close more file descriptors on exec

Don't inherit the --status and --ifconfig-pool-persist, and on Linux
the epoll(7), file descriptors to scripts and other processes that
may be forked by plugins.

Signed-off-by: Heiko Hund <heiko.hund@sophos.com>
Acked-by: David Sommerseth <davids@redhat.com>
Message-Id: 1359728354-9405-1-git-send-email-heiko.hund@sophos.com
URL: http://article.gmane.org/gmane.network.openvpn.devel/7312
Signed-off-by: David Sommerseth <davids@redhat.com>
(cherry picked from commit 09ee4192b1d16bbd7c3c138cc2d46760a11797bf)
Update README.IPv6 to match what is in 2.3.0

IPv6 is no longer provided by external patches - all has been
integrated.  Document that fact, point at the new configuration options,
and at potential caveats.

Acked-by: David Sommerseth <davids@redhat.com>
Message-Id: 1359113954-25768-1-git-send-email-gert@greenie.muc.de
URL: http://article.gmane.org/gmane.network.openvpn.devel/7305
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit c2f4c1918202f4395438663804b0806c93790501)
Remove dead code path and putenv functionality

The construct_name_value function call will always fail so this code path
is never used. Since we now always have a valid environment in
static_context->c2.es it is better to have a ASSERT(es) than to call this
code patch.

Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: David Sommerseth <davids@redhat.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: 1359889951-3369-1-git-send-email-arne@rfc2549.org
URL: http://article.gmane.org/gmane.network.openvpn.devel/7323
Signed-off-by: Gert Doering <gert@greenie.muc.de>
man page patch for missing options

man page patch to include the options that were made connection-entry
specific in 2.3.0

Acked-by: Gert Doering <gert@greenie.muc.de>
Message-ID: 510E4344.6010608@nikhef.nl
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit d94873f6cc2c24e29964e4483b0bc02653860deb)
Enable TCP_NODELAY configuration on FreeBSD.

The missing #include <netinet/tcp.h> causes a defined(TCP_NODELAY) to
fail.  I have added the patch to the FreeBSD ports OpenVPN 2.2.2 and
2.3.0, and confirmed (with strings ... | grep) that the TCP_NODELAY code
is now part of the executable on amd64, and results in this log output:

Sat Jan 12 13:39:18 2013 Listening for incoming TCP connection on [undef]
Sat Jan 12 13:39:18 2013 Socket flags: TCP_NODELAY=1 succeeded

Obtained from: https://community.openvpn.net/openvpn/ticket/158
Credits to: M. Nottebrock

Signed-off-by: Matthias Andree <matthias.andree@gmx.de>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: 1357994477-29981-1-git-send-email-matthias.andree@gmx.de
URL: http://article.gmane.org/gmane.network.openvpn.devel/7230
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 3e86f688757529f8b33f9e6b49e31ba8d8564c5e)
Removed ChangeLog.IPv6

Acked-by: Gert Doering <gert@greenie.muc.de>
Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: 1359101540-976-2-git-send-email-samuli@openvpn.net
URL: http://article.gmane.org/gmane.network.openvpn.devel/7297
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit a93ed2e64cd57a63ca5e9a393cee9bc58ef32378)
Added cross-compilation information INSTALL-win32.txt

Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: 1359101540-976-3-git-send-email-samuli@openvpn.net
URL: http://article.gmane.org/gmane.network.openvpn.devel/7295
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 168780d0df95a37b652e133483c722aefa40cb80)
Updated README

Added links to easy-rsa, tap-windows and openvpn-build and fixes some paths

Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: 1359101540-976-4-git-send-email-samuli@openvpn.net
URL: http://article.gmane.org/gmane.network.openvpn.devel/7296
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 7e0d16a9d6b9a972e5449d9d588545fdbd4ec46c)
Cleaned up and updated INSTALL

- Changed "Supported platforms" to reflect current support status of the
  mentioned operatingsystems
- Removed mentions of the obsolete Python and domake-win buildsystems
- Added mention of official Debian/RPM packages
- Added links to the Wiki
- Added mention of the new openvpn-build cross-compile environment
- Added PolarSSL to and removed pthreads from the "Optional" section
- Added mention of t_client.sh test framework
- Removed some very old (pre-2005) nuggets of (obsolete) information
- Other minor cleanups
- Some reorganization

Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: 1359107974-1481-1-git-send-email-samuli@openvpn.net
URL: http://article.gmane.org/gmane.network.openvpn.devel/7303
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 607a678d371c56d368319b0a7a1bb147008d5822)
Ignore UTF-8 byte order mark

Currently openvpn exits when reading configuration from a file
that has an UTF-8 byte order mark (EF BB BF) at its start.

While it is useless to put a BOM into UTF-8 encoded files, the
Unicode standard [1] permits it (on page 36):

  "Use of a BOM is neither required nor recommended for UTF-8,
  but may be encountered in contexts where UTF-8 data is converted
  from other encoding forms that use a BOM or where the BOM is
  used as a UTF-8 signature."

Notepad.exe, the default text editor on Windows, always puts the BOM
into UTF-8 encoded files when saving them. Others may do as well.

