Merge upstream v2.2.2

This merges upstream's OpenVPN version 2.2.2 with the following commits:

commit 12158e5a92b57ec9975e0b6fe66b27be01d4ada8
Author: David Sommerseth <davids@redhat.com>
Date:   Wed Dec 14 12:17:45 2011 +0100

    Preparing for v2.2.2 release

    ChangeLog got a few updates for the the v2.2.1 section as well.  One
    typo, plus some layout fixes.

    Signed-off-by: David Sommerseth <davids@redhat.com>

commit 81ce1d45f88bec701fd477fa061acd0f0033fdf9
Author: samuli@openvpn.net <samuli@openvpn.net>
Date:   Wed Dec 14 10:36:22 2011 +0200

    Backported pkcs11-related parts of 7a8d707237bb18 to 2.2 branch

    Fixes https://community.openvpn.net/openvpn/ticket/145

    Trac: 145
    Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
    Signed-off-by: David Sommerseth <davids@redhat.com>

commit b7bbe47a7fcfa74297ff04a50982b70113f28f96
Author: David Sommerseth <davids@redhat.com>
Date:   Tue Dec 13 18:08:24 2011 +0100

    Only warn about non-tackled IPv6 packets once

    When using OpenVPN 2.2 on clients and server with Windows based
    clients, it will try to push IPv6 packets through the tunnel.  This
    causes the server log to be filled up with log entries like this:

     Wed Jun 29 22:12:51 2011 username/1.2.3.4:56990 Need IPv6 code in mroute_extract_addr_from_packet

    This patch modifies this message to state that IPv6 packets are not
    tackled in tun mode, and prints it only once.

    Trac: 147
    Signed-off-by: David Sommerseth <davids@redhat.com>
    Acked-by: Gert Doering <gert@greenie.muc.de>

commit ed77e8ad8e892c14d7613a4eb377b8d03078a872
Author: Gert Doering <gert@greenie.muc.de>
Date:   Wed Nov 23 11:11:54 2011 +0100

    log error message and exit for "win32, tun mode, tap driver version 9.8"

    (driver is known-buggy for small IPv4 packets in tun mode)

    Signed-off-by: Gert Doering <gert@greenie.muc.de>
    Acked-by: David Sommerseth <davids@redhat.com>
    Signed-off-by: David Sommerseth <davids@redhat.com>
    (cherry-picked from commit 03ab4ead8295e005f72dbffcffdaa74487d9668c)

commit 066df6aa44c154bb94403b364f585c4ed569bf47
Author: Gert Doering <gert@greenie.muc.de>
Date:   Wed Nov 23 11:07:09 2011 +0100

    bump tap driver version from 9.8 to 9.9

    (bugfixed tapdrvr.c regarding small IPv4 packets)

    Signed-off-by: Gert Doering <gert@greenie.muc.de>
    Acked-by: David Sommerseth <davids@redhat.com>
    Signed-off-by: David Sommerseth <davids@redhat.com>
    (cherry picked from commit 1523d1101222340b7ef305020ed7eba0dd1676cf)

commit c5b9d40f0f2917761f430d9d59c59ca66153103f
Author: Gert Doering <gert@greenie.muc.de>
Date:   Thu Nov 10 20:15:44 2011 +0100

    add missing break between "case IPv4" and "case IPv6", leading to the
    minimum-size for IPv6 being applied to IPv4 packets, subsequently
    leading to drop of small-sized IPv4 packets.

    Bug found & fixed by Christian Niessner.

    Signed-off-by: Christian Niessner <bug-report@secadm.de>
    Acked-by: Gert Doering <gert@greenie.muc.de>
    Signed-off-by: Gert Doering <gert@greenie.muc.de>
    Signed-off-by: David Sommerseth <davids@redhat.com>
    (cherry picked from commit 10b99726a30bb7252cb01806f5f276be7873e84e)

commit 68deffc892173e1d003e4da1ad6811e8ba28a51e
Author: David Sommerseth <davids@redhat.com>
Date:   Fri Jul 1 11:17:57 2011 +0200

    Prepared for releasing OpenVPN 2.2.1

    Signed-off-by: David Sommerseth <davids@redhat.com>

commit 924e2d9db3a840f166a5fbe9e0758fb8f16498fe
Author: Samuli Seppänen <samuli@openvpn.net>
Date:   Thu Jun 30 10:59:10 2011 +0300

    Fixes to easy-rsa/2.0

    As support for OpenSSL 1.0.0 requires a modified openssl.cnf file, it was
    decided to rename openssl.cnf to openssl-1.0.0.cnf for clarity and better
    support of different OpenSSL versions. The old openssl.cnf was renamed as
    openssl-0.9.8.cnf.

    This patch makes sure that all openssl*.cnf files are copied when running 'make
    install' in easy-rsa and makes the whichopensslcnf script aware of them as well.

    Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
    Acked-by: David Sommerseth <davids@redhat.com>
    Signed-off-by: David Sommerseth <davids@redhat.com>

commit 5d14fcd885d19de42f3da45c94568ee934075949
Author: Samuli Seppänen <samuli@openvpn.net>
Date:   Wed Jun 29 11:24:08 2011 +0300

    Made domake-win builds to use easy-rsa/2.0/openssl-1.0.0.cnf

    Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
    Acked-by: David Sommerseth <davids@redhat.com>
    Signed-off-by: David Sommerseth <davids@redhat.com>

commit 4ec60a5839c73b3840ad9297e9d9d15893085eff
Author: Samuli Seppänen <samuli@openvpn.net>
Date:   Wed Jun 29 11:24:07 2011 +0300

    Updated "easy-rsa" for OpenSSL 1.0.0

    This patch fixes remaining issues with Trac ticket #125. It does the following:

    - Update easy-rsa/2.0/README
    - Rename easy-rsa/2.0/openssl.cnf as openssl-0.9.8.cnf
    - Add easy-rsa/2.0/openssl-1.0.0.cnf
    - Updated vars.bat.sample to use openssl-1.0.0.cnf
    - Updated win/openvpn.nsi to use openssl-1.0.0.cnf
    - Add a few undefined variables to vars and vars.bat.sample:
      required by OpenSSL 1.0.0 (at least on Windows)

    Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
    Tested-by: Samuli Seppänen <samuli@openvpn.net>
    Acked-by: David Sommerseth <davids@redhat.com>
    Signed-off-by: David Sommerseth <davids@redhat.com>

commit 6ab3848244388ca856d26aed8b0e44e4b9d589c3
Author: David Sommerseth <davids@redhat.com>
Date:   Mon Jun 20 11:44:22 2011 +0200

    Revert "Add new openssl.cnf to easy-rsa/Windows"

    This reverts commit 6989cbde616a00380acf3a390959987765a5325b.

    Accoding to Jan Just Keijser [1] there are issues with this new
    openssl.cnf file, so reverting this commit and wait for a new patch.

    [1] http://thread.gmane.org/gmane.network.openvpn.devel/4729/focus=4735

commit 6989cbde616a00380acf3a390959987765a5325b
Author: Samuli Seppänen <samuli@openvpn.net>
Date:   Mon Jun 20 10:49:41 2011 +0300

    Add new openssl.cnf to easy-rsa/Windows

    This is required for patch "Fix a build-ca issue on Windows" to work

    Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
    Acked-by: David Sommerseth <davids@redhat.com>
    (cherry picked from commit 663860ad04dd4190fddbee63e724d3fdceafd937)

commit 09282a688bd16d1572a7cc4fd20d3785fb2b4c1e
Author: Samuli Seppänen <samuli@openvpn.net>
Date:   Fri Jun 17 12:18:02 2011 +0300

    Fix a build-ca issue on Windows

    Fixes Trac ticket #125

    Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
    Acked-by: David Sommerseth <davids@redhat.com>
    Signed-off-by: David Sommerseth <davids@redhat.com>
    (cherry picked from commit 38108434db7b2d574133dd645d01df03848532d6)

commit 22c7d4699b4aaaa4d8512dd841564ac1606c0556
Author: David Sommerseth <davids@redhat.com>
Date:   Wed Jun 15 12:00:57 2011 +0200

    Remove support for Linux 2.2 configuration fallback

    When configuring OpenVPN nowadays, the TUN/TAP configuration can
    sometimes jump into the Linux 2.2 fallback code paths, which will
    also fails.  The reason it jumps into fallback mode is that the
    tun/tap device already exists or that /dev/net/tun does not exist.
    This can be very confusing, as /dev/tunX which the fallback mode tries
    to use, does not exist on Linux 2.4 and newer.

    Considering that the last Linux 2.2 update was released 25-Feb-2004
    and the first Linux 2.4 release came 04-Jan-2001, there are no
    reasonable reasons to help users to stay on outdated kernels.
    I consider this extra code path just waste of bytes ... so lets make
    the world simpler.

    Signed-off-by: David Sommerseth <davids@redhat.com>
    Acked-by: Gert Doering <gert@greenie.muc.de>
    (cherry picked from commit ce637abdafdc19547fc97192033a4d1703ecaf23)

commit a599b7f62998de9502e23b3ca79e88d12089486b
Author: Robert Fischer <ml-openvpn@trispace.org>
Date:   Thu Apr 21 22:55:52 2011 +0200

    Documented --x509-username-field option

    Also fixed a typo in the --help screen.

    Signed-off-by: Robert Fischer <ml-openvpn@trispace.org>
    Acked-by: David Sommerseth <davids@redhat.com>
    Signed-off-by: David Sommerseth <davids@redhat.com>
    (cherry picked from commit ca8af756c52ab7a4aecb857f60d6124e58458f0a)

commit 0010dd8d40ab3360b2ec8cbb3c8bbeb73546f3bb
Author: Robert Fischer <ml-openvpn@trispace.org>
Date:   Thu Apr 21 21:36:10 2011 +0200

    Added info about --show-proxy-settings

    Signed-off-by: Robert Fischer <ml-openvpn@trispace.org>
    Acked-by: David Sommerseth <davids@redhat.com>
    Signed-off-by: David Sommerseth <davids@redhat.com>
    (cherry picked from commit 54d40afdfa56f38030d7b440cb379abf9c9ddabc)

commit 05485d7f7733ba498262abc127795910fda0d0bb
Author: David Sommerseth <davids@redhat.com>
Date:   Tue May 31 16:59:30 2011 +0200

    Fix compiling issues with pkcs11 when --disable-management is configured

    pkcs11.c seems to miss some header files which gets implicitly added when
    the management interface is enabled.

    Signed-off-by: David Sommerseth <davids@redhat.com>
    Tested-by: Mr Dash Four <mr.dash.four@googlemail.com>
    (cherry picked from commit efcdf594f81a6af34b72285c12bacbce35c14b2d)

commit 4fe914a0ef0424144df3b12de19f2166fc613a0c
Author: David Sommerseth <davids@redhat.com>
Date:   Thu May 26 10:16:59 2011 +0200

    Don't define ENABLE_PUSH_PEER_INFO if SSL is not available

    The push_peer_info feature depends on the SSL infrastructure and openvpn
    will fail to build if ./configure --disable-crypto --disable-ssl is
    used.  The solution is to not define ENABLE_PUSH_PEER_INFO if we don't
    have crypto/ssl.

    Signed-off-by: David Sommerseth <davids@redhat.com>
    Acked-by: Gert Doering <gert@greenie.muc.de>
    (cherry picked from commit 21fc2edfc49bcc903d5cfb74c1ba2f41ac8771f0)

commit e1f2f5f61e5be20be9abd9c747fa83e8189d34c8
Author: Matthew L. Creech <mlcreech@gmail.com>
Date:   Wed May 11 17:57:28 2011 -0400

    Fix 2.2.0 build failure when management interface disabled

    I just upgraded to 2.2.0, and my build fails with:

    ps.c: In function 'port_share_open':
    ps.c:778:7: error: 'management' undeclared (first use in this function)
    ps.c:778:7: note: each undeclared identifier is reported only once for
    each function it appears in
    make[5]: *** [ps.o] Error 1

    [Comment by David Sommerseth:
     This happens only when building with --enable-small, --disable-management
     and --disable-pkcs11

     Also changed MANAGEMENT_ENABLED to ENABLE_MANAGEMENT from the original
     patch.
    ]

    Mailing-list: http://thread.gmane.org/gmane.network.openvpn.devel/4639
    Signed-off-by: Matthew L. Creech <mlcreech@gmail.com>
    Acked-by: Gert Doering <gert@greenie.muc.de>
    Signed-off-by: David Sommerseth <davids@redhat.com>
    (cherry picked from commit ca0ed8458a355aea46d26c209984caaf533784ec)

commit 96ca4f3334b126ad972948d76add176a31116ca4
Author: Simon Matter <simon.matter@invoca.ch>
Date:   Tue Mar 8 07:27:00 2011 +0000

    Fix issues with some older GCC compilers

    Some older GCC compilers don't like that variables are declared
    in the middle of the code, and expect them on the top in the
    block/scope.

    Trac-ticket: 99
    Signed-off-by: Simon Matter <simon.matter@invoca.ch>
    Acked-by: David Sommerseth <davids@redhat.com>
    Signed-off-by: David Sommerseth <davids@redhat.com>
    (cherry picked from commit aa52ca828fc075e010c326e91d2171484a514fde)

commit 60fdd9b01deab10f9a62ee9235ad9ec16873b5d5
Author: Gustavo Zacarias <gustavo@zacarias.com.ar>
Date:   Wed Apr 27 18:43:50 2011 +0200

    Fix compile issues when using --enable-small and --disable-ssl/--disable-crypto

    The tmp_dir string is required in the options struct regardless of options
    so spin it out of #if conditionals.

    Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
    Acked-by: David Sommerseth <dazo@users.sourceforge.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    (cherry picked from commit b70d99fb617350b252c8bde2f1f2d81d3f5b7955)

commit 1ed76da8b70aa13e0e8ac52d0459d37105f151e8
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Thu Apr 21 21:26:05 2011 +0200

    Tagging the v2.2.0 release

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit 1d6f40a16cf3b20f9e32ca722c6fa3fc9d64b552
Author: Robert Fischer <ml-openvpn@trispace.org>
Date:   Sun Apr 17 23:25:34 2011 +0200

    Update man page with info about --connect-timeout

    Signed-off-by: Robert Fischer <ml-openvpn@trispace.org>
    Acked-by: David Sommerseth <dazo@users.sourceforge.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    (cherry picked from commit 285252d1a189c331becde940d948d7ca1fe778fd)

commit 3aae5db7f7f9bd6e907e18b92e23c107d3907d4f
Author: Robert Fischer <ml-openvpn@trispace.org>
Date:   Sun Apr 17 23:03:49 2011 +0200

    Update man page with info about --capath

    Signed-off-by: Robert Fischer <ml-openvpn@trispace.org>
    Acked-by: David Sommerseth <dazo@users.sourceforge.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    (cherry picked from commit b63ecceb8b9bc3215866ae622bbd013d029d0b69)

commit 9322eca5d95353757f3b7b47f67054ddb7b14369
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Thu Apr 21 21:03:25 2011 +0200

    Add a simple comment regarding openvpn_snprintf() is duplicated

    Commit df5a4380c3931520d5fae2b18f0fc2e67a883aae copies this function
    from buffer.c to service-win32/openvpnserv.c.  Any changes on either
    places should be done in both implementations.

