Fixed a bug where PolarSSL gave an error when using an inline file tag.

Signed-off-by: Adriaan de Jong <dejong@fox-it.com>
Acked-by: David Sommerseth <davids@redhat.com>
Message-Id: 1350466765-23301-1-git-send-email-dejong@fox-it.com
Signed-off-by: David Sommerseth <davids@redhat.com>
Options parsing demands unnecessary configuration if PKCS11 is used

In the old patch the if incorrectly closed the outer if condition.
(closes ticket #231)

Trac-ticket: 231
Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: David Sommerseth <davids@redhat.com>
Message-Id: 1350470774-12511-1-git-send-email-arne@rfc2549.org
URL: http://article.gmane.org/gmane.network.openvpn.devel/7095
Signed-off-by: David Sommerseth <davids@redhat.com>
Make git ignore some more files

Don't care about ./libtool (autogenerated) and test reports from t_client.sh

Signed-off-by: David Sommerseth <davids@redhat.com>
Fix display of plugin hook types

The OPENVPN_PLUGIN_ROUTE_PREDOWN hook was missing and displayed as
"PLUGIN_???" in the log.

OPENVPN_PLUGIN_ENABLE_PF was the only one that displayed the
OPENVPN_ prefix.

Signed-off-by: Heiko Hund <heiko.hund@sophos.com>
Acked-by: David Sommerseth <davids@redhat.com>
Message-Id: 1351517910-11414-1-git-send-email-heiko.hund@sophos.com
URL: http://article.gmane.org/gmane.network.openvpn.devel/7111
Signed-off-by: David Sommerseth <davids@redhat.com>
Support UTF-8 --client-config-dir

If a common name (or user name, when used in conjunction with
--username-as-common-name) contains UTF-8 encoded characters their
octets get replaced by underscores. This becomes problematic when
user "Müller" and "Möller" need to have a CCD file and both would
receive options from the file "M__ller". The situation is even
worse for non-latin alphabets, where CCD file names consist of
underscores entirely.

This patch removes that limitation and also allows the file names
to contain any punctuation characters besided the resevered ones.

Signed-off-by: Heiko Hund <heiko.hund@sophos.com>
Acked-by: David Sommerseth <davids@redhat.com>
Message-Id: 1351516597-11128-1-git-send-email-heiko.hund@sophos.com
URL: http://article.gmane.org/gmane.network.openvpn.devel/7110
Signed-off-by: David Sommerseth <davids@redhat.com>
Remove the support for using system() when executing external programs or scripts

This patch removes the support for the system() call, and enforces the
usage of execve() on the *nix platform and CreateProcessW() on Windows.
This is to enhance the overall security when calling external scripts.
Using system() is prone to shell expansions, which may lead to security
breaches.  Which is also why the execve() approach has been the default
since commit a82813527551f0e79c6d6ed5a9c1162e3c171bcf which
re-introduced the system() in Nov. 2008.

After having asked on the mailing list and checked around on the IRC
channels, the genereal consensus is that very few uses system() these
days.

The only annoyance I've been made aware of is that this will now
require adding a full path to the script interpreter together with the
script, and not just put in the script name alone.  But to just use the
script name in Windows, you had to configure --script-security with the
'system' flag earlier too.  So my conclusion is that it's better to add
a full path to the script interpreter in Windows and raise the overal
security with OpenVPN, than to continue to have a possible potentially
risky OpenVPN configuration just to make life "easier" for Windows
script users.

Removal of the system() call, also solves a nasty bug related to the
usage of putenv() on the *nix platforms.

For more information please see:
http://thread.gmane.org/gmane.network.openvpn.devel/7090
https://community.openvpn.net/openvpn/ticket/228

Trac-ticket: 228
Signed-off-by: David Sommerseth <davids@redhat.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1351539352-17371-1-git-send-email-dazo@users.sourceforge.net>
URL: http://article.gmane.org/gmane.network.openvpn.devel/7114
Fix double-free issue in pf_destroy_context()

In commit dc7be6d078ba106f9b0de12f3e879c3561c3c537 the string_alloc() call
in pf_init_context() was modified to use the gc_arena object for memory
allocation.  What was not taken into consideration was that
pf_destroy_context() was also freeing memory allocated by string_alloc(),
and when pf_init_context() is calling gc_free() a double-free situation
showed up.

Lets remove the explict free, and let gc_free take care of all the memory
handling.