Just ignoring the UTF-8 BOM will make config files with UTF-8 BOM
readable.

[1] http://www.unicode.org/versions/Unicode5.0.0/ch02.pdf

Signed-off-by: Heiko Hund <heiko.hund@sophos.com>
Acked-by: David Sommerseth <davids@redhat.com>
Message-Id: 1359977966-31724-1-git-send-email-heiko.hund@sophos.com
URL: http://article.gmane.org/gmane.network.openvpn.devel/7342
Signed-off-by: David Sommerseth <davids@redhat.com>
(cherry picked from commit 6e6f55f4ba5deda5649679a13e4e323e07b3e661)
fix build with automake 1.13(.1)

AM_CONFIG_HEADER has been deprecated for some time, finally it is removed
on automake 1.13. The attached patch replaces it with AC_CONFIG_HEADERS and
fixes build process with latest automake.

Acked-by: Matthias Andree <matthias.andree@gmx.de>
Message-Id: 20130108093912.7ae7c6f8@leda
URL: http://article.gmane.org/gmane.network.openvpn.devel/7222

Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit d86d577031577dfd69e5ba104e0ce1cb5192c16a)
Fix corner case in NTLM authentication (trac #172)

The problem is located in the file proxy.c within
"establish_http_proxy_passthru": To keep buffers small long
base64-encoded NTLM-Strings are truncated.

But the truncating is done on a wrong place: base 64 strings can be
cut every 4 chars. the buffer is 128 bytes - including the terminating
\0, so the usable data is only 127 bytes. And decoding a 127 char
base64 string fails... this is why the ntlm authentication fails in
certain cases (long strings)...

Acked-by: Joerg Willmann <joe@clnt.de>
URL: https://community.openvpn.net/openvpn/ticket/172

Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit f8ac53b98ed2513f1d80363b6fd2351f1b4ae511)
reintroduce --no-name-remapping option

The option is just an alias for --compat-names no-remapping and is
introduced so pre-2.3 server configurations don't break.

Signed-off-by: Heiko Hund <heiko.hund@sophos.com>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: 1361526263-1740-2-git-send-email-heiko.hund@sophos.com
URL: http://article.gmane.org/gmane.network.openvpn.devel/7364
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 26b0433c4a642f8d2197f3fd371759f0047bd0bd)
make --tls-remote compatible with pre 2.3 configs

In openvpn 2.3.0 the semantics of the --tls-remote option changed.
That broke more configurations than anticipated. To not break
configurations that use --tls-remote with a legacy OpenSSL style DN
anymore, it is now detected when such a DN is configured. When
necessary the --compat-names option is then automatically enabled.

Signed-off-by: Heiko Hund <heiko.hund@sophos.com>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: 1361526263-1740-3-git-send-email-heiko.hund@sophos.com
URL: http://article.gmane.org/gmane.network.openvpn.devel/7366
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit ad532bba896875e56488e69ec16212a77787c57b)
add new option for X.509 name verification

Add the option --verify-x509-name to provide the functionality
of the now deprecated --tls-remote.

The new option accepts RFC 2253 subject DNs only and compares
RDN or RDN prefix only if configured explicitly.

Signed-off-by: Heiko Hund <heiko.hund@sophos.com>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: 1362670601-18660-1-git-send-email-heiko.hund@sophos.com
URL: http://article.gmane.org/gmane.network.openvpn.devel/7376
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 9f0fc745664fd0fc6a1c6785e101bf912088db16)
Remove unused function xor

The function name xor is also a reserved keyword in C++

Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1363032651-23934-1-git-send-email-arne@rfc2549.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/7390
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 462b6d5228660d664c3158902ee50687edf3475d)
Move static prototype definition from header into c file

Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1363032651-23934-3-git-send-email-arne@rfc2549.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/7389

Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 46d402f6513a6745daeaf08e9b260258e912f184)
Remove unused function no_tap_ifconfig

Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1363032651-23934-4-git-send-email-arne@rfc2549.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/7388
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit dc63e06b2c366f74752c8baa61b0f173d62511ad)
Repair "tcp server queue overflow" brokenness, more <stdbool.h> fallout.

Return value of mbuf_len() wrong - it's returning a length value, not
a yes/no value - so when the queue length approached 65 (full!), it
still only returned "1", leading to MBUF overflow later on.  Change
from "bool" to "unsigned int", misbehaviour gone...

This fixes OpenVPN trac ticket #263.

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: Peter Caprioli <petercap@kth.se>
Message-Id: <20130312100706.GN953@greenie.muc.de>
URL: http://article.gmane.org/gmane.network.openvpn.devel/7396
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 0eb398501fab9c016b9b6008682c43873c4a6188)
Permit pool size of /64.../112 for ifconfig-ipv6-pool

(Leftover check from the early days where --server-ipv6 also only
accepted /64 - nowadays we handle smaller pools just fine)

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <20130120185030.GR22465@greenie.muc.de>
URL: http://article.gmane.org/gmane.network.openvpn.devel/7269
(cherry picked from commit 704d9273b6e0e253b62eb728fddd5bbb02503eea)