forked from OpenVPN/openvpn
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathChangeLog
5208 lines (4446 loc) · 217 KB
/
ChangeLog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
OpenVPN Change Log
Copyright (C) 2002-2017 OpenVPN Technologies, Inc. <[email protected]>
2017.06.21 -- Version 2.4.3
Antonio Quartulli (1):
Ignore auth-nocache for auth-user-pass if auth-token is pushed
David Sommerseth (3):
crypto: Enable SHA256 fingerprint checking in --verify-hash
copyright: Update GPLv2 license texts
auth-token with auth-nocache fix broke --disable-crypto builds
Emmanuel Deloget (8):
OpenSSL: don't use direct access to the internal of X509
OpenSSL: don't use direct access to the internal of EVP_PKEY
OpenSSL: don't use direct access to the internal of RSA
OpenSSL: don't use direct access to the internal of DSA
OpenSSL: force meth->name as non-const when we free() it
OpenSSL: don't use direct access to the internal of EVP_MD_CTX
OpenSSL: don't use direct access to the internal of EVP_CIPHER_CTX
OpenSSL: don't use direct access to the internal of HMAC_CTX
Gert Doering (6):
Fix NCP behaviour on TLS reconnect.
Remove erroneous limitation on max number of args for --plugin
Fix edge case with clients failing to set up cipher on empty PUSH_REPLY.
Fix potential 1-byte overread in TCP option parsing.
Fix remotely-triggerable ASSERT() on malformed IPv6 packet.
Update Changes.rst with relevant info for 2.4.3 release.
Guido Vranken (6):
refactor my_strupr
Fix 2 memory leaks in proxy authentication routine
Fix memory leak in add_option() for option 'connection'
Ensure option array p[] is always NULL-terminated
Fix a null-pointer dereference in establish_http_proxy_passthru()
Prevent two kinds of stack buffer OOB reads and a crash for invalid input data
Jérémie Courrèges-Anglas (2):
Fix an unaligned access on OpenBSD/sparc64
Missing include for socket-flags TCP_NODELAY on OpenBSD
Matthias Andree (1):
Make openvpn-plugin.h self-contained again.
Selva Nair (1):
Pass correct buffer size to GetModuleFileNameW()
Steffan Karger (11):
Log the negotiated (NCP) cipher
Avoid a 1 byte overcopy in x509_get_subject (ssl_verify_openssl.c)
Skip tls-crypt unit tests if required crypto mode not supported
openssl: fix overflow check for long --tls-cipher option
Add a DSA test key/cert pair to sample-keys
Fix mbedtls fingerprint calculation
mbedtls: fix --x509-track post-authentication remote DoS (CVE-2017-7522)
mbedtls: require C-string compatible types for --x509-username-field
Fix remote-triggerable memory leaks (CVE-2017-7521)
Restrict --x509-alt-username extension types
Fix potential double-free in --x509-alt-username (CVE-2017-7521)
Steven McDonald (1):
Fix gateway detection with OpenBSD routing domains
2017.05.11 -- Version 2.4.2
David Sommerseth (5):
auth-token: Ensure tokens are always wiped on de-auth
docs: Fixed man-page warnings discoverd by rpmlint
Make --cipher/--auth none more explicit on the risks
plugin: Fix documentation typo for type_mask
plugin: Export secure_memzero() to plug-ins
Hristo Venev (1):
Fix extract_x509_field_ssl for external objects, v2
Selva Nair (1):
In auth-pam plugin clear the password after use
Steffan Karger (10):
cleanup: merge packet_id_alloc_outgoing() into packet_id_write()
Don't run packet_id unit tests for --disable-crypto builds
Fix Changes.rst layout
Fix memory leak in x509_verify_cert_ku()
mbedtls: correctly check return value in pkcs11_certificate_dn()
Restore pre-NCP frame parameters for new sessions
Always clear username/password from memory on error
Document tls-crypt security considerations in man page
Don't assert out on receiving too-large control packets (CVE-2017-7478)
Drop packets instead of assert out if packet id rolls over (CVE-2017-7479)
ValdikSS (1):
Set a low interface metric for tap adapter when block-outside-dns is in use
2017.03.21 -- Version 2.4.1
Antonio Quartulli (4):
attempt to add IPv6 route even when no IPv6 address was configured
fix redirect-gateway behaviour when an IPv4 default route does not exist
CRL: use time_t instead of struct timespec to store last mtime
ignore remote-random-hostname if a numeric host is provided
Christian Hesse (7):
man: fix formatting for alternative option
systemd: Use automake tools to install unit files
systemd: Do not race on RuntimeDirectory
systemd: Add more security feature for systemd units
Clean up plugin path handling
plugin: Remove GNUism in openvpn-plugin.h generation
fix typo in notification message
David Sommerseth (6):
management: >REMOTE operation would overwrite ce change indicator
management: Remove a redundant #ifdef block
git: Merge .gitignore files into a single file
systemd: Move the READY=1 signalling to an earlier point
plugin: Improve the handling of default plug-in directory
cleanup: Remove faulty env processing functions
Emmanuel Deloget (8):
OpenSSL: check for the SSL reason, not the full error
OpenSSL: don't use direct access to the internal of X509_STORE_CTX
OpenSSL: don't use direct access to the internal of SSL_CTX
OpenSSL: don't use direct access to the internal of X509_STORE
OpenSSL: don't use direct access to the internal of X509_OBJECT
OpenSSL: don't use direct access to the internal of RSA_METHOD
OpenSSL: SSLeay symbols are no longer available in OpenSSL 1.1
OpenSSL: use EVP_CipherInit_ex() instead of EVP_CipherInit()
Eric Thorpe (1):
Fix Building Using MSVC
Gert Doering (4):
Add openssl_compat.h to openvpn_SOURCES
Fix '--dev null'
Fix installation of IPv6 host route to VPN server when using iservice.