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    (cherry picked from commit 14708eb69e377ae7edcbbdbd2842bcfbc43fb84a)

commit 47dd9a4d7b2930f6e1b5d6f0ce0c154efc87ac29
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Thu Apr 21 20:32:26 2011 +0200

    Improve the mysprintf() issue in openvpnserv.c

    A quick and dirty compile fix was introduced in commit 77d244050964525417,
    and was accepted under the condition that it would be a temporary fix.

    As the usage of _snprintf() is realy not ideal on Windows, this patch
    uses the same well tested openvpn_snprintf() function from buffer.c.
    It was a longer discussion of several possibilities to re-use that code,
    but in the end it seemed easier to just copy-paste this function to
    openvpnserv.c for now.

    The reason for this conclusion was that the function is really simple,
    well defined and will most likely not be changed much in the future.
    It is also added a comment in openvpnserv.c where this function
    has its origins.

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: James Yonan <james@openvpn.net>
    (cherry picked from commit df5a4380c3931520d5fae2b18f0fc2e67a883aae)

commit 1cc2b62d97d651ce9b05466928faba3b463838b7
Author: Samuli Seppänen <samuli@openvpn.net>
Date:   Fri Apr 15 16:25:17 2011 +0300

    Fixed a bug with GUI icon deletion on upgrade from 2.2-RC or earlier

    This bug was introduced in commit 110e42d199e735ab1a31388c5678f59d0fa9510c.

    Trac-ticket: 120
    Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
    Acked-by: David Sommerseth <davids@redhat.com>
    Signed-off-by: David Sommerseth <davids@redhat.com>
    (cherry picked from commit 6d1d08f6792109a4a4cdd9cd0936fd4338c76fa1)

commit d1a24b6fe38e15e02e607a71161b3f3c8a7bbad7
Author: Gisle Vanem <gvanem@broadpark.no>
Date:   Sat Apr 9 12:56:52 2011 +0000

    Avoid re-defining uint32_t when using mingw compiler

    Since MingW for quite a long time (since 3.2 in 2008?) has defined
    'uint32_t' etc. in it's <stdint.h>, we need to guard against defining
    them again. Ideally we should figure out in what version of MingW
    this happened. But for now:

    Signed-off-by: Gisle Vanem <gvanem@broadpark.no>
    Acked-by: David Sommerseth <dazo@users.sourceforge.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    (cherry picked from commit 6a8270c29120473570ec6da4003226f36a4b71eb)

commit 5ccb1c4ff042ef4df99845be339174a8664a7d6d
Author: rf <ml-openvpn@trispace.org>
Date:   Fri Apr 8 20:49:49 2011 +0200

    Added man page entry for --management-client

    Track-ticket: 114
    Signed-off-by: rf <ml-openvpn@trispace.org>
    Acked-by: David Sommerseth <dazo@users.sourceforge.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    (cherry picked from commit cffcefac8f227fc75772eb5f531eafc7ab1593e5)

commit 3136439d71fef635dd9148f02471b57e6fcf3cd1
Author: rf <ml-openvpn@trispace.org>
Date:   Fri Apr 8 13:15:23 2011 -0700

    Update man page with info about --remote-random-hostname

    Trac-ticket: 115
    Signed-off-by: rf <ml-openvpn@trispace.org>
    Acked-by: David Sommerseth <dazo@users.sourceforge.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    (cherry picked from commit 6215e11e2b864085c0b55fff631f81b2cc587f69)

commit f71233577e573c5d1dc0cd711b7b78867a7853be
Author: Samuli Seppänen <samuli@openvpn.net>
Date:   Thu Apr 14 17:43:40 2011 +0300

    Fixed copying of tapinstall.exe to dist/bin when using prebuilt TAP-drivers

    Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
    Acked-by: David Sommerseth <dazo@users.sourceforge.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    (cherry picked from commit 343037a99708bd7785de10cc5be37a150609bd01)

commit 8cf7903c31d76ea905b7fd5d9257f116f424fe9e
Author: Samuli Seppänen <samuli@openvpn.net>
Date:   Thu Apr 14 17:41:23 2011 +0300

    Removed Win2k from supported platforms list in INSTALL and win/openvpn.nsi

    Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
    Acked-by: David Sommerseth <dazo@users.sourceforge.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    (cherry picked from commit 9b8247edf3e58893eb3ecc38dbfb2805ff1bb83d)

commit 6f0ded58250d4b4fef9cfdd314165d88d8f8f80e
Author: Samuli Seppänen <samuli@openvpn.net>
Date:   Thu Apr 14 17:40:33 2011 +0300

    Fix a bug in devcon source code handling

    The win/config_ti.py build script assumes to find ../tapinstall/7600/sources.in
    which does not exists in devcon.exe source code directory. This makes
    config_ti.py look for ../tapinstall/7600/sources instead.

    Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
    Acked-by: David Sommerseth <dazo@users.sourceforge.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    (cherry picked from commit a18752d4febdaa91f87efcc487ac865d6587c527)

commit eb4b1bb6adc7fb1828839967a7807b6317305145
Author: David Sommerseth <davids@redhat.com>
Date:   Thu Apr 14 16:21:16 2011 +0200

    Change the default --tmp-dir path to a more suitable path

    In commit 4e1cc5f6dda22e9 the create_temp_filename() function was
    reviewed and hardened, which in the end renamed this function to
    create_temp_file() in commit 495e3cec5d156.

    With these changes it became more evident that OpenVPN needs a directory
    where it can create temporary files.  The create_temp_file() will create
    such files f.ex. if --client-connect or --plugin which makes use of
    the OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY hook, such as openvpn-auth-pam.so.

    When this happens, OpenVPN will normally create these files in the directory
    OpenVPN was started.  In many cases, this will fail due to restricted access.
    By using --tmp-dir and pointing it to a directory writeable to the user
    running OpenVPN, it works again.

    This patch makes OpenVPN use a more suitable temproary directory by default,
    instead of the current working directory.  On non-Windows platforms this
    default value is set to '/tmp', but can be modified at compile-time by
    running ./configure --with-tmp-dir-path=<TEMP DIR PATH>.  On Windows, it
    will use GetTempPath() to find temporary paths recommended by the OS.  If
    this fails, it will fallback to the old behaviour, using the directory
    where OpenVPN was started.

    In any cases, this default value can be overridden in the configuration
    file by using the --tmp-dir option, as before.

    To check what the default is at runime, you can see this easily by doing
    this:

          $ ./openvpn --verb 4 --dev tun | grep tmp_dir

    Signed-off-by: David Sommerseth <davids@redhat.com>
    Tested-by: Jan Just Keijser <janjust@nikhef.nl>
    Acked-by: Gert Doering <gert@greenie.muc.de>
    (cherry picked from commit ca4c6d618d743ec4a3b6f7ef8003d891603ec1a6)

commit c7dd80cf45efa935f01a233aa74050fb5898adb8
Author: James Yonan <james@openvpn.net>
Date:   Sun Apr 3 23:48:15 2011 +0200

    Fixed bug in port-share that could cause port share process to crash
    with output like this:

    TCP connection established with 85.190.0.3:41781
    85.190.0.3:41781 SIGTERM[soft,port-share-redirect] received, client-instance exiting
    MANAGEMENT: TCP recv error: Socket operation on non-socket
    MANAGEMENT: Client disconnected
    MANAGEMENT: Triggering management exit
    Exiting due to fatal error
    EVENT: epoll_ctl EPOLL_CTL_MOD failed, sd=6: Bad file descriptor (errno=9)

    Then an error like this for every incoming connection that should be
    proxied:

    76.120.71.74:55302 PORT SHARE: sendmsg failed -- unable to communicate with background process (6,8,-1,-1): Connection refused (errno=111)

    Version 2.1.3s
    (cherry picked from commit 9ed122efe870288ea75ee62a4eae2373a655145b)

commit 89e0728ba6057bfe45b635a42c36502e9edc8cb3
Author: Gert Doering <gert@greenie.muc.de>
Date:   Sat Apr 9 18:16:21 2011 +0200

    Add more detailed explanation regarding the function of "--rdns-internal"

    As agreed in last thursday's IRC meeting [1], I've added a comment to the
    code explaining "--rdns-internal".  It's really very much an internal
    option, so it does not need to go to the man page.

    [1] http://thread.gmane.org/gmane.network.openvpn.devel/4573

    Signed-off-by: Gert Doering <gert@greenie.muc.de>
    Acked-by: David Sommerseth <davids@redhat.com>
    Signed-off-by: David Sommerseth <davids@redhat.com>
    (cherry picked from commit cdb3a5c0864e0fe8d0b814de1f024fd624dd3b1c)

commit f05b6d3302b3f204ebccb606ab52244316f08d09
Author: Samuli Seppänen <samuli@openvpn.net>
Date:   Thu Apr 14 17:18:47 2011 +0300

    Change all CRLF linefeeds to LF linefeeds

    Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
    Acked-by: David Sommerseth <davids@redhat.com>
    Signed-off-by: David Sommerseth <davids@redhat.com>
    (cherry picked from commit 6b2883a637fe73492f09816ee95b00c1b88d5fcb)

commit 86caf38ddcf4d9a80a97353888756255247b0a04
Author: Samuli Seppänen <samuli@openvpn.net>
Date:   Tue Mar 29 11:19:00 2011 +0000

    Add man page entry for --redirect-private

    Trac-ticket: 107
    Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
    Acked-by: David Sommerseth <dazo@users.sourceforge.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    (cherry picked from commit 808ba6b9316ff7f5910e2d4516c1a6aac788354c)

commit 272aef2f0fd6b8c81c397fc32a503776e2b4bef1
Author: David Sommerseth <davids@redhat.com>
Date:   Wed Mar 30 14:14:21 2011 +0200

    Fix the --client-cert-not-required feature

    Commit 2e8337de248ef0b5b48cbb2964da0d5c3f28b15b introduced a new
    feature for using other SSL certificate fields for authentication
    than the CN field.

    This commit introduced a bug, which made the verify_callback()
    function getting called even if --client-cert-not-required was
    enabled in the config.

    The reason for this was that an 'else' statement was lacking a
    couple of curly braces.  The offending commit in reality moved
    the setup of the verify_callback() function out of the 'else'
    statement.

    Report-URL: https://community.openvpn.net/openvpn/ticket/108
    Report-URL: https://forums.openvpn.net/topic7751.html
    Signed-off-by: David Sommerseth <davids@redhat.com>
    Acked-by: Jan Just Keijser <janjust@nikhef.nl>
    (cherry picked from commit 008a18e772bf1854f9a2102bef4b3d5b0a08a66b)

commit 53aa737dd18d72fb759f08794799c166ae81fab7
Author: chantra <chantra@debuntu.org>
Date:   Fri Mar 25 10:24:30 2011 +0100

    Clarify --tmp-dir option

    Signed-off-by: chantra <chantra@debuntu.org>
    Acked-By: David Sommerseth <davids@redhat.com>
    Signed-off-by: David Sommerseth <davids@redhat.com>
    (cherry picked from commit dc2ccc825c6952546132286c57b193d8bb9daacd)

commit 338b6948dd52bc0cf2da7e09a29f5127066a7af7
Author: David Sommerseth <davids@redhat.com>
Date:   Thu Mar 24 22:01:20 2011 +0100

    Preparing for the v2.2-RC2 release

    Signed-off-by: David Sommerseth <davids@redhat.com>

commit aab2f95439c28e2aa9358dbfe1ce7a15c774a766
Author: Alon Bar-Lev <alon.barlev@gmail.com>
Date:   Fri Mar 4 23:14:33 2011 +0200

    Windows cross-compile cleanup

    It should be sufficient to just try to see if socklen_t is defined.
    Next, on all platforms it would be int in all other platforms.
    And, there is no need to check for the type in monolitic environment
    like Windows, as it will be always the same.

    Currently it fails cross compile windows in mingw-w64 compiler, as
    winsock.h is as follows:
       """
         /* define WINSOCK_API_LINKAGE and WSAAPI for less
          * diff output between winsock.h and winsock2.h, but
          * remember to undefine them at the end of file */
       """
    And the macro uses these macros which are internal winsock macros and
    should not be used anyway.

    Also, when did the autodefs.h went mandatory? Why is it in
    tap-win32/common.h while no constant is actually used?

    The use of WSA_IO_INCOMPLETE without including winsock2.h is invalid!
    Look at http://msdn.microsoft.com/en-us/library/aa921087.aspx

    Signed-off-by: Alon Bar-Lev <alon.barlev@gmail.com>
    Acked-by: James Yonan <james@openvpn.net>
    Signed-off-by: David Sommerseth <davids@redhat.com>

commit ae32ea5919c156902bcdc1a4f2555d00d6109e32
Author: Samuli Seppänen <samuli@openvpn.net>
Date:   Thu Mar 24 21:17:10 2011 +0200

    Clarified --client-config-dir section on the man-page.

    Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
    Acked-by: David Sommerseth <davids@redhat.com>
    Signed-off-by: David Sommerseth <davids@redhat.com>

commit 1b71eafd4a0251740be28c495c874c2ffc9af3f6
Author: David Sommerseth <davids@redhat.com>
Date:   Thu Mar 24 14:51:48 2011 +0100

    Clarify default value for the --inactive option.

    It is not clear in the manual that this feature is disabled
    by default.

    Signed-off-by: David Sommerseth <davids@redhat.com>
    Acked-by: Gert Doering <gert@greenie.muc.de>

commit 527a351d5843793d016735a5e24daab42442ba45
Author: David Sommerseth <davids@redhat.com>
Date:   Mon Dec 13 12:49:00 2010 +0100

    Open log files as text files on Windows

    By giving the "t" flag to _fdopen() on Windows, the file will be
    opened in a "translate mode", where it will take care of converting
    \n to \r\n, and also look for the CTRL-Z mark when opening the log
    file in append mode.

    Reference:
    <http://msdn.microsoft.com/en-us/library/dye30d82%28VS.80%29.aspx>

    Thanks to Alon Bar-Lev for pointing out this solution.

    Reported-by: Thomas Reifferscheid
    Signed-off-by: David Sommerseth <davids@redhat.com>
    Acked-by: Gert Doering <gert@greenie.muc.de>

commit ef2cbc771a6cf95868f2bb1c692e3cc9e2be5280
Author: Samuli Seppänen <samuli@openvpn.net>
Date:   Wed Mar 23 14:14:32 2011 +0200

    Fixes to Makefile.am

    Removed reference to config-win32.h, which has been removed. Added
    management-notes.txt to dist_doc_DATA.

    Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
    Acked-by: David Sommerseth <davids@redhat.com>
    Signed-off-by: David Sommerseth <davids@redhat.com>

commit 58704ea66478942ae82c013d0d48c7931cb79fa0
Author: Samuli Seppänen <samuli@openvpn.net>
Date:   Tue Mar 15 16:38:07 2011 +0200

    Updated INSTALL-win32.txt

    Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
    Acked-by: Gert Doering <gert@greenie.muc.de>
    Signed-off-by: David Sommerseth <davids@redhat.com>

commit 4b312378e9e7084a0699ca6d4b895bdadb7540db
Author: Samuli Seppänen <samuli@openvpn.net>
Date:   Tue Mar 15 16:37:41 2011 +0200

    Replaced config-win32.h with win/config.h.in

    The original config-win32.h - a static header file - has been superceded by both
    "domake-win" script and the new Python-based buildsystem. Transformed it into a
    template file, win/config.h.in, which obtains the most commonly used build
    parameters from win/settings.in.

    Added support code to win/config.py and win/wb.py to preprocess win/config.h.in
    and copy it to config.h, from where source and header files can find it.

    Removed all references to config-win32.h. Also removed obsolete
    PACKAGE_BUGREPORT and USE_PTHREAD variables from the win/config.h.in file.

    Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
    Acked-by: James Yonan <james@openvpn.net>
    Signed-off-by: David Sommerseth <davids@redhat.com>

commit 110e42d199e735ab1a31388c5678f59d0fa9510c
Author: Samuli Seppänen <samuli@openvpn.net>
Date:   Tue Mar 15 16:36:41 2011 +0200

    Fixes to win/openvpn.nsi

    Added support for generating installer with unsigned TAP drivers. Fixed Windows
    Vista/7 Start menu shortcut uninstall failure.

    Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
    Acked-by: James Yonan <james@openvpn.net>
    Signed-off-by: David Sommerseth <davids@redhat.com>

commit 0c03c731a80399998cc4b03a35ffad2961c7b369
Author: Samuli Seppänen <samuli@openvpn.net>
Date:   Tue Mar 8 16:07:49 2011 +0200

    Added support for prebuilt TAP-drivers. Automated embedding manifests.

    Removed win/make_dist.py's dependency on TAP-driver and tapinstall.exe building.
    Also added manifest embedding commands to win/make_dist.py. To avoid duplicate
    code moved the "build_vc" method from win/build.py to win/wb.py and renamed it
    "run_in_vs_shell".

    Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
    Acked-by: James Yonan <james@openvpn.net>
    Signed-off-by: David Sommerseth <davids@redhat.com>

commit 0265cf3a6b646cc02a78cc3501dce77f99e81a5f
Author: Gert Doering <gert@greenie.muc.de>
Date:   Sun Mar 7 19:28:55 2010 +0100

    Implement IPv6 in TUN mode for Windows TAP driver.

    * install-win32/settings.in: bump version to 9.7, TAP_RELDATE to "07/03/2010".

    * tap-win32/proto.h: add data types and definitions needed for IPv6

    * tap-win32/types.h: add m_UserToTap_IPv6 ethernet header for IPv6 packets

    * tap-win32/tapdrvr.c: implement support for IPv6 in TUN mode:
         - IPv6 packets User->OS need correct ether type
         - IPv6 packets OS->User get correctly forwarded
         - IPv6 neighbour discovery packets for "fe80::8" (magic address
           installed as route-nexthop by OpenVPN.exe) get answered locally
    (cherry picked from commit 175e17a5abd5969f6803a9cc9587b7959e1100ae)

    Signed-off-by: Gert Doering <gert@greenie.muc.de>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit 4d283d7a54fa61c5bc5c5124977a5e35d9ee265f
Author: Ville Skyttä <ville.skytta@iki.fi>
Date:   Mon Feb 28 23:28:54 2011 +0200

    Fix line continuation in chkconfig init script description.

    See the chkconfig(8) man page for details.

    Signed-off-by: Ville Skyttä <ville.skytta@iki.fi>
    Acked-by: David Sommerseth <davids@redhat.com>
    Signed-off-by: David Sommerseth <davids@redhat.com>

commit 26eaa885b0a84e5a020c7d463a261f3d819af7a1
Author: David Sommerseth <davids@redhat.com>
Date:   Mon Feb 28 14:57:49 2011 +0100

    Fix packaging of config-win32.h and service-win32/msvc.mak

    The config-win32.h and service-win32/msvc.mak was not included
    into the final source balls when using 'make dist', which is
    crucial for Windows building.

    Signed-off-by: David Sommerseth <davids@redhat.com>
    Acked-by: Samuli Seppänen <samuli@openvpn.net>

commit 55f698d92ecf8811e62f077f8a6db4e31e963b91
Author: David Sommerseth <davids@redhat.com>
Date:   Mon Feb 28 11:36:13 2011 +0100

    Preparing for the OpenVPN 2.2-RC release

    Signed-off-by: David Sommerseth <davids@redhat.com>

commit 77d24405096452541700fb24aacd6f8a589fce3b
Author: Samuli Seppänen <samuli@openvpn.net>
Date:   Fri Feb 18 11:39:27 2011 +0200

    Temporary snprintf-related fix to service-win32/openvpnserv.c

    This is intended just as a TEMPORARY solution to get the 2.2-RC released.
    The intesion is to get this fixed with a better solution for the final 2.2
    release.  This patch has also been discussed here:

    http://thread.gmane.org/gmane.network.openvpn.devel/4325/

    The only reason for this patch to be accepted in its current shape, is
    that it will be fixed before the final 2.2 release.

    Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
    Acked-by: David Sommerseth <davids@redhat.com>
    Signed-off-by: David Sommerseth <davids@redhat.com>

commit c75a8976f070ef86cfced71b3df5cbce0e32e01a
Author: Samuli Seppänen <samuli@openvpn.net>
Date:   Sat Feb 19 10:15:12 2011 +0200

    Changes to buildsystem patchset

    Implemented changes to the buildsystem patchset suggested by jamesyonan in IRC
    meeting on 17th Feb 2010:

    1) Remove variables added to version.m4 and use win/settings.in instead
    2) Add ENABLE_<FEATURE> configuration to win/settings.in instead of parsing
       config-win32.h for them

    This patch applies on top of the previous 13 patches.

    Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
    Acked-by: James Yonan <james@openvpn.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit 3b315a57d579d9ba8e259216f722094f1c1dbcde
Author: Samuli Seppänen <samuli@openvpn.net>
Date:   Fri Feb 11 16:32:35 2011 +0200

    Added first version of NSI installer script to win/openvpn.nsi

    This win/openvpn.nsi file is a heavily cleaned-up version of the
    install-win32/openvpn.nsi file. The key differences:

    - paths have been adapted to new buildsystem's requirements
    - obsolete XGUI support has been removed
    - unused Windows version detection has been removed
    - variables specific to new build system (win/settings.in, version.m4) are
      imported
    - a few new installer options have been introduced:
      - install lzo2.dll
      - install msvcr90.dll (a requirement from VS2008 builds)

    Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
    Acked-by: James Yonan <james@openvpn.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit 21c60e9f11d8d53c11611ea66698afea9c0350ef
Author: Samuli Seppänen <samuli@openvpn.net>
Date:   Fri Feb 11 16:31:18 2011 +0200

    Copied install-win32/setpath.nsi to win/setpath.nsi

    Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
    Acked-by: James Yonan <james@openvpn.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit 4e4aa65e9df1bfe4b9726eacea2c75cad32c0927
Author: Samuli Seppänen <samuli@openvpn.net>
Date:   Fri Feb 11 16:25:40 2011 +0200

    Several modifications to win/make_dist.py to allow building the NSI installer

    Added copying of all remaining openvpn dependencies to dist directory so that
    the NSI installer script (win/openvpn.nsi) can find and use them more easily.
    This includes openvpn.exe, openvpnserv.exe, libpkcs11-helper-1.dll, openssl.exe,
    and example files. The associated, external DDL/manifest files are copied also,
    so that embedding them with mt.exe is easier. This is a temporary solution until
    nmake makefiles are modified to automate this process, except for a few of the
    library dependencies (lzo2.dll and libpkcs11-helper-1.dll).

    Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
    Acked-by: James Yonan <james@openvpn.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit 26e127cd59e07825a0785db2247fdac76ff01693
Author: Samuli Seppänen <samuli@openvpn.net>
Date:   Fri Feb 11 16:22:51 2011 +0200

    Added comments to win/build_ddk.py

    Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
    Acked-by: James Yonan <james@openvpn.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit 5e0b636ba6cb26a69ce5e863526e44d0fbd33ffc
Author: Samuli Seppänen <samuli@openvpn.net>
Date:   Fri Feb 11 16:20:43 2011 +0200

    Added openvpnserv.exe building to win/build.py

    Made win/build.py call nmake in service-win32 directory to build openvpnserv.exe
    after main build (openvpn.exe) has finished.

    Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
    Acked-by: James Yonan <james@openvpn.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit a7f0fc316caf3fbbe7c75866b4d8d21e2e931fc1
Author: Samuli Seppänen <samuli@openvpn.net>
Date:   Fri Feb 11 16:16:14 2011 +0200

    Added configure.h and version.m4 variable parsing to win/config.py

    Python-based buildsystem uses win/config.py to obtain global build parameters
    from various sources. Added parsing of the (fake) configure.h and version.m4 to
    it so that other Python build files can use them.

    Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
    Acked-by: James Yonan <james@openvpn.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit 8c1c666e65db37fe680f7760c6ef52c2dd031932
Author: Samuli Seppänen <samuli@openvpn.net>
Date:   Fri Feb 11 16:14:28 2011 +0200

    Added command-line switch to win/build_all.py to skip TAP driver building

    Modified win/build_all.py so that by giving -n or --notap switch the TAP driver
    is not built. This is useful if using prebuilt TAP drivers, or when WinDDK is
    not installed.

    Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
    Acked-by: James Yonan <james@openvpn.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit 292cf21a64b4afb3b22a6ba19967f965b486600a
Author: Samuli Seppänen <samuli@openvpn.net>
Date:   Fri Feb 11 16:06:05 2011 +0200

    Added comments and made small modifications to win/msvc.mak.in

    The win/msvc.mak.in file is used as basis for msvc.mak file which drives
    openvpn.exe building. This change separates output file from LINK32_FLAGS and
    adds helpful comments to the win/msvc.mak.in file.

    Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
    Acked-by: James Yonan <james@openvpn.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit 3b44aa49400647b785721e77da9c5e38eeb9fd83
Author: Samuli Seppänen <samuli@openvpn.net>
Date:   Fri Feb 11 16:03:31 2011 +0200

    Added support for viewing config-win32.h paramters to win/show.py

    The win/show.py tools is used to view build parameters interactively. This
    changes it so that it displays parameters parsed from config-win32.h in addition
    to those from win/settings.in.

    Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
    Acked-by: James Yonan <james@openvpn.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit a8220492b30f2780c55c57d110253f310c170b73
Author: Samuli Seppänen <samuli@openvpn.net>
Date:   Fri Feb 11 15:53:19 2011 +0200

    Added helper functionality to win/wb.py

    This change adds several helper functions to win/wb.py:

    - config-win32.h parser (to read build configuration options)
    - helper function to cd to service-win32 for openvpnserv.exe building
    - code to dynamically generate TAP-driver -related variables from version.m4,
      required by tap-win32/tapdrv.c
    - configure.h generator to allow viewing build options using openvpn --version
    - creation of temporary version.m4-based file to allow importing it's variables
      to the NSI installer script (win/openvpn.nsi)
    - helper function to rename files (used in win/make_dist.py)

    Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
    Acked-by: James Yonan <james@openvpn.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit 9e178ebe41233c228a3f76c1adb623a633057249
Author: Samuli Seppänen <samuli@openvpn.net>
Date:   Fri Feb 11 15:28:13 2011 +0200

    Moved TAP-driver version info to version.m4. Cleaned up win/settings.in.

    Previously parts of TAP-driver version information were stored in
    win/settings.in. This patch moves all of it to version.m4. This patch also
    cleans up and adds comments to win/settings.in

    Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
    Acked-by: James Yonan <james@openvpn.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit da51a175ed364ae8d41950858d8ebb2a25b742ee
Author: Samuli Seppänen <samuli@openvpn.net>
Date:   Fri Feb 11 15:15:51 2011 +0200

    Added a nmake makefile for openvpnserv.exe building

    This change adds a nmake makefile (service-win32/msvc.mak) which allows building
    openvpnserv.exe using the new Python-based buildsystem.

    Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
    Acked-by: James Yonan <james@openvpn.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit 980d44047f4ab1541f80df1c9c2cfe6a2c572af8
Author: Samuli Seppänen <samuli@openvpn.net>
Date:   Fri Feb 11 15:11:51 2011 +0200

    Added ENABLE_PASSWORD_SAVE to config-win32.h

    This change adds ENABLE_PASSWORD_SAVE to config-win32.h. This option is also
    defined in win/settings.in, but it does not have any effect there.

    Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
    Acked-by: James Yonan <james@openvpn.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit c994385048a64adb3ec3e8f5f906c5f8668e1a71
Author: David Sommerseth <davids@redhat.com>
Date:   Thu Jan 6 19:31:34 2011 +0100

    Fix compiler warning when compiling against OpenSSL 1.0.0

    The declaration of  SSL_get_current_cipher() has changed to be
    return a const value.  And this makes compilers a little bit grumpy.

    gcc:
      ssl.c: In function ‘print_details’:
      ssl.c:1918: warning: assignment discards qualifiers from pointer target type

    Visual C:
      ssl.c (1918): warning C4019: '=' : different 'const' qualifiers

    Signed-off-by: David Sommerseth <davids@redhat.com>
    Acked-by: Gert Doering <gert@greenie.muc.de>
    (cherry picked from commit 7bd3cea4c2f2aa8ed1bf548a3233ae2c3619d47d)

commit bc454059ce843c580dee2141813b4e82d45fcbc3
Author: James Yonan <james@openvpn.net>
Date:   Fri Dec 10 21:17:36 2010 +0000

    Minor addition of logging info before and after
    execution of Windows net commands.

    Version 2.1.3d

    git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6712 e7ae566f-a301-0410-adde-c780ea21d3b5

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    (cherry picked from commit 7621741b480f93411928c66735d2ee9c7f69de3b)

commit fbd18db6485e3d08d8d933263cff96ee60eddb39
Author: David Sommerseth <davids@redhat.com>
Date:   Wed Dec 15 10:53:04 2010 +0100

    Make the --x509-username-field feature an opt-in feature

    After some discussion [1] regarding an extension of this feature,
    James Yonan wanted this extension to be an opt-in feature.  However,
    as it does not make sense to opt-in on a extension of a feature which
    was discussed, this patch makes the base feature an opt-in instead.

