Fix merge error in a6c573d, the ssl ctx is now abstracted.

Between the origin patch submission (2011) and now the cipher abstraction
layer has been added. This patch slipped through without proper adjustment.

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <53863C41.1020408@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8745
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Use generic openvpn_x509_cert_t in ssl_verify_polarssl.c

For symmetry with ssl_verify_openssl.c and release/2.3 branch.

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1401645536-27849-2-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8752
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Fix ssl.c, ssl_verify_* includes

* ssl.c: remove three unneeded includes
* ssl_verify_polarssl.h: remove two unneeded includes
* ssl_verify_openssl.c: add missing ssl_verify_openssl.h and error.h
  includes, and reorder includes.

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1401645536-27849-3-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8753
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Move #include "ssl_verify.h" from ssl.h to the source files that need it.

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1401645536-27849-4-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8749
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Remove dependency on manage.h from ssl_verify.h

verify_user_pass_enabled() is a function on a tls_session, and belongs in
ssl.c. Moving the function removes the dependency on manage.h.

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1401645536-27849-5-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8754
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Remove unused variable 'proxy' from socket_restart_pause()

Variable 'proxy' was set but never read, so remove it.

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1401645536-27849-6-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8750
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Add (default disabled) --enable-werror option to configure

Useful for example during development or automated builds, to make the
build error out if new warnings are introduced.

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1401359947-31144-1-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8747
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Fix --disable-ssl builds, were broken by cleanup in 63dc03d.

Wrap ssl_verify.h in "#if defined(ENABLE_CRYPTO) && defined(ENABLE_SSL)" to
make it empty for --disable-ssl builds.

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1401737019-15702-1-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8763
Signed-off-by: Gert Doering <gert@greenie.muc.de>
refine assertion to allow other modes than CBC

cipher_ctx_final() only returns an outlen in CBC mode. If CFB or OFB
are used the assertion outlen == iv_len is always false.

There's no CBC mode defined for the GOST 28147-89 block cipher. Hence
this patch is needed for it to work. It's needed for other ciphers like
BF-CFB as well, though.

Signed-off-by: Heiko Hund <heiko.hund@sophos.com>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <538A00AA.7090007@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8748
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Drop incoming fe80:: packets silently now.

IPv6 has the concept of "link local" addresses, fe80::<host id>, which
normally are present on every link, and are used for stuff like DHCPv6,
neighbor discovery, etc.

OpenVPN point-to-multipoint mode currently does neither configure them on
tun interfaces, nor are they handled in a meaningful way if a client OS
always has them (like Windows or Solaris) - so the log fills with many
lines of "MULTI: bad source address from client [fe80::...]", serving
no useful purpose.

This patch just recognizes IPv6 LL packets and silently drops them.

Further patches can build on this and add full link-local support, which
would require address learning (as the addresse are based on host IDs, not
assigned by the server).

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <1402080235-24409-1-git-send-email-gert@greenie.muc.de>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8773
Improve error reporting on file access to --client-config-dir and --ccd-exclusive

OpenVPN will do some simple sanity checking at startup to ensure
the expected files and directories is in place.  However, with
--client-config-dir and --ccd-exclusive, things are slightly different.
In both cases it is perfectly fine that files does not exists, and we
cannot know any file names beforehand due to these filenames being based
upon the certificate's CN field.

The problem arises when OpenVPN cannot open files inside a directory
because the directory permissions are too restrictive, have wrong
ownership (triggered by the usage of --user/--group) or other security
mechanisms the OS uses.

When a client connects, the test_file() function is used to check if a
client config file has been prepared.  And if not, it continues without
trying to read it.  So, if the privileges of the running OpenVPN process
is not allowed to open and read an existing file, OpenVPN will treat this
as a non-existing file without saying anything.  This is clearly wrong.
So this patch adds an warning message in the OpenVPN log if it could
not open the file due to lack of permissions.

This will work fine on all *nix based OSes.  Windows however reports
'no such file or directory' (errno=2/-ENOENT) even on privilege access
errors when the directory this file resides is too restrictive.  But there
is no easy way to work around that.  However, I believe that the initial
sanity checking at startup will catch that one, as it will check if the
directories it needs exists.