Make ENABLE_OCC no longer depend on !ENABLE_SMALL
Gisle Vanem (1):
Crash in options.c
Ilya Shipitsin (2):
Resolve several travis-ci issues
travis-ci: remove unused files
Olivier Wahrenberger (1):
Fix building with LibreSSL 2.5.1 by cleaning a hack.
Selva Nair (4):
Fix push options digest update
Always release dhcp address in close_tun() on Windows.
Add a check for -Wl, --wrap support in linker
Fix user's group membership check in interactive service to work with domains
Simon Matter (1):
Fix segfault when using crypto lib without AES-256-CTR or SHA256
Steffan Karger (8):
More broadly enforce Allman style and braces-around-conditionals
Use SHA256 for the internal digest, instead of MD5
OpenSSL: 1.1 fallout - fix configure on old autoconf
Fix types in WIN32 socket_listen_accept()
Remove duplicate X509 env variables
Fix non-C99-compliant builds: don't use const size_t as array length
Deprecate --ns-cert-type
Be less picky about keyUsage extensions
2016.12.26 -- Version 2.4.0
David Sommerseth (5):
dev-tools: Added script for updating copyright years in files
Update copyrights
docs: Further enhance the documentation related to SWEET32
man: Remove references to no longer present IV_RGI6 peer-info
build: Ensure Changes.rst is shipped and installed as a doc file
Gert Doering (1):
Remove IV_RGI6=1 peer-info signalling.
Steffan Karger (3):
Document that RSA_SIGN can also request TLS 1.2 signatures
man: encourage user to read on about --tls-crypt
Textual fixes for Changes.rst
2016.12.16 -- Version 2.4_rc2
David Sommerseth (9):
Fix wrong configure.ac parsing of --enable-async-push
Changes: Further improve systemd unit file updates
systemd: Intermediate --chroot fix with the new sd_notify() implementation
Further enhance async-push feature description
Changes.rst: Mainatiner update on C99
dev-tools: Add reformat-all.sh for code style unification
The Great Reformatting - first phase
Merge 'reformatting' branch into master
auth-gen-token: Hardening memory cleanup on auth-token failuers
Gert Doering (1):
Refactor setting close-on-exec for socket FDs
Lev Stipakov (2):
Arm inotify only in server mode
Add "async push" feature to Changes.rst
Magnus Kroken (1):
mbedtls: include correct net/net_sockets header according to version
Selva Nair (2):
Correctly state the default dhcp server address in man page
Unhide a line in man page by fixing a typo
Steffan Karger (4):
Fix (and cleanup) crypto flags in combination with NCP
Deprecate --no-iv
man: mention that --ecdh-curve does not work on mbed TLS builds
Don't reopen tun if cipher changes
2016.12.01 -- Version 2.4_rc1
Antonio Quartulli (1):
reload CRL only if file was modified
Christian Hesse (3):
update year in copyright message
Use systemd service manager notification
Refuse to daemonize when running from systemd
Gert Doering (1):
Fix windows path in Changes.rst
Samuli Seppänen (1):
Mention that OpenVPN 2.4 requires Windows Vista or higher
Selva Nair (4):
Map restart signals from event loop to SIGTERM during exit-notification wait
When parsing '--setenv opt xx ..' make sure a third parameter is present
Force 'def1' method when --redirect-gateway is done through service
Do not restart dns client service as a part of --register-dns processing
Steffan Karger (4):
tls_process: don't set variable that's never read
Unconditionally enable TLS_AGGREGATE_ACK
Clean up format_hex_ex()
Introduce and use secure_memzero() to erase secrets
2016.11.24 -- Version 2.4_beta2
Arne Schwabe (5):
Document that tls-crypt also supports inline
Fix warning that RAND_bytes is undeclared
Remove compat-stdbool.h.
Fix various compiler warnings
Handle DNS6 option on Android
David Sommerseth (2):
Changes.rst: Fixing wrong formatting
Document the --auth-token option
Gert Doering (2):
Remove remaining traces of compat-stdbool.h
Stub implementation of "--dhcp-option DNS6 <v6addr>"
Selva Nair (3):
Do not set ipv6 address if '--ip-win32 manual' is used
Handle --dhcp-option DNS6 on Windows using netsh
Set IPv6 DNS servers using interactive service
Steffan Karger (6):
multi_process_float: revert part of c14c4a9e
--tls-crypt fixes
Change cmocka remote to use https in stead of git protocol
generate_key_expansion: make assumption explicit, use C99 features
Poor man's NCP for non-NCP peers
Refactor data channel key generation API
2016.11.17 -- Version 2.4_beta1
Arne Schwabe (1):
Make Changes.rst nicer for 2.4 release
David Sommerseth (16):
Update .mailmap to unify and clean up odd names and e-mail addresses
cleanup: Remove NOP code sections in ssl.c:tls_process()
Remove last rest of INSTALL-win32.txt references
auth-gen-token: Add --auth-gen-token option
auth-gen-token: Generate an auth-token per client
auth-gen-token: Push generated auth-tokens to the client
auth-gen-token: Authenticate generated auth-tokens when client re-authenticates
Fix builds with --disable-crypto
man: Improve the --keepalive section
console: Fix compiler warning
systemd: Improve the systemd unit files
tun: Fix compiler warnings
file checks: Merge warn_if_group_others_accessible() into check_file_access()
tun: Fix weird commit error causing a double assignment
options: Remove --tls-remote
Remove unused variable in argv_printf_arglist()
Gert Doering (10):
openvpn version line: remove [IPv6], add [AEAD] if available
clean up *sig_info handling in link_socket_init_phase2()
check c->c2.link_socket before calling do_init_route_ipv6_list()
Check previously-unchecked buf_alloc_write() call in crypto self-test.