    The base feature comes from commit 2e8337de248ef0b5b48cbb2964 (beta2.2)
    and commit 935c62be9c0c8a256112 (feat_misc).

    [1] http://thread.gmane.org/gmane.network.openvpn.devel/4266

    Signed-off-by: David Sommerseth <davids@redhat.com>
    Acked-by: James Yonan <james@openvpn.net>
    (cherry picked from commit 024972e2ced84c6e5cabc43620ab510e5693d1d4)

commit 709271e8af5d19472cb200956bcc9b756a655f77
Author: Matthias Andree <matthias.andree@gmx.de>
Date:   Sat Dec 4 03:51:11 2010 +0100

    Change variadic macros to C99 style.

    The macros used GCC's pre-C99 syntax, which could not be compiled with
    Microsoft Visual Studio 2008.

    Note this breaks compatibility with GCC versions before 3.0, which is
    deemed safe in a discussion on IRC with David Sommerseth and Samuli
    Seppänen on #openvpn-devel (RHEL 3 uses GCC 3.2 already).

    Compiled tested on VS2008 by Samuli, on Cygwin GCC 3.4 and GCC 4.3 by myself.

    Signed-off-by: Matthias Andree <matthias.andree@gmx.de>
    Acked-by: David Sommerseth <dazo@users.sourceforge.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    (cherry picked from commit 9469168e3abb09bd78297208a917ee4d9c025041)

commit 14f7e0f2d58ad12f3a206b38bae2464ebc0a98f4
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Thu Nov 25 21:45:26 2010 +0100

    Prepared v2.2-beta5 for release

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit f437ac7aded5e6c30b5543ff0a8531552d16c212
Merge: 4729263 86f6b9d
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Thu Nov 25 21:28:10 2010 +0100

    Merge branch 'feat_misc' into beta2.2

commit 86f6b9d3bdd94d1e564ae14bb16b04554f6ab27b
Author: Samuli Seppänen <samuli@openvpn.net>
Date:   Thu Nov 25 21:48:34 2010 +0200

    Fixed an issue causing a build failure with MS Visual Studio 2008.

    The new SOCKS auth code in socks.c contained a call to sprintf instead of
    openvpn_sprintf. This caused build to fail if MS Visual Studio 2008 C compiler
    was used. This change fixes that issue.

    Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
    Acked-by: David Sommerseth <dazo@users.sourceforge.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit 4729263dbe01afc078d6b7cf7167122d50e65533
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Sun Nov 21 16:04:54 2010 +0100

    Prepared for v2.2-beta4 for release

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit 38f110bb87aa60a2c8a4a4f653685a63c2036227
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Thu Nov 18 22:33:47 2010 +0100

    Updated ChangeLog with info about last merges

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit 529df9922d85574828d95020eebcd228ba3a8164
Merge: eb208d3 7c18c63
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Thu Nov 18 22:17:58 2010 +0100

    Merge branch 'feat_misc' into beta2.2

    Conflicts:
    	acinclude.m4
    	config-win32.h
    	configure.ac
    	misc.c
    	thread.c
    	thread.h
            - These conflicts was mainly due to feat_misc getting old
              and mostly caused by the pthread clean-up patches in
              feat_misc

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit eb208d36d466a1725e20e0a7aef39b1114b99e78
Merge: 4b519cf f20c2f0
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Thu Nov 18 19:10:08 2010 +0100

    Merge branch 'bugfix2.1' into beta2.2

commit f20c2f0d6b42f652f39c0082237c3f8d69752ec9
Author: Samuli Seppänen <samuli@openvpn.net>
Date:   Thu Nov 18 18:00:54 2010 +0200

    Added command-line option parser and an unsigned build option to build_all.py

    Modified win/build_all.py so that it parses command-line options using getopt.
    Added option "-u / --unsigned" which allows forcing unsigned builds and a "-h /
    --help" option. By default a signed build is generated, provided that the Python
    SignTool module is installed. If not, the build is interrupted.

    Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
    Acked-by: Peter Stuge <peter@stuge.se>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit 7c18c6353904f8c6e7f4eab3d13c985761ab80e5
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Mon Nov 15 09:00:12 2010 +0100

    Merged add_bypass_address() and add_host_route_if_nonlocal()

    The add_host_route_if_nonlocal() function is too simple to really
    benefit from calling add_bypass_address() when this function is the
    only caller to this function.

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: Peter Stuge <peter@stuge.se>

commit 7581c8fd6f0b0f0855b8dae8dba697fecb5ac6a4
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Mon Nov 15 08:58:36 2010 +0100

    Removed functions not being used anywhere

    The GNU C compiler gave warnings about these functions in the patch
    not being used anywhere.  Doing a git grep on the code turned out
    there were no callers to these functions.  Taking these functions out,
    as there is not good reason why to carry dead code.

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: Peter Stuge <peter@stuge.se>

commit d29e6de16ad1cbbc5740e732268da9347b370a1d
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Mon Nov 15 08:56:18 2010 +0100

    Only add some functions when really needed

    The GNU C compiler gave warnings about some functions not being used.
    These functions where only used if certian #ifdef sections was enabled.

    This patch encapsulates these function declarations with matching #ifdef's
    to make it more clear when these functions are needed.

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: Peter Stuge <peter@stuge.se>

commit 33ee747fff4acb4ea4c143089aa2c596a1e4d0bd
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Mon Nov 15 08:53:40 2010 +0100

    Fixed potential misinterpretation of boolean logic

    The GNU C compiler warned about a potential issue with an if()
    expression missing an extra set of parentheses.

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: Peter Stuge <peter@stuge.se>

commit eabb8eed0bc3b2b16722eeb38d8000eda35668a7
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Mon Nov 15 08:48:57 2010 +0100

    Fix compiler warnings about not used dummy() functions

    It has been reported that the Microsoft Visual C compiler complains if
    a .c file do not contain any compilable code, which can happen if the
    code has been #ifdef'ed out.  To avoid this, these #ifdef sections have
    a #else section which adds a static dummy() function which does nothing.

    On the other hand, the GNU C compiler complains about unused functions when
    it discovers this situation.

    This patch tries to only add these dummy() functions if the Microsoft Visual C
    compiler is detected, via the _MSC_VER macro.

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: Peter Stuge <peter@stuge.se>

commit 2ff54d66a22402caf08709ec22730e20c193ecbd
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Mon Nov 15 21:44:59 2010 +0100

    Use stricter snprintf() formatting in socks_username_password_auth() (v3)

    commit fc1fa9ffc7e3356458ec3 added a new function which needs to have a
    stricter string formatting.  This was detected due to a compiler warning.

    This patch makes sure that the length of username and password is not longer
    than 255 bytes.  It also adds extra checks to avoid NULL pointer issues with
    strlen() on these two parameters.

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: Gert Doering <gert@greenie.muc.de>

commit e98124dfbabfa78e9bf6e841ffcc8e04868df331
Merge: 423d68b 2d12eb1
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Thu Nov 18 18:47:06 2010 +0100

    Merge branch 'svn-BETA21' into bugfix2.1

commit 2d12eb12cf2a49adbc2e89e20990415947519900
Author: James Yonan <james@openvpn.net>
Date:   Tue Nov 16 09:10:39 2010 +0000

    Fixes to prevent compile breakage when --disable-crypto is used.

    git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6656 e7ae566f-a301-0410-adde-c780ea21d3b5

commit b2dee7d568d4f31e2c2c8aba5de5ac02147c6b6b
Author: James Yonan <james@openvpn.net>
Date:   Tue Nov 16 08:36:18 2010 +0000

    In verify_callback, the subject var should be freed by OPENSSL_free,
    not free, since it is allocated by OpenSSL.

    git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6655 e7ae566f-a301-0410-adde-c780ea21d3b5

commit 4b519cf51d02daacb388eb90bd0c5930145d7a0d
Merge: 513a532 423d68b
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Sun Nov 14 23:48:49 2010 +0100

    Merge branch 'bugfix2.1' into beta2.2

    Conflicts:
    	options.c
    	- Disagreements about a new included file (forward.h)

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit 423d68b0ede7f10c02fa753cba8d60d2218d2dc7
Author: James Yonan <james@openvpn.net>
Date:   Sun Nov 14 23:38:47 2010 +0100

    Fixed compiling issues when using --disable-crypto

    Peter Korsgaard <jacmet@sunsite.dk> reported an issue [1] when compiling
    with --disable-crypto activated.  He suggested a patch, which only
    partly solved the issue.  SVN r6568 / commit 3cf9dd88fd84108 added a
    new feature which further made it impossible to compile without crypto.

    This patch fixes both issues, based on Peter Korsgaard's patch.

    [1] <http://sourceforge.net/mailarchive/forum.php?thread_name=87fwx08bod.fsf%40macbook.be.48ers.dk&forum_name=openvpn-devel>

    Signed-off-by: James Yonan <james@openvpn.net>
    Acked-by: David Sommerseth <dazo@users.sourceforge.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit 3adf2f558e157ef5087ca44f13e097a394ef7c78
Author: Jesse Young <jesse.young@gmail.com>
Date:   Mon Nov 1 11:33:26 2010 -0500

    Remove hardcoded path to resolvconf

    Signed-off-by: Jesse Young <jesse.young@gmail.com>
    Acked-by: David Sommerseth <dazo@users.sourceforge.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit 6af422162fbc1c505526157ecf630e37694dbc7b
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Sat Aug 28 20:52:19 2010 +0200

    Clean-up: Removing useless code - hash related functions

    Removed even more function which where practically empty and took away
    some function arguments which were not used.

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: James Yonan <james@openvpn.net>

commit cc88a2695f4a54e27143efeae62de24fec8e26a1
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Sat Aug 28 20:44:07 2010 +0200

    Clean-up: Remove more dead and inactive code paths

    These code paths was practically not needed with no locking mechanisms
    enabled and was just bloating the source code.

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: James Yonan <james@openvpn.net>

commit 7aa6c12a4424d00ea0add0a849f8a5b31a2de6a1
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Sat Aug 28 20:14:36 2010 +0200

    Clean-up: Remove pthread and mutex locking code

    This code was not activated at all, and hard coded as disabled in syshead.h
    with this code snippet:

       /*
        * Pthread support is currently experimental (and quite unfinished).
        */
       #if 1 /* JYFIXME -- if defined, disable pthread */
       #undef USE_PTHREAD
       #endif

    So no matter if --enable-pthread when running ./configure or not, this feature
    was never enabled in reality.  Further, by removing the blocker code above made
    OpenVPN uncompilable in the current state.

    As the threading part needs to be completely rewritten and pthreading will not be
    supported in OpenVPN 2.x, removing this code seems most reasonable.

    In addition, a lot of mutex locking code was also removed, as they were practically
    NOP functions, due to pthreading being forcefully disabled

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: James Yonan <james@openvpn.net>

commit 513a53284158c6fe3b4c89b59eb10029639407b5
Merge: 1aa664c 5682d33
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Sun Nov 14 12:42:38 2010 +0100

    Merge branch 'feat_misc' into beta2.2

commit 5682d3394204c788988b3cf67b3443a717704d2c
Author: Samuli Seppänen <samuli@openvpn.net>
Date:   Fri Nov 12 17:30:07 2010 +0200

    Added check for variable CONFIGURE_DEFINES into options.c

    The file containing CONFIGURE_DEFINES variable, configure.h, is not present if
    openvpn is built using the Python + Visual C -based buildsystem. This causes the
    build to fail. This patch adds a check to see if variable exists before trying
    to use it.

    Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
    Acked-by: Peter Stuge <peter@stuge.se>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit 1aa664cef51e4b4ed4b35e569925acb4fd7b9b52
Merge: 61c4064 f0eac1a
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Sat Nov 13 00:55:02 2010 +0100

    Merge branch 'feat_misc' into beta2.2

    Conflicts:
    	Makefile.am
    	openvpn.8
    	options.c
    	socket.c
    	ssl.c
    	- feat_misc is missing a lot of bugfix2.1 changes

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit 61c40649de994c8f2ce713389294134aeb6cc8a7
Merge: 8367889 22178d0
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Sat Nov 13 00:49:05 2010 +0100

    Merge branch 'bugfix2.1' into beta2.2

commit 8367889e8467ce73b051aa8db64b0336aea8ed4b
Merge: 0bb41e5 20a4c12
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Sat Nov 13 00:48:28 2010 +0100

    Merge branch 'svn-BETA21' into beta2.2

    Conflicts:
    	version.m4
    	- Reset version.m4 to a more neutral version number

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit 22178d05f7912fd51a21a32387982394447d90f6
Merge: bbea5bb 20a4c12
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Sat Nov 13 00:46:13 2010 +0100

    Merge branch 'svn-BETA21' into bugfix2.1

commit bbea5bb30f8148546bee0a72e409c6089b84b757
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Fri Nov 12 23:10:32 2010 +0100

    Clarified --explicit-exit-notify man page entry

    Reformulated parts of this entry to clarify that the OpenVPN
    will not attempt notifying the server unless this option is used.

    This misunderstanding was reported anonymously to the old SF.net
    tracker.

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Trac-ticket: 40

commit a4bd825b7e6b4d62bfbbadf1b3dbd71fd3f70c25
Author: Gert Doering <gert@greenie.muc.de>
Date:   Thu Oct 21 13:13:21 2010 +0200

    Improved man page entry for script_type

    Signed-off-by: Gert Doering <gert@greenie.muc.de>
    Acked-by: krzee <jeff@doeshosting.com>
    Acked-by: David Sommerseth <dazo@users.sourceforge.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit 58f8d948acf3e9d35a9326b5b4996b55eed75a02
Author: Lars Hupel <hupel@in.tum.de>
Date:   Thu Sep 30 01:27:36 2010 +0100

    Add HTTP/1.1 Host header

    OpenVPN should send a Host: header to comply with the HTTP/1.1
    specification.

    Full discussion of this patch can be found here:
    <http://thread.gmane.org/gmane.network.openvpn.devel/4039>

    Signed-off-by: Lars Hupel <hupel@in.tum.de>
    Acked-by: Peter Stuge <peter@stuge.se>
    Acked-by: Gert Doering <gert@greenie.muc.de>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Trac-ticket: 63

commit f0eac1a5979096c671b3674f9d80871f496d1da8
Author: Gert Doering <gert@greenie.muc.de>
Date:   Sat Oct 30 21:03:16 2010 +0200

    Make "topology subnet" work on Solaris (ifconfig + route metric changes by Kazuyoshi Aizawa, adding of local "connected subnet" route by me)

    Tested on OpenSolaris/i386, no impact for other TARGETs.

    Signed-off-by: Gert Doering <gert@greenie.muc.de>
    Acked-by: Kazuyoshi Aizawa <admin2@whiteboard.ne.jp>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit 121755c2cb4891f8963ebcab5d61bc09dadf457c
Author: Gert Doering <gert@greenie.muc.de>
Date:   Fri Oct 29 17:41:53 2010 +0200

    Integrate support for TAP mode on Solaris, written by Kazuyoshi Aizawa <admin2@whiteboard.ne.jp>.

