pre-shared static key (like the --tls-auth key) to encrypt control channel packets. Encrypting control channel packets has three main advantages: * It provides more privacy by hiding the certificate used for the TLS connection. * It is harder to identify OpenVPN traffic as such. * It provides "poor-man's" post-quantum security, against attackers who will never know the pre-shared key (i.e. no forward secrecy). Control channel packet encryption --------------------------------- We propose to use the following encryption method, based on the SIV construction [0], to achieve nonce misuse-resistant authenticated encryption: msg = control channel plaintext header = opcode (1 byte) || session_id (8 bytes) || packet_id (8 bytes) Ka = authentication key (256 bits) Ke = encryption key (256 bits) (Ka and Ke are pre-shared keys, like with --tls-auth) auth_tag = HMAC-SHA256(Ka, header || msg) IV = 128 most-significant bits of auth_tag ciph = AES256-CTR(Ke, IV, msg) output = Header || Tag || Ciph This boils down to the following on-the-wire packet format: -opcode- || -session_id- || -packet_id- || auth_tag || * payload * Where - XXX - means authenticated, and * XXX * means authenticated and encrypted. Which is very similar to the current tls-auth packet format, and has the same overhead as "--tls-auth" with "--auth SHA256". The use of a nonce misuse-resistant authenticated encryption scheme allows us to worry less about the risks of nonce collisions. This is important, because in contrast with the data channel in TLS mode, we will not be able to rotate tls-crypt keys often or fully guarantee nonce uniqueness. For non misuse-resistant modes such as GCM [1], [2], the data channel in TLS mode only has to ensure that the packet counter never rolls over, while tls-crypt would have to provide nonce uniqueness over all control channel packets sent by all clients, for the lifetime of the tls-crypt key. Unlike with tls-auth, no --key-direction has to be specified for tls-crypt. TLS servers always use key direction 1, and TLS clients always use key direction 2, which means that client->server traffic and server->client traffic always use different keys, without requiring configuration. Using fixed, secure, encryption and authentication algorithms makes both implementation and configuration easier. If we ever want to, we can extend this to support other crypto primitives. Since tls-crypt should provide privacy as well as DoS protection, these should not be made negotiable. Security considerations: ------------------------ tls-crypt is a best-effort mechanism that aims to provide as much privacy and security as possible, while staying as simple as possible. The following are some security considerations for this scheme. 1. The same tls-crypt key is potentially shared by a lot of peers, so it is quite likely to get compromised. Once an attacker acquires the tls-crypt key, this mechanism no longer provides any security against the attacker. 2. Since many peers potentially use the tls-crypt key for a long time, a lot of data might be encrypted under the tls-crypt key. This leads to two potential problems: * The "opcode || session id || packet id" combination might collide. This might happen in larger setups, because the session id contains just 64 bits or random. Using the uniqueness requirement from the GCM spec [3] (a collision probability of less than 2^(-32)), uniqueness is achieved when using the tls-crypt key for at most 2^16 (65536) connections per process start. (The packet id includes the daemon start time in the packet ID, which should be different after stopping and (re)starting OpenPVN.) And if a collision happens, an attacker can *only* learn whether colliding packets contain the same plaintext. Attackers will not be able to learn anything else about the plaintext (unless the attacker knows the plaintext of one of these packets, of course). Since the impact is limited, I consider this an acceptable remaining risk. * The IVs used in encryption might collide. When two IVs collide, an attacker can learn the xor of the two plaintexts by xorring the ciphertexts. This is a serious loss of confidentiality. The IVs are 128-bit, so when HMAC-SHA256 is a secure PRF (an assumption that must also hold for TLS), and we use the same uniqueness requirement from [3], this limits the total amount of control channel messages for all peers in the setup to 2^48. Assuming a large setup of 2^16 (65536) clients, and a (conservative) number of 2^16 control channel packets per connection on average, this means that clients may set up 2^16 connections on average. I think these numbers are reasonable. (I have a follow-up proposal to use client-specific tls-auth/tls-crypt keys to partially mitigate these issues, but let's tackle this patch first.) References: ----------- [0] Rogaway & Shrimpton, A Provable-Security Treatment of the Key-Wrap Problem, 2006 (https://www.iacr.org/archive/eurocrypt2006/40040377/40040377.pdf) [1] Ferguson, Authentication weaknesses in GCM, 2005 (http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/comments/CWC-GCM/Ferg uson2.pdf) [2] Joux, Authentication Failures in NIST version of GCM, 2006 (http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/comments/800-38_Serie s-Drafts/GCM/Joux_comments.pdf) [3] Dworking, Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC, 2007 (http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf) Patch history: -------------- v2 - processed Arne's review comments: * Error out early with a clear error message when AES-256-CTR or HMAC-SHA-256 are not supported by the crypto library. * Clarify that cipher_ctx_reset() sets the IV. v3 - actually add error messages promised in v2... Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1479216586-20078-1-git-send-email-steffan.karger@fox-it.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg13069.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2016-11-15Replace WIN32 by _WIN32Gert Doering
