Commit graph

48 commits

Author SHA1 Message Date
adam
25c99e5b54 Changes 2.2.2:
* Only warn about non-tackled IPv6 packets once
* add missing break between "case IPv4" and "case IPv6"
* bump tap driver version from 9.8 to 9.9
* log error message and exit for "win32, tun mode, tap driver version 9.8"
* Backported pkcs11-related parts of 7a8d707237bb18 to 2.2 branch
2012-01-19 13:26:55 +00:00
adam
b5fdfcea72 Fix buildling on Mac OS X 10.7 2011-08-12 09:38:08 +00:00
cheusov
55bb07d579 rc.d script improvements:
- openvpn_chrootdir variable was introduced for running openvpn in chroot
  - openvpn_flags variable was introduced for extra flag passed to openvpn
++pkgrevision
2011-08-03 08:33:32 +00:00
adam
29645d48db Changes 2.2.1:
* Don't define ENABLE_PUSH_PEER_INFO if SSL is not available
* Fix compiling issues with pkcs11 when --disable-management is configured
* Remove support for Linux 2.2 configuration fallback
* Fix compile issues when using --enable-small and
  --disable-ssl/--disable-crypto
* Fix 2.2.0 build failure when management interface disabled
* Added info about --show-proxy-settings
* Documented --x509-username-field option
* Updated "easy-rsa" for OpenSSL 1.0.0
* Fixes to easy-rsa/2.0
* Made domake-win builds to use easy-rsa/2.0/openssl-1.0.0.cnf
* Fix a build-ca issue on Windows
* Fix issues with some older GCC compilers
2011-07-08 10:15:31 +00:00
adam
620b8f615e Changes 2.2.0:
* Several man-page updates
* Several buildsystem fixes
* Fixed a bug with GUI icon deletion on upgrade from 2.2-RC or earlier
* Change the default --tmp-dir path to a more suitable path
* Improve the mysprintf() issue in openvpnserv.c
* Fixed bug in port-share that could cause port share process to crash
* Fix the --client-cert-not-required feature
2011-04-28 07:27:24 +00:00
obache
9ea3b36c23 recursive bump from gettext-lib shlib bump. 2011-04-22 14:40:40 +00:00
adam
571aacd5a9 Changes 2.1.4:
* Fix problem with special case route targets ('remote_host')
  The init_route() function will leave &netlist untouched for
  get_special_addr() routes ("remote_host" being one of them).
  netlist is on stack,  contains random garbage, and
  netlist.len will not be 0 - thus, random stack data is copied from
  netlist.data[] until the route_list is full.
2010-11-30 08:50:17 +00:00
adam
8b26ff69b3 Changes 2.1.3:
* Fixed potential local privilege escalation vulnerability in
  Windows service.
* Added Python-based based alternative build system for Windows using
  Visual Studio 2008 (in win directory).
* When aborting in a non-graceful way, try to execute do_close_tun in
  init.c prior to daemon exit to ensure that the tun/tap interface is
  closed and any added routes are deleted.
* Fixed an issue where AUTH_FAILED was not being properly delivered
  to the client when a bad password is given for mid-session reauth,
  causing the connection to fail without an error indication.
* Don't advance to the next connection profile on AUTH_FAILED errors.
* Fixed an issue in the Management Interface that could cause
  a process hang with 100% CPU utilization in --management-client
  mode if the management interface client disconnected at the
  point where credentials are queried.
* Fixed an issue where if reneg-sec was set to 0 on the client,
  so that the server-side value would take precedence,
  the auth_deferred_expire_window function would incorrectly
  return a window period of 0 seconds.  In this case, the
  correct window period should be the handshake window period.
* Modified ">PASSWORD:Verification Failed" management interface
  notification to include a client reason string:
    >PASSWORD:Verification Failed: 'AUTH_TYPE' ['REASON_STRING']
* Enable exponential backoff in reliability layer retransmits.
* Set socket buffers (SO_SNDBUF and SO_RCVBUF) immediately after
  socket is created rather than waiting until after connect/listen.
* Management interface performance optimizations:
  1. Added env-filter MI command to perform filtering on env vars
     passed through as a part of --management-client-auth
  2. man_write will now try to aggregate output into larger blocks
     (up to 1024 bytes) for more efficient i/o
* Fixed minor issue in Windows TAP driver DEBUG builds
  where non-null-terminated unicode strings were being
  printed incorrectly.
* Fixed issue on Windows with MSVC compiler, where TCP_NODELAY support
  was not being compiled in.
* Proxy improvements:
* Implemented http-proxy-override and http-proxy-fallback directives to make it
  easier for OpenVPN client UIs to start a pre-existing client config file with
  proxy options, or to adaptively fall back to a proxy connection if a direct
  connection fails.
* Implemented a key/value auth channel from client to server.
* Fixed issue where bad creds provided by the management interface
  for HTTP Proxy Basic Authentication would go into an infinite
  retry-fail loop instead of requerying the management interface for
  new creds.
2010-09-05 20:33:48 +00:00
tnn
ba28a3b03a - fix PLIST
- kill some pkglint warnings
2010-06-16 07:30:26 +00:00
sborrill
3019374ba7 Updated to 2.1.1.
Changes:

2009.12.11 -- Version 2.1.1

* Fixed some breakage in openvpn.spec (which is required to build an
  RPM distribution) where it was referencing a non-existent
  subdirectory in the tarball, causing it to fail (patch from
  David Sommerseth).

2009.12.11 -- Version 2.1.0

* Fixed a couple issues in sample plugins auth-pam.c and down-root.c.
  (1) Fail gracefully rather than segfault if calloc returns NULL.
  (2) The openvpn_plugin_abort_v1 function can potentially be called
  with handle == NULL.  Add code to detect this case, and if  so, avoid
  dereferencing pointers derived from handle  (Thanks to David
  Sommerseth for finding this bug).