Fix potential division by zero in shaper_reset()
Repair topology subnet on FreeBSD 11
Repair topology subnet on OpenBSD
Add in_port_t check to configure.ac
Fix compilation on MinGW with -std=c99
Replace WIN32 by _WIN32
Heiko Hund (4):
put argv_* functions into own file, add unit tests
Remove unused and unecessary argv interfaces
remove unused system_str from struct argv
Factor out %sc handling from argv_printf()
Lev Stipakov (1):
Drop recursively routed packets
Samuli Seppänen (6):
Remove INSTALL-win32.txt that is now hosted in openvpn-build
Fix update_t_client_ips.sh for out of tree builds
Make sure that all relevant files under test go to release tarballs
Allow passing extra arguments to fping/fping6 in t_client.rc
Prevent generation of duplicate EXPECT_IFCONFIG entries
Fix a logic problem in handling of --up scripts in t_client.sh
Selva Nair (2):
Support --block-outside-dns on multiple tunnels
Unbreak windows build
Steffan Karger (19):
Fix use-after-free bug in prepare_push_reply()
Remove verbose msg() from send_push_reply()
Limit --reneg-bytes to 64MB when using small block ciphers
Add a revoked cert to the sample keys
Fix --tls-version-max in mbed TLS builds
Don't deference type-punned pointers
Fix builds on compilers without anonymous union support
Refactor static/tls-auth key loading
Add missing includes in error.h
Make argv unit tests obey {MBEDTLS, OPENSSL}_{LIBS, CFLAGS}
Move private file access checks to options_postprocess_filechecks()
Deprecate key-method 1
Refactor CRL handling
Remove unneeded check for extra_certs_file_inline
Fix missing return value checks in multi_process_float()
Restore pre-NCP cipher options on SIGUSR1
Remove unused variables from do_init_crypto_static()
Add control channel encryption (--tls-crypt)
Add --tls-crypt unit tests
2016.10.19 -- Version 2.4_alpha2
David Sommerseth (1):
Update .mailmap to unify and clean up odd names and e-mail addresses
Steffan Karger (1):
Fix use-after-free bug in prepare_push_reply()
2016.10.17 -- Version 2.4_alpha1
Adriaan de Jong (2):
Fixed a bug where PolarSSL gave an error when using an inline file tag.
Fix --show-pkcs11-ids (Bug #239)
Alexander Pyhalov (1):
Default gateway can't be determined on illumos/Solaris platforms
Alon Bar-Lev (1):
pkcs11: use generic evp key instead of rsa
Andris Kalnozols (3):
Fix some typos in the man page.
Do not upcase x509-username-field for mixed-case arguments.
extract_x509_extension(): hide status message during normal operation.
Arne Schwabe (100):
Document man agent-external-key
Options parsing demands unnecessary configuration if PKCS11 is used
Error message if max-routes used incorrectly
Properly require --key even if defined(MANAGMENT_EXTERNAL_KEY)
Remove dnsflags_to_socktype, it is not used anywhere
Fix the proto is used inconsistently warning
Remove dead code path and putenv functionality
Remove unused function xor
Move static prototype definition from header into c file
Remove unused function no_tap_ifconfig
Add the client id (CID) to the output of the status command
Print client id only if compiled with man agent support. Otherwise print an empty string.
Allow routes to be set before opening tun, similar to ifconfig before opening tun
Add ability to send/receive file descriptors via management interface
Android platform specific changes.
Emulate persist-tun on Android
Document the Android implementation in OpenVPN
Only print script warnings when a script is used. Remove stray mention of script-security system.
Fix #ifdefs for P2MP_SERVER
Move settings of user script into set_user_script function
Move checking of script file access into set_user_script
Fix another #ifdef/#if P2MP_SERVER
PATCHv3 Remove unused variables or put them to the defines they are being used in
Add support of utun devices under Mac OS X
Add support to ignore specific options.
Add a note what setenv opt does for OpenVPN < 2.3.3
Implement custom HTTP header for http-proxy, and always send user-agent:
Add reporting of UI version to basic push-peer-info set.
Change the type of all ports in openvpn to const char* and let getaddrinfo resolve the port together with the hostname.
Fix compile error in ssl_openssl introduced by polar external-management patch
Simplify print_sockaddr_ex function, merge duplicate ipv4/ipv6 logic.
Split the PROTO_UDP_xx options into AF_INET/AF_INET6 and PROTO_TCP/PROTO_UDP part.
