Fixed static defined length check to use sizeof()

This comes in addition to commit 935c62be9c0c8a256112d after some
additional review comments.

Signed-off-by: Emilien Mantel <emilien.mantel@businessdecision.com>
Acked-by: Peter Stuge <peter@stuge.se>
Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
Added support for MSVC debugging of openvpn.exe in settings.in:

  # Build debugging version of openvpn.exe
  !define PRODUCT_OPENVPN_DEBUG


git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6283 e7ae566f-a301-0410-adde-c780ea21d3b5
Fixed bug in proxy fallback capability where openvpn.exe could
core dump if http-proxy-fallback-disable command was issued in
response to ">PROXY:NEED_NOW management" interface notification.


git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6284 e7ae566f-a301-0410-adde-c780ea21d3b5
Version 2.1.1k


git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6285 e7ae566f-a301-0410-adde-c780ea21d3b5
Implemented multi-address DNS expansion on the network field of route
commands.

When only a single IP address is desired from a multi-address DNS
expansion, use the first address rather than a random selection.

Version 2.1.1l


git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6291 e7ae566f-a301-0410-adde-c780ea21d3b5
Added --register-dns option for Windows.

Fixed some issues on Windows with --log, subprocess creation
for command execution, and stdout/stderr redirection.

Version 2.1.1m.


git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6304 e7ae566f-a301-0410-adde-c780ea21d3b5
Added win/build_exe.py script, which is similar to
win/build_all.py except that it doesn't build the
TAP drivers or tapinstall.


git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6306 e7ae566f-a301-0410-adde-c780ea21d3b5
Fixed typo: missing comment close.


git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6347 e7ae566f-a301-0410-adde-c780ea21d3b5
Fixed an issue where application payload transmissions on the
TLS control channel (such as AUTH_FAILED) that occur during
or immediately after a TLS renegotiation might be dropped. 

Version 2.1.1n


git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6350 e7ae566f-a301-0410-adde-c780ea21d3b5
Added "net stop dnscache" and "net start dnscache" in front
of existing --register-dns commands.


git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6352 e7ae566f-a301-0410-adde-c780ea21d3b5
Distribute win directory (Python/MSVC-based build system)
in "make dist" tarball.


git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6382 e7ae566f-a301-0410-adde-c780ea21d3b5
Added warning about tls-remote in man page.


git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6384 e7ae566f-a301-0410-adde-c780ea21d3b5
Windows security issue:
Fixed potential local privilege escalation vulnerability in
Windows service. The Windows service did not properly quote the
executable filename passed to CreateService.  A local attacker
with write access to the root directory C:\ could create an
executable that would be run with the same privilege level as
the OpenVPN Windows service.  However, since non-Administrative
users normally lack write permission on C:\, this vulnerability
is generally not exploitable except on older versions of Windows
(such as Win2K) where the default permissions on C:\ would allow
any user to create files there.
Credit:  Scott Laurie, MWR InfoSecurity

Version 2.1.2


git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6400 e7ae566f-a301-0410-adde-c780ea21d3b5
Attempt to fix issue where domake-win build system was not properly
signing drivers and .exe files.

Added win/tap_span.py for building multiple versions of the TAP driver
and tapinstall binaries using different DDK versions to span from Win2K
to Win7 and beyond.

Version 2.1.3


git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6404 e7ae566f-a301-0410-adde-c780ea21d3b5
Allow PKCS12 file content to be included inline in configuration file,
rendered as base64.


git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6412 e7ae566f-a301-0410-adde-c780ea21d3b5
Don't configure Linux tun/tap txqueuelen setting if OpenVPN
txqueuelen directive is set to 0.


git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6420 e7ae566f-a301-0410-adde-c780ea21d3b5
Added --proto-force directive.

Version 2.1.3a


git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6424 e7ae566f-a301-0410-adde-c780ea21d3b5
Added mapping files from SVN commit ID to more descriptive commit IDs.

Unfortunately, this will not rewrite the commit history.  So all commits
done by james@e7ae566f-a301-0410-adde-c780ea21d3b5 is James Yonans commits.

It was considered to risky to use git tools to rewrite the commit history, as
it could influence those already using this git tree.
[PATCH] Change verify-cn so cn is no longer hardcoded in openvpn's config file

This patch should be easy to process.
A resubmission of the patch sent to this list on 04/23/2009.

The patch changes the verify-cn script sample
to be used with --tls-verify so that instead of having
to hardcode a cn to verify in the OpenVPN configuration file
the allowed cns may be written into a separate file.

This makes the process of verifying cns a whole
lot more dynamic, to the point where it is useful
in the real world.

One problem with this patch is that it is backwards
incompatible.  I did not bother keeping the original
calling interface as A) it's a sample script, and B) the
original's functionality seems useless
and equalivant functionality is easily available
with the new script.

The problem with the original is that there seems
little point in verifying a client's cn when all
the clients share one cn, as would have to be
the case when the cn is hardcoded into the openvpn
config file.

This patch applies against the testing allmiscs branch,
and should apply against any of the other testing
branches as well.

It works for me.  I've tested it throughly but not
used it extensively in production.

Regards,

Karl <kop@meme.com>

Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
Acked-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Eric F Crist <ecrist@secure-computing.net>
verb 5 logging wrongly reports received bytes

With --verb 5, openvpn logs a single letter (rwRW) for each package
received or sent. I recently ran into a problem with the tun device on
Linux where the read from that device returned 0. Unfortunately this was
also logged as "r", which made me assume that openvpn had received
something, while it actually hadn't.

(See https://dev.openwrt.org/ticket/6650 for the bug that made me find out
about this problem with openvpn.)

I'm attaching a patch which prevents openvpn from logging "r" or "R" when
it didn't actually read anything. This is against openvpn 2.1-rc20, but
probably still applies to the most recent version.

This patch was received anonymously via the sf.net bug tracker:
<http://sourceforge.net/tracker/?func=detail&atid=454719&aid=2951003&group_id=48978>

Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
Acked-by: David Sommerseth <dazo@users.sourceforge.net>
Acked-by: Gert Doering <gert@greenie.muc.de>