* Documented "multihome" option in the man page.

2009.11.20 -- Version 2.1_rc22

* Fixed a client-side bug on Windows that occurred when the
  "dhcp-pre-release" or "dhcp-renew" options were combined with
  "route-gateway dhcp".  The release/renew would not occur
  because the Windows DHCP renew function is blocking and
  therefore must be called from another process or thread
  so as not to stall the tunnel.

* Added a hard failure when peer provides a certificate chain
  with depth > 16.  Previously, a warning was issued.
2010-06-15 12:05:28 +00:00
wiz
579796a3e5 Recursive PKGREVISION bump for jpeg update to 8. 2010-01-17 12:02:03 +00:00
manu
de343c006a Update to 2.1rc21. From Changelog:
* Rebuilt OpenVPN Windows installer with OpenSSL 0.9.8l to address
  CVE-2009-3555.  Note that OpenVPN has never relied on the session
  renegotiation capabilities that are built into the SSL/TLS protocol,
  therefore the fix in OpenSSL 0.9.8l (disable SSL/TLS renegotiation
  completely) will not adversely affect OpenVPN mid-session SSL/TLS
  renegotation or any other OpenVPN capabilities.

* Added additional session renegotiation hardening.  OpenVPN has always
  required that mid-session renegotiations build up a new SSL/TLS
  session from scratch.  While the client certificate common name is
  already locked against changes in mid-session TLS renegotiations, we
  now extend this locking to the auth-user-pass username as well as all
  certificate content in the full client certificate chain.
2009-11-18 08:10:15 +00:00
manu
4afe504277 NetBSD's tun driver has no broadcast support. When configured with
a tun device and subnet topology, OpenVPN insisted on setting a broadcast
address on the tun device, causing a fatal error. This patch fixes that,
and has been submitted upstream
2009-11-12 08:41:10 +00:00
manu
d70dc539d4 Add a pam option for the PAM plugin 2009-10-30 19:06:06 +00:00
jmmv
8cf503665c Update to 2.1_rc20 from 2.1_rc13:
2009.10.01 -- Version 2.1_rc20

* Fixed a bug introduced in 2.1_rc17 (svn r4436) where using the
  redirect-gateway option by itself, without any extra parameters,
  would cause the option to be ignored.

* Fixed build problem when ./configure --disable-server is used.

* Fixed ifconfig command for "topology subnet" on FreeBSD (Stefan Bethke).

* Added --remote-random-hostname option.

* Added "load-stats" management interface command to get global server
  load statistics.

* Added new ./configure flags:

  --disable-def-auth      Disable deferred authentication
  --disable-pf            Disable internal packet filter

* Added "setcon" directive for interoperability with SELinux (Sebastien
  Raveau).

* Optimized PUSH_REQUEST handshake sequence to shave several seconds
  off of a typical client connection initiation.

* The maximum number of "route" directives (specified in the config
  file or pulled from a server) can now be configured via the new
  "max-routes" directive.

* Eliminated the limitation on the number of options that can be pushed
  to clients, including routes.  Previously, all pushed options needed
  to fit within a 1024 byte options string.

* Added --server-poll-timeout option : when polling possible remote
  servers to connect to in a round-robin fashion, spend no more than
  n seconds waiting for a response before trying the next server.

* Added the ability for the server to provide a custom reason string
  when an AUTH_FAILED message is returned to the client.  This
  string can be set by the server-side managment interface and read
  by the client-side management interface.

* client-kill management interface command, when issued on server, will
  now send a RESTART message to client.
  This feature is intended to make UDP clients respond the same as TCP
  clients in the case where the server issues a RESTART message in
  order to force the client to reconnect and pull a new options/route
  list.

2009.07.16 -- Version 2.1_rc19

* In Windows TAP driver, refactor DHCP/ARP packet injection code to
  use a DPC (deferred procedure call) to defer packet injection until
  IRQL < DISPATCH_LEVEL, rather than calling NdisMEthIndicateReceive
  in the context of AdapterTransmit.  This is an attempt to reduce kernel
  stack usage, and prevent EXCEPTION_DOUBLE_FAULT BSODs that have been
  observed on Vista.  Updated TAP driver version number to 9.6.

* In configure.ac, use datadir instead of datarootdir for compatibility
  with <autoconf-2.60.

2009.06.07 -- Version 2.1_rc18

* Fixed compile error on ./configure --enable-small

* Fixed issue introduced in r4475 (2.1-rc17) where cryptoapi.c change
  does not build on Windows on non-MINGW32.

2009.05.30 -- Version 2.1_rc17

* Reduce the debug level (--verb) at which received management interface
  commands are echoed from 7 to 3.  Passwords will be filtered.

* Fixed race condition in management interface recv code on
  Windows, where sending a set of several commands to the
  management interface in quick succession might cause the
  latter commands in the set to be ignored.

* Increased management interface input command buffer size
  from 256 to 1024 bytes.

* Minor tweaks to Windows build system.

* Added "redirect-private" option which allows private subnets
  to be pushed to the client in such a way that they don't accidently
  obscure critical local addresses such as the DHCP server address and
  DNS server addresses.

* Added new 'autolocal' redirect-gateway flag.  When enabled, the OpenVPN
  client will examine the routing table and determine whether (a) the
  OpenVPN server is reachable via a locally connected interface, or (b)
  traffic to the server must be forwarded through the default router.
  Only add a special bypass route for the OpenVPN server if (b) is true.
  If (a) is true, behave as if the 'local' flag is specified, and do not
  add a bypass route.

  The new 'autolocal' flag depends on the non-portable test_local_addr()
  function in route.c, which is currently only implemented for Windows.
  The 'autolocal' flag will act as a no-op on platforms that have not
  yet defined a test_local_addr() function.

* Increased TLS_CHANNEL_BUF_SIZE to 2048 from 1024 (this will allow for
  more option content to be pushed from server to client).