With c99, "WIN32" is no longer automatically defined when (cross-)building for Windows, and proper compilation relies on including <windefs.h>, before checking the macro. "_WIN32" is the official define that is guaranteed to be defined by the compiler itself, no includes are needed. So, mechanically change all occurrances of "WIN32" to "_WIN32". While at it, get rid of unused WIN32_0_1 #define in syshead.h See also: http://nadeausoftware.com/articles/2012/01/c_c_tip_how_use_compiler_predefi ned_macros_detect_operating_system#WindowsCygwinnonPOSIXandMinGW Trac #746 v2: rebased to master, merge the console[_builtin].c changes Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20161113195228.74090-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg13035.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2016-11-04Drop recursively routed packetsLev Stipakov
v4: - Account for IP header offset in TAP mode - Correct handle of non-IP protocols in TAP mode v3: Use better way of figuring out IP proto version which does not break TAP mode. Add an option to allow recursive routing, could be useful when packets sent by openvpn itself are not subject to the routing tables that would move packets into the tunnel. v2: better method naming On certain OSes (Windows, OS X) when network adapter is disabled (ethernet cable pulled off, Wi-Fi hardware switch disabled), operating system starts to use tun as an external interface. Outgoing packets are routed to tun, UDP encapsulated, given to routing table and sent to.. tun. As a consequence, system starts talking to itself on full power, traffic counters skyrocket and user is not happy. To prevent that, drop packets which have gateway IP as destination address. Tested on Win7/10, OS X, Linux. Trac #642 Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1478208503-25929-1-git-send-email-lstipakov@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg12894.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2016-10-31auth-gen-token: Add --auth-gen-token optionDavid Sommerseth
This sets the flag if the OpenVPN server should create authentication tokens on-the-fly on successful --auth-user-pass-verify or --plugin with OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY processing. If an OpenVPN server is running without this option, it should behave as before. Next patches will implement the auth-token generation and passing it on to the clients. The --auth-gen-token can be given an optional integer argument which defines the lifetime of generated tokens. The lifetime argument must be given in number of seconds. v2 - Update Changes.rst - Improve man page in regards to lifetime argument - Rename struct member auth_generate_token to auth_token_generate to have a consistent naming scheme Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Steffan Karger <steffan@karger.me> Message-Id: <1477684124-26083-2-git-send-email-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg12825.html
2016-10-14Remove tun-ipv6 Option. Instead assume that IPv6 is always supported.Arne Schwabe
This option was useful when IPv6 tun support was non standard and was an internal/user specified flag that tracked the Ipv6 capability of the tun device. All supported OS support IPv6. Also tun-ipv6 is pushable by the remote so not putting tun-ipv6 does not forbid ipv6 addresses. This commit also clean up a bit of the ipv6 related tun.c. Changes for most platforms are minimal. For linux a bit more cleanup is done: - Remove compatibility defines that were added 2008 - Always use IFF_NO_PI for the linux tun and not only for IPv4 only tun setups (Android also always IFF_NO_PI works fine with Ipv6). This commit also remove a non ipv6 fallback for tap driver from OpenVPN 2.2-beta or earlier and only warns. Patch V2: Integrate Gert's comments Patch V3: Remove tun_ipv4 option. It only used for MTU discovery and there it was wrong since it should on the transport protocol if at all Patch V4: Completely remove support for NetBSD <= 4.0 and remove NETBSD_MULTI_AF defines Patch V5: Assume generic OS in tun.c is also IPv6 capable. Add changes to man page. Fix typos/change message as suggest by David. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1476377656-3150-1-git-send-email-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg12695.html Signed-off-by: David Sommerseth <davids@openvpn.net>
2016-07-26Fix '--cipher none --cipher' crashSteffan Karger
As reported in trac #699, OpenVPN crashes when an "--cipher none" option is followed by "--cipher" (without arguments). Fix this by removing the redudant ciphername_defined and authname_defined members of struct options, and remove support to specify --cipher or --auth without an argument. That not only fixes the issue, but also cleans up the code a bit. v2: don't print a deprecating warning (we'll do that in the 2.3 branch), but just rip out support for --cipher and --auth without an argument. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1469541338-1530-1-git-send-email-steffan.karger@fox-it.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/12106 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2016-07-11Add options to restrict cipher negotiationSteffan Karger
Add --ncp-disable to completely disable cipher negotiation, and --ncp-ciphers to specify which ciphers to accept from the server. v2: * fix --disable-crypto builds * use register_signal() instead of operating directly on c->sig * add man-page entry for new options v3: * rebased on client-side NCP v3 v4: * rebased on client-side NCP v4 Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1467149700-10042-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/12008 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2016-07-11Exponentially back off on repeated connect retriesSelva Nair
- When the number of retries per remote exceeds a limit (hard coded to 5), double the restart pause interval for each additional retry per remote. - Trigger a SIGHUP to reset the retry count when the pause interval exceeds 1024 times the base value of restart pause. (removed in v2 of the patch) The base value of restart pause is set using --connect-retry (5 seconds by default). v2 changes (based on suggestions from Arne Schwabe <arne@rfc2549.org>) - Do not throw SIGHUP. - Add an optional argument to "--connect-retry n [m]" where 'm' specifies the max value of restart pause interval (default 300 sec). E.g., "--connect-retry 5 1800" will cause the restart pause to scale up starting at 5 until it exceeds 1800 seconds at which point it gets capped at 1800. - If n == m no slow down will occur. - While at it, fix typos and clarify the description of connect-retry-max in the man page and Changes.rst v3 changes (on further feedback from arne@rfc2549.org): - Limiting the base value of retry wait interval to 16 bits moved to options.c - Apply backoff only in the udp and tcp-client modes. Backing off on tcp-server could be exploited by a client in p2p-mode to maliciously slow it down (thanks to Arne Schwabe for pointing this out. - Fix typo in Changes.rst: "third argument" -> "second argument" Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1467732770-19110-1-git-send-email-selva.nair@gmail.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/12050 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2016-06-24Remove http-proxy-retry and socks-proxy-retry.Arne Schwabe
These options were probably introduced long before we had multiple remote/connection entries. For all other connection entries, OpenVPN will go on with the next connection if it fails. For proxies, if it fails in some ways it works the same, for other failures it completely stops. Removing the *-proxy-retry and defaulting to retry makes the behavior more predictiable. Stopping after one try (regardless of reason) can be achieved with --max-connect-retry 1 V2: Add reason for removing, remove from manpage, give a hint at --max-connet-retry V3: Collapse the two ifs in options.c to one block Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1466771230-5266-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/11988 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2016-06-11Remove http-proxy-timeout, socks timeout and set default of ↵Arne Schwabe
server-poll-timeout to 120s With this change all timeouts before the first packet from the OpenVPN server are unified into the server-poll-timeout option. The default of 120s has been chosen to be a safe value is larger as it is larger the sums of the old small timeouts. V3: fix some whitespace/typos problems Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1465656195-12722-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/11899 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2016-06-07Add an option to filter options received from serverSelva Nair
v2 changes: - Add the flag "ignore" and have "reject" trigger a restart. - Unlimited number of filters: yes, going against the consensus, but the code looks simpler and cleaner this way. - New commit message to reflect the changes. Usage: --pull-filter accept|ignore|reject "option" Permit a client to selectively accept, ignore or reject options pushed by the server. May be used multiple times. The filters are applied in the order specified to each pushed option received. The filtering stops as soon as a match is found. The action "ignore" removes the option and continues processing the next option, while "reject" flags an error and restarts the connection with SIGUSR1. Prefix matching is used so that all options starting with the specified "option" string are filtered. Example: pull-filter accept "route 192.168." pull-filter ignore "route " pull-filter accept "ifconfig 10.9.0." pull-filter reject "ifconfig " will ignore all pushed routes except those starting with "192.168." and reject the assigned ip unless its in the "10.9.0.0/24" range. A match of the reject filter will trigger a restart. SIGUSR1 restart is used instead of SIGHUP so as to try the next remote for reconnection. Note the space at the end of "route " to not reject "route-gateway", for example. All options not matched by any filter are accepted. Acknowledges shameless imitation of --push-remove. Inspired by Trac #682. Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1465162884-32520-1-git-send-email-selva.nair@gmail.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/11808 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2016-05-16Implement push-remove option to selectively remove pushed options.Gert Doering
With this option, the server can remove individual options from the set pushed to a client (call from --client-config-dir file, or from --client-connect script or plugin). Options are removed at parse time, so it is possible to do stuff like: push-remove route-ipv6 push "route-ipv6 fd00::/8" to first remove all IPv6 route options set so far, then add something specific (what "push-reset" does to all the options). Arguments to push-remove are strncmp()'ed to option string, so partial matches like push-remove "route-ipv6 2001:" are possible ("remove all IPv6 routes starting with 2001:"). Implementation of remove_iroutes_from_push_route_list() had to be changed slightly to stop it from re-enabling all disabled options again. v2: documentation (Changes.rst, doc/openvpn.8) remove surplus gc_arena implement filtering of "ifconfig-ipv6" v3: correct quoting in commit message only handle a single argument per push-remove statement - if multiple options are to be removed, just use multiple push-remove statements Trac #29, #614 Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1463393584-8318-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/11665 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2016-04-28Migrate to mbed TLS 2.xSteffan Karger
PolarSSL / mbed TLS 1.3 is going end-of-life by 2016-12-31, so let's move the master branch on to the 2.x series. This patch purges all references to polarssl, except for file names and some comments referring to 1.2 and earlier, which were never released as 'mbed TLS'. A separate patch for the file names follows, so the real changes are easier to spot without git-fu. This patch intends to not change any behaviour. The vast majority of this patch is just renaming functions and structs. There are some small changes in the implementation: * In ssl_polarssl.c: the debug callback prototype changed, so our implementation changed a bit too. * in ssl_polarssl.c: the old polarssl ssl_context is now split into a mbedtls_ssl_config and mbedtls_ssl_context. The intention is that mbedtls_ssl_config is shared among connections, and mbedtls_ssl_context contains the per-connection state. That doesn't work for us, because we use per-connection verify callback data, while the verify callback is registered on mbed_tls_config. Therefore we still need to init a mbed_tls_config struct for each connection. * in ssl_polarssl.c: the mbed bio handling changed, so our implementation changed a bit too. * in ssl_polarssl.c and ssl_verify_polarssl.c: the mbedtls x509 parse functions now fail if we don't provide a NUL-terminated string, so use strlen()+1 as the length argument to include the terminating NUL. I tested this patch to work with: * 'make check' (with 2.0.0 and 2.2.1, other tests just with 2.2.1) * static key mode * TLS mode with PEM key file * TLS mode with password protected PEM key file * TLS mode with management-external-key * TLS mode with PKCS#11 * TLS mode with inline ca/key/cert/dh Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1460918143-408-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/11458 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2016-04-28Implemented x509-track for PolarSSL.Steffan Karger
This patch is a variant of the patch to implement x509-track for PolarSSL that was sent to openvpn-devel@ by James Yonan (<1456993146-63968-7-git-send-email-james@openvpn.net>). It still uses some of the original code from James, but proposes a different implementation. This patch does the following things differently: * Do not introduce NID_* defines that need to be maintained. Instead, just use the short name of the attribute for identification. This has the advantage that we automatically support everything that PolarSSL supports, it is less code and we do not have maintain the list. But the disadvantage is that this approach will not error out when an unknown attribute name is supplied. PolarSSL (at least 1.3, I didn't check 2.x) does not provide the functions required to do that. Instead of erroring out, this implementation will just silently ignore the unknown --x509-track attribute name. * Remove the ENABLE_X509_TRACK define completely - it depended just on ENABLE_CRYPTO anyway. * Move the --x509-track option parsing out of ENABLE_MANAGEMENT, since it does not depend on management functionality. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <CAA1AbxL1w8e_o-GjS2jETZWxYdMbS2iKABPc6OZBA8bOVycjtA@mail.gmail.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/11350 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2016-04-04Implement inlining of crl filesArne Schwabe
While crl files can change regulary and it is usually not a good idea to statically include them into config files, handling multiple files and updating files on mobile devices is tiresome/problematic. Inlining a static version of the crl file is better in these use cases than to use no crl at all. OpenVPN 3 already supports inlining crl-verify, so <crl-verify> is already used in config files. V2: Fixed PolarSSL and made formatting respect the 80 column limit V3: Accidentally reverted one change too much in V2 Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1457293149-10526-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/11337 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2016-02-05interactive service v3Heiko Hund
