Document man agent-external-key

Adapt commit message from cf69617bbea45a15423c4188daa9386debcbe1ec for man
page and management documentation.

Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: David Sommerseth <davids@redhat.com>
Message-Id: 1349082318-985-1-git-send-email-arne@rfc2549.org
URL: http://article.gmane.org/gmane.network.openvpn.devel/7081
Signed-off-by: David Sommerseth <davids@redhat.com>
(cherry picked from commit 75b6f4bd84302d225a301f4ed87e2bb27908b972)
Fix v3 plugins to support returning values back to OpenVPN.

There's a small implementation issue with the V3 plugin API
implementation.  V3 plugins cannot return data back to OpenVPN using
openvpn_plugin_args_func_return since
openvpn_plugin_args_func_return.return_list is always NULL.

This patch makes the behaviour identical to the V2 API (return_list is
again a proper out parameter).

Signed-off-by: Kenneth Rose <ken+openvpn@surfeasy.com>
Acked-by: David Sommerseth <davids@redhat.com>
Message-Id: CAAUdgR8VZjaO0-thFPVoQkbZ1DNG3rx+gtYYLqyfocp3yns==w@mail.gmail.com
URL: http://article.gmane.org/gmane.network.openvpn.devel/7083
Signed-off-by: David Sommerseth <davids@redhat.com>
(cherry picked from commit e92255f58bcfaec157c3ef59e01c40cbd04b1d43)
Fixed a bug where PolarSSL gave an error when using an inline file tag.

Signed-off-by: Adriaan de Jong <dejong@fox-it.com>
Acked-by: David Sommerseth <davids@redhat.com>
Message-Id: 1350466765-23301-1-git-send-email-dejong@fox-it.com
Signed-off-by: David Sommerseth <davids@redhat.com>
(cherry picked from commit 2ebbe4c0b4f0f0b15b4c32180e906a545446c376)
Make git ignore some more files

Don't care about ./libtool (autogenerated) and test reports from t_client.sh

Signed-off-by: David Sommerseth <davids@redhat.com>
Options parsing demands unnecessary configuration if PKCS11 is used

In the old patch the if incorrectly closed the outer if condition.
(closes ticket #231)

Trac-ticket: 231
Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: David Sommerseth <davids@redhat.com>
Message-Id: 1350470774-12511-1-git-send-email-arne@rfc2549.org
URL: http://article.gmane.org/gmane.network.openvpn.devel/7095
Signed-off-by: David Sommerseth <davids@redhat.com>
(cherry picked from commit 70a07339f8d323d69cdcf8d59da1f331d39e4d0a)
Fix display of plugin hook types

The OPENVPN_PLUGIN_ROUTE_PREDOWN hook was missing and displayed as
"PLUGIN_???" in the log.

OPENVPN_PLUGIN_ENABLE_PF was the only one that displayed the
OPENVPN_ prefix.

Signed-off-by: Heiko Hund <heiko.hund@sophos.com>
Acked-by: David Sommerseth <davids@redhat.com>
Message-Id: 1351517910-11414-1-git-send-email-heiko.hund@sophos.com
URL: http://article.gmane.org/gmane.network.openvpn.devel/7111
Signed-off-by: David Sommerseth <davids@redhat.com>
(cherry picked from commit ae303d444c11984b87e0046c4138982d7a41fd8b)
Support UTF-8 --client-config-dir

If a common name (or user name, when used in conjunction with
--username-as-common-name) contains UTF-8 encoded characters their
octets get replaced by underscores. This becomes problematic when
user "Müller" and "Möller" need to have a CCD file and both would
receive options from the file "M__ller". The situation is even
worse for non-latin alphabets, where CCD file names consist of
underscores entirely.

This patch removes that limitation and also allows the file names
to contain any punctuation characters besided the resevered ones.

Signed-off-by: Heiko Hund <heiko.hund@sophos.com>
Acked-by: David Sommerseth <davids@redhat.com>
Message-Id: 1351516597-11128-1-git-send-email-heiko.hund@sophos.com
URL: http://article.gmane.org/gmane.network.openvpn.devel/7110
Signed-off-by: David Sommerseth <davids@redhat.com>
(cherry picked from commit 9885f57e3ac8d2e32ba20ca84f6bdd0a1a995eac)
Remove the support for using system() when executing external programs or scripts

This patch removes the support for the system() call, and enforces the
usage of execve() on the *nix platform and CreateProcessW() on Windows.
This is to enhance the overall security when calling external scripts.
Using system() is prone to shell expansions, which may lead to security
breaches.  Which is also why the execve() approach has been the default
since commit a82813527551f0e79c6d6ed5a9c1162e3c171bcf which
re-introduced the system() in Nov. 2008.