* Raised D_MULTI_DROPPED debug level to 4 from 3 to filter out (at debug
  levels <=3) a common and usually innocuous warning.

* Fixed issue of symbol conflicts interfering with Windows CryptoAPI
  functionality (Alon Bar-Lev).

* Fixed bug where the remote_X environmental variables were not being
  set correctly when the 'local' option is specifed.

2009.05.17 -- Version 2.1_rc16

* Windows installer changes:

  1. ifdefed out the check Windows version code which is causing
  problems on Windows 7

  2. don't define SF_SELECTED if it is already defined

  3. Use LZMA instead of BZIP2 compression for better compression

  4. Upgraded OpenSSL to 0.9.8k

* Added the ability to read the configuration file
  from stdin, when "stdin" is given as the config
  file name.

* Allow "management-client" directive to be used
  with unix domain sockets.

* Added errors-to-stderr option.  When enabled, fatal errors
  that result in the termination of the daemon will be written
  to stderr.

* Added optional "nogw" (no gateway) flag to --server-bridge
  to inhibit the pushing of the route-gateway parameter to
  clients.

* Added new management interface command "pid" to show the
  process ID of the current OpenVPN process (Angelo Laub).

* Fixed issue where SIGUSR1 restarts would fail if private
  key was specified as an inline file.

* Added daemon_start_time and daemon_pid environmental variables.

* In management interface, added new ">CLIENT:ESTABLISHED" notification.

* Build fixes:

  1. Fixed some issues with C++ style comments that leaked into the code.

  2. Updated configure.ac to work on MinGW64.

  3. Updated common.h types for _WIN64.

  4. Fixed issue involving an #ifdef in a macro reference that breaks early gcc
     compilers.

  5. In cryptoapi.c, renamed CryptAcquireCertificatePrivateKey to
     OpenVPNCryptAcquireCertificatePrivateKey to work around
     a symbol conflict in MinGW-5.1.4.

2008.11.19 -- Version 2.1_rc15

* Fixed issue introduced in 2.1_rc14 that may cause a
  segfault when a --plugin module is used.

* Added server-side --opt-verify option: clients that connect
  with options that are incompatible with those of the server
  will be disconnected (without this option, incompatible
  clients would trigger a warning message in the server log
  but would not be disconnected).

* Added --tcp-nodelay option: Macro that sets TCP_NODELAY socket
  flag on the server as well as pushes it to connecting clients.

* Minor options check fix: --no-name-remapping is a
  server-only option and should therefore generate an
  error when used on the client.

* Added --prng option to control PRNG (pseudo-random
  number generator) parameters.  In previous OpenVPN
  versions, the PRNG was hardcoded to use the SHA1
  hash.  Now any OpenSSL hash may be used.  This is
  part of an effort to remove hardcoded references to
  a specific cipher or cryptographic hash algorithm.

* Cleaned up man page synopsis.

2008.11.16 -- Version 2.1_rc14

* Added AC_GNU_SOURCE to configure.ac to enable struct ucred,
  with the goal of fixing a build issue on Fedora 9 that was
  introduced in 2.1_rc13.

* Added additional method parameter to --script-security to preserve
  backward compatibility with system() call semantics used in OpenVPN
  2.1_rc8 and earlier.  To preserve backward compatibility use:

    script-security 3 system

* Added additional warning messages about --script-security 2
  or higher being required to execute user-defined scripts or
  executables.

* Windows build system changes:

  Modified Windows domake-win build system to write all openvpn.nsi
  input files to gen, so that gen can be disconnected from
  the rest of the source tree and makensis openvpn.nsi will
  still function correctly.

  Added additional SAMPCONF_(CA|CRT|KEY) macros to settings.in
  (commented out by default).

  Added optional files SAMPCONF_CONF2 (second sample configuration
  file) and SAMPCONF_DH (Diffie-Helman parameters) to Windows
  build system, and may be defined in settings.in.

* Extended Management Interface "bytecount" command
  to work when OpenVPN is running as a server.
  Documented Management Interface "bytecount" command in
  management/management-notes.txt.

* Fixed informational message in ssl.c to properly indicate
  deferred authentication.

* Added server-side --auth-user-pass-optional directive, to allow
  connections by clients that do not specify a username/password, when a
  user-defined authentication script/module is in place (via
  --auth-user-pass-verify, --management-client-auth, or a plugin module).

* Changes to easy-rsa/2.0/pkitool and related openssl.cnf:

  Calling scripts can set the KEY_NAME environmental variable to set
  the "name" X509 subject field in generated certificates.

  Modified pkitool to allow flexibility in separating the Common Name
  convention from the cert/key filename convention.

  For example:

  KEY_CN="James's Laptop" KEY_NAME="james" ./pkitool james

  will create a client certificate/key pair of james.crt/james.key
  having a Common Name of "James's Laptop" and a Name of "james".

* Added --no-name-remapping option to allow Common Name, X509 Subject,
  and username strings to include any printable character including
  space, but excluding control characters such as tab, newline, and
  carriage-return (this is important for compatibility with external
  authentication systems).

  As a related change, added --status-version 3 format (and "status 3"
  in the management interface) which uses the version 2 format except
  that tabs are used as delimiters instead of commas so that there
  is no ambiguity when parsing a Common Name that contains a comma.

  Also, save X509 Subject fields to environment, using the naming
  convention:

  X509_{cert_depth}_{name}={value}

  This is to avoid ambiguities when parsing out the X509 subject string
  since "/" characters could potentially be used in the common name.

* Fixed some ifconfig-pool issues that precluded it from being combined
  with --server directive.

  Now, for example, we can configure thusly:

    server 10.8.0.0 255.255.255.0 nopool
    ifconfig-pool 10.8.0.2 10.8.0.99 255.255.255.0

  to have ifconfig-pool manage only a subset
  of the VPN subnet.

