Drop too-short control channel packets instead of asserting out.

This fixes a denial-of-service vulnerability where an authenticated client
could stop the server by triggering a server-side ASSERT().

OpenVPN would previously ASSERT() that control channel packets have a
payload of at least 4 bytes. An authenticated client could trigger this
assert by sending a too-short control channel packet to the server.

Thanks to Dragana Damjanovic for reporting the issue.

This bug has been assigned CVE-2014-8104.

Signed-off-by: Steffan Karger <steffan.karger@fox-it.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1CED409804E2164C8104F9E623B08B9018803B0FE7@FOXDFT02.FOX.local>
Signed-off-by: Gert Doering <gert@greenie.muc.de>
autotools: Fix wrong ./configure help screen default values

enable_crypto_ofb_cfb is "yes" by default, so the --help screen
should show --disable-ofb-cfb and not --enable-ofb-cfb.

enable_small and enable_password_save are both "no" by default, so
the --help screen should state "default: no".  Now it says "yes" as
default, but is really disabled in the reality.

Signed-off-by: David Sommerseth <davids@redhat.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1416852578-7581-1-git-send-email-openvpn.list@topphemmelig.net>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9278
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Include systemd units in the source tarball (make dist)

Acked-by: David Sommerseth <davids@redhat.com>
Message-Id: 1417548862-24990-1-git-send-email-floppym@gentoo.org
URL: http://article.gmane.org/gmane.network.openvpn.devel/9299
Signed-off-by: David Sommerseth <davids@redhat.com>
Really fix '--cipher none' regression

... by not incorrectly hinting to the compiler the function argument of
cipher_kt_mode_{cbc,ofb_cfb}() is nonnull, since that no longer is the
case.

Verified the fix on Debian Wheezy, one of the platforms the reporter in
trac #473 mentions with a compiler that would optimize out the required
checks.

Also add a testcase for --cipher none to t_lpback, to prevent further
regressions.

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1417552920-31770-1-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9300
Signed-off-by: Gert Doering <gert@greenie.muc.de>
down-root plugin: Replaced system() calls with execve()

The system() call is prone to shell expansions and provides far more
environments variables to the executable run than what is usually
preferred.  By moving over to exevce() shell expansions are far more
difficult to achieve and only the OpenVPN provided environment
variables are available.

This is a response to the patch submitted to openvpn-devel ML:
http://article.gmane.org/gmane.network.openvpn.devel/7919

 v2 - Pulling it up again, fixing a few whitespace and spelling issues

Signed-off-by: David Sommerseth <davids@redhat.com>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <1416148262-20978-1-git-send-email-openvpn.list@topphemmelig.net>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9238
Signed-off-by: Gert Doering <gert@greenie.muc.de>
down-root: Improve error messages

If down-root fails it will now use warn() to provide some more information
about what went wrong, by retrieving the error message via errno.

Signed-off-by: David Sommerseth <davids@redhat.com>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <1416262460-9158-1-git-send-email-openvpn.list@topphemmelig.net>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9247
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Remove possibility of using --tls-auth with non OpenVPN Static key files

In older version OpenVPN would hash a --tls-auth file
if it does not conform to the expected format
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <1417871704-30273-1-git-send-email-arne@rfc2549.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9306

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Update doxygen (a bit)

This is not a full update, but just updates some data channel-related docs
I came across. Other pages probably need a bit of attention too.

Stuff that was changed:
 * Explain data channel crypto format in crypto.h
 * Add P_DATA_V1 and P_DATA_V2 packet format spec
 * Remove '2.1' from title
 * Update some OpenSSL-specific text

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1417978095-19427-1-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9318
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Add the peer-id to the output of the status command

This adds peer-id to the status output which might help analyze floating
logs. This will change the output of status in the same way commit
662ce6acc065bddf6490b3494725b8b3987b7def did.

Signed-off-by: Lev Stipakov <lstipakov@gmail.com>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: 1418058362-13480-1-git-send-email-lstipakov@gmail.com
URL: http://article.gmane.org/gmane.network.openvpn.devel/9322
Signed-off-by: David Sommerseth <davids@redhat.com>
Prevent memory drain for long lasting floating sessions

For every float event we generate prefix, which allocates 256 + 64
bytes. That memory is reclaimed when client disconnects, so long lasting
and constantly floating sessions drain memory.

As a fix use preallocated buffer inside multi_instance for storing
multi_prefix.

Signed-off-by: Lev Stipakov <lstipakov@gmail.com>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: 1418057325-13265-1-git-send-email-lstipakov@gmail.com
URL: http://article.gmane.org/gmane.network.openvpn.devel/9321
Signed-off-by: David Sommerseth <davids@redhat.com>
plugin, down-root: Fix compiler warnings

Removed a few compiler warnings:
  down-root.c:164:4: warning: implicit declaration of function 'warn'
[-Wimplicit-function-declaration]
  down-root.c:239:5: warning: implicit declaration of function 'err'
[-Wimplicit-function-declaration]
  down-root.c:461:7: warning: unused variable 'i' [-Wunused-variable]
  down-root.c:460:15: warning: unused variable 'p' [-Wunused-variable]

Signed-off-by: David Sommerseth <davids@redhat.com>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: 1418074541-24987-1-git-send-email-openvpn.list@topphemmelig.net
URL: http://article.gmane.org/gmane.network.openvpn.devel/9327