v1: Heiko Hund - Message-ID: <2215306.x9ci9DhAZ9@de-gn-40970> - extend openvpn service to provide "automatic service" and "interactive service" (which is used by GUI and OpenVPN to run openvpn non-privileged and still be able to install routes and configure IPv6 addresses) - add --msg-channel <n> option to openvpn to tell it which pipe to use to talk to the interactive service (used in tun.c for ifconfig + ARP flush, and route.c for routing) - add openvpn-msg.h with message definitions for talking to interactive service - routing in openvpn uses message-pipe automatically if --msg-channel <n> is configured, no other option needed - today, the integration in route.c and tun.c is windows-only, but could be adapted to other platforms v2: Steffan Karger - Message-ID: <548D9046.5000600@karger.me> - include "openvpn-msg.h" not "include/openvpn-msg.h" - add $(top_srcdir)/include to openvpnsrv build for out-of-tree builds v3: Gert Doering, rebasing and integrating review feedback - rebased to 417fe4a72c - r->metric_defined is now r->flags & RT_METRIC_DEFINED (c3ef2d2333fb) - move "openvpn-msg.h" include inside #ifdef WIN32 (windows-only right now) - hide "msg_channel" extra option inside tt->tuntap_options, so we do not need an extra argument to all the add/del_route...() functions - do_route_ipv6_service(): use r->adapter index (if set) for RGI6 routes Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Selva Nair <selva.nair@gmail.com> (Service changes) Acked-by: Arne Schwabe <arne@rfc2549.org> (OpenVPN changes) Message-Id: <1453835508-26119-1-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/11027 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2015-12-30Detecting and logging Windows versionsLev Stipakov
Also send it with peer-info as IV_PLAT_VER. Signed-off-by: Lev Stipakov <lstipakov@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1451422957-23951-1-git-send-email-lstipakov@gmail.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/10904 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2015-12-13Add Windows DNS Leak fix using WFP ('block-outside-dns')ValdikSS
This option blocks all out-of-tunnel communication on TCP/UDP port 53 (except for OpenVPN itself), preventing DNS Leaks on Windows 8.1 and 10. This is the same patch as dd628d2e0d786e4 in release/2.3, except that it is always compiled (on WIN32) here - we already require compilation for Vista+ in master (-> 2.4). Reviewed-by: Selva Nair <selva.nair@gmail.com> Reviewed-by: Lev Stipakov <lstipakov@gmail.com> Reviewed-by: James Yonan <james@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1449780715-4027-1-git-send-email-iam@valdikss.org.ru> URL: http://article.gmane.org/gmane.network.openvpn.devel/10744 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2015-11-24Fix memory leak in add_option() by simplifying get_ipv6_addrSteffan Karger
If get_ipv6_addr() would fail *after* allocating memory for ipv6_local, add_option() would fail to free that memory. The fix here is to remove the allocation from get_ipv6_addr(), and create a separate function for the strip-and-allocate, such that failures are easier to handle. v2 - remove free(options->ifconfig_ipv6_local), since that is now handled by a garbage collector. Memory leak found by coverity (in 2011!). Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1448312335-25908-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/10573 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit 7e618994f3112ff4b29b9f08d087fb558636a6af)
2015-11-22Notify clients about server's exit/restartLev Stipakov
When server exits / restarts (gets SIGUSR1, SIGTERM, SIGHUP, SIGINT) and explicit-exit-notify is set, server sends RESTART control channel command to all clients and reschedules received signal in 2 secs. When client receives RESTART command, it either reconnects to the same server or advances to the new one, depends on parameter comes with RESTART command - behavior is controlled by explicit-exit-notify in the server config. v4: - Rebase on top of master - Remove #ifdef ENABLE_OCC around connection_entry->explicit_exit_notification since it is also used outside of OCC context - Update usage message v3: - Use control channel "RESTART" command instead of new OCC code to notify clients - Configure on the server side (by value of explicit-exit-notify) if client should reconnect to the same server or advance to the next one - Fix compilation when OCC is disabled (--enable-small) - Update man page v2: - Take into use explicit-exit-notify on the server side - OCC_SHUTTING_DOWN renamed to OCC_SERVER_EXIT - Code prettifying Signed-off-by: Lev Stipakov <lstipakov@gmail.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1447752827-16720-1-git-send-email-lstipakov@gmail.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/10515 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2015-10-10Added support for TLS Keying Material Exporters [RFC-5705]Daniel Kubec
Keying Material Exporter [RFC-5705] allow additional keying material to be derived from existing TLS channel. This exported keying material can then be used for a variety of purposes. [DS: Updated man page to document both upper and lower length boundaries] Signed-off-by: Daniel Kubec <niel@rtfm.cz> Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Steffan Karger <steffan.karger@fox-it.com Acked-by: David Sommerseth <davids@redhat.com>
2015-09-15Remove #ifdefs for client nat support.Arne Schwabe
The client-nat feature was always unconditionally enabled Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1442309019-7586-3-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/10109 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2015-04-13Mac OS X Keychain management clientVasily Kulikov