* Added config file option "setenv FORWARD_COMPATIBLE 1" to relax
  config file syntax checking to allow directives for future OpenVPN
  versions to be ignored.
2009-10-11 17:32:00 +00:00
spz
fa36e46c3f add an option to openvpn to enable using certificates on USB sticks
or cards (etc) that are using the PKCS11 protocol
2009-09-21 12:33:31 +00:00
joerg
62d1ba2bac Remove @dirrm entries from PLISTs 2009-06-14 18:03:28 +00:00
wiz
60f460ab01 Use standard location for LICENSE line (in MAINTAINER/HOMEPAGE/COMMENT
block). Uncomment some commented out LICENSE lines while here.
2009-05-19 08:59:00 +00:00
hasso
d7adb762c0 Make it work on DragonFly 2.0 and up. Bump PKGREVISION. 2008-12-05 08:13:35 +00:00
wiz
2e4d9b2a72 Do not unnecessarily create share/doc/openvpn, and remove it from PLIST.
It wasn't created when installing the binary package.

Bump PKGREVISION.
2008-11-23 15:16:42 +00:00
sborrill
8e7c555061 Update to 2.1rc13. Changes include:
2008.10.07 -- Version 2.1_rc13

* Bundled OpenSSL 0.9.8i with Windows installer.

* Management interface can now listen on a unix
  domain socket, for example:

    management /tmp/openvpn unix

  Also added management-client-user and management-client-group
  directives to control which processes are allowed to connect
  to the socket.

* Copyright change to OpenVPN Technologies, Inc.

2008.09.23 -- Version 2.1_rc12

* Patched Makefile.am so that the new t_cltsrv-down.sh script becomes
  part of the tarball (Matthias Andree).

* Fixed --lladdr bug introduced in 2.1-rc9 where input validation code
  was incorrectly expecting the lladdr parameter to be an IP address
  when it is actually a MAC address (HoverHell).

2008.09.14 -- Version 2.1_rc11

* Fixed a bug that can cause SSL/TLS negotiations in UDP mode
  to fail if UDP packets are dropped.

2008.09.10 -- Version 2.1_rc10

* Added "--server-bridge" (without parameters) to enable
  DHCP proxy mode:  Configure server mode for ethernet
  bridging using a DHCP-proxy, where clients talk to the
  OpenVPN server-side DHCP server to receive their IP address
  allocation and DNS server addresses.

* Added "--route-gateway dhcp", to enable the extraction
  of the gateway address from a DHCP negotiation with the
  OpenVPN server-side LAN.

* Fixed minor issue with --redirect-gateway bypass-dhcp or bypass-dns
  on Windows.  If the bypass IP address is 0.0.0.0 or 255.255.255.255,
  ignore it.

* Warn when ethernet bridging that the IP address of the bridge adapter
  is probably not the same address that the LAN adapter was set to
  previously.

* When running as a server, warn if the LAN network address is
  the all-popular 192.168.[0|1].x, since this condition commonly
  leads to subnet conflicts down the road.

* Primarily on the client, check for subnet conflicts between
  the local LAN and the VPN subnet.

* Added a 'netmask' parameter to get_default_gateway, to return
  the netmask of the adapter containing the default gateway.
  Only implemented on Windows so far.  Other platforms will
  return 255.255.255.0.  Currently the netmask information is
  only used to warn about subnet conflicts.

* Minor fix to cryptoapi.c to not compile itself unless USE_CRYPTO
  and USE_SSL flags are enabled (Alon Bar-Lev).

* Updated openvpn/t_cltsrv.sh (used by "make check") to conform to new
  --script-security rules.  Also adds retrying if the addresses are in
  use (Matthias Andree).

* Fixed build issue with ./configure --disable-socks --disable-http.

* Fixed separate compile errors in options.c and ntlm.c that occur
  on strict C compilers (such as old versions of gcc) that require
  that C variable declarations occur at the start of a {} block,
  not in the middle.

* Workaround bug in OpenSSL 0.9.6b ASN1_STRING_to_UTF8, which
  the new implementation of extract_x509_field_ssl depends on.

* LZO compression buffer overflow errors will now invalidate
  the packet rather than trigger a fatal assertion.

* Fixed minor compile issue in ntlm.c (mid-block declaration).

* Added --allow-pull-fqdn option which allows client to pull DNS names
  from server (rather than only IP address) for --ifconfig, --route, and
  --route-gateway.  OpenVPN versions 2.1_rc7 and earlier allowed DNS names
  for these options to be pulled and translated to IP addresses by default.
  Now --allow-pull-fqdn will be explicitly required on the client to enable
  DNS-name-to-IP-address translation of pulled options.

* 2.1_rc8 and earlier did implicit shell expansion on script
  arguments since all scripts were called by system().
  The security hardening changes made to 2.1_rc9 no longer
  use system(), but rather use the safer execve or CreateProcess
  system calls.  The security hardening also introduced a
  backward incompatibility with 2.1_rc8 and earlier in that
  script parameters were no longer shell-expanded, so
  for example:

    client-connect "docc CLIENT-CONNECT"

  would fail to work because execve would try to execute
  a script called "docc CLIENT-CONNECT" instead of "docc"
  with "CLIENT-CONNECT" as the first argument.

  This patch fixes the issue, bringing the script argument
  semantics back to pre 2.1_rc9 behavior in order to preserve
  backward compatibility while still using execve or CreateProcess
  to execute the script/executable.

* Modified ip_or_dns_addr_safe, which validates pulled DNS names,
  to more closely conform to RFC 3696:

  (1) DNS name length must not exceed 255 characters

  (2) DNS name characters must be limited to alphanumeric,
      dash ('-'), and dot ('.')

* Fixed bug in intra-session TLS key rollover that was introduced with
  deferred authentication features in 2.1_rc8.