Fix two instances of asserting AF_INET
Fix assertion when SIGUSR1 is received while getaddrinfo is successful
Split link_socket_init_phase1 and link_socket_init_phase2 into smaller more managable/readable functions. No functional changes
Change proto_remote() function to return a constant string
Remove the ip-remote-hint option.
change the type of 'remote' to addrinfo*, and rename to 'remote_list'.
When resolving fails print the error message from socket layer
Implement dual stack client support for OpenVPN
Move ASSERT so external-key with OpenSSL works again
Implement listing on IPv4/IPv6 dual socket on all platform
Add warning for using connection block variables after connection blocks
Update IPv6 related readme files
Introduce safety check for http proxy options
Fix warning for max-routes: do not quit when parsing an old configuration. Format the message to be more like the other deprecated options
Fix connecting to localhost on Android
Move the initialization of the environment to the top so c2.es is initialized
Workaround broken Android 4.4 VpnService API for persist-tun mode
Implement an easy parsable log output that allows access to flags of the log message
Introduce an option to resolve dns names in advance for --remote, --local and --http-proxy
Fix for server selecting address family
Don't show the connection profile store in options->ce if there is a connection_list defined.
Add gateway and device to android control messages
Clean up of socket code.
Fix assert when using port-share
Work around Solaris getaddrinfo() returing ai_protocol=0
Fix man page and OSCP script: tls_serial_{n} is decimal
Remove ENABLE_BUFFER_LIST
Fix server routes not working in topology subnet with --server [v3]
Always enable http-proxy and socks-proxy
Remove deprecated --max-routes option from manual
Add documentation for PERSIST_TUN_ACTION (Android specific)
Remove possibility of using --tls-auth with non OpenVPN Static key files
Remove unused function sock_addr_set
Document the default for tls-cipher.
Report missing end-tags of inline files as errors
Fix commit e473b7c if an inline file happens to have a line break exactly at buffer limit
Show extra-certs in current parameters, fix clang warning and logic error in preresolve
Remove unused function h_errno_msg
Add support for requesting the fd again to rebind to the next interface.
Don't redirect the gateway on Android even if requested
Fix loglevel of protect socket message
Extend network-change command to allow reprotecting on the same network (for short connection losses)
Use pseudo gw as default gw on Android as a workaround for not being able to read /proc/net/route
Remove #ifdefs for client nat support.
Do not install a host route for the VPN on Android
Fix commit c67acea173dc9ee37220f5b9ff14ede081181992
Do not set the buffer size by default but rely on the operation system default.
Start Changes.rst that lists changes in 2.4.0
Remove --enable-password-save option
Reflect enable-password-save change in documentation
Also remove second instance of enable-password-save in the man page
Detect config lines that are too long and give a warning/error
Implement the compression V2 data format for stub and lz4.
Fix assert when comp is called with unknown algorithm, always call comp init method
Ignore stamp-h2 we generate during build process
Implement inlining of crl files
Complete push-peer-info documentation and allow IV_PLAT_VER for other platforms than Windows if the client UI supplies it.
Remove http-proxy-timeout, socks timeout and set default of server-poll-timeout to 120s
Add documentation for http-proxy-user-pass option
Remove http-proxy-retry and socks-proxy-retry.
Update android documentation to match source code
Use AES ciphers in our sample configuration files and add a few modern 2.4 examples
Fix ENABLE_CRYPTO_OPENSSL set to YES even with --disable-crypto set
Prefer RECVDSTADDR to PKTINFO for IPv4 in OS X since it actually works (unlike PKTINFO)
Incorporate the Debian typo fixes where appropriate and make show_opt default message clearer
Enable TCP non-linear packet ID
Change the hold command to communicate the time that OpenVPN would wait to the UI.
Remove tun-ipv6 Option. Instead assume that IPv6 is always supported.
Boris Lytochkin (1):
Log serial number of revoked certificate
Christian Hesse (1):
fix build with automake 1.13(.1)
Christian Niessner (1):
Fix corner case in NTLM authentication (trac #172)
Christos Trochalakis (1):
Adjust server-ipv6 documentation
Cristian Rodriguez (1):
Use SSL_MODE_RELEASE_BUFFERS if available
Daniel Hahler (1):
options: fix option check for "plugin"
Daniel Kubec (4):
Added support for TLS Keying Material Exporters [RFC-5705]
Added document for TLS Keying Material Exporters [RFC-5705]
sample-plugin: TLS Keying Material Exporter [RFC-5705] demonstration plug-in
Fix buffer size parameter for exported keying material.