    See also http://www.whiteboard.ne.jp/~admin2/tuntap/

    Signed-off-by: Gert Doering <gert@greenie.muc.de>
    Acked-by: Kazuyoshi Aizawa <admin2@whiteboard.ne.jp>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit fc1fa9ffc7e3356458ec38d43816e5ddeb0c580a
Author: Pierre Bourdon <delroth@gmail.com>
Date:   Mon Oct 11 00:56:04 2010 +0200

    Adding support for SOCKS plain text authentication

    This patch adds support for SOCKS plain text (username/password)
    authentication as described in RFC 1929. It adds an optional third
    parameter to the socks-proxy option, which is a file containing the
    login credentials.

    I've been using this patch for two weeks now and it does not seem to
    cause any problem. The only modifications are in the SOCKS handshake
    handling and the options parser.

    Signed-Off-By: Pierre Bourdon <delroth@gmail.com>
    Acked-by: Gert Doering <gert@greenie.muc.de>
    Acked-by: David Sommerseth <dazo@users.sourceforge.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit 20a4c12783144d798c6b7446bae8920fdfea7adc
Author: James Yonan <james@openvpn.net>
Date:   Thu Oct 28 05:01:24 2010 +0000

    Version 2.1.3b

    git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6585 e7ae566f-a301-0410-adde-c780ea21d3b5

commit d053e36df93aabcdb23e9971c48f990aa77bda4e
Author: James Yonan <james@openvpn.net>
Date:   Sun Oct 24 09:17:24 2010 +0000

    Make base64.h have the same conditional compilation expression as
    base64.c.

    git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6569 e7ae566f-a301-0410-adde-c780ea21d3b5

commit 3cf9dd88fd84108eccfcce0ebf44e00f9481cd82
Author: James Yonan <james@openvpn.net>
Date:   Sun Oct 24 09:12:47 2010 +0000

    Implement challenge/response authentication support in client mode,
    where credentials are entered from stdin.  This capability is
    compiled when ENABLE_CLIENT_CR is defined in syshead.h (enabled
    by default).

    Challenge/response support was previously implemented for creds
    that are queried via the management interface.  In this case,
    the challenge message will be returned as a custom
    client-reason-text string (see management-notes.txt for more
    info) on auth failure.

    Also, see the comments in misc.c above get_auth_challenge()
    for info on the OpenVPN challenge/response protocol.

    git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6568 e7ae566f-a301-0410-adde-c780ea21d3b5

commit c68e0cddf024ae5b18f89062bf7164da77f1cf06
Author: James Yonan <james@openvpn.net>
Date:   Sat Oct 23 22:32:00 2010 +0000

    Fixed initialization bug in route_list_add_default_gateway
    (Gert Doering).

    git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6566 e7ae566f-a301-0410-adde-c780ea21d3b5

commit 0bb41e58782ae9834a61491c5964bc9816b76bc8
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Sat Aug 21 23:46:30 2010 +0200

    Preparing for v2.2-beta3

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit 4bf989571a74f90bb5d783072919862d2b64034e
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Mon Aug 16 20:23:49 2010 +0200

    Fixed compiler warning in ssl.c

    James Yonan noticed a couple of compiler warnings when compiling with
    --enable-strict configured.  This patch was sent directly to him
    for review and got accepted.

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: James Yonan <james@openvpn.net>

commit 6cc43bf573700b2391ae462651190a3b209da2c8
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Thu Apr 22 23:29:34 2010 +0200

    Solved hidden merge conflict between feat_misc and bugfix2.1

    The OCSP patch (commit a3982181e284f8c5c8f, feat_misc) introduced
    a new function which was calling create_temp_filename().  When merging
    in bugfix2.1 into allmerged, create_temp_filename() got renamed to
    create_temp_file() in commit 5d30273a8741d2c141.

    This patch only changes create_temp_filename() to create_temp_file()
    in the new function introduced by commit a3982181e284f8c5c8f.

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    (cherry picked from commit 926d1662e4d9e14b50eddec993b2f4e0209c0646)

commit 238f81b9097c6ec70be3080b23cce46ad635e54c
Author: Emilien Mantel <emilien.mantel@businessdecision.com>
Date:   Sat Jun 26 13:56:48 2010 +0200

    Fixed static defined length check to use sizeof()

    This comes in addition to commit 935c62be9c0c8a256112d after some
    additional review comments.

    Signed-off-by: Emilien Mantel <emilien.mantel@businessdecision.com>
    Acked-by: Peter Stuge <peter@stuge.se>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit 2e8337de248ef0b5b48cbb2964da0d5c3f28b15b
Author: Emilien Mantel <emilien.mantel@businessdecision.com>
Date:   Thu Jun 17 21:38:59 2010 +0200

    Choose a different field in X509 to be username

    For my company, we use a PKI (linked to a LDAP) with OpenVPN. We can't use "CN" to be
    username (few people can have the same "CN"). In our case, we only use the UID.

    With my patch, you can choose another field to be username with a new option called
    --x509-username-field, the default value is "CN".

    Signed-off-by: Emilien Mantel <emilien.mantel@businessdecision.com>
    Acked-by: David Sommerseth <dazo@users.sourceforge.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit 8bebb729a53ae423d0867648f0c12868a96cafde
Author: Fabian Knittel <fabian.knittel@avona.com>
Date:   Tue May 4 16:21:47 2010 +0200

    ssl.c: fix use of openvpn_run_script()'s return value

    This patch fixes two bugs introduced in

        commit 339f2a4d4b487afa53fa99d72c35b16f31e417d3
        Author: David Sommerseth <dazo@users.sourceforge.net>
        Date:   Thu Apr 29 23:35:45 2010 +0200

    David's patch replaced openvpn_execve() with openvpn_run_script() in two places,
    but didn't adjust the return value handling.  openvpn_run_script() returns true
    or false, while openvpn_execve() returns the program's exit code.

    Without the fix, the --tls-verify script and the --auth-user-pass-verify
    script fail to run.  (I noticed the latter, but haven't actually tested the
    former.)

    The return value handling is fine for the other places where
    openvpn_run_script() is used, because those places previously used
    openvpn_execve_check() (notice the "_check" suffix).

    Signed-off-by: Fabian Knittel <fabian.knittel@avona.com>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: David Sommerseth <dazo@users.sourceforge.net>

commit c2533d18ce6da1bd43502f9f2923541c578864e9
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Thu Apr 29 23:35:45 2010 +0200

    Revamped the script-security warning logging (version 2)

    The main task of this patch is to avoid reporting the SCRIPT_SECURITY_WARNING
    over and over again, in addition to not show this warning when it should not
    be a problem.  This general warning should now only appear once, and only when
    --script-security is not set, 0 or 1.  In all other cases this warning should
    not appear.

    In addition, this warning will come close to the script-hook which most probably
    will fail.  It will also give a little bit more concrete hint on which script-hook
    which failed.  If --script-security is 2 or 3, only the execve failure itself will
    be shown.  This message will on the other hand be shown repeatedly.

    This is a new rewritten version which simplifies the implementaion of the new
    openvpn_run_script() function.  It was considered to remove it completely, but
    due to code clearity and easy of use it was decided to make this function a static
    inline function instead.  Anyhow, this function will enforce openvpn_execve_check()
    to be called with the S_SCRIPT flag.

    Patch ACKed on the developers meeting 2009-04-29.

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: James Yonan <james@openvpn.net>

commit aa6e58ae0e110eb92775aa1982f5f363057bcd43
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Thu Apr 22 23:05:00 2010 +0200

    Don't add compile time information if --enable-small is used

    This is to satisfy those wanting to build openvpn for embedded devices
    where every bytes matters.

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: Gert Doering <gert@greenie.muc.de>

commit 3ee62caf112c1e8c9a79079b0cb0648446915caa
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Tue Apr 13 15:12:27 2010 +0200

    Make use of automake CLEANFILES variable instead of clean-local rule

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: Gert Doering <gert@greenie.muc.de>

commit 043b61b2a5a30d5d45b15e9f8de7b72052225727
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Thu Apr 22 23:01:31 2010 +0200

    Fix dependency checking for configure.h (v2)

    Alon Bar-Lev indicated commit f27bf509315a48b0070294c3993a718df0c2626c
    was missing proper dependency checking.  This patch corrects this and
    fixes an issue when creating configure.h via make distcheck.

    This is an enhanced version of the one sent to the openvpn-devel mailing
    list April 13, 2010 [1], after having received some feedback from Gert
    Doering, cleaning up configure_log.awk further.

    [1] <http://thread.gmane.org/gmane.network.openvpn.devel/3410/focus=3491>

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: Gert Doering <gert@greenie.muc.de>

commit d94049b8284cdddd90fc17cc171fbf20fcc12780
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Thu Apr 8 20:31:01 2010 +0200

    Add comile time information/settings from ./configure to --version

    This patch will create ./configure.h which will contain two new #define
    strings.  CONFIGURE_DEFINES will contain all USE, ENABLED, DISABLED and
    DEPRECATED defines from ./config.h.  CONFIGURE_CALL will contain the
    complete ./configure line which was used when configuring the package
    for building.

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: James Yonan <james@openvpn.net>

commit 6dc60191ddf8673db7d156e6b90fb794e4fa350a
Author: Wil Cooley <wcooley@users.sourceforge.net>
Date:   Tue Mar 2 21:54:15 2010 +0100

    pkitool lacks expected option "--help"

    The pkitool script lacks the "--help" parameter to actually display the
    usage statement; most people are conditioned to try that before running the
    command without options. This patch adds that and "--version" to display
    just the program name and version.

    sf.net tracker:
    <https://sourceforge.net/tracker/?func=detail&atid=454721&aid=1705407&group_id=48978>

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: Jan Just Keijser <janjust@nikhef.nl>

commit d04b8582a8d9cda4e886019c81f24712663e97b4
Author: Karl O. Pinc <kop@mofo.meme.com>
Date:   Tue Mar 2 21:41:06 2010 +0100

    Several updates to openvpn.8 (man page updates)

    This is a collection of 4 patches sent to the -devel mailing list:
    * [PATCH] Frob the openvpn(8) man page tls-verify section to clarify
    * [PATCH] More improvments to openvpn(8) --tls-verify
    * [PATCH] Yet another tweak of openvpn(8) --tls-verify
    * [PATCH] Final frobbing of openvpn(8) --tls-verify

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: David Sommerseth <dazo@users.sourceforge.net>

commit 39238d1b173d8b7f08e061dd51e30605ce722e92
Author: Mathieu GIANNECCHINI <mat.giann@free.fr>
Date:   Tue Mar 2 00:26:57 2010 +0100

    enhance tls-verify possibility

    It should be nice to enhance tls-verify check possibilities against peer
    cert during a pending TLS connection like :
    - OCSP verification
    - check any X509 extensions of the peer certificate
    - delta CRL verification
    - ...

    This patch add a new "tls-export-cert" option which allow to get peer
    certificate in PEM format and to store it in an openvpn temporary file.
    Peer certificate is stored before tls-script execution and deleted after.
    The name of the related temporary file is available under tls-verify
    script by an environment variable "peer_cert".

    The patch was made from OpenVPN svn Beta21 branches.

    Here is a very simple exemple of Tls-verify script which provide OCSP
    support to OpenVPN (with tls-export-cert option) without any OpenVPN
    "core" modification :

    X509=$2

    openssl ocsp \
          -issuer /etc/openvpn/ssl.crt/RootCA.pem \
          -CAfile /etc/openvpn/ssl.capath/OpenVPNServeur-cafile.pem \
          -cert $peer_cert \
          -url http://your-ocsp-url
          if [ $? -ne 0 ]
          then
              echo "error : OCSP check failed for ${X509}" | logger -t
    "tls-verify"
              exit 1
           fi

    This has been discussed here:
    <http://thread.gmane.org/gmane.network.openvpn.devel/2492>
    <http://thread.gmane.org/gmane.network.openvpn.devel/3150>
    <http://thread.gmane.org/gmane.network.openvpn.devel/3217>

    This patch has been modified by David Sommerseth, by fixing a few issues
    which came up to during the code review process.  The man page has been
    updated and tmp_file in ssl.c is checked for not being NULL before calling
    delete_file().

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: Gert Doering <gert@greenie.muc.de>

commit 0c1f7ad5e84e7a79bd3f982cba5dad3cc12dbebb
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Mon Feb 15 23:15:44 2010 +0100

    Reworked the eurephia patch for inclusion to the openvpn-testing tree

    Addedd configure option (--disable-eurephia) to disable the code which the
    eurephia plug-in depends on.

    It was chosen to use --disable-eurephia, as this patch is not much intrusive.  It
    just enables a SHA1 fingerprint environment variable for each certificate being
    used for the connection.

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit 59afc4a5f72e22b850cfa2845385172623a38e77
Author: Gert Doering <gert@greenie.muc.de>
Date:   Thu Oct 21 10:35:29 2010 +0200

    Fix problem with special case route targets ('remote_host')

    The init_route() function will leave &netlist untouched for
    get_special_addr() routes ("remote_host" being one of them).
    netlist is on stack,  contains random garbage, and netlist.len
    will not be 0 - thus, random stack data is copied from
    netlist.data[] until the route_list is full.

    This issue has been reported several places lately:
       http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=600166
       http://thread.gmane.org/gmane.network.openvpn.devel/4083
       https://forums.openvpn.net/viewtopic.php?f=1&t=7201&p=8168

    Signed-off-by: Gert Doering <gert@greenie.muc.de>
    Acked-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: James Yonan <james@openvpn.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit d6b783a8ec505c8e158bd0304c5e195cff5bb8c3
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Fri Sep 17 17:10:25 2010 +0200

    Fixed compiler warnings reported on Ubuntu 10.04

    The warnings reported where:
    --------------------------------------------------------
    misc.c:158: warning: ignoring return value of ‘nice’, declared with attribute warn_unused_result
    options.c:4033: warning: format not a string literal and no format arguments
    options.c:4043: warning: format not a string literal and no format arguments
    options.c:4053: warning: format not a string literal and no format arguments
    push.c:182: warning: format not a string literal and no format arguments
    push.c:199: warning: format not a string literal and no format arguments
    push.c:235: warning: format not a string literal and no format arguments
    status.c:171: warning: ignoring return value of ‘ftruncate’, declared with attribute warn_unused_result
    --------------------------------------------------------

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: Gert Doering <gert@greenie.muc.de>
    Acked-by: Peter Stuge <peter@stuge.se>

commit 6f1e61b41be52fd0e7f4655ebc3000f63254aede
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Wed Aug 18 17:05:09 2010 +0200

    More t_client.sh updates - exit with SKIP when we want to skip

    Several places we exited with 0 instead of 77 when we want to indicate
    that we should skip this test.