008.07.31 -- Version 2.1_rc9

* Security Fix -- affects non-Windows OpenVPN clients running
  OpenVPN 2.1-beta14 through 2.1-rc8 (OpenVPN 2.0.x clients are NOT
  vulnerable nor are any versions of the OpenVPN server vulnerable).
  An OpenVPN client connecting to a malicious or compromised
  server could potentially receive an "lladdr" or "iproute" configuration
  directive from the server which could cause arbitrary code execution on
  the client. A successful attack requires that (a) the client has agreed
  to allow the server to push configuration directives to it by including
  "pull" or the macro "client" in its configuration file, (b) the client
  succesfully authenticates the server, (c) the server is malicious or has
  been compromised and is under the control of the attacker, and (d) the
  client is running a non-Windows OS.  Credit: David Wagner.

* Miscellaneous defensive programming changes to multiple
  areas of the code.  In particular, use of the system() call
  for calling executables such as ifconfig, route, and
  user-defined scripts has been completely revamped in favor
  of execve() on unix and CreateProcess() on Windows.

* In Windows build, package a statically linked openssl.exe to work around
  observed instabilities in the dynamic build since the migration to
  OpenSSL 0.9.8h.

2008.06.11 -- Version 2.1_rc8

* Added client authentication and packet filtering capability
  to management interface.  In addition, allow OpenVPN plugins
  to take advantage of deferred authentication and packet
  filtering capability.

* Added support for client-side connection profiles.

* Fixed unbounded memory growth bug in environmental variable
  code that could have caused long-running OpenVPN sessions
  with many TLS renegotiations to incrementally
  increase memory usage over time.

* Windows release now packages openssl-0.9.8h.

* Build system changes -- allow building on Windows using
  autoconf/automake scripts (Alon Bar-Lev).

* Changes to Windows build system to make it easier to do
  partial builds, with a reduced set of prerequisites,
  where only a subset of OpenVPN installer
  components are built.  See ./domake-win comments.

* Cleanup IP address for persistence interfaces for tap and also
  using ifconfig, gentoo#209055 (Alon Bar-Lev).

* Fall back to old version of extract_x509_field for OpenSSL 0.9.6.

* Clarified tcp-queue-limit man page entry (Matti Linnanvuori).

* Added new OpenVPN icon and installer graphic.

* Minor pkitool changes.

* Added --pkcs11-id-management option, which will cause OpenVPN to
  query the management interface via the new NEED-STR asynchronous
  notification query to get additional PKCS#11 options (Alon Bar-Lev).

* Added NEED-STR management interface asynchronous query and
  "needstr" management interface command to respond to the query
  (Alon Bar-Lev).

* Added Dragonfly BSD support (Francis-Gudin).

* Quote device names before passing to up/down script (Josh Cepek).

* Bracketed struct openvpn_pktinfo with #pragma pack(1) to
  prevent structure padding from causing an incorrect length
  to be returned by sizeof (struct openvpn_pktinfo) on 64-bit
  platforms.

* On systems that support res_init, always call it
  before calling gethostbyname to ensure that
  resolver configuration state is current.

* Added NTLMv2 proxy support (Miroslav Zajic).

* Fixed an issue in extract_x509_field_ssl where the extraction
  would fail on the first field of the subject name, such as
  the common name in:  /CN=foo/emailAddress=
 foo@bar.comThis e-mail address is being protected from spambots. You need
JavaScript enabled to view it


* Made "Linux ip addr del failed" error nonfatal.

* Amplified --client-cert-not-required warning.

* Added #pragma pack to proto.h.
2008-10-09 10:57:23 +00:00
jlam
0d30e66b3f + Add full DESTDIR support.
+ Replace unnecessary /bin/bash in easy-rsa scripts with /bin/sh.

Bump the PKGREVISION to 1.
2008-02-20 04:24:17 +00:00
martti
86ad3952a8 Updated net/openvpn to 2.1rc7
* Added a few extra files that exist in the svn repo but were
  not being copied into the tarball by make dist.

* Fixup null interface on close, don't use ip addr flush (Alon Bar-Lev).

* Fixed options checking bug introduced in rc5 where legitimate configuration
  files might elicit the error: "Options error: Parameter pkcs11_private_mode
  can only be specified in TLS-mode, i.e. where --tls-server or --tls-client
  is also specified."

* Added "forget-passwords" command to the management interface
  (Alon Bar-Lev).

* Added --management-signal option to signal SIGUSR1 when the
  management interface disconnects (Alon Bar-Lev).

* Modified command line and config file parser to allow
  quoted strings using single quotes ('') (Alon Bar-Lev).

* Use pkcs11-helper as external library, can be downloaded from
  https://www.opensc-project.org/pkcs11-helper (Alon Bar-Lev).

* Fixed interim memory growth issue in TCP connect loop where
  "TCP: connect to %s failed, will try again in %d seconds: %s"
  is output.

* Fixed bug in epoll driver in event.c, where the lack of a
  handler for EPOLLHUP could cause 99% CPU usage.

* Defined ALLOW_NON_CBC_CIPHERS for people who don't
  want to use a CBC cipher for OpenVPN's data channel.

* Added PLUGIN_LIBDIR preprocessor string to prepend a default
  plugin directory to the dlopen search list when the user
  specifies the basename of the plugin only (Marius Tomaschewski).

* Rewrote extract_x509_field and modified COMMON_NAME_CHAR_CLASS
  to allow forward slash characters ("/") in the X509 common name
  (Pavel Shramov).

* Allow OpenVPN to run completely unprivileged under Linux
  by allowing openvpn --mktun to be used with --user and --group
  to set the UID/GID of the tun device node.  Also added --iproute
  option to allow an alternative command to be executed in place
  of the default iproute2 command (Alon Bar-Lev).

* Fixed --disable-iproute2 in ./configure to actually disable
  iproute2 usage (Alon Bar-Lev).

