Fixed tls-cipher translation bug in openssl-build

Signed-off-by: Steffan Karger <steffan.karger@fox-it.com>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <1CED409804E2164C8104F9E623B08B9013BC28A538@FOXDFT02.FOX.local>
URL: http://article.gmane.org/gmane.network.openvpn.devel/7480
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Add the client id (CID) to the output of the status command

This add adds CID which is needed by a few other management commands to
the status output. This will change the output of status in the same way
commit ca18a638aa7cf316611f893127ba44131e57083c did.

Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1346422753-19520-1-git-send-email-arne@rfc2549.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/7021
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Print client id only if compiled with man agent support. Otherwise
print an empty string.

Also use %lu instead of %u for printing unsigned long int

Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1365687278-3921-1-git-send-email-arne@rfc2549.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/7498

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Print "Virtual IPv6 Address" on management interface queries [v4]

Add extra column to management queries for "status 2" or "status 3"
after "Virtual Address", empty if no IPv6 address assigned to this
client (or IPv6 not active at all).

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <20130411150918.GW569@greenie.muc.de>
URL: http://article.gmane.org/gmane.network.openvpn.devel/7503
Fixed usage of stale define USE_SSL to ENABLE_SSL

Signed-off-by: Steffan Karger <steffan.karger@fox-it.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <516BCEA2.6000608@fox-it.com>
URL: http://article.gmane.org/gmane.network.openvpn.devel/7509
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Improve the git revision tracking

This removes the single 'git revision' line from the --version screen and
moves this information on the top, together with the OpenVPN version.

In addition this patch adds two git flags after the git committish.  If
there exists changed but unstaged files when the build was done, a '+' is
appended after the committish.  If there exists staged files (files which
have been added with 'git add') a '*' will be appended.  These flags are
not exclusive.

This also simplifies the config-version.h generation by not using
sed parsing a template.  It's just two lines which are generated, so
no need to complicate things more than needed.

Signed-off-by: David Sommerseth <davids@redhat.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: 1366375212-14886-1-git-send-email-dazo@users.sourceforge.net
URL: http://article.gmane.org/gmane.network.openvpn.devel/7522
Allow routes to be set before opening tun, similar to ifconfig before opening tun

Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1367159559-22947-1-git-send-email-arne@rfc2549.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/7564

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Add ability to send/receive file descriptors via management interface

Used for communicating with the Java side on Android to send
to-be-protected socket fd, and to receive tun fd.

For now under #ifdef ANDROID

Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1367006045-13576-2-git-send-email-arne@rfc2549.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/7557

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Android platform specific changes.

On Android 4.0 (TARGET_ANDROID) the real opening of the tun is handled by
the (Java) application controlling OpenVPN. Instead of calling
ifconfig/route call the management to do the work. When running openvpn as
root openvpn should be compiled as TARGET_LINUX

Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1367350151-23089-1-git-send-email-arne@rfc2549.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/7570
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Emulate persist-tun on Android

On Android changing the configuration of tun is not possible. So instead
of reconfiguring the tun device, open a new tun device and close the old
one if needed.

Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1367006372-14815-1-git-send-email-arne@rfc2549.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/7558

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Document the Android implementation in OpenVPN

Also fix a minor mistake in the manpage.

Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1367353997-6669-1-git-send-email-arne@rfc2549.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/7571

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Fix proto tcp6 for server & non-P2MP modes

This fix adds support for using tcp6 as a proto in server or non-P2MP
modes, resolving a failed ASSERT in such cases.

Fixes the crash in trac#288.

Signed-off-by: Josh Cepek <josh.cepek@usa.net>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <klul5d$8ta$1@ger.gmane.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/7578
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Fix segfault when enabling pf plug-ins

This fixes an issue where a segfault happens in pf_cn_test() if no
packet filtering rules have been parsed.  See the trac ticket for
more details.

Trac: 163
Signed-off-by: David Sommerseth <davids@redhat.com>
Acked-by: David Sommerseth <davids@redhat.com>
Use constrain_int() instead of MIN()+syshead.c compat definition - v2.

Reverts commit 15ca5c297b556fbb, instead change ssl_openssl.c to use
"constrain_int()", which already exists in "integer.h".