Reported-by: cuzz@163.com
Signed-off-by: David Sommerseth <davids@redhat.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: 1352196216-11560-1-git-send-email-dazo@users.sourceforge.net
URL: http://article.gmane.org/gmane.network.openvpn.devel/7124
Reset the version.m4 version for the master branch

Signed-off-by: David Sommerseth <davids@redhat.com>
Fix --show-pkcs11-ids (Bug #239)

Broken by 00b973f8af85c3ea8fa3cef80eec55e8dc139b27

Signed-off-by: Joachim Schipper <joachim.schipper@fox-it.com>
Acked-by: David Sommerseth <davids@redhat.com>
Trac-ticket: 239
Message-Id: 1CED409804E2164C8104F9E623B08B901323A48384@FOXDFT02.FOX.local
URL: http://article.gmane.org/gmane.network.openvpn.devel/7129
Signed-off-by: David Sommerseth <davids@redhat.com>
Error message if max-routes used incorrectly

the route/route-ipv6/redirect-gateway options allocate the route structe
with max_routes number of routes. A max-routes after any of this commands
has no effect. This can be problematic
(http://code.google.com/p/ics-openvpn/issues/detail?id=101)

Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: 1353348737-21920-1-git-send-email-arne@rfc2549.org
URL: http://article.gmane.org/gmane.network.openvpn.devel/7131
Signed-off-by: David Sommerseth <davids@redhat.com>
doc/management-notes.txt: fix typo

Signed-off-by: Joachim Schipper <joachim.schipper@fox-it.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: 1CED409804E2164C8104F9E623B08B901323D0B184@FOXDFT02.FOX.local
URL: http://article.gmane.org/gmane.network.openvpn.devel/7141
Signed-off-by: David Sommerseth <davids@redhat.com>
Fix typo in ./configure message

Signed-off-by: Joachim Schipper <joachim.schipper@fox-it.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: 1CED409804E2164C8104F9E623B08B901323D0B186@FOXDFT02.FOX.local
URL: http://article.gmane.org/gmane.network.openvpn.devel/7142
Signed-off-by: David Sommerseth <davids@redhat.com>
Properly require --key even if defined(MANAGMENT_EXTERNAL_KEY)

When specifying --tls-client --cert ... without a --key (or --pkcs11)
option, OpenVPN should complain:
"You must define private key file (--key)...".  Ensure that this
works even when compiling with MANAGMENT_EXTERNAL_KEY.

Also fix the other instance where this logic is broken

Orginal-Patch-by: Found by Joachim Schipper <joachim.schipper@fox-it.com>
Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: 1353940389-31075-1-git-send-email-arne@rfc2549.org
URL: http://article.gmane.org/gmane.network.openvpn.devel/7143
Signed-off-by: David Sommerseth <davids@redhat.com>
Avoid recursion in virtual_output_callback_func()

This solves a SEGV situation when using the management API while OpenVPN
is closing down.

The situation happens when the management socket has closed and OpenVPN
tries to write an error about this to the management socket.  What happens
is that

 virtual_output_callback_func() is called, which then calls
 -> man_output_list_push_finalize()
    -> man_output_standalone()
       -> man_write()  <-- this does the socket write
          -> man_io_error()
             -> x_msg()
                -> virtual_output_print()
                   -> virtual_output_callback_func() (recursion start)

virtual_output_callback_func() do have a mechanism to avoid recursion,
but that did not keep the recurse counter when
man_output_list_push_finalize()
is called.

This patch just reorganise the recursion block to also keep the counter
while
calling the other functions from virtual_output_callback_func()

Signed-off-by: David Sommerseth <davids@redhat.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: 1353063726-25113-1-git-send-email-dazo@users.sourceforge.net
URL: http://article.gmane.org/gmane.network.openvpn.devel/7130
The get_default_gateway() function uses warn() instead of msg()

A report on #openvpn pointed out that in his setup three warnings
appeard on the console when starting up.

    $ sudo /usr/local/etc/rc.d/openvpn restart
    Stopping openvpn.
    Waiting for PIDS: 33031.
    Starting openvpn.
    openvpn: writing to routing socket: No such process
    openvpn: writing to routing socket: No such process
    openvpn: writing to routing socket: No such process
    $

This setup is on FreeBSD using jails with strict access to the
routing table.

After looking at the code path, this error was found in the BSD
sections for get_default_gateway().  But it was using the warn()
call instead of msg(M_WARN|M_ERRNO, ...) which causes these
warnings to go to stderr instead of the log file.

The warning string is also slightly modified to better explain
what fails.

Reported-by: Thomas Steen Rasmussen <thomas@gibfest.dk>
Tested-by: Thomas Steen Rasmussen <thomas@gibfest.dk>
Signed-off-by: David Sommerseth <davids@redhat.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: 1354194972-5388-1-git-send-email-dazo@users.sourceforge.net
URL: http://article.gmane.org/gmane.network.openvpn.devel/7149
Remove dnsflags_to_socktype, it is not used anywhere
Change the type of all ports in openvpn to const char* and let getaddrinfo resolve the port together with the hostname.

This delays error reporting from config parsing to resolving of host addresses. But it allows statements like

remote openvpn.example.org openvpn
port https
management localhost ntp

Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Simplify print_sockaddr_ex function, merge duplicate ipv4/ipv6 logic
Split the PROTO_UDP_xx options into AF_INET/AF_INET6 and PROTO_TCP/PROTO_UDP part.

Splitting will make the code a little bit cleaner and prepares for dual stack

Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Split link_socket_init_phase2 into smaller more managable/readable functions. No functional changes

Signed-off-by: Arne Schwabe <arne@rfc2549.org>