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: Gert Doering <gert@greenie.muc.de>

commit f25fe91a40aa3fad21657f590fd5f5c34d9f64d9
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Wed Aug 18 15:00:13 2010 +0200

    Test framework improvment - Do not FAIL if t_client.rc is missing

    This is to avoid 'make check' fail if this extra test case is not
    configured.

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: Gert Doering <gert@greenie.muc.de>

commit 5086d75d8e8a3ec294cdb4ef5dacc403acc96bac
Author: Gert Doering <gert@greenie.muc.de>
Date:   Tue Aug 10 12:39:28 2010 +0200

    Build t_client.sh by configure at run-time.

    This is now built using "configure", knows how to find "ip", "ifconfig" and "netstat" (configure
    does the work :-) ), *and* has been tested on Solaris (works!).

    extend configure.ac to find "netstat" binary and to chmod +x "t_client.sh"

    Signed-off-by: Gert Doering <gert@greenie.muc.de>
    Acked-by: David Sommerseth <dazo@users.sourceforge.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit 186f9a76fddfd7309fcb0e4a15e3498b37b16838
Author: Gert Doering <gert@greenie.muc.de>
Date:   Sun Aug 8 21:24:30 2010 +0200

    full "VPN client connect" test framework for OpenVPN

    Run from "make check" if "t_client.rc" is found in workdir or srcdir
     (copy t_client.rc-sample, fill in specifics for your test server)

    How does it work?

     - you run "sudo make check" (needs root access to configure tun if!)

     - t_client.sh reads t_client.rc from current dir or ${srcdir}

     - t_client.rc defines a number of "test suffixes" to run (could be
       "1" "2" "3" or "p2m", "p2p", "special" or whatever you like), and
       for each suffix, there's config variables to specify

        - how to call OpenVPN
        - which hosts to ping for IPv4 and IPv6 when OpenVPN is up
          (and actually before starting OpenVPN - to make the test more
          meaningful, I have decided that the test hosts must not ping
          before the tests starts)
        - which addresses must show up in the output of "ifconfig" after
          OpenVPN has started
        - all variables except OPENVPN_CONF_<x> are optional

       (this should all be fairly obvious from looking at t_client.rc-sample)

     - the script wants to connect to a well-defined OpenVPN server that
       will assign well-known IPv4 (and IPv6) addresses, have well-defined
       pingable addresse, etc. - so you need to setup the test server before
       the script is useful for you.  (Whether you use certificates or
       username/password is up to you, you could even mix and match - run
       one test with certs, and one with user/pass against different target
       ports... :-) )

       [we *could* run a "reference server" somewhere and ship a sample
       t_client.rc + cert so that users could use this right away, but I
       do not currently have the resources to run such a public server]

     - whatever the script does is logged to a newly created directory
       below the current directory (openvpn output, ifconfig+route before
       starting OpenVPN, while running it, after ending it)

     - important: at least on NetBSD and OpenBSD, the script will print
       one failure, because the tun0 interface created is not destroyed
       after openvpn ends.  For OpenBSD, I have changed close_tun() to
       do so ("ifconfig tun0 destroy"), for NetBSD I have not yet changed
       anything - but I strongly believe that the output of "ifconfig+route"
       should be reverted to exactly how it looked like before OpenVPN
       was started, so I consider this a bug in the NetBSD-specific bits
       of OpenVPN (and will look into this).

     - the test framework has been tested on Linux, NetBSD and OpenBSD.
       It *should* work fine on FreeBSD and Solaris.
       It works on MacOS X (but the output looks funny, because /bin/sh
       does not implement "echo -e" - need to add configure trickery)

       It will *not* work on Windows yet - I haven't looked into what's
       needed to make it work (background processes and signals in mingw
       bash?), maybe it's as easy as adding the necessary "ipconfig" and
       "netsh" commands to print interface + routing config...

     - I have only tested "connect via IPv4 transport, use IPv4+IPv6 payload",
       but the framework is generic enough that "connect via IPv6 transport"
       should work just fine (just setup OPENVPN_CONF_x accordingly in the
       t_client.rc).

     - this is neither finished nor pretty, but it helps me a *lot* in
       quickly testing whether I broke anything when fiddling system-dependent
       code (tun.c, route.c) across multiple build hosts - so I hope this
       is going to be fairly useful to Samuli and the buildbot :-)

    Signed-off-by: Gert Doering <gert@greenie.muc.de>
    Acked-by: David Sommerseth <dazo@users.sourceforge.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit 4c91fc83684874fb8f1a2ca061247956fb0fc77f
Author: chantra <chantra@debuntu.org>
Date:   Fri Jul 16 20:09:07 2010 +0200

    Fixes openssl-1.0.0 compilation warning

    When compiling against OpenSSL v1.0.0, the following compiler warnings
    appears.

    ssl.c: In function ‘verify_callback’:
    ssl.c:944: warning: passing argument 1 of ‘sk_num’ from incompatible
    pointer type
    /usr/include/openssl/stack.h:79: note: expected ‘const struct _STACK *’
    but argument is of type ‘struct stack_st_X509_REVOKED *’
    ssl.c:947: warning: passing argument 1 of ‘sk_value’ from incompatible
    pointer type
    /usr/include/openssl/stack.h:80: note: expected ‘const struct _STACK *’
    but argument is of type ‘struct stack_st_X509_REVOKED *’
    ssl.c: In function ‘init_ssl’:
    ssl.c:1565: warning: passing argument 1 of ‘sk_num’ from incompatible
    pointer type
    /usr/include/openssl/stack.h:79: note: expected ‘const struct _STACK *’
    but argument is of type ‘struct stack_st_X509 *’
    ssl.c: In function ‘print_details’:
    ssl.c:1766: warning: assignment discards qualifiers from pointer target type

    Trac ticket #5
    https://community.openvpn.net/openvpn/ticket/5

    Signed-off-by: chantra <chantra@debuntu.org>
    Acked-by: David Sommerseth <dazo@users.sourceforge.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit a9b5134f78480f903434366478f3918c021b7caa
Author: Gert Doering <gert@greenie.muc.de>
Date:   Sat Jul 10 11:24:41 2010 +0200

    Fix <net/if.h> compile time problems on OpenBSD for good

    Previous fix (commit eb973e055bc249948) fixed NetBSD but not OpenBSD
    (include <sys/socket.h> *after* <sys/types.h>)

    Signed-off-by: Gert Doering <gert@greenie.muc.de>
    Acked-by: krzee <jeff@doeshosting.com>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit 22ff667e4e7e412db21d9b1642fc92fa670d323d
Author: Gert Doering <gert@greenie.muc.de>
Date:   Fri Jul 9 10:24:46 2010 +0200

    Fix compile problems on NetBSD and OpenBSD

    Configure will not find <net/if.h> due to missing <sys/types.h> in the test program,
    and thus, tun.c will fail to compile with missing symbol IFF_MULTICAST.

    Signed-off-by: Gert Doering <gert@greenie.muc.de>
    Acked-by: krzee <jeff@doeshosting.com>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit 3a777430493de180d425cebbc9eecde68e7fb6a6
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Thu Aug 5 20:51:22 2010 +0200

    Fix multiple configured scripts conflicts issue (version 2)

    This is a fix for trac ticket #20,
    <https://community.openvpn.net/openvpn/ticket/20>
    which was started in the sf.net bug tracker:
    <http://sourceforge.net/tracker/?func=detail&aid=2078470&group_id=48978&atid=454719>

    The implemented solution is to give a warning for each of the different script hooks
    available.  The last configured script will override any earlier configured scripts,
    to ensure that the command line can override the configuration file.

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: James Yonan <james@openvpn.net>

commit 639216502cc474fcc2526598680b2bcdbb35c0a1
Author: Davide Brini <dave_br@gmx.com>
Date:   Sun May 2 11:07:38 2010 +0200

    Exclude ping and control packets from activity

    Problem: using --ping and --inactive together partially defeats the
    point of using --inactive as periodic ping packets are counted as
    activity. Here is the original discussion:

    http://article.gmane.org/gmane.network.openvpn.devel/3676

    It turns out that "activity" is detected and recorded in two places
    in the code, both in forward.c: in process_outgoing_tun() for received
    packets, after they've been decrypted and sent to the TUN device; and
    in process_outgoing_link(), after they've been encrypted and written
    to the network socket.

    In the first case we can be sure that packets that get so far are
    really due to user activity, whereas in the second case there can be
    non-user packets (like OpenVPN's internal ping packets, and TLS control
    packets), and those should not be counted as activity as they are not
    coming from the user.

    So a need arises to detect those control packets and not count them as
    activity for the purposes of --inactive. Unfortunately, at that stage
    packets are already compressed and encrypted, so it's not possible to
    look into them to see what they are. However, there seems to be a
    convention in the code that packets whose buffer length in the context_2
    structure is 0 should be ignored for certain purposes. TLS control
    packets follow that convention already, so this patch makes a small
    change in the code that generates the ping packets to set their buffer
    length to 0 as well.
    Finally, the call to register_activity() in process_outgoing_link() is
    made conditional to the buffer length being > 0.

    According to my tests, now --inactive behaves correctly according to
    the configured parameters (time or time+bytes) even when --ping is
    being used.

    forward.c:
        Call register_activity() in process_outgoing_link() only if the
        packet is not a ping or TLS control packet.

    openvpn.8:
        Updated the description of --inactive to describe the new semantics.

    ping.c:
        Set c->c2.buf.len = 0 after the ping packet has been generated and
        encrypted.

    Test routine is described here:
    <https://community.openvpn.net/openvpn/wiki/PingInactivePatch?version=6>

    Signed-off-by: Davide Brini <dave_br@gmx.com>
    Acked-by: David Sommerseth <dazo@users.sourceforge.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit b02b609b28199a932da2d07ec61c2fb6b9271363
Author: chantra <chantra@debuntu.org>
Date:   Fri Jul 30 20:48:50 2010 +0200

    Fix errors in openvpn-plugin.h documentation

    Just minor updates to comments in openvpn-plugin.h

    Signed-off-by: chantra <chantra@debuntu.org>
    Acked-by: David Sommerseth <dazo@users.sourceforge.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit e0221d9d4d4329918d914ddcce188d0dc7c99357
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Sun Jun 13 00:35:55 2010 +0200

    Fixed client hang when server don't PUSH (aka the NO_SOUP_FOR_YOU patch)

    Solves bug ticket 13
    <https://community.openvpn.net/openvpn/ticket/13>

    When the client sends PUSH_REQUESTS, it waits until the server sends PUSH_REPLY.
    If the server do not have anything to push to the client nothing happens.  The
    client will then regularly send new PUSH_REQUESTS until it gets an answer, which
    results in not completing the connection negotiation.

    This patch makes the server send an empty PUSH_REPLY when it has nothing to more
    to push to the client.

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: James Yonan <james@openvpn.net>

commit d2ad24c062c0d1870d826ecbb9506f893896f50c
Author: chantra <chantra@debuntu.org>
Date:   Fri Jun 11 16:23:03 2010 +0200

    Handle non standard subnets in PF grammar

    Allow subnets for like 192.168.100.8/28 to be understood.  A warning
    will be logged when subnet is incorrect and is being corrected to what
    is assumed to be correct.

    Signed-off-by: chantra <chantra@debuntu.org>
    Acked-by: Gert Doering <gert@greenie.muc.de>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit 233105d2c9d1a2c6911342d8249b19310e94c251
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Sun May 16 19:42:40 2010 +0200

    OCSP_check.sh: new check logic

    contrib/OCSP_check/OCSP_check.sh:
      I discovered that, quite surprisingly, the exit status of "openssl ocsp"
      is 0 even if the certificate status is "revoked". This means that the
      logic of the script needs to be rewritten so that it parses the output
      returned by the query and explicitly looks for a

      "0x<serial number>: good"

      line, and exit if either the command has a non-zero exit status, or the
      above line is not found.

      Doing that portably without bashisms requires some juggling around, so
      perhaps the code is slightly less clean now, but it does have many
      comments.

    Signed-off-by: Davide Brini <dave_br@gmx.com>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: David Sommerseth <dazo@users.sourceforge.net>

commit 6f94529f31cfab709c07d5e012ecc16cc9228d3c
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Mon Apr 26 09:50:30 2010 +0200

    Avoid repetition of "this config may cache passwords in memory" (v2)

    For OpenVPN clients with long living connections, this message is repeated
    everytime the connection is renegotiated.  This patch removes this behaviour
    and will only show this warning once.

    Patch ACKed on the developers meeting 2009-04-29.

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: James Yonan <james@openvpn.net>

commit 7d5e26cbb53e2700c966e6b6e815f0c824da8956
Author: Davide Brini <dave_br@gmx.com>
Date:   Tue Apr 27 12:20:05 2010 +0100

    Fix certificate serial number export

        contrib/OCSP_check/OCSP_check.sh:
                 New barebone script to demonstrate how to use $tls_serial_{n}
                 to perform simple OCSP queries using OpenSSL command line
                 "openssl ocsp". Minimal sanity checks to fail if user tries to
                 use it without customizing.

        openvpn.8:
                 Added some notes about $tls_serial_{n} format and usage to the
                 existing description.

        ssl.c:
                 correctly manage and export serial numbers of any size (as
                 parsed by OpenSSL) into the environment. Set to empty string
                 in case of errors, as 0 and negative numbers are all possible
                 (although illegal) certificate serial numbers. Use an OpenSSL
                 BIO object to do the job. Conforms to coding style guidelines.

        See the discussion at

        http://article.gmane.org/gmane.network.openvpn.devel/3588

        for more details.

    Signed-off-by: Davide Brini <dave_br@gmx.com>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: David Sommerseth <dazo@users.sourceforge.net>

commit 892e64b6b9e08f838add6b32dfdea73d607b36ce
Author: Davide Brini <dave_br@gmx.com>
Date:   Thu Apr 22 09:50:31 2010 +0200

    Fix missing /bin/bash -> /bin/sh

    In commit a9c9a89e96dc1e4e843e05ecadc4349b81606b06 the
    client.{up,down} scripts where overhauled and bashism was removed.
    During that process, a #! change was missing.

    Signed-off-by: Davide Brini <dave_br@gmx.com>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: David Sommerseth <dazo@users.sourceforge.net>

commit 5c9f1d2e703d0c8aaaf7254e9f3bd1bf0dddb120
Author: Davide Brini <dave_br@gmx.com>
Date:   Mon Apr 19 22:41:42 2010 +0200

    Enhance contrib/pull-resolv-conf/client.{up,down} scripts

    Patch arrived from Davide Brini:

    - No more bashisms (AFAICT). Should work with any POSIX-compatible shell
    (which means "almost all reasonably recent shells"), though I've only tested
    with bash and dash.