David Sommerseth (44):
Make git ignore some more files
Remove the support for using system() when executing external programs or scripts
Fix double-free issue in pf_destroy_context()
Reset the version.m4 version for the master branch
Avoid recursion in virtual_output_callback_func()
The get_default_gateway() function uses warn() instead of msg()
Improve the git revision tracking
man page: Update man page about the tls_digest_{n} environment variable
Remove the --disable-eurephia configure option
plugin: Extend the plug-in v3 API to identify the SSL implementation used
autoconf: Fix typo
t_client.sh: Check for fping/fping6 availability
t_client.sh: Write errors to stderr and document requirements
t_client.sh: Add prepare/cleanup possibilties for each test case
Fix file checks when --chroot is being used
Adjusted autotools files to build more cleanly on newer autoconf/automake versions
Improve error reporting on file access to --client-config-dir and --ccd-exclusive
Don't let openvpn_popen() keep zombies around
Don't try to use systemd-ask-password if it is not available
Clean up the pipe closing in openvpn_popen()
Add systemd unit file for OpenVPN
systemd: Use systemd functions to consider systemd availability
systemd: Reworked the systemd unit file to handle server and client configs better
autotools: Fix wrong ./configure help screen default values
down-root plugin: Replaced system() calls with execve()
down-root: Improve error messages
plugin, down-root: Fix compiler warnings
sockets: Remove the limitation of --tcp-nodelay to be server-only
plugins, down-root: Code style clean-up
Provide compile time OpenVPN version information to plug-ins
Provide OpenVPN runtime version information to plug-ins
Avoid partial authentication state when using --disabled in CCD configs
Only build and run cmocka unit tests if its submodule is initialized
Another fix related to unit test framework
Remove NOP function and callers
Revert "Drop recursively routed packets"
Fix client connection instant timeout
t_client.sh: Make OpenVPN write PID file to avoid various sudo issues
t_client.sh: Add support for Kerberos/ksu
t_client.sh: Improve detection if the OpenVPN process did start during tests
Rework the user input interface to make it more modular
Re-implement the systemd support using the new query user API
systemd: Do not mask usernames when querying for it via systemd-ask-password
Move memcmp_constant_time() to crypto.h
David Woodhouse (2):
pkcs11: Load p11-kit-proxy.so module by default
Make 'provider' option to --show-pkcs11-ids optional where p11-kit is present
Davide Brini (2):
Provide more accurate warning message
Document authfile for socks server
Dmitrij Tejblum (1):
Fix is_ipv6 in case of tap interface.
Dorian Harmans (1):
Add CHACHA20-POLY1305 ciphersuite IANA name translations.
Felix Janda (1):
Use OPENVPN_ETH_P_* so that <netinet/if_ether.h> is unecessary
Fish (1):
Add lz4 support to MSVC.
Gert Doering (110):
Implement --mssfix handling for IPv6 packets.
Fix option inconsistency warnings about "proto" and "tun-ipv6"
Fix parameter type for IP_TOS setsockopt on non-Linux systems.
Fix client crash on double PUSH_REPLY.
Update README.IPv6 to match what is in 2.3.0
Repair "tcp server queue overflow" brokenness, more <stdbool.h> fallout.
Permit pool size of /64.../112 for ifconfig-ipv6-pool
Add MIN() compatibility macro
Fix directly connected routes for "topology subnet" on Solaris.
Print "Virtual IPv6 Address" on management interface queries [v4]
Use constrain_int() instead of MIN()+syshead.c compat definition - v2.
Fix NULL-pointer crash in route_list_add_vpn_gateway().
Fix usage of 'compression ...' from global config.
Make push-peer-info visible in "normal" per-instance environment.
Fix problem with UDP tunneling due to mishandled pktinfo structures.
Improve documentation and help text for --route-ipv6.
Fix argument type warning introduced by http extra proxy header patch.
Fix IPv6 examples in t_client.rc-sample
Fix slow memory drain on each client renegotiation.
t_client.sh: ignore fields from "ip -6 route show" output that distort results.
Fix IPv6_V6ONLY logic.
Implement LZ4 compression.
Provide LZ4 sources in src/compat/ and use if no system lz4 library found.
Document "lz4" argument to "compress" config option.
Make code and documentation for --remote-random-hostname consistent.
Reduce IV_OPENVPN_GUI_VERSION= to IV_GUI_VER=
remove some 'unused variable' warnings
Cleanup ir6->netbits handling.
Document issue with --chroot, /dev/urandom and PolarSSL.
Rename 'struct route' to 'struct route_ipv4'
Replace copied structure elements with including <net/route.h>
Add "test-driver" and "compile" to .gitignore
Fix crash when using --inetd.
IPv6 address/route delete fix for Win8
Add SSL library version reporting.
Minor t_client.sh cleanups
Repair --multihome on FreeBSD for IPv4 sockets.
Rewrite manpage section about --multihome
More IPv6-related updates to the openvpn man page.
Conditionalize calls to print_default_gateway on !ENABLE_SMALL
Merge get_default_gateway() implementation for all 4+1 BSD variants.
Drop incoming fe80:: packets silently now.
Recognize AIX, define TARGET_AIX
Add tap driver initialization and ifconfig for AIX.
implement adding/deleting routes on AIX, for IPv4 and IPv6
Make t_client.sh work on AIX.
Fix t_lpback.sh platform-dependent failures
Call init script helpers with explicit path (./)
Fix windows build on older mingw versions.
New approach to handle peer-id related changes to link-mtu.
Print remote IPv4 address on a dual-stack v6 socket in IPv4 format
Fix incorrect use of get_ipv6_addr() for iroute options.
Remove count_netmask_bits(), convert users to use netmask_to_netbits2()
Fix leftover 'if (false) ;' statements
Print helpful error message on --mktun/--rmtun if not available.
explain effect of --topology subnet on --ifconfig
Add note about file permissions and --crl-verify to manpage.
repair --dev null breakage caused by db950be85d37
assume res_init() is always there.
Correct note about DNS randomization in openvpn.8
Disallow usage of --server-poll-timeout in --secret key mode.
slightly enhance documentation about --cipher
Enforce "serial-tests" behaviour for tests/Makefile
Revert "Enforce "serial-tests" behaviour for tests/Makefile"
On signal reception, return EAI_SYSTEM from openvpn_getaddrinfo().