After having asked on the mailing list and checked around on the IRC
channels, the genereal consensus is that very few uses system() these
days.

The only annoyance I've been made aware of is that this will now
require adding a full path to the script interpreter together with the
script, and not just put in the script name alone.  But to just use the
script name in Windows, you had to configure --script-security with the
'system' flag earlier too.  So my conclusion is that it's better to add
a full path to the script interpreter in Windows and raise the overal
security with OpenVPN, than to continue to have a possible potentially
risky OpenVPN configuration just to make life "easier" for Windows
script users.

Removal of the system() call, also solves a nasty bug related to the
usage of putenv() on the *nix platforms.

For more information please see:
http://thread.gmane.org/gmane.network.openvpn.devel/7090
https://community.openvpn.net/openvpn/ticket/228

Trac-ticket: 228
Signed-off-by: David Sommerseth <davids@redhat.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1351539352-17371-1-git-send-email-dazo@users.sourceforge.net>
URL: http://article.gmane.org/gmane.network.openvpn.devel/7114
(cherry picked from commit 0563473601abfbf2142bfa0ca5b863c5aa7953a2)
Preparing for v2.3_rc1

Signed-off-by: David Sommerseth <davids@redhat.com>
Fix double-free issue in pf_destroy_context()

In commit dc7be6d078ba106f9b0de12f3e879c3561c3c537 the string_alloc() call
in pf_init_context() was modified to use the gc_arena object for memory
allocation.  What was not taken into consideration was that
pf_destroy_context() was also freeing memory allocated by string_alloc(),
and when pf_init_context() is calling gc_free() a double-free situation
showed up.

Lets remove the explict free, and let gc_free take care of all the memory
handling.

Reported-by: cuzz@163.com
Signed-off-by: David Sommerseth <davids@redhat.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: 1352196216-11560-1-git-send-email-dazo@users.sourceforge.net
URL: http://article.gmane.org/gmane.network.openvpn.devel/7124
(cherry picked from commit 1f300fe94f1bd521966bb05dea40edc1fae82b84)
Fix --show-pkcs11-ids (Bug #239)

Broken by 00b973f8af85c3ea8fa3cef80eec55e8dc139b27

Signed-off-by: Joachim Schipper <joachim.schipper@fox-it.com>
Acked-by: David Sommerseth <davids@redhat.com>
Trac-ticket: 239
Message-Id: 1CED409804E2164C8104F9E623B08B901323A48384@FOXDFT02.FOX.local
URL: http://article.gmane.org/gmane.network.openvpn.devel/7129
Signed-off-by: David Sommerseth <davids@redhat.com>
(cherry picked from commit 5fd3e56430678bee3e6e3a3cf8dfd6db7e105676)
Error message if max-routes used incorrectly

the route/route-ipv6/redirect-gateway options allocate the route structe
with max_routes number of routes. A max-routes after any of this commands
has no effect. This can be problematic
(http://code.google.com/p/ics-openvpn/issues/detail?id=101)

Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: 1353348737-21920-1-git-send-email-arne@rfc2549.org
URL: http://article.gmane.org/gmane.network.openvpn.devel/7131
Signed-off-by: David Sommerseth <davids@redhat.com>
(cherry picked from commit f83ccec6525179968b68696acb6ccf22182fc6de)
doc/management-notes.txt: fix typo

Signed-off-by: Joachim Schipper <joachim.schipper@fox-it.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: 1CED409804E2164C8104F9E623B08B901323D0B184@FOXDFT02.FOX.local
URL: http://article.gmane.org/gmane.network.openvpn.devel/7141
Signed-off-by: David Sommerseth <davids@redhat.com>
(cherry picked from commit 5dfdb7c010c5a32a0ec51d9266748c641cd24dba)
Fix typo in ./configure message

Signed-off-by: Joachim Schipper <joachim.schipper@fox-it.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: 1CED409804E2164C8104F9E623B08B901323D0B186@FOXDFT02.FOX.local
URL: http://article.gmane.org/gmane.network.openvpn.devel/7142
Signed-off-by: David Sommerseth <davids@redhat.com>
(cherry picked from commit 038f0aca3077807f3fc60077e2aacffef5ba2f45)
Properly require --key even if defined(MANAGMENT_EXTERNAL_KEY)

When specifying --tls-client --cert ... without a --key (or --pkcs11)
option, OpenVPN should complain:
"You must define private key file (--key)...".  Ensure that this
works even when compiling with MANAGMENT_EXTERNAL_KEY.