    - Unnecessary calls to external tools (sed) removed

    - Manages multiple DNS and DOMAIN options. Each DNS option becomes a
    "nameserver" line in the new resolv.conf (up to a maximum of 3). If there's a
    single DOMAIN option, it becomes a "domain" line in resolv.conf; otherwise,
    all the domains are listed in a "search" line in resolv.conf (eg "search
    foo.com example.net").

    - Client.up renames the existing resolv.conf and creates a brand new one;
    client.down restores it from the saved copy when the VPN terminates (the usual
    rules about running as root apply). This is how Gentoo does that; the old
    scripts instead added/removed some lines at the beginning of the file, which
    looks a less clean approach to me. The rename approach also dramatically
    simplifies and shortens client.down, as you'll see.

    - Uses resolvconf if it's available (detected by the presence of
    /sbin/resolvconf) rather than writing to resolv.conf directly. Not sure
    whether this is a Linux-only thing or other systems use it though.

    Script has been smoke tested on Fedora 12 with OpenVPN 2.1.1 without
    the resolvconf package , and in addition Debian Lenny with
    OpenVPN 2.1_rc11 according to the patch.

    Signed-off-by: Davide Brini <dave_br@gmx.com>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: David Sommerseth <dazo@users.sourceforge.net>

commit 8517cba1997f5a08f1461ca90d159fcbe6392b5e
Author: Davide Brini <dave_br@gmx.com>
Date:   Mon Apr 19 00:23:52 2010 +0200

    The man page does not mention that the default value of "mssfix" is 1450.

    Signed-off-by: Davide Brini <dave_br@gmx.com>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: David Sommerseth <dazo@users.sourceforge.net>

commit d2bf22af84a1758d6ba281cd22e4ff44a7bb40c6
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Sat Apr 17 21:03:06 2010 +0200

    Fixed potential NULL pointer issue

    If create_temp_file() returns NULL, this strlen() check would cause
    a SEGV.

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: Gert Doering <gert@greenie.muc.de>

commit 50a22f30fc4d89e5cdefc6c8ffb1500fda468000
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Sat Apr 17 21:01:20 2010 +0200

    Removed no longer needed delete_file() call

    Fabian Knittel noticed that this delete_file() calls should have been
    removed in commit 5d30273a8741d2c1410bfdbc08b341398bf39b40

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: Gert Doering <gert@greenie.muc.de>

commit add7fe05dae7202bb6ccd7301c052c9364bcccae
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Fri Apr 16 22:11:59 2010 +0200

    Updated the man page to reflect the behavioural change of create_temp_file()

    As this function now creates the temp file, it is no longer
    'not-yet-created', but 'freshly created'.

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: Gert Doering <gert@greenie.muc.de>

commit 495e3cec5d15655058cd70983b8a0d65bd403d84
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Fri Apr 16 22:09:48 2010 +0200

    Renamed all calls to create_temp_filename()

    All places where create_temp_filename() was called are now calling
    create_temp_file().  Extra checks on the result of create_temp_file()
    is added in addition.

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: Gert Doering <gert@greenie.muc.de>

commit 4e1cc5f6dda22e9ff121d3753066775c25448bcc
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Fri Apr 16 22:02:36 2010 +0200

    Harden create_temp_filename() (version 2)

    By hardening the create_temp_filename() function to check if the generated
    filename exists and to create the temp file with only S_IRUSR|S_IWUSR bit
    files set before calling the script, it should become even more difficult to
    exploit such a scenario.

    After a discussion on the mailing list, Fabian Knittel provided an enhanced
    version of the inital patch which is added to this patch.

    This patch also renames create_temp_filename() to create_temp_file(), as this
    patch also creates the temporary file.  The function returns the filename of the
    created file, or NULL on error.

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Signed-off-by: Fabian Knittel <fabian.knittel@avona.com>
    Acked-by: Gert Doering <gert@greenie.muc.de>

commit 41104b4e23aaa17257cadb7f6c4ba1325c025b46
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Thu Apr 8 21:18:42 2010 +0200

    Make use of counter_type instead of int when counting bytes and network packets

    This is in response to a reported Debian bug, where the connection counter overflows.
    <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=576827>

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: Gert Doering <gert@greenie.muc.de>

commit 886593ac4ae79f4321f6f12fad0a51600e4aca28
Author: Jan Brinkmann <the-luckyduck@users.sourceforge.net>
Date:   Sun Feb 28 23:29:29 2010 +0100

    The man page needs dash escaping in UTF-8 environments

    There was a debian bugreport which was filed in 2005 . It was patched but
    it seems that nobody forwarded the patch to the openvpn project itself.

    The problem is quite simple:
    The dashes for options (the double dashes) are not escaped. This causes
    trouble in relationship with utf-8 .

    Since the bugreport was closed it was patched within the debian/ubuntu
    packages itself. I've attached the patch to get it atleast reviewed by the
    openvpn project itself.

    See <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=296133> for details.

    sf.net tracker:
    <https://sourceforge.net/tracker/?func=detail&aid=2935611&group_id=48978&atid=454721>

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Tested-by: Jan Just Keijser <janjust@nikhef.nl>
    Tested-by: Pavel Shramov <shramov@mexmat.net>
    Tested-by: Samuli Seppänen <samuli@openvpn.net>

commit ff99a3b5fc5f99deddaf1ab85115affec9b9e276
Author: Daniel Johnson <Progman2000@usa.net>
Date:   Tue Mar 30 15:54:44 2010 +0200

    When I began testing OpenVPN v2.1_rc9 I was having trouble authenticating to the MS Active Directory through auth-pam and Samba. I used the following line in my configs (without the linebreak of course):

    plugin /opt/openvpn/openvpn-auth-pam.so
                       "openvpn login OURDOMAIN+USERNAME password PASSWORD"

    Finally I turned on more verbose logging and found that the plugin did
    not recognize "USERNAME" as something to replace, because it expected
    the string to be surrounded by whitespace.  I wrote the following patch
    to correct this.  I hope you find it useful,

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit afa7ddf083bbee1ed0a88a7cea079cd818eb9e70
Author: Alberto Gonzalez Iniesta <agi@inittab.org>
Date:   Tue Mar 16 23:03:10 2010 +0100

    Debian patch: Fix spelling in log message

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: David Sommerseth <dazo@users.sourceforge.net>

commit 86715242cee9d50ca24a522913d1a6b04e0bcc3d
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Thu Mar 11 17:28:41 2010 +0100

    Fix autotools cross-compiling support

    This is a modified version of a patch sent to the sf.net
    patch tracker:

    <http://sourceforge.net/tracker/?func=detail&aid=2491190&group_id=48978&atid=454721>

    After having disucssed this patch on IRC (#openvpn-discussions)
    March 4, 2010, it was decided to accept this patch when not modifying
    TARGET_* defines through out the code.  Further, in a mail comment
    Alon Bar-Lev had some other comments of what would be needed to be done.

    Mail reference:
    <http://thread.gmane.org/gmane.network.openvpn.devel/3176>

    This patch has been tested by bootstrapping the code on a RHEL4.6 box.
    with the following autotools packages installed:
    autoconf-2.59-5
    automake-1.9.2-3
    libtool-1.5.6-4.EL4.2

    It builds cleanly and 'make check' passes.

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: James Yonan <james@openvpn.net>
    Acked-by: Alon Bar-Lev <alon.barlev@gmail.com>

commit 1e02046b68af74e84eafbfadb6f856195bbbdcb0
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Wed Mar 10 11:45:04 2010 +0100

    On TARGET_LINUX define _GNU_SOURCE if not defined

    This is to include peercred support on hosts where _GNU_SOURCE is not
    defined by default.  This issue has been found on Gentoo with glibc-2.8.

    The solution was discussed on the IRC meeting March 4, 2010
    in #openvpn-discussions.
    <http://thread.gmane.org/gmane.network.openvpn.devel/3242>

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: James Yonan <james@openvpn.net>

commit 48fe8bb37167b57722d209274626f5f91975c001
Author: Jan Brinkmann <the-luckyduck@users.sourceforge.net>
Date:   Sun Feb 28 23:29:29 2010 +0100

    The man page needs dash escaping in UTF-8 environments

    There was a debian bugreport which was filed in 2005 . It was patched but
    it seems that nobody forwarded the patch to the openvpn project itself.

    The problem is quite simple:
    The dashes for options (the double dashes) are not escaped. This causes
    trouble in relationship with utf-8 .

    Since the bugreport was closed it was patched within the debian/ubuntu
    packages itself. I've attached the patch to get it atleast reviewed by the
    openvpn project itself.

    See <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=296133> for details.

    sf.net tracker:
    <https://sourceforge.net/tracker/?func=detail&aid=2935611&group_id=48978&atid=454721>

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Tested-by: Jan Just Keijser <janjust@nikhef.nl>
    Tested-by: Pavel Shramov <shramov@mexmat.net>
    Tested-by: Samuli Seppänen <samuli@openvpn.net>

commit 2d4e7685cd1a6d8e1eb1befa241b7595809d3b45
Author: Dan Nelson <dnelson@users.sourceforge.net>
Date:   Sun Feb 28 22:09:18 2010 +0100

    bash->bourne script cleanup

    Many of the scripts in the openvpn source have their shell set to
    /bin/bash, but only two use bash features. The attached patch (against
    openvpn-2.1_rc9) sets the shell on the rest of the scripts to /bin/sh for
    better portability. The only scripts that actually require bash are
    contrib/pull-resolv-conf/client.{up,down} ; they use the ${!var} variable
    indirection feature.

    sf.net tracker:
    <https://sourceforge.net/tracker/?func=detail&aid=2040296&group_id=48978&atid=454721>

    Discussed on the IRC meeting March 4, 2010 in #openvpn-discussions.
    <http://thread.gmane.org/gmane.network.openvpn.devel/3242>

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: James Yonan <james@openvpn.net>

commit 798497ae52d782248cc89fb8bf0e4fcdba98a0d3
Author: Enrico Scholz <enrico.scholz@sigma-chemnitz.de>
Date:   Sun Feb 28 14:40:57 2010 +0100

    Allow 'lport 0' setup for random port binding

    I am running a multihomed host where 'local <extip>' must be specified
    for proper operation.  Unfortunately, this implies 'lport 1194' or
    another static port.

    This causes problems with stateful firewalls which register the host/port
    pairs in the internal connection tracking table. On ungraceful reconnects,
    the new TCP connection will have same the host/port pairs but unexpected
    sequence numbers. The new connection will be assumed as invalid hence and
    be dropped.

    It would be nice when local port can be configured to be bound to a
    random port number.  After reading code,

    |    else if (streq (p[0], "lport") && p[1])
    |  ...
    |        port = atoi (p[1]);
    |-       if (!legal_ipv4_port (port))
    |+       if (port != 0 && !legal_ipv4_port (port))
    |          {

    in options.c seems to be the only required change.

    This has been discussed here:
    <http://thread.gmane.org/gmane.network.openvpn.user/28622>

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: Gert Doering <gert@greenie.muc.de>

commit 8528e2b77d19384f9077fe41fd39da58cb761168
Author: Gert Doering <gert@greenie.muc.de>
Date:   Sun Feb 28 23:09:40 2010 +0100

    remove duplicate code in FREEBSD+DRAGONFLY system-dependent ifconfig
    (ACKed by Eric F Crist and David Sommerseth)

    (cherry picked from commit dd66b12647852e3f1267be70b0fb3b11deedf377)

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Signed-off-by: Gert Doering <gert@greenie.muc.de>

commit adfe37fc84f47f0dfc11b4ad728f314ef76e4ee7
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Fri Feb 19 17:32:56 2010 +0100

    verb 5 logging wrongly reports received bytes

    With --verb 5, openvpn logs a single letter (rwRW) for each package
    received or sent. I recently ran into a problem with the tun device on
    Linux where the read from that device returned 0. Unfortunately this was
    also logged as "r", which made me assume that openvpn had received
    something, while it actually hadn't.

    (See https://dev.openwrt.org/ticket/6650 for the bug that made me find out
    about this problem with openvpn.)

    I'm attaching a patch which prevents openvpn from logging "r" or "R" when
    it didn't actually read anything. This is against openvpn 2.1-rc20, but
    probably still applies to the most recent version.

    This patch was received anonymously via the sf.net bug tracker:
    <http://sourceforge.net/tracker/?func=detail&atid=454719&aid=2951003&group_id=48978>

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: Gert Doering <gert@greenie.muc.de>

commit 058f3d0b3eade5480b34eaacda673182925bea60
Author: Karl O. Pinc <kop@meme.com>
Date:   Thu Feb 18 21:30:48 2010 +0100

    [PATCH] Change verify-cn so cn is no longer hardcoded in openvpn's config file

    This patch should be easy to process.
    A resubmission of the patch sent to this list on 04/23/2009.

    The patch changes the verify-cn script sample
    to be used with --tls-verify so that instead of having
    to hardcode a cn to verify in the OpenVPN configuration file
    the allowed cns may be written into a separate file.

    This makes the process of verifying cns a whole
    lot more dynamic, to the point where it is useful
    in the real world.

    One problem with this patch is that it is backwards
    incompatible.  I did not bother keeping the original
    calling interface as A) it's a sample script, and B) the
    original's functionality seems useless
    and equalivant functionality is easily available
    with the new script.

    The problem with the original is that there seems
    little point in verifying a client's cn when all
    the clients share one cn, as would have to be
    the case when the cn is hardcoded into the openvpn
    config file.

    This patch applies against the testing allmiscs branch,
    and should apply against any of the other testing
    branches as well.

    It works for me.  I've tested it throughly but not
    used it extensively in production.

    Regards,

    Karl <kop@meme.com>

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: Gert Doering <gert@greenie.muc.de>
    Acked-by: Eric F Crist <ecrist@secure-computing.net>

commit 9e30f68fc4bf4f81b276b2d4f7092e783d8746d6
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Tue Feb 16 22:06:51 2010 +0100

    Added mapping files from SVN commit ID to more descriptive commit IDs.

    Unfortunately, this will not rewrite the commit history.  So all commits
    done by james@e7ae566f-a301-0410-adde-c780ea21d3b5 is James Yonans commits.

    It was considered to risky to use git tools to rewrite the commit history, as
    it could influence those already using this git tree.

commit 51e6e5b0f14db8bf5a6b6ebee26678fe8b623ad4
Author: James Yonan <james@openvpn.net>
Date:   Wed Sep 1 06:04:29 2010 +0000

    Added --proto-force directive.

