2008.10.07 -- Version 2.1_rc13
* Bundled OpenSSL 0.9.8i with Windows installer.
* Management interface can now listen on a unix
domain socket, for example:
management /tmp/openvpn unix
Also added management-client-user and management-client-group
directives to control which processes are allowed to connect
to the socket.
* Copyright change to OpenVPN Technologies, Inc.
2008.09.23 -- Version 2.1_rc12
* Patched Makefile.am so that the new t_cltsrv-down.sh script becomes
part of the tarball (Matthias Andree).
* Fixed --lladdr bug introduced in 2.1-rc9 where input validation code
was incorrectly expecting the lladdr parameter to be an IP address
when it is actually a MAC address (HoverHell).
2008.09.14 -- Version 2.1_rc11
* Fixed a bug that can cause SSL/TLS negotiations in UDP mode
to fail if UDP packets are dropped.
2008.09.10 -- Version 2.1_rc10
* Added "--server-bridge" (without parameters) to enable
DHCP proxy mode: Configure server mode for ethernet
bