Introduce safety check for http proxy options

Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1395061013-1802-1-git-send-email-arne@rfc2549.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8353

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Fix warning for max-routes: do not quit when parsing an old configuration. Format the message to be more like the other deprecated options

Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1395060345-30870-1-git-send-email-arne@rfc2549.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8354

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Set SSL_OP_NO_TICKET flag in SSL context for OpenSSL builds, to disable TLS stateless session resumption.

OpenVPN doesn't want or need SSL session renegotiation or
resumption, as it handles renegotiation on its own.

For this reason, OpenVPN always disables the SSL session cache:

SSL_CTX_set_session_cache_mode (ctx, SSL_SESS_CACHE_OFF)

However, even with the above code, stateless session resumption
is still possible unless explicitly disabled with the
SSL_OP_NO_TICKET flag.  This patch does this.

Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <1395017376-24554-1-git-send-email-james@openvpn.net>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8346

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Fix connecting to localhost on Android

Do not protect the link socket when connecting to localhost. Also only
call the protect function on valid socket
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1395407925-25518-2-git-send-email-arne@rfc2549.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8375

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Move the initialization of the environment to the top so c2.es is initialized

Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1395407925-25518-3-git-send-email-arne@rfc2549.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8372

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Workaround broken Android 4.4 VpnService API for persist-tun mode

In Android 4.4 it is not possible to open a new tun device and then close
the old tun device without breaking the whole VPNService stack until the
device is rebooted.

Add new management method to ask the UI what method should be taken to
ensure the optimal solution for the situation.  Then do open-before-close
or close-before-open inside open_tun() as requested.

Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1395407925-25518-4-git-send-email-arne@rfc2549.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8373

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Implement an easy parsable log output that allows access to flags of the log message

Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1395407925-25518-5-git-send-email-arne@rfc2549.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8374

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Adjusted autotools files to build more cleanly on newer autoconf/automake versions

Signed-off-by: David Sommerseth <davids@redhat.com>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <1389803764-5879-1-git-send-email-davids@redhat.com>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8239
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Introduce an option to resolve dns names in advance for --remote, --local and --http-proxy

Also introduce x_gc_addspeical function that allows to add objects with a
custom free function to the gc.

Some additional addrinfo cleanup

Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1395576786-17507-1-git-send-email-arne@rfc2549.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8386

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Fix for server selecting address family

Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1395407925-25518-7-git-send-email-arne@rfc2549.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8371

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Don't show the connection profile store in options->ce if there is a connection_list defined.

Entries in options->ce are never used and overwritten by the first usable
connection profile on initialisation.

Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1395407925-25518-8-git-send-email-arne@rfc2549.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8377

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Add gateway and device to android control messages

Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1395407925-25518-9-git-send-email-arne@rfc2549.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8368

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Bump minimum OpenSSL version to 0.9.8

OpenSSL 0.9.7 and older are considered obsolete (see
http://www.openssl.org/news/news.html). This patch updates configure.ac to
require OpenSSL 0.9.8 or newer, and removes a number of #ifdefs that are
now no longer needed.

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <1395582781-27966-1-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8392
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Add openssl-specific common cipher list names to ssl.c.

This adds a number of commonly used cipher list names to ssl.c, which makes
OpenVPN not give a "translation not found" warning when using these.

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <1393684575-28112-2-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8316
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Disable unsupported TLS cipher modes by default, cleans --show-tls output.

This explicitly disables a number of tls ciphers that OpenVPN has currently
no support for. OpenSSL will automatically detect this during negotiation,
but --show-tls would erroneously show a number of unsupported ciphers.

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <1393684575-28112-3-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8318
Signed-off-by: Gert Doering <gert@greenie.muc.de>
configure.ac: check for SSL_OP_NO_TICKET flag in OpenSSL

SSL_OP_NO_TICKET tells OpenSSL to disable "stateless session resumption".
This is something we do not want nor need, but could potentially be used
for a future attack. OpenVPN 2.4 requires the flag to be set and will fail
configure if the flag is not present.
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <CAA1AbxJh17KYmVU1BVa5kp4iJsUJT+xnXp0rVU_3g3c5hPnqDQ@mail.gmail.com>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8389

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Clean up of socket code.

Let socket_create take struct addrinfo as argument and use the entries of
addrinfo to create the socket.

Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1395407925-25518-11-git-send-email-arne@rfc2549.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8370

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Fix assert when using port-share

Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1395407925-25518-12-git-send-email-arne@rfc2549.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8369

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Fix crash when using --inetd.

Change "local" argument to socket_do_listen() to avoid calling
"local->ai_addr" in the caller for the "do_listen == FALSE" case,
in which case it could be NULL.

Also, ensure "ai" is always initialized in socket_listen_accept() for
the "!remote_dynamic" case - otherwise it will sometimes(!) crash in
addrlist_match() later on.

Get rid of spurious operator precedence warning concerning
GETADDR_CACHE_MASK.

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <1396181376-32022-1-git-send-email-gert@greenie.muc.de>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8412
configure.ac: use CPPFLAGS for SSL_OP_NO_TICKET check

AC_EGREP_CPP uses CPPFLAGS, not CFLAGS. Make sure the macro can find
OpenSSL by temporarily adding OPENSSL_CRYPTO_FLAGS to CPPFLAGS.

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Heiko Hund <heiko.hund@sophos.com>
Message-Id: <5339EFFC.6090908@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8419
Signed-off-by: Gert Doering <gert@greenie.muc.de>