Use configure.ac hack to apply serial_test AM option only if supported.
Use EAI_AGAIN instead of EAI_SYSTEM for openvpn_getaddrinfo().
Move res_init() call to inner openvpn_getaddrinfo() loop
Fix FreeBSD ifconfig for topology subnet tunnels.
Produce a meaningful error message if --daemon gets in the way of asking for passwords.
Document --daemon changes and consequences (--askpass, --auth-nocache).
Fix build on OpenSolaris (non-gmake)
Un-break --auth-user-pass on windows
refactor struct route_ipv6, bring in line with struct route_ipv4 again
refactor struct route_ipv6_list, bring in line with struct route_list again
Add route_ipv6_gateway* data structures for rgi6 support.
Create basic infrastructure for IPv6 default gateway handling / redirection.
Make client delay less before sending PUSH_REQUEST
get_default_gateway_ipv6(): Linux / Netlink implementation.
Implement handling of overlapping IPv6 routes with IPv6 remote VPN server address
Implement '--redirect-gateway ipv6'
get_default_gateway_ipv6(): *BSD / MacOS / Solaris PF_ROUTE implementation
Fix IPv6 host routes to LAN gateway on OpenSolaris
Replace unaligned 16bit access to TCP MSS value with bytewise access
Repair test_local_addr() on WIN32
Add custom check for inet_pton()/inet_ntop() on MinGW/WIN32
get_default_gateway_ipv6(): Win32 implementation using GetBestRoute2()
Remove support for snappy compression.
Fix info.af == AF_UNSPEC case for server with --mtu-disc
Fix FreeBSD-specific mishandling of gc arena pointer in create_arbitrary_remote()
remove unused gc_arena in FreeBSD close_tun()
Un-break compilation on *BSD
Fix isatty() check for good.
Fix openserv/validate.o linking issues on mingw.
Fix library order in -lmbedtls test.
Implement push-remove option to selectively remove pushed options.
Upgrade bundled compat-lz4 to upstream release r131.
Change --enable-pedantic to use -std=c99 and not -ansi (C90).
Fix problems with NCP and --inetd.
Do not abort t_client run if OpenVPN instance does not start.
Fix IP_PKTINFO related compilation failure on NetBSD 7.0
Show compile-time variant for --multihome in --version output.
Fix win32 building with C99 mode
Fix t_client runs on OpenSolaris
make t_client robust against sudoers misconfiguration
add POSTINIT_CMD_suf to t_client.sh and sample config
Fix --multihome for IPv6 on 64bit BSD systems.
Enable -D_SVR4_2 for compilation on Solaris
Revert "Enable -D_SVR4_2 for compilation on Solaris"
Enable -D_XPG4_2 for compilation on Solaris
Guy Yur (1):
Fix --redirect-private in --dev tap mode.
Heikki Hannikainen (1):
Always load intermediate certificates from a PKCS#12 file
Heiko Hund (20):
Fix display of plugin hook types
Support UTF-8 --client-config-dir
close more file descriptors on exec
Ignore UTF-8 byte order mark
reintroduce --no-name-remapping option
make --tls-remote compatible with pre 2.3 configs
add new option for X.509 name verification
Support non-ASCII TAP adapter names on Windows
Support non-ASCII characters in Windows tmp path
make sure sa_family_t is defined
convert struct signal_info element
grow route lists dynamically
fix route struct name
refine assertion to allow other modes than CBC
Fix compilation on Windows
fix warnings on Windows
extend management interface command "state"
put virtual IPv6 addresses into env
interactive service v3
Windows: do_ifconfig() after open_tun()
Holger Kummert (1):
Del ipv6 addr on close of linux tun interface
Hubert Kario (2):
ocsp_check - signature verification and cert staus results are separate
ocsp_check - double check if ocsp didn't report any errors in execution
Ilya Shipitsin (3):
initial travis-ci support
skip t_lpback.sh and t_cltsrv.sh if openvpn configured --disable-crypto
enable "--disable-crypto" build configuration for travis
Ivo Manca (1):
Plug memory leak in mbedTLS backend
James Bekkema (1):
Fix socket-flag/TCP_NODELAY on Mac OS X
James Geboski (1):
Fix --askpass not allowing for password input via stdin
James Yonan (14):
Added support for the Snappy compression algorithm
Always push basic set of peer info values to server.
TLS version negotiation
Added "setenv opt" directive prefix. If present, and if the directive that follows is recognized, it will be processed as if the "setenv opt" prefix was absent. If present and if the directive that follows is not recognized, the directive will be ignored rather than cause a fatal error.
MSVC fixes
Set SSL_OP_NO_TICKET flag in SSL context for OpenSSL builds, to disable TLS stateless session resumption.
Use native strtoull() with MSVC 2013.
Define PATH_SEPARATOR for MSVC builds.
Fixed some compile issues with show_library_versions()
Added flags parameter to format_hex_ex.
Extended x509-track for OpenSSL to report SHA1 fingerprint.
Fixed port-share bug with DoS potential
Added directive to specify HTTP proxy credentials in config.