* Added --management-forget-disconnect option -- forget
  passwords when management session disconnects (Alon Bar-Lev).
2008-02-13 12:07:24 +00:00
tnn
ad6ceadd25 Per the process outlined in revbump(1), perform a recursive revbump
on packages that are affected by the switch from the openssl 0.9.7
branch to the 0.9.8 branch. ok jlam@
2008-01-18 05:06:18 +00:00
tnn
f23875c078 Merge Solaris tap support patch for OpenVPN by "Kazuyoshi". 2007-07-01 15:40:05 +00:00
tnn
a430ce03d6 On SunOS, depend on net/solaris-tap to get the <net/if_tun.h> header. 2007-07-01 01:11:38 +00:00
jlam
073181c3cc Update net/openvpn to 2.1rc4. Changes from version 2.1rc2 include:
* Fixed 64-bit portability bug in time_string function
  (Thomas Habets).

* Clean up configure on FreeBSD for recent autotool versions
  that require that all .h files have to be compiled.
  Also, FreeBSD install does not support GNU long options
  which the Makefile in easy-rsa/2.0 uses (not checked the
  others as we don't install those on Gentoo) (Roy Marples).
2007-06-21 21:44:42 +00:00
sborrill
96ed53fb4b Update to 2.1rc2. Mainly bug fixes and improvements to management interface 2007-02-28 11:06:21 +00:00
sborrill
ef2197e057 Update to 2.1_rc1. Many, many improvements including:
Added optional minimum-number-of-bytes parameter to --inactive directive.
Added --route-metric option to set a default route metric for --route
Added --lladdr option to specify the link layer (MAC) address
  for the tap interface on non-Windows platforms
Security Vulnerability CVE-2006-1629
Extended tun device configure code to support ethernet bridging on NetBSD
Added --port-share option for allowing OpenVPN and HTTPS
  server to share the same port number.
Added --management-client option to connect as a client to management GUI app
  rather than be connected to as a server.
Added "bytecount" command to management interface.
Added --connect-timeout option to control the timeout on TCP client
  connection attempts (doesn't work on all OSes).  This patch also
  makes OpenVPN signalable during TCP connection attempts.
Allow ca, cert, key, and dh files to be specified inline via XML-like syntax
  without needing to reference an explicit file.
Allow plugin and push directives to have multi-line parameter lists
Added connect-retry-max option
Added a backtrack-hardened system time algorithm.
Added --remote-cert-ku, --remote-cert-eku, and
  --remote-cert-tls options for verifying certificate attributes
Added PKCS#11 support
Added --bind option for TCP client connections
Made LZO setting pushable

Plus numerous bug fixes.
2007-02-20 09:40:49 +00:00
jlam
9f7c0b26c9 Update net/openvpn to 2.0.7. Changes from version 2.0.6 include fixing
a Windows bug with 64bit counters which could cause intermittent
crashes.
2006-07-05 15:50:05 +00:00
jlam
97c35ccfe0 Add support for NetBSD's cloning tap device to support "device tap"
configurations.  Changes supplied in PR pkg/32929 by Alan Barrett.
Bump PKGREVISION to 1.
2006-04-11 20:09:52 +00:00
jlam
e558d1450c Update net/openvpn to 2.0.6. Changes from version 2.0.5 include:
* [security] An OpenVPN client connecting to a malicious or compromised
  server could potentially receive "setenv" configuration directives
  from the server which could cause arbitrary code execution on the
  client via a LD_PRELOAD attack.  A successful attack appears to
  require that (a) the client has agreed to allow the server to push
  configuration directives to it by including "pull" or the macro
  "client" in its configuration file, (b) the client configuration
  file uses a scripting directive such as "up" or "down", (c) the
  client succesfully authenticates the server, (d) the server is
  malicious or has been compromised and is under the control of the
  attacker, and (e) the attacker has at least some level of pre-existing
  control over files on the client (this might be accomplished by
  having the server respond to a client web request with a specially
  crafted file).  The fix is to disallow "setenv" to be pushed to
  clients from the server.  For those who need this capability, OpenVPN
  2.1 supports a new "setenv-safe" directive which is free of this
  vulnerability.

* When deleting routes under Linux, use the route metric as a
  differentiator to ensure that the route teardown process only deletes
  the identical route which was originally added via the "route"
  directive (Roy Marples).

* Fix the t_cltsrv.sh file in FreeBSD 4 jails (Matthias Andree, Dirk
  Meyer, Vasil Dimov).

* Extended tun device configure code to support ethernet bridging on
  NetBSD (Emmanuel Kasper).
2006-04-05 13:49:26 +00:00
jlam
9c8b5ede43 Point MAINTAINER to pkgsrc-users@NetBSD.org in the case where no
developer is officially maintaining the package.

The rationale for changing this from "tech-pkg" to "pkgsrc-users" is
that it implies that any user can try to maintain the package (by
submitting patches to the mailing list).  Since the folks most likely
to care about the package are the folks that want to use it or are
already using it, this would leverage the energy of users who aren't
developers.
2006-03-04 21:28:51 +00:00
jlam
dc9594e09d Remove USE_PKGINSTALL from pkgsrc now that mk/install/pkginstall.mk
automatically detects whether we want the pkginstall machinery to be
used by the package Makefile.
2005-12-29 06:21:30 +00:00
rillig
579e977969 Ran "pkglint --autofix", which corrected some of the quoting issues in
CONFIGURE_ARGS.
2005-12-05 23:55:01 +00:00
rillig
b71a1d488b Fixed pkglint warnings. The warnings are mostly quoting issues, for
example MAKE_ENV+=FOO=${BAR} is changed to MAKE_ENV+=FOO=${BAR:Q}. Some
other changes are outlined in

    http://mail-index.netbsd.org/tech-pkg/2005/12/02/0034.html
2005-12-05 20:49:47 +00:00
salo
db2f0dee9b Security update to version 2.0.5.
Changes:

2.0.5:
======
- Fixed bug in Linux get_default_gateway function
  introduced in 2.0.4, which would cause redirect-gateway
  on Linux clients to fail.
- Restored easy-rsa/2.0 tree (backported from 2.1 beta
  series) which accidentally disappeared in
  2.0.2 -> 2.0.4 transition.

