Add configure check for the path to systemd-ask-password

Gentoo Linux installs this in /usr/bin by default. Also, the user may
have installed it in /usr/local/bin if building from source.

Acked-by: David Sommerseth <davids@redhat.com>
Message-Id: 1404419045-14728-1-git-send-email-floppym@gentoo.org
URL: http://article.gmane.org/gmane.network.openvpn.devel/8825

Signed-off-by: David Sommerseth <davids@redhat.com>
Don't let openvpn_popen() keep zombies around

Commit 9449e6a9eba30c9ed054f57d630a88c9f087080f introduced the
openvpn_popen() function to support retrieving passwords via systemd.

It was discovered that the child processes openvpn fork()ed would
be lingering around until openvpn stopped.  This was due to the lack
of a wait() call.

This patch also cleans up a few minor white-space issues in the same
code segment.

 [v2 proper initialisation of status variable]

Signed-off-by: David Sommerseth <davids@redhat.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: 1409930731-15263-2-git-send-email-davids@redhat.com
URL: http://article.gmane.org/gmane.network.openvpn.devel/9021
Don't try to use systemd-ask-password if it is not available

If the SYSTEMD_ASK_PASSWORD_PATH executable cannot be found, we
don't consider systemd as running.

[v2 - Don't clean up white-space]

Signed-off-by: David Sommerseth <davids@redhat.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: 20140909202044.GJ1118@greenie.muc.de
URL: http://article.gmane.org/gmane.network.openvpn.devel/9035
Clean up the pipe closing in openvpn_popen()

Do the proper closing of the pipe ends which is not being used,
also in error situations.  Moved the closing of the parent side
before the waitpid(), to be consistent with the child side (as
early as possible).

Also improved the error messages with more details.

[v2 - Don't call close() if execve() fails]

Signed-off-by: David Sommerseth <davids@redhat.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: 20140909202408.GK1118@greenie.muc.de
URL: http://article.gmane.org/gmane.network.openvpn.devel/9036
Remove quadratic complexity from openvpn_base64_decode()

Every four input characters, openvpn_base64_decode called token_decode,
which in turn called strlen() on the remaining input. This means that
base64 decoding in openvpn had quadratic complexity.

All we really need to know is whether the token is complete, so replace
the check to check just that, and make the complexity linear wrt the
input length.

Signed-off-by: Steffan Karger <steffan.karger@fox-it.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <5408494D.7050407@fox-it.com>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9016
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Fix some unintialized variable warnings

Does not actually change behaviour, but fixes compiler warnings
and properly initializing is good habit anyway.

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: David Sommerseth <dazo@users.sourceforge.net>
Message-Id: <1408568426-19601-1-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9003
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Fix clang warning in options.c

fixed warning: expression which evaluates to zero treated as a
null pointer constant of type 'struct addrinfo *'

Seems to be innocent, but clang is correct that this is strange.
init_tun() expects two pointers, but options_string() tried to
feed it two uint32_t values.

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: David Sommerseth <dazo@users.sourceforge.net>
Message-Id: <1408568426-19601-2-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9004
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Fix compiler warnings in ssl_polarssl.c.

No functional changes, just add missing includes and make casts explicit.

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1408396155-9017-1-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8991
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Add systemd unit file for OpenVPN

This is to encourage all Linux distributions to use a unified systemd
unit file.

This unit file also tries to reduce the capabilities of the running
openvpn process.

Signed-off-by: David Sommerseth <davids@redhat.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: 1411030936-16309-1-git-send-email-openvpn.list@topphemmelig.net
URL: http://article.gmane.org/gmane.network.openvpn.devel/9043
ocsp_check - signature verification and cert staus results are separate

when openssl returns result of parsing and verification of the
OCSP response, the signature verification is separate from the certificate
status, as such it's necessary to check both of them.

Otherwise results like:

Response Verify Failure
140170966779776:error:27069076:OCSP routines:OCSP_basic_verify:signer
certificate not found:ocsp_vfy.c:85:
ca/cert.pem: good
        This Update: Sep 23 12:12:28 2014 GMT

will be accepted as being trustworthy.

Note that "Response verify OK" is printed on stderr, so it can't
be discarded.

Signed-off-by: Hubert Kario <hkario@redhat.com>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <1411727041-11884-1-git-send-email-hkario@redhat.com>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9054
Signed-off-by: Gert Doering <gert@greenie.muc.de>
ocsp_check - double check if ocsp didn't report any errors in execution

in case the reposnses are too old, ocsp tool can return text like this:

Response verify OK
ca/cert.pem: WARNING: Status times invalid.
139990703290240:error:2707307D:OCSP routines:OCSP_check_validity:status
expired:ocsp_cl.c:358:
good
        This Update: Sep 21 12:12:48 2014 GMT
        Next Update: Sep 22 12:12:48 2014 GMT

light change in buffering can cause "verify OK" and "ca/cert.pem: good"
to be placed in a way that matching will be valid
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <1411727041-11884-2-git-send-email-hkario@redhat.com>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9055

Signed-off-by: Gert Doering <gert@greenie.muc.de>
systemd: Use systemd functions to consider systemd availability

This is another systemd implementation clean-up.  It was found that
SELinux will block OpenVPN from checking /sys/fs/cgroups.  As OpenVPN
only checked /sys/fs/cgroups and /sys/fs/cgroups/systemd to see if
systemd was available or not, it was considered better to query
systemd directly to see whether or not to query for usernames and
passwords via systemd.