This patch adds support for using certificates stored in the Mac OSX Keychain to authenticate with the OpenVPN server. This works with certificates stored on the computer as well as certificates on hardware tokens that support Apple's tokend interface. The patch is based on the Windows Crypto API certificate functionality that currently exists in OpenVPN. This patch version implements management client which handles RSA-SIGN command for RSA offloading. Also it handles new 'NEED-CERTIFICATE' request to pass a certificate from the keychain to OpenVPN. OpenVPN itself gets new 'NEED-CERTIFICATE" command which is called when --management-external-cert is used. It is implemented as a multiline command very similar to an existing 'RSA-SIGN' command. The patch is against commit 3341a98c2852d1d0c1eafdc70a3bdb218ec29049. v4: - added '--management-external-cert' argument - keychain-mcd now parses NEED-CERTIFICATE argument if 'auto' is passed as cmdline's identity template - fixed typo in help output option name - added '--management-external-cert' info in openvpn(8) manpage - added 'certificate' command documentation into doc/management-notes.txt v3: - used new 'NEED-CERTIFICATE' command for certificate data request instead of 'NEED-OK' - improved option checking - improved invalid certificate selection string handling - added man page for keychain-mcd - handle INFO, FATAL commands from openvpn and show them to user * ACK from Arne Schwabe for OpenVPN part * ACK from James based on Arne's testing v2 (http://sourceforge.net/p/openvpn/mailman/message/33225603/): - used management interface to communicate with OpenVPN process v1 (http://sourceforge.net/p/openvpn/mailman/message/33125844/): - used RSA_METHOD to extend openvpn itself Signed-off-by: Vasily Kulikov <segoon@openwall.com> -- Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20150225160718.GA6306@cachalot> URL: http://article.gmane.org/gmane.network.openvpn.devel/9486 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2014-12-31Remove ENABLE_SSL define (and --disable-ssl configure option)Steffan Karger
Remove the --disable-ssl configure option and accompanying ENABLE_SSL defines in the master/2.4 branch, to reduce the code and testing complexity a bit. This does not remove to runtime option to run without SSL, just the compile time option to not include any SSL-related code. During the community meeting in November 2014 there were no objections amongst he developers present. Also, this has been announced on the -users and -devel mailing lists two weeks ago, without any response whatsoever. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <54A4248A.1090501@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9371 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2014-11-27Peer-id patch v7Lev Stipakov
Added new packet format P_DATA_V2, which includes peer-id. If server supports, client sends all data packets in the new format. When data packet arrives, server identifies peer by peer-id. If peer's ip/port has changed, server assumes that client has floated, verifies HMAC and updates ip/port in internal structs. Changes in v7: A few nitpicks. Changes in v6: Fixed: Make sure float won't happen if hmac check failed (regression). Fixed: Access outside of bounds of array, which has caused memory corruption and crash. Various review fixes. Changes in v5: Protection agains replay attack by commiting float changes only after existing packet processing flow has completed. If peer floats to an address which is already taken by another active session, drop float packet, otherwise disconnect existing session. Changes in v4: Handles correctly float to an address which is used by another peer. This also has fixed crash on assert in multi_client_disconnect. Changes in v3: Bugfix: If float happens after TLS renegotiation and there are no data packets between reneg and float, server will not recognize floated client. Acked-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1416755831-21250-1-git-send-email-lstipakov@gmail.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/9270 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2014-07-18Always enable http-proxy and socks-proxyArne Schwabe
Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1404735142-31420-2-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8840 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2014-05-20Fixed some compile issues with show_library_versions()James Yonan
* Refactored show_library_versions to work around the fact that some compilers (such as MSVC 2008) can't handle #ifdefs inside of macro references. * Declare show_library_versions() in options.h because it's referenced by other files such as openvpn.c. * Declare get_ssl_library_version() as returning const char *, to avoid loss of const qualifier in ssl_openssl.c. Signed-off-by: James Yonan <james@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1399589436-8730-7-git-send-email-james@openvpn.net> URL: http://article.gmane.org/gmane.network.openvpn.devel/8711 Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit a91a2d6ad7b139ec78d61c8616b8447847e9ecc6)
2014-04-25Add support for elliptic curve diffie-hellmann key exchange (ECDH)Steffan Karger
This patch is based on Jan Just Keijser's patch from Feb 7, 2012. When OpenSSL 1.0.2+ or PolarSSL is used, lets the crypto library do the heavy lifting. For OpenSSL builds, if a user specifies a curve using --ecdh-curve, it first tries to override automatic selection using that curve. For older OpenSSL, tries the following things (in order of preference): * When supplied, use the ecdh curve specified by the user. * Try to extract the curve from the private key, use the same curve. * Fall back on secp384r1 curve. Note that although a curve lookup might succeed, OpenSSL 1.0.0 and older do *not* support TLSv1.1 or TLSv1.2, which means no that no EC-crypto can be used. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <53597BEA.6080408@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/8625 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2014-03-23Introduce an option to resolve dns names in advance for --remote, --local ↵Arne Schwabe