Bind to local socket before dropping privileges
Jan Just Keijser (5):
man page patch for missing options
make 'explicit-exit-notify' pullable again
include ifconfig_ environment variables in --up-restart env set
Author: Jan Just Keijser <[email protected]>
Make certificate expiry warning patch (091edd8e299686) work on OpenSSL 1.0.1 and earlier.
Jann Horn (1):
Remove quadratic complexity from openvpn_base64_decode()
Jeffrey Cutter (1):
Update contrib/pull-resolv-conf/client.up for no DOMAIN
Jens Neuhalfen (6):
Make intent of utun device name validation clear
Fix buffer overflow by user supplied data
ignore the local config file t_client.rc in git
Prevent integration test timeout bc. of sudo
Add unit testing support via cmocka
Add a test for auth-pam searchandreplace
Jens Wagner (1):
Fix spurious ignoring of pushed config options (trac#349).
Jesse Glick (1):
Allow use of NetBeans without saving nbproject/ directory.
Joachim Schipper (5):
doc/management-notes.txt: fix typo
Fix typo in ./configure message
Refactor tls_ctx_use_external_private_key()
--management-external-key for PolarSSL
external_pkcs1_sign: Support non-RSA_SIG_RAW hash_ids
Jonathan K. Bullard (3):
Fix mismatch of fprintf format specifier and argument type
Fix null pointer dereference in options.c
Fail if options have extra parameters [v2]
Josh Cepek (7):
Fix parameter listing in non-debug builds at verb 4
(updated) [PATCH] Warn when using verb levels >=7 without debug
Fix proto tcp6 for server & non-P2MP modes
Fix Windows script execution when called from script hooks
Correct error text when no Windows TAP device is present
Require a 1.2.x PolarSSL version
Push an IPv6 CIDR mask used by the server, not the pool's size
Julien Muchembled (1):
Fix --mtu-disc option with IPv6 transport
Kenneth Rose (1):
Fix v3 plugins to support returning values back to OpenVPN.
Klee Dienes (1):
tls_ctx_load_ca: Improve certificate error messages
Leon Klingele (1):
Add link to bug tracker
Leonardo Basilio (1):
Correctly report TCP connection timeout on windows.
Lev Stipakov (26):
Peer-id patch v7
Add the peer-id to the output of the status command
Prevent memory drain for long lasting floating sessions
Disallow lameduck's float to an address taken by another client
Fix NULL dereferencing
Fix mssfix default value in connection_list context
This fixes MSVS 2013 compilation.
Continuation of MSVS fixes
Fast recovery when host is in unreachable network
Fix compilation error with --disable-crypto
Send push reply right after async auth complete
Fix compilation with --disable-server
Refine float logging
Generate openvpn-plugin.h for MSVC build
Replace variable length array with malloc
Use adapter index instead of name for windows IPv6 interface config
Notify clients about server's exit/restart
Use adapter index for add/delete_route_ipv6
Pass adapter index to up/down scripts
Detecting and logging Windows versions
Report Windows bitness
Fix "implicit declaration" compiler warning
Drop recursively routed packets
Support for disabled peer-id
Exclude peer-id from pulled options digest
Use separate list for per-client push options
Lukasz Kutyla (1):
Fix privilege drop if first connection attempt fails
Matthias Andree (1):
Enable TCP_NODELAY configuration on FreeBSD.
Max Muster (1):
Remove duplicate cipher entries from TLS translation table.
Michael McConville (1):
Fix undefined signed shift overflow
Michal Ludvig (1):
Support for username-only auth file.
Mike Gilbert (2):
Add configure check for the path to systemd-ask-password
Include systemd units in the source tarball (make dist)
Niels Ole Salscheider (1):
Fix build with libressl
Peter Sagerson (1):
Fix configure interaction with static OpenSSL libraries
Philipp Hagemeister (2):
Add topology in sample server configuration file
Implement on-link route adding for iproute2
Phillip Smith (1):
Use bob.example.com and alice.example.com to improve clarity of documentation
Robert Fischer (1):
Updated manpage for --rport and --lport
Samuel Thibault (1):
Ensure that client-connect files are always deleted
Samuli Seppänen (15):
Removed ChangeLog.IPv6
Added cross-compilation information INSTALL-win32.txt
Updated README
Cleaned up and updated INSTALL
Fix to --shaper documentation on the man-page
Properly escape dashes on the man-page
Improve documentation in --script-security section of the man-page
Add CONTRIBUTING.rst
Update CONTRIBUTING.rst to allow GitHub PRs for code review purposes
Clarify the fact that build instructions in README are for release tarballs
Mention tap-windows6 in INSTALL file
Use an up-to-date easy-rsa URL on the man-page
Clarify which Windows versions require which TUN/TAP driver
Deprecate the automatic part of openvpnserv.exe in favor of openvpnserv2.exe
Automatically cache expected IPs for t_client.sh on the first run
Selva Nair (26):
Fix termination when windows suspends/sleeps
Do not hard-code windows systemroot in env_block
Handle ctrl-C and ctrl-break events on Windows
Unbreak read username password from management
Restrict options/configs for startup through interactive service
Send stdout and stderr of OpenVPN started by interactive service to NUL
Handle localized Administrators group name in windows
Fix interactive service ignoring stop command if openvpn is running
Use appropriate buffer size for WideCharToMultiByte output in interactive.c
Refactor and move the block-outside-dns code to a new file (block_dns.[ch])
Add support for block-outside-dns through the interactive service
Ensure input read using systemd-ask-password is null terminated
Support reading the challenge-response from console
Make error non-fatal while deleting address using netsh
Add support for register-dns through interactive service
Fix handling of out of memory error in interactive service
Fix the comparison of pull options hash on restart
Set WFP engine handle to NULL in win_wfp_uninit()
Make block-outside-dns work with persist-tun
Add an option to filter options received from server
Ignore SIGUSR1/SIGHUP during exit notification
Fix management-external-cert option parsing error
Return process id of openvpn from interactive service to client
Exponentially back off on repeated connect retries
Promptly close the netcmd_semaphore handle after use
Avoid format specifier %zu for Windows compatibility
Steffan Karger (180):
PolarSSL-1.2 support
Improve PolarSSL key_state_read_{cipher, plain}text messages
Improve verify_callback messages
Config compatibility patch. Added translate_cipher_name.