This patch has only gone through simple basic testing, with both too few
privileges and with proper privileges to the CCD directory.  With wrong
privileges, the following error can be found if CN=Test client

  Fri May  2 00:00:10 2014 us=281993 127.0.0.1:41017 Could not access file
'/etc/clients/Test client': Permission denied (errno=13)

[v2 - use openvpn_errno() instead of errno, for better platform support]

Trac: #277
Trac-URL: https://community.openvpn.net/openvpn/ticket/277
Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <1398990504-4239-1-git-send-email-dazo@users.sourceforge.net>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8688
Signed-off-by: Gert Doering <gert@greenie.muc.de>
configure.ac: fix SSL_OP_NO_TICKET check

Only check for SSL_OP_NO_TICKET if building with --enable-ssl and using
openssl. This fixes cross-compiling polarssl builds for Windows (where
pkg-config would find the system openssl library, but the cross compiler
would not have openssl for the target platform).

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1403461119-21440-1-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8795
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Fix bug that incorrectly refuses oid representation eku's in polar builds

The return value of x509_get_numeric_string() was interpreted incorrectly
by ssl_verify_polarssl.c's x509_verify_cert_eku(). This patch enables the
usage of oid represenation in --remote-cert-eku options.

Signed-off-by: Steffan Karger <steffan.karger@fox-it.com>
Acked-by: David Sommerseth <dazo@users.sourceforge.net>
Message-Id: <1398415277-6880-1-git-send-email-steffan.karger@fox-it.com>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8627
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Update README.polarssl

PolarSSL support has been extended and adjusted, but README.polarssl was
not accordingly adjusted. This updates README.polarssl to the current state
of affairs for the master branch.

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1403640206-7024-2-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8803
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Fix some typos in the man page.

Signed-off-by: Andris Kalnozols <andris@hpl.hp.com>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <53AF0D20.7020204@karger.me>
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Fix socket-flag/TCP_NODELAY on Mac OS X

Hi All,

OpenVPN 2.3.4 will currently throw a warning of "NOTE: setsockopt
TCP_NODELAY=1 failed (No kernel support) when attempting to use the
TCP_NODELAY socket option on Mac OS X/Darwin. Kernel support is there,
however the required header file where TCP_NODELAY is defined is not being
included. This patch simply alters syshead.h to include <netinet/tcp.h> on
Darwin platforms.

Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <A1005665-126D-45D5-A6F2-75ED0EAE30FE@sparklabs.com>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8809

Signed-off-by: Gert Doering <gert@greenie.muc.de>
cleanup: remove #if 0'ed function initiate_untrusted_session() from ssl.c.

Has been inside the #if 0 since 'git tree epoch' (sept-2005) and was not
referenced, from either code, nor dead code nor comment.

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1404336688-15036-1-git-send-email-steffan@karger.me>
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Recognize AIX, define TARGET_AIX

force "have_tap_header=yes", as configure won't like AIX headers otherwise
(no tun related headers, just <net/if_tap.h>).

force ROUTE to be "/usr/sbin/route" - not executable by non-root users, so
configure testing for executables will not find it

force "ac_cv_header_net_if_h=no", because AIX' <net/if.h> pulls in AIX'
<net/route.h>, which #defines ROUTE_H, disabling our "route.h"... (and
we don't need <net/if.h> on AIX anyway)

Signed-off-by: Gert Doering <gd@medat.de>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <1402409073-54067216-2-git-send-email-gert@greenie.muc.de>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8787
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Add tap driver initialization and ifconfig for AIX.

AIX is special... ifconfig only works if it can add the data to
the ODM right away, so setup a local enviromnment set that has
"ODMDIR=/etc/objrepos" in it (hard-coded, nobody changes that).

Only --dev tap or --dev tapNN are supported right now.  AIX has no
tun driver (so tun mode would need to dynamically add/remove ethernet
headers to/from AIX).

Signed-off-by: Gert Doering <gd@medat.de>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <1402409073-54067216-3-git-send-email-gert@greenie.muc.de>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8788
Signed-off-by: Gert Doering <gert@greenie.muc.de>
implement adding/deleting routes on AIX, for IPv4 and IPv6

AIX only has TAP interfaces, so always use gateway address as next hop,
not interface name.

AIX route works much more reliable if passed netbits than netmask - do so
(introducing a new helper function netmask_to_netbits2())
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <1402409073-54067216-4-git-send-email-gert@greenie.muc.de>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8785

Signed-off-by: Gert Doering <gert@greenie.muc.de>