This patch has been compile tested on Fedora 19 and Fedora 21 alpha and
function tested on Fedora 19.

  v2 - Use PKG_CHECK_MODULES() + check for libsystemd before
       libystemd-daemon.  systemd >= 209 use a unified library

Signed-off-by: David Sommerseth <davids@redhat.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1412356567-27125-1-git-send-email-openvpn.list@topphemmelig.net>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9072
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Add documentation for PERSIST_TUN_ACTION (Android specific)

Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1412712650-5173-1-git-send-email-arne@rfc2549.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9090

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Implement --passtos for tagged ethernet frames

This patch makes it possible to use the --passtos option with 802.1Q tagged
ethernet frames.

sf.net tracker:
<https://sourceforge.net/tracker/?func=detail&aid=2829878&group_id=48978&atid=454721>

Discussed on the IRC meeting March 4, 2010 in #openvpn-discussions.
<http://thread.gmane.org/gmane.network.openvpn.devel/3242>

* [PATCH] Implement --passtos for tagged ethernet frames
  - http://thread.gmane.org/gmane.network.openvpn.devel/3165
  - decided to ask for testing help in the mailinglists

This patch will need to be tested in it's own feat_passtos branch.  When testing
has been acceped by the community, it will be merged into the 'allmerged' branch.

Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
is_ipv4(): add packet length check for 802.1Q packets

This patch adds an additional length check to is_ipv4().

Currently is_ipv4() only checks whether the frame is large enough for struct
openvpn_ethhdr. In case of an 802.1Q packet the function now also checks
whether the frame is large enough for struct openvpn_8021qhdr, which is 4 bytes
larger than struct openvpn_ethhdr.

Signed-off-by: Fabian Knittel <fabian.knittel@lettink.de>
vlan: add compile-time option ENABLE_VLAN_TAGGING

The option can be disabled via "./configure --disable-vlan-tagging".

Signed-off-by: Fabian Knittel <fabian.knittel@lettink.de>
vlan: Add global --vlan-accept option

This patch adds the new "--vlan-accept mode" option.  The option is valid
in server mode.  It is set to "raw" by default.

If the option is set to "raw", OpenVPN will operate as before. Frames may
be tagged or untagged and OpenVPN couldn't care less.

If the option is set to "tagged", OpenVPN will assume the tap device
to be in tagged mode, i.e. packets coming in on the device are VLAN-tagged.
Packets going out through the device will be VLAN-tagged likewise. Untagged
packets coming in on the tap device will be dropped.

If the option is set to "untagged", openvpn will assume the packets to be
untagged or priority-tagged. Incoming VLAN-tagged packets will be dropped.

If the option is set to "all", openvpn will accept both VLAN-tagged packets
and untagged or priority-tagged packets.

The option has no immediate effect yet, but will be used by later patches.

Signed-off-by: Fabian Knittel <fabian.knittel@lettink.de>
vlan: Add per-client --vlan-pvid option

This patch adds the new "--vlan-pvid" integer option.  The option is valid
in server mode and can be set in a client context (e.g. from the client-connect
hook).  It defaults to 1.

The value indicates which VID (VLAN identifier) to associate with a client
or (in global context) with the tap device.
It also serves as the Port VLAN Identifier, i.e. the VID to use for incoming
and outgoing untagged or priority-tagged frames.

The client will only receive packets which belong to the same VLAN.

The option has no immediate effect yet, but will be used by later patches.

Signed-off-by: Fabian Knittel <fabian.knittel@lettink.de>
vlan: Prepend and remove VLAN identifiers on outgoing and incoming frames

This patch adds parsing of the IEEE 802.1Q headers for incoming and outgoing
ethernet frames.

For frames coming in from the tap device, the 802.1Q header is parsed and
translated into a regular Ethernet II header.

For frames where the Priority Code Point (PCP) is non-zero, the 802.1Q tagging
isn't removed. Instead, the VID is zeroed out, turning the frame into a
priority frame.

For frames going out over the tap interface, the Ethernet II header is
replaced with a 802.1Q-based header.  PCP and CFI are permanently set to 0,
unless the frame was a priority frame, in which case the values are copied
over.  The VID is set according to the instance's vlan_pvid value (also see
patch adding the "--vlan-pvid" option).

In "--vlan-accept untagged" mode, VLAN-tagged frames coming in from the tap
device are dropped.  Untagged or priority tagged frames are assigned the VID of
the global "--vlan-pvid" setting.  Outgoing frames are sent untagged or
priority-tagged. Outgoing frames are dropped if the VID does not match the
global "--vlan-pvid" setting.

In "--vlan-accept all" mode, VLAN-tagged frames coming in from the tap device
are handled the same way as in the "tagged" mode. Untagged or priority
tagged frames are handled the same was as in "untagged" mode. Outgoing frames
are tagged if they don't match the global tag_pvid value. Otherwise they go
out untagged.

The patch also introduces the log level D_VLAN_DEBUG for debug messages
regarding tagging/untagging.

Signed-off-by: Fabian Knittel <fabian.knittel@lettink.de>
vlan: Add VLAN identifier to mroute_addr for ethernet addresses

This patch appends the VID to the ethernet address in mroute_addr.

By including the VID in mroute_addr, the routing space is divided by VLAN.
This means:
 - duplicate MAC addresses on different VLANs no longer conflict and
 - all unicast-traffic is constrained to whatever VLAN the traffic came
   from (i.e. cross-VLAN unicast routing is no longer possible).

(This patch doesn't take care of broadcast traffic.  Broadcast traffic across
VLANs is still be possible at this point.)

Signed-off-by: Fabian Knittel <fabian.knittel@lettink.de>