and --http-proxy Also introduce x_gc_addspeical function that allows to add objects with a custom free function to the gc. Some additional addrinfo cleanup Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1395576786-17507-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8386 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2014-03-22Implement an easy parsable log output that allows access to flags of the log ↵Arne Schwabe
message Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1395407925-25518-5-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8374 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2014-02-23grow route lists dynamicallyHeiko Hund
This removes the need for the --max-routes option. Instead of allocating a fixed size array for the route(-option)s they are managed in linked lists instead. Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1392746395-19246-1-git-send-email-heiko.hund@sophos.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/8295 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2014-01-07Fix spurious ignoring of pushed config options (trac#349).Jens Wagner
The function incoming_push_message(...) in push.c uses a local variable option_types_found, that gets passed to do_up(...). If the server push got split into several parts, only the last part (PUSH_MSG_REPLY) option_types_found is used for do_up (initilized as 0 locally), the previous ones (PUSH_MSG_CONTINUATION) are ignored. So e.g. a ping config, pushed by the server in the first push, followed by a lot of "push route" configs, causing a second push message, will have the do_up() called, but without e.g. the OPT_P_TIMER flag, so those options will be silently ignored. The patch resolves that, by introducing "push_option_types_found" in "c->options" and using that as storage. Fix trac bug #349. Acked-by: Gert Doering <gert@greenie.muc.de> URL: https://community.openvpn.net/openvpn/ticket/349 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2013-11-29Implement listing on IPv4/IPv6 dual socket on all platformArne Schwabe
With this patch OpenVPN will listen on Ipv4 as well as IPv6 when an IPv6 socket is used. Using bind ipv6only will disable this behavior Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1385382680-5912-7-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8052 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2013-11-29Implement dual stack client support for OpenVPNArne Schwabe
This patch contains a number of changes. I did not further spit this since some changes make only sense being changed together. Always use connection_list, simplifies the reconnection logic. Change meaning of --connect-retry-max and --connect-retry to be used all connections. This now allows OpenVPN to quit after n unsuccessful udp connection attempts Remove the tcp reconnection logic. Failing a TCP connection will now cause a USR1 like a UDP connection. Also extend sig->source from bool to int to specify signal source. This allows a finer grained reconnection logic if necessary in the future. Dual-Stack support: if an address resolves to multiple records each address is tried in sequential order. Then proceed to next connection entry. Introduce the field current_remote to represent the current connecting remote. Also change some fields to struct addrinfo* form openvn_addr to store multiple addresses needed for the dual stack support. Change meaning from udp and tcp to allow both IPv4 and IPv6. Introducue new udp4 and tcp4 to force IPv4. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1385382680-5912-6-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8058 Signed-off-by: Gert Doering <gert@greenie.muc.de> Message-ID: <20131129194258.GL161@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8071 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2013-11-26Remove the ip-remote-hint option.Arne Schwabe
The ip-remote-hint option overrides the remote hostname of every remote/connection entry unless management-query-remote is also defined and the management interfaces overrides the option with remote MOD. The remote name is even overridden when when management interface issues remote ACCEPT after being presented with the non overridden remote. Overriding all remote options can also be done by management-query-remote and issuing remote MOD or by changing alll remote statements in the configuration. Also: remove unused variable newcycle Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1385382680-5912-3-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8057 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2013-11-24Split the PROTO_UDP_xx options into AF_INET/AF_INET6 and PROTO_TCP/PROTO_UDP ↵Arne Schwabe
part. Splitting will make the code a little bit cleaner and prepares for dual stack Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1385236624-3776-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8043 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2013-11-22Change the type of all ports in openvpn to const char* and let getaddrinfo ↵Arne Schwabe
resolve the port together with the hostname. This delays error reporting from config parsing to resolving of host addresses. But it allows statements like remote openvpn.example.org openvpn port https management localhost ntp Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1385064495-25877-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8018 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2013-08-16Add support to ignore specific options.Arne Schwabe
Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1376640664-26379-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7799 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2013-05-31Move settings of user script into set_user_script functionArne Schwabe