2.0.4:
======
- Security fix -- Affects non-Windows OpenVPN clients of
  version 2.0 or higher which connect to a malicious or
  compromised server.  A format string vulnerability
  in the foreign_option function in options.c could
  potentially allow a malicious or compromised server
  to execute arbitrary code on the client.  Only
  non-Windows clients are affected.  The vulnerability
  only exists if (a) the client's TLS negotiation with
  the server succeeds, (b) the server is malicious or
  has been compromised such that it is configured to
  push a maliciously crafted options string to the client,
  and (c) the client indicates its willingness to accept
  pushed options from the server by having "pull" or
  "client" in its configuration file (Credit: Vade79).
  CVE-2005-3393
- Security fix -- Potential DoS vulnerability on the
  server in TCP mode.  If the TCP server accept() call
  returns an error status, the resulting exception handler
  may attempt to indirect through a NULL pointer, causing
  a segfault.  Affects all OpenVPN 2.0 versions.
  CVE-2005-3409
- Fix attempt of assertion at multi.c:1586 (note that
  this precise line number will vary across different
  versions of OpenVPN).
- Added ".PHONY: plugin" to Makefile.am to work around
  "make dist" issue.
- Fixed double fork issue that occurs when --management-hold
  is used.
- Moved TUN/TAP read/write log messages from --verb 8 to 6.
- Warn when multiple clients having the same common name or
  username usurp each other when --duplicate-cn is not used.
- Modified Windows and Linux versions of get_default_gateway
  to return the route with the smallest metric
  if multiple 0.0.0.0/0.0.0.0 entries are present.

2.0.3:
======
- openvpn_plugin_abort_v1 function wasn't being properly
  registered on Windows.
- Fixed a bug where --mode server --proto tcp-server --cipher none
  operation could cause tunnel packet truncation.
2005-11-03 14:31:19 +00:00
jlam
6e81adebc0 Add a "reset" action to the openvpn rc.d script which triggers a
SIGUSR1 reset of the openvpn process.  This is useful for simplifying
dhclient-exit-hooks hook scripts that need to tell the openvpn process
to reset and re-run its "up" script.

Bump the PKGREVISION of net/openvpn to 1.
2005-09-18 03:11:39 +00:00
jlam
0078530d42 Update net/openvpn to 2.0.2. Changes from version 2.0.1 include:
* Fixed bug in route.c in FreeBSD, Darwin, OpenBSD and NetBSD
  version of get_default_gateway.  Allocated socket for route
  manipulation is never freed so number of mbufs continuously
  grow and exhaust system resources after a while (Jaroslav Klaus).

* Fixed bug where "--proto tcp-server --mode p2p --management
  host port" would cause the management port to not respond until
  the OpenVPN peer connects.
2005-09-01 03:40:42 +00:00
jlam
1a1e916c52 Update net/openvpn to version 2.0.1. Major changes from version 1.6.0
include:

    Adding a highly scalable server for handling multiple TCP/UDP
    clients over point-to-point TUN interfaces, all using a single
    port number.  The server has been designed so that it can run with
    reduced privilege.

    On the client side, "pull" has been added, which basically says
    "accept certain config file options which the server pushes back
    to you." The major win of the push/pull capability is that the
    same client configuration file can be used on each client provided
    each client has its own set of SSL/TLS keys which have been signed
    by the master CA.

    A management interface has been developed which can be used to
    remotely control or centrally manage an OpenVPN daemon.

    "remote" can now specify a set of machines, or a hostname can be
    configured with multiple addresses in DNS.  A server will be
    randomly chosen from the list, and if the connect fails, another
    will be tried (see the "remote-random" option)

    A package for easy RSA key management (easy-rsa-2.0rc1) has been
    included to aid in generating SSL keys and certificates for use
    with OpenVPN.
2005-08-17 19:55:57 +00:00
tv
f816d81489 Remove USE_BUILDLINK3 and NO_BUILDLINK; these are no longer used. 2005-04-11 21:44:48 +00:00
agc
b12d62efb5 Add RMD160 digests. 2005-02-24 12:13:41 +00:00
bad
6884c89897 Update openvpn to 1.6.0.
While here port it properly so that the route statements in the configuration
file work.  Also add patches so that der Mouse's if_tap driver can be used.

Changes since 1.5.0:

2004.05.09 -- Version 1.6.0

* Unchanged from 1.6-rc4 except for version number
  upgrade.

2004.04.01 -- Version 1.6-rc4

* Made minor customizations to devcon and
  renamed as tapinstall.exe for Windows version.
* Fixed "storage size of `iv' isn't known" build
  problem on FreeBSD.
* OpenSSL 0.9.7d bundled with Windows self-install.

2004.03.13 -- Version 1.6-rc3

* Minor Windows fixes for --ip-win32 dynamic, relating to
  the way the TAP-Win32 driver responds to a DHCP request
  from the Windows DHCP client.
* The net_gateway environmental variable wasn't being
  set correctly for called scripts (Paul Zuber).
* Added code to determine the default gateway on FreeBSD,
  allowing the --redirect-gateway option to work
  (Juan Rodriguez Hervella).

2004.03.04 -- Version 1.6-rc2

* Fixed bug in Windows version where the NetBIOS node-type
  DHCP option might have been passed even if it was not
  specified.
* Fixed bug in Windows version introduced in 1.6-rc1, where
  DHCP timeout would be set to 0 seconds if --ifconfig option
  was used and --ip-win32 option was not explicitly specified.
* Added some new --dhcp-option types for Windows version.