    Version 2.1.3a

    git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6424 e7ae566f-a301-0410-adde-c780ea21d3b5

commit 1d76ecbcd03de5bbf97f9969f15debddd0387b87
Author: James Yonan <james@openvpn.net>
Date:   Tue Aug 31 21:39:30 2010 +0000

    Don't configure Linux tun/tap txqueuelen setting if OpenVPN
    txqueuelen directive is set to 0.

    git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6420 e7ae566f-a301-0410-adde-c780ea21d3b5

commit 2e8ff6c1bd1eb96a6551304e16af5e01e86b328f
Author: James Yonan <james@openvpn.net>
Date:   Sun Aug 29 05:24:15 2010 +0000

    Allow PKCS12 file content to be included inline in configuration file,
    rendered as base64.

    git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6412 e7ae566f-a301-0410-adde-c780ea21d3b5

commit 031d18fcb8a2a552aecabb41f1afdfe3f51bdd58
Author: Emilien Mantel <emilien.mantel@businessdecision.com>
Date:   Sat Jun 26 13:56:48 2010 +0200

    Fixed static defined length check to use sizeof()

    This comes in addition to commit 935c62be9c0c8a256112d after some
    additional review comments.

    Signed-off-by: Emilien Mantel <emilien.mantel@businessdecision.com>
    Acked-by: Peter Stuge <peter@stuge.se>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit 935c62be9c0c8a256112df818bfb8470586a23b6
Author: Emilien Mantel <emilien.mantel@businessdecision.com>
Date:   Thu Jun 17 21:38:59 2010 +0200

    Choose a different field in X509 to be username

    For my company, we use a PKI (linked to a LDAP) with OpenVPN. We can't use "CN" to be
    username (few people can have the same "CN"). In our case, we only use the UID.

    With my patch, you can choose another field to be username with a new option called
    --x509-username-field, the default value is "CN".

    Signed-off-by: Emilien Mantel <emilien.mantel@businessdecision.com>
    Acked-by: David Sommerseth <dazo@users.sourceforge.net>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit c5b7923a2b0a94d702e1dad59438f7ee75971d3b
Author: Fabian Knittel <fabian.knittel@avona.com>
Date:   Tue May 4 16:21:47 2010 +0200

    ssl.c: fix use of openvpn_run_script()'s return value

    This patch fixes two bugs introduced in

        commit 339f2a4d4b487afa53fa99d72c35b16f31e417d3
        Author: David Sommerseth <dazo@users.sourceforge.net>
        Date:   Thu Apr 29 23:35:45 2010 +0200

    David's patch replaced openvpn_execve() with openvpn_run_script() in two places,
    but didn't adjust the return value handling.  openvpn_run_script() returns true
    or false, while openvpn_execve() returns the program's exit code.

    Without the fix, the --tls-verify script and the --auth-user-pass-verify
    script fail to run.  (I noticed the latter, but haven't actually tested the
    former.)

    The return value handling is fine for the other places where
    openvpn_run_script() is used, because those places previously used
    openvpn_execve_check() (notice the "_check" suffix).

    Signed-off-by: Fabian Knittel <fabian.knittel@avona.com>
    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: David Sommerseth <dazo@users.sourceforge.net>

commit 339f2a4d4b487afa53fa99d72c35b16f31e417d3
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Thu Apr 29 23:35:45 2010 +0200

    Revamped the script-security warning logging (version 2)

    The main task of this patch is to avoid reporting the SCRIPT_SECURITY_WARNING
    over and over again, in addition to not show this warning when it should not
    be a problem.  This general warning should now only appear once, and only when
    --script-security is not set, 0 or 1.  In all other cases this warning should
    not appear.

    In addition, this warning will come close to the script-hook which most probably
    will fail.  It will also give a little bit more concrete hint on which script-hook
    which failed.  If --script-security is 2 or 3, only the execve failure itself will
    be shown.  This message will on the other hand be shown repeatedly.

    This is a new rewritten version which simplifies the implementaion of the new
    openvpn_run_script() function.  It was considered to remove it completely, but
    due to code clearity and easy of use it was decided to make this function a static
    inline function instead.  Anyhow, this function will enforce openvpn_execve_check()
    to be called with the S_SCRIPT flag.

    Patch ACKed on the developers meeting 2009-04-29.

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: James Yonan <james@openvpn.net>

commit 8dd2672d72508e9edec3d24b75e698b2669d7623
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Thu Apr 22 23:05:00 2010 +0200

    Don't add compile time information if --enable-small is used

    This is to satisfy those wanting to build openvpn for embedded devices
    where every bytes matters.

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: Gert Doering <gert@greenie.muc.de>

commit ef12b6f57b32cc1e79c87741666d1850d6f25bd9
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Tue Apr 13 15:12:27 2010 +0200

    Make use of automake CLEANFILES variable instead of clean-local rule

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: Gert Doering <gert@greenie.muc.de>

commit 63c367398a57c98ab56f8532e3ff3ea8b89ab92e
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Thu Apr 22 23:01:31 2010 +0200

    Fix dependency checking for configure.h (v2)

    Alon Bar-Lev indicated commit f27bf509315a48b0070294c3993a718df0c2626c
    was missing proper dependency checking.  This patch corrects this and
    fixes an issue when creating configure.h via make distcheck.

    This is an enhanced version of the one sent to the openvpn-devel mailing
    list April 13, 2010 [1], after having received some feedback from Gert
    Doering, cleaning up configure_log.awk further.

    [1] <http://thread.gmane.org/gmane.network.openvpn.devel/3410/focus=3491>

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: Gert Doering <gert@greenie.muc.de>

commit f27bf509315a48b0070294c3993a718df0c2626c
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Thu Apr 8 20:31:01 2010 +0200

    Add comile time information/settings from ./configure to --version

    This patch will create ./configure.h which will contain two new #define
    strings.  CONFIGURE_DEFINES will contain all USE, ENABLED, DISABLED and
    DEPRECATED defines from ./config.h.  CONFIGURE_CALL will contain the
    complete ./configure line which was used when configuring the package
    for building.

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: James Yonan <james@openvpn.net>

commit 9f4725e86be9700c5894e360e09496d9ee1cfb85
Author: Wil Cooley <wcooley@users.sourceforge.net>
Date:   Tue Mar 2 21:54:15 2010 +0100

    pkitool lacks expected option "--help"

    The pkitool script lacks the "--help" parameter to actually display the
    usage statement; most people are conditioned to try that before running the
    command without options. This patch adds that and "--version" to display
    just the program name and version.

    sf.net tracker:
    <https://sourceforge.net/tracker/?func=detail&atid=454721&aid=1705407&group_id=48978>

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: Jan Just Keijser <janjust@nikhef.nl>

commit 87afefff8fe7b43b2c5cbba7a03a887fd9c02336
Author: Karl O. Pinc <kop@mofo.meme.com>
Date:   Tue Mar 2 21:41:06 2010 +0100

    Several updates to openvpn.8 (man page updates)

    This is a collection of 4 patches sent to the -devel mailing list:
    * [PATCH] Frob the openvpn(8) man page tls-verify section to clarify
    * [PATCH] More improvments to openvpn(8) --tls-verify
    * [PATCH] Yet another tweak of openvpn(8) --tls-verify
    * [PATCH] Final frobbing of openvpn(8) --tls-verify

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: David Sommerseth <dazo@users.sourceforge.net>

commit a3982181e284f8c5c8fc15bbbd670da4d91a2ba9
Author: Mathieu GIANNECCHINI <mat.giann@free.fr>
Date:   Tue Mar 2 00:26:57 2010 +0100

    enhance tls-verify possibility

    It should be nice to enhance tls-verify check possibilities against peer
    cert during a pending TLS connection like :
    - OCSP verification
    - check any X509 extensions of the peer certificate
    - delta CRL verification
    - ...

    This patch add a new "tls-export-cert" option which allow to get peer
    certificate in PEM format and to store it in an openvpn temporary file.
    Peer certificate is stored before tls-script execution and deleted after.
    The name of the related temporary file is available under tls-verify
    script by an environment variable "peer_cert".

    The patch was made from OpenVPN svn Beta21 branches.

    Here is a very simple exemple of Tls-verify script which provide OCSP
    support to OpenVPN (with tls-export-cert option) without any OpenVPN
    "core" modification :

    X509=$2

    openssl ocsp \
          -issuer /etc/openvpn/ssl.crt/RootCA.pem \
          -CAfile /etc/openvpn/ssl.capath/OpenVPNServeur-cafile.pem \
          -cert $peer_cert \
          -url http://your-ocsp-url
          if [ $? -ne 0 ]
          then
              echo "error : OCSP check failed for ${X509}" | logger -t
    "tls-verify"
              exit 1
           fi

    This has been discussed here:
    <http://thread.gmane.org/gmane.network.openvpn.devel/2492>
    <http://thread.gmane.org/gmane.network.openvpn.devel/3150>
    <http://thread.gmane.org/gmane.network.openvpn.devel/3217>

    This patch has been modified by David Sommerseth, by fixing a few issues
    which came up to during the code review process.  The man page has been
    updated and tmp_file in ssl.c is checked for not being NULL before calling
    delete_file().

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: Gert Doering <gert@greenie.muc.de>

commit 9bd1cd1b0014041ebff2c2bc9d5614d0bec5f6db
Author: Enrico Scholz <enrico.scholz@sigma-chemnitz.de>
Date:   Sun Feb 28 14:40:57 2010 +0100

    Allow 'lport 0' setup for random port binding

    I am running a multihomed host where 'local <extip>' must be specified
    for proper operation.  Unfortunately, this implies 'lport 1194' or
    another static port.

    This causes problems with stateful firewalls which register the host/port
    pairs in the internal connection tracking table. On ungraceful reconnects,
    the new TCP connection will have same the host/port pairs but unexpected
    sequence numbers. The new connection will be assumed as invalid hence and
    be dropped.

    It would be nice when local port can be configured to be bound to a
    random port number.  After reading code,

    |    else if (streq (p[0], "lport") && p[1])
    |  ...
    |        port = atoi (p[1]);
    |-       if (!legal_ipv4_port (port))
    |+       if (port != 0 && !legal_ipv4_port (port))
    |          {

    in options.c seems to be the only required change.

    This has been discussed here:
    <http://thread.gmane.org/gmane.network.openvpn.user/28622>

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: Gert Doering <gert@greenie.muc.de>

commit 1ed4098663cc0fc5457bd2f6e67b44c0b24e6f6c
Author: Gert Doering <gert@greenie.muc.de>
Date:   Sun Feb 28 23:09:40 2010 +0100

    remove duplicate code in FREEBSD+DRAGONFLY system-dependent ifconfig
    (ACKed by Eric F Crist and David Sommerseth)

    (cherry picked from commit dd66b12647852e3f1267be70b0fb3b11deedf377)

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Signed-off-by: Gert Doering <gert@greenie.muc.de>

commit 6233a9f1ac39a56187f6cf34c4996cbfda5eb588
Merge: 228c8b0 63976e0
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Fri Feb 26 17:11:40 2010 +0100

    Merge branch 'master' into bugfix2.1

commit 63976e0f09c51f3001e487584863f8f3e930a824
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Tue Feb 16 22:06:51 2010 +0100

    Added mapping files from SVN commit ID to more descriptive commit IDs.

    Unfortunately, this will not rewrite the commit history.  So all commits
    done by james@e7ae566f-a301-0410-adde-c780ea21d3b5 is James Yonans commits.

    It was considered to risky to use git tools to rewrite the commit history, as
    it could influence those already using this git tree.

commit d2b0636c491f44bb33b62893f2d3875d54f88fda
Author: james <james@e7ae566f-a301-0410-adde-c780ea21d3b5>
Date:   Fri Feb 26 10:26:45 2010 +0000

    Fixed an issue in the Management Interface that could cause
    a process hang with 100% CPU utilization in --management-client
    mode if the management interface client disconnected at the
    point where credentials are queried.

    git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@5458 e7ae566f-a301-0410-adde-c780ea21d3b5

commit 228c8b0f1e843e799251adb744f7066d983b2385
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Fri Feb 19 17:32:56 2010 +0100

    verb 5 logging wrongly reports received bytes

    With --verb 5, openvpn logs a single letter (rwRW) for each package
    received or sent. I recently ran into a problem with the tun device on
    Linux where the read from that device returned 0. Unfortunately this was
    also logged as "r", which made me assume that openvpn had received
    something, while it actually hadn't.

    (See https://dev.openwrt.org/ticket/6650 for the bug that made me find out
    about this problem with openvpn.)

    I'm attaching a patch which prevents openvpn from logging "r" or "R" when
    it didn't actually read anything. This is against openvpn 2.1-rc20, but
    probably still applies to the most recent version.

    This patch was received anonymously via the sf.net bug tracker:
    <http://sourceforge.net/tracker/?func=detail&atid=454719&aid=2951003&group_id=48978>

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: Gert Doering <gert@greenie.muc.de>

commit 22b055eb0888cefa86e0a6d4a34da6066873be45
Author: Karl O. Pinc <kop@meme.com>
Date:   Thu Feb 18 21:30:48 2010 +0100

    [PATCH] Change verify-cn so cn is no longer hardcoded in openvpn's config file

    This patch should be easy to process.
    A resubmission of the patch sent to this list on 04/23/2009.

    The patch changes the verify-cn script sample
    to be used with --tls-verify so that instead of having
    to hardcode a cn to verify in the OpenVPN configuration file
    the allowed cns may be written into a separate file.

    This makes the process of verifying cns a whole
    lot more dynamic, to the point where it is useful
    in the real world.

    One problem with this patch is that it is backwards
    incompatible.  I did not bother keeping the original
    calling interface as A) it's a sample script, and B) the
    original's functionality seems useless
    and equalivant functionality is easily available
    with the new script.

    The problem with the original is that there seems
    little point in verifying a client's cn when all
    the clients share one cn, as would have to be
    the case when the cn is hardcoded into the openvpn
    config file.

    This patch applies against the testing allmiscs branch,
    and should apply against any of the other testing
    branches as well.

    It works for me.  I've tested it throughly but not
    used it extensively in production.

    Regards,

    Karl <kop@meme.com>

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
    Acked-by: Gert Doering <gert@greenie.muc.de>
    Acked-by: Eric F Crist <ecrist@secure-computing.net>

commit 4880739c17b502d00a9ec45c6f6dd3e8bbff057f
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Thu Feb 18 21:20:14 2010 +0100

    Do not randomize resolving of IP addresses in getaddr()

    Based on a discussion on the mailing list and in the IRC meeting Feb 18,
    it was decided to remove get_random() from the getaddr() function as that
    can conflict with round-robin/randomization done by DNS servers.

    This change must be documented in the release notes.

    Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>

commit 30b492a60107d0e28b425239afca2524ac67b9d5
Author: David Sommerseth <dazo@users.sourceforge.net>
Date:   Tue Feb 16 22:06:51 2010 +0100

    Added mapping files from SVN commit ID to more descriptive commit IDs.

    Unfortunately, this will not rewrite the commit history.  So all commits
    done by james@e7ae566f-a301-0410-adde-c780ea21d3b5 is James Yonans commits.

    It was considered to risky to use git tools to rewrite the commit history, as
    it could influence those already using this git tree.

Change-Id: Ie059e5843374aa9839ac39e6a851b4d28f42aca2