This also fixes commit 567bfc06d051b60e9cdca1f5bb468631b899682a if not all script options are available by setting options->user_script_used Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1369945603-17169-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/7634 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2013-05-19Added support for the Snappy compression algorithmJames Yonan
Added support for the Snappy compression algorithm which has shown to have considerably better compression speed than LZO at a comparable compression ratio. To enable Snappy add: compress snappy to both client and server config files. Alternatively, enable compression framing on the client: compress and have the server selectively push "compress snappy" to the client. This change also extends the client capability handshake to include IV_SNAPPY so the server can be aware that a connecting client supports Snappy. Note that the Snappy implementation also includes an improved framing approach where the first byte of the compressed payload is replaced by the compression control byte (the first payload byte is moved to the end of the packet). This solves off-by-one alignment issues, which improves performance on ARM. By default, the configure script will try to build with Snappy support. To disable, use the --disable-snappy option. The --enable-lzo-stub configure directive is now --enable-comp-stub (because it's not actually "lzo" but "compression-enabled packet framing") Add compression overhead to extra buffer unconditionally, as long as USE_COMP is defined. OpenVPN SVN r8206 (2.1.21a) and r8212 (2.1.21b) Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1366393268-27392-3-git-send-email-gert@greenie.muc.de> URL: http://article.gmane.org/gmane.network.openvpn.devel/7531 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2013-03-07add new option for X.509 name verificationHeiko Hund
Add the option --verify-x509-name to provide the functionality of the now deprecated --tls-remote. The new option accepts RFC 2253 subject DNs only and compares RDN or RDN prefix only if configured explicitly. Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: 1362670601-18660-1-git-send-email-heiko.hund@sophos.com URL: http://article.gmane.org/gmane.network.openvpn.devel/7376 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2012-07-19add option --management-query-proxyHeiko Hund
Make openvpn query for proxy information through the management interface. This allows GUIs to provide (automatically detected) proxy information on a per connection basis. This new option supersedes the undocumented --http-proxy-fallback option and puts the responsibilty for HTTP proxy fallback handling to the GUI caring for such. Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Reviewed-by: James Yonan <james@openvpn.net> Message-Id: 1342009010-9735-1-git-send-email-heiko.hund@sophos.com URL: http://article.gmane.org/gmane.network.openvpn.devel/6841 Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
2012-06-22Remove ENABLE_CONNECTIONS ifdefsArne Schwabe
Connections were always on for a long time. Note that ENABLE_MAMAGEMENT_REMOTE was only depending on ENABLE_CONNECTIONS and is removed as well Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: James Yonan <james@openvpn.net> Message-Id: 1340044749-10694-5-git-send-email-arne@rfc2549.org URL: http://article.gmane.org/gmane.network.openvpn.devel/6744 Signed-off-by: David Sommerseth <davids@redhat.com>
2012-06-22Remove ENABLE_INLINE_FILES conditionalsArne Schwabe
This code is always enabled and removing the #ifdef make the code a little bit clearer Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: James Yonan <james@openvpn.net> Message-Id: 1340044749-10694-4-git-send-email-arne@rfc2549.org URL: http://article.gmane.org/gmane.network.openvpn.devel/6746 Signed-off-by: David Sommerseth <davids@redhat.com>
2012-06-22Completely remove ancient IANA port warning.Arne Schwabe
Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: 1340044749-10694-3-git-send-email-arne@rfc2549.org URL: http://article.gmane.org/gmane.network.openvpn.devel/6742 Signed-off-by: David Sommerseth <davids@redhat.com>
2012-06-22Only use tmpdir if tmp_dir is really used.Arne Schwabe
This fixes starting openvpn compiled as client only version of systems that have no /tmp (Android). --tmp-dir could only be set if P2MP_SERVER has been enabled too. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: 1340044749-10694-2-git-send-email-arne@rfc2549.org URL: http://article.gmane.org/gmane.network.openvpn.devel/6741 Signed-off-by: David Sommerseth <davids@redhat.com>
2012-06-13remove the --auto-proxy option from openvpnHeiko Hund
During discussion on FOSDEM 2012 it was decided that proxy auto detection is best done in the GUI as it's highly platform specific and shouldn't be handled in openvpn itself for every supported platform in openvpn itself. This removes --auto-proxy from openvpn. Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Acked-by: David Sommerseth <davids@redhat.com> Message-Id: 1328446029-30523-1-git-send-email-heiko.hund@sophos.com URL: http://article.gmane.org/gmane.network.openvpn.devel/5333 Signed-off-by: David Sommerseth <davids@redhat.com>
2012-06-01Remove two unused functionsDavid Sommerseth
Both is_persist_option() and is_stateful_restart() functions where never used anywhere in the code. Remove them. Signed-off-by: David Sommerseth <davids@redhat.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: 1336036240-23838-1-git-send-email-dazo@users.sourceforge.net URL: http://article.gmane.org/gmane.network.openvpn.devel/6402
generated by cgit v1.1 at 2024-10-07 02:15:20 +0000