Using this instead of min_int() ensures that the result is always bounded
to 0...256 even in the case of a potential MAX_INT overflow.

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: David Sommerseth <davids@redhat.com>
Message-Id: 1367826941-22412-1-git-send-email-gert@greenie.muc.de
URL: http://article.gmane.org/gmane.network.openvpn.devel/7586
Signed-off-by: David Sommerseth <davids@redhat.com>
Fix NULL-pointer crash in route_list_add_vpn_gateway().

Add ASSERT() check to route_list_add_vpn_gateway() to ensure that *rl
is valid (and if not, crash with a somewhat more meaningful message than
"segmentation violation").  For the actual bugfix, change init code to
always allocate a "struct route_list" for IPv4, even if no --route options
have been seen in the config.

Fix trac#281 and trac#258.

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Josh Cepek <josh.cepek@usa.net>
Message-Id: <1367608404-2257-1-git-send-email-gert@greenie.muc.de>
URL: http://article.gmane.org/gmane.network.openvpn.devel/7581
Fix Windows script execution when called from script hooks

Console applications under Windows, such as batch scripts, require the
CREATE_NO_WINDOW process flag when run without an actual console window
present. This change allows such scripts to execute and impact the hook
status by way of their return code.

Fixes bug #240.

Signed-off-by: Josh Cepek <josh.cepek@usa.net>
Acked-by: Heiko Hund <heiko.hund@sophos.com>
Message-Id: <kn2pao$5sv$1@ger.gmane.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/7594
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Added support for the Snappy compression algorithm

Added support for the Snappy compression algorithm which has shown to
have considerably better compression speed than LZO at a comparable
compression ratio.

To enable Snappy add:

  compress snappy

to both client and server config files.

Alternatively, enable compression framing on the client:

  compress

and have the server selectively push "compress snappy" to the client.

This change also extends the client capability handshake to include
IV_SNAPPY so the server can be aware that a connecting client supports
Snappy.

Note that the Snappy implementation also includes an improved framing
approach where the first byte of the compressed payload is replaced by
the compression control byte (the first payload byte is moved to the end
of the packet).  This solves off-by-one alignment issues, which improves
performance on ARM.

By default, the configure script will try to build with Snappy support.
To disable, use the --disable-snappy option.

The --enable-lzo-stub configure directive is now --enable-comp-stub
(because it's not actually "lzo" but "compression-enabled packet framing")

Add compression overhead to extra buffer unconditionally, as long
as USE_COMP is defined.

OpenVPN SVN r8206 (2.1.21a) and r8212 (2.1.21b)

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <1366393268-27392-3-git-send-email-gert@greenie.muc.de>
URL: http://article.gmane.org/gmane.network.openvpn.devel/7531
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Fix usage of 'compression ...' from global config.

The new compression framework introduced by SVN r8206 only works for
a P2MP server if the compression settings are re-installed for each
client via management interface, ccd/ file or client-connect script,
but the "global" settings get lost due to (needlessly) clearing the
c2.comp_context in the per-client instance.  Fixed.  (also trac#273)

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <1366393268-27392-6-git-send-email-gert@greenie.muc.de>
URL: http://article.gmane.org/gmane.network.openvpn.devel/7529
make 'explicit-exit-notify' pullable again

Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <519F5ED0.4070109@nikhef.nl>
URL: http://article.gmane.org/gmane.network.openvpn.devel/7605

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Always push basic set of peer info values to server.

On the client, allow certain peer info fields to be pushed even if
push-peer-info isn't specified in the config.

This is needed to allow the compression handshake to work correctly
(i.e. where the client indicates its support for LZO and/or Snappy).

Fields that have privacy implications such as Mac Address and UV_*
environment variables will not be pushed to the server as before unless
push-peer-info is specified by client config.

v1: equivalent to OpenVPN SVN r8225 (2.1.21c)

v2: distinguish 3 levels of peer-info detail

  --push-peer-info specified --> send all we have
  --pull           specified --> send basic set, as per r8225
  default                    --> send nothing (do not leak from server)

v3: undo extra whitespace changes in v1 and v2

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <1369044801-7594-1-git-send-email-gert@greenie.muc.de>
URL: http://article.gmane.org/gmane.network.openvpn.devel/7604