Switch to IANA names for TLS ciphers.
Fixed autoconf script to properly detect missing pkcs11 with polarssl.
Use constant time memcmp when comparing HMACs in openvpn_decrypt.
Fixed tls-cipher translation bug in openssl-build
Fixed usage of stale define USE_SSL to ENABLE_SSL
Do not pass struct tls_session* as void* in key_state_ssl_init().
Require polarssl >= 1.2.10 for polarssl-builds, which fixes CVE-2013-5915.
Also update TLSv1_method() calls in support code to SSLv23_method() calls.
Update TLSv1 error messages to SSLv23 to reflect changes from commit 4b67f98
If --tls-cipher is supplied, make --show-tls parse the list.
Remove OpenSSL tmp_rsa_callback. Removes support for ephemeral RSA in TLS.
Make tls_ctx_restrict_ciphers accept NULL as char *cipher_list.
Disable export ciphers by default for OpenSSL builds.
Fix compiler warning for unused result of write()
Remove unused variables from ssl_verify_polarssl.c's x509_get_serial()
Fix compiler warnings in ssl_polarssl.c
Bump minimum OpenSSL version to 0.9.8
Add openssl-specific common cipher list names to ssl.c.
Disable unsupported TLS cipher modes by default, cleans --show-tls output.
configure.ac: check for SSL_OP_NO_TICKET flag in OpenSSL
configure.ac: use CPPFLAGS for SSL_OP_NO_TICKET check
Upgrade to PolarSSL 1.3
Improve error reporting during key/cert loading with PolarSSL.
Update openvpn-plugin.h for PolarSSL 1.3.
Add support for elliptic curve diffie-hellmann key exchange (ECDH)
Add an elliptic curve testing cert chain to the sample keys
Change signedness of hash in x509_get_sha1_hash(), fixes compiler warning.
Fix OCSP_check.sh to also use decimal for stdout verification.
Make serial env exporting consistent amongst OpenSSL and PolarSSL builds.
Fix build system to accept non-system crypto library locations for plugins.
Remove function without effect (cipher_ok() always returned true).
Remove unneeded wrapper functions in crypto_openssl.c
Remove unneeded defines (were needed for pre-0.9.7 OpenSSL).
Fix merge error in a6c573d, the ssl ctx is now abstracted.
Use generic openvpn_x509_cert_t in ssl_verify_polarssl.c
Fix ssl.c, ssl_verify_* includes
Move #include "ssl_verify.h" from ssl.h to the source files that need it.
Remove dependency on manage.h from ssl_verify.h
Remove unused variable 'proxy' from socket_restart_pause()
Add (default disabled) --enable-werror option to configure
Fix --disable-ssl builds, were broken by cleanup in 63dc03d.
configure.ac: fix SSL_OP_NO_TICKET check
Fix bug that incorrectly refuses oid representation eku's in polar builds
Update README.polarssl
cleanup: remove #if 0'ed function initiate_untrusted_session() from ssl.c.
Rename ALLOW_NON_CBC_CIPHERS to ENABLE_OFB_CFB_MODE, and add to configure.
Add proper check for crypto modes (CBC or OFB/CFB)
Improve --show-ciphers to show if a cipher can be used in static key mode
Extend t_lpback tests to test all ciphers reported by --show-ciphers
Don't issue warning for 'translate to self' tls-ciphers
Don't exit daemon if opening or parsing the CRL fails.
Define dummy SSL_OP_NO_TICKET flag if not present in OpenSSL.
Fix typo in cipher_kt_mode_{cbc, ofb_cfb}() doxygen.
Fix some unintialized variable warnings
Fix clang warning in options.c
Fix compiler warnings in ssl_polarssl.c.
Fix regression with password protected private keys (polarssl)
Remove unused variables from ssl_verify_openssl.c extract_x509_extension()
Fix assertion error when using --cipher none
Add --tls-version-max
Modernize sample keys and sample configs
Drop too-short control channel packets instead of asserting out.
Really fix '--cipher none' regression
Update doxygen (a bit)
Set tls-version-max to 1.1 if cryptoapicert is used
openssl: add crypto_msg(), to easily log openssl errors
openssl: add more descriptive message for 'no shared cipher' error
Remove ENABLE_SSL define (and --disable-ssl configure option)
openssl: use crypto_msg(), get rid of openssl-specific code in error.c
Add option to disable Diffie Hellman key exchange by setting '--dh none'
Account for peer-id in frame size calculation
Disable SSL compression
Use tls-auth in sample config files
Fix frame size calculation for non-CBC modes.