2004.03.02 -- Version 1.6-rc1

* For Windows, make "--ip-win32 dynamic" the default.
* For Windows, make "--route-delay 10" the default
  unless --ip-win32 dynamic is not used or --route-delay
  is explicitly specified.
* L_TLS mutex could have been left in a locked state
  for certain kinds of TLS errors.

2004.02.22 -- Version 1.6-beta7

* Allow scheduling priority increase (--nice) together
  with UID/GID downgrade (--user/--group).
* Code that causes SIGUSR1 restart on TLS errors in TCP
  mode was not activated in pthread builds.
* Save the certificate serial number in an environmental
  variable called tls_serial_{n} prior to calling the
  --tls-verify script.  n is the current cert chain level.
* Added NetBSD IPv6 tunnel capability (also requires
  a kernel patch) (Horst Laschinsky).
* Fixed bug in checking the return value of the nice()
  function (Ian Pilcher).
* Bug fix in new FreeBSD IPv6 over TUN code which was
  originally added in 1.6-beta5 (Nathanael Rensen).
* More Socks5 fixes -- extended the struct frame
  infrastructure to accomodate proxy-based encapsulation
  overhead.
* Added --dhcp-option to Windows version for setting
  adapter properties such as WINS & DNS servers.
* Use a default route-delay of 5 seconds when
  --ip-win32 dynamic is specified (only applicable when
  --route-delay is not explicitly specified).
* Added "log_append" registry variable to control
  whether the OpenVPN service wrapper on Windows
  opens log files in append (log_append="1") or
  truncate (log_append="0") mode.  The default
  is truncate.

2004.02.05 -- Version 1.6-beta6

* UDP over Socks5 fix to accomodate Socks5 encapsulation
  overhead (Christof Meerwald).
* Minor --ip-win32 dynamic tweaks (use long lease time,
  invalidate existing lease with DHCPNAK).

2004.02.01 -- Version 1.6-beta5

* Added Socks5 proxy support (Christof Meerwald).
* IPv6 tun support for FreeBSD (Thomas Glanzmann).
* Special TAP-Win32 debug mode for Windows self-install that was
  enabled in beta4 is now turned off.
* Added some new Solaris notes to INSTALL (Koen Maris).
* More work on --ip-win32 dynamic.

2004.01.27 -- Version 1.6-beta4

* For this beta, the Windows self-install is a debug version
  and will run slower -- use only for testing.
* Reverted the --ip-win32 default back to 'ipapi'
  from 'dynamic'.
* Added the offset parameter to '--ip-win32 dynamic' which
  can be used to control the address of the masqueraded
  DHCP server which replies to Windows DHCP requests.
* Added a wait/nowait option to --inetd (nowait can only
  be used with TCP sockets, TLS authentication, and over
  a bridged configuration -- see FAQ for more info)
  (Stefan `Sec` Zehl).
* Added a build-time capability where TAP-Win32 driver
  debug messages can be output by OpenVPN at --verb 6
  or higher.

2004.01.20 -- Version 1.6-beta2

* Added ./configure --enable-iproute2 flag which
  uses iproute2 instead of route + ifconfig --
  this is necessary for the LEAF Linux distro
  (Martin Hejl).
* Added renewal-time and rebind-time to set of
  DHCP options returned by the TAP-Win32 driver when
  "--ip-win32 dynamic" is used.

2004.01.14 -- Version 1.6-beta1

* Fixed --proxy bug that sometimes caused plaintext
  control info generated by the proxy prior to http
  CONNECT method establishment to be incorrectly
  parsed as OpenVPN data.
* For Windows version, implemented the
  "--ip-win32 dynamic" method and made it the default.
  This method sets the TAP-Win32 adapter IP address
  and netmask by replying to the kernel's DHCP queries.
  See the man page for more detailed info.
* Added --connect-retry parameter which controls
  the time interval (in seconds) between connect()
  retries when --proto tcp-client is used.  Previously,
  this value was hardcoded to 5 seconds, and still
  defaults as such.
* --resolv-retry can now be used with a parameter
  of "infinite" to retry indefinitely.
* Added SSL_CTX_use_certificate_chain_file() to ssl.c
  for support of multi-level certificate chains
  (Sten Kalenda).
* Fixed --tls-auth incompatibility with 1.4.x and earlier
  versions of OpenVPN when the passphrase file is an
  OpenVPN static key file (as generated by --genkey).
* Added shell-escape support in config files using
  the backslash character ("\") so that (for example)
  double quotes can be passed to the shell.
* Added "contrib" subdirectory on tarball, source zip,
  and CVS containing user-submitted contributions.
* Added an optional patch to the Redhat init script to
  allow the configuration file directory to be a
  multi-level directory hierarchy (Farkas Levente).
  See contrib/multilevel-init.patch
* Added some scripts and documentation on using
  Linux "fwmark" iptables rules to enable
  fine-grained routing control over the VPN
  (Sean Reifschneider, <jafo@tummy.com>).
  See contrib/openvpn-fwmarkroute-1.00
2005-02-21 23:26:24 +00:00
tv
c487cb967a Libtool fix for PR pkg/26633, and other issues. Update libtool to 1.5.10
in the process.  (More information on tech-pkg.)

Bump PKGREVISION and BUILDLINK_DEPENDS of all packages using libtool and
installing .la files.

Bump PKGREVISION (only) of all packages depending directly on the above
via a buildlink3 include.
2004-10-03 00:12:51 +00:00
snj
f1422b74ad Convert to buildlink3. 2004-04-11 07:23:57 +00:00
wiz
a661ce60c0 PKGREVISION bump after openssl-security-fix-update to 0.9.6m.
Buildlink files: RECOMMENDED version changed to current version.
2004-03-26 02:27:34 +00:00
xtraeme
5dc86dc237 MAINTAINER should be tech-pkg@ not packages@... 2004-02-12 23:11:12 +00:00
wulf
c0414d455f Initial commit of openvpn-1.5.0: A robust and highly configurable VPN 2004-02-10 12:39:17 +00:00