Also fix the other instance where this logic is broken

Orginal-Patch-by: Found by Joachim Schipper <joachim.schipper@fox-it.com>
Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: 1353940389-31075-1-git-send-email-arne@rfc2549.org
URL: http://article.gmane.org/gmane.network.openvpn.devel/7143
Signed-off-by: David Sommerseth <davids@redhat.com>
(cherry picked from commit feca0900dd00577779ab02f2e52b41eb3dab935f)
The get_default_gateway() function uses warn() instead of msg()

A report on #openvpn pointed out that in his setup three warnings
appeard on the console when starting up.

    $ sudo /usr/local/etc/rc.d/openvpn restart
    Stopping openvpn.
    Waiting for PIDS: 33031.
    Starting openvpn.
    openvpn: writing to routing socket: No such process
    openvpn: writing to routing socket: No such process
    openvpn: writing to routing socket: No such process
    $

This setup is on FreeBSD using jails with strict access to the
routing table.

After looking at the code path, this error was found in the BSD
sections for get_default_gateway().  But it was using the warn()
call instead of msg(M_WARN|M_ERRNO, ...) which causes these
warnings to go to stderr instead of the log file.

The warning string is also slightly modified to better explain
what fails.

Reported-by: Thomas Steen Rasmussen <thomas@gibfest.dk>
Tested-by: Thomas Steen Rasmussen <thomas@gibfest.dk>
Signed-off-by: David Sommerseth <davids@redhat.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: 1354194972-5388-1-git-send-email-dazo@users.sourceforge.net
URL: http://article.gmane.org/gmane.network.openvpn.devel/7149
(cherry picked from commit b3f19cc4bec6978a128f5af3ab22d8cfa954b064)
Avoid recursion in virtual_output_callback_func()

This solves a SEGV situation when using the management API while OpenVPN
is closing down.

The situation happens when the management socket has closed and OpenVPN
tries to write an error about this to the management socket.  What happens
is that

 virtual_output_callback_func() is called, which then calls
 -> man_output_list_push_finalize()
    -> man_output_standalone()
       -> man_write()  <-- this does the socket write
          -> man_io_error()
             -> x_msg()
                -> virtual_output_print()
                   -> virtual_output_callback_func() (recursion start)

virtual_output_callback_func() do have a mechanism to avoid recursion,
but that did not keep the recurse counter when
man_output_list_push_finalize()
is called.

This patch just reorganise the recursion block to also keep the counter
while
calling the other functions from virtual_output_callback_func()

Signed-off-by: David Sommerseth <davids@redhat.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: 1353063726-25113-1-git-send-email-dazo@users.sourceforge.net
URL: http://article.gmane.org/gmane.network.openvpn.devel/7130
(cherry picked from commit b2b66179f6dcc37de9582d5c3044f0357dda3df3)
Remove dnsflags_to_socktype, it is not used anywhere

Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: 1354303076-13606-1-git-send-email-arne@rfc2549.org
URL: http://article.gmane.org/gmane.network.openvpn.devel/7160
Signed-off-by: David Sommerseth <davids@redhat.com>
(cherry picked from commit 740137f6bb7b3565054c3a8e894ceca93f2ff0e4)
Fix the proto is used inconsistently warning

Fix the "WARNING: 'proto' is used inconsistently, local='proto UDP',
remote='proto UDPv6'." message.

Note that the on wire strings are now always TCPv4 and UDPv4 to be
compatible to pre2.3

Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: 1354650174-25601-1-git-send-email-arne@rfc2549.org
URL: http://article.gmane.org/gmane.network.openvpn.devel/7175
Signed-off-by: David Sommerseth <davids@redhat.com>
(cherry picked from commit 38727e09df35245ba0cfe335e23e6b43c817ce58)
Implement --mssfix handling for IPv6 packets.

Rename process_ipv4_header() to process_ip_header() and PIPV4_MSSFIX
flag to PIP_MSSFIX, to make visible that it's no longer IPv4-only.

Inside process_ip_header(), call out to mss_fixup_ipv6() if --mssfix
is active and IPv6 packet seen.

Rename mss_fixup() to mss_fixup_ipv4(), implement mss_fixup_ipv6().

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: 1354482672-16136-2-git-send-email-gert@greenie.muc.de
URL: http://article.gmane.org/gmane.network.openvpn.devel/7173
Signed-off-by: David Sommerseth <davids@redhat.com>
(cherry picked from commit f0e8997a874a89b3fe1f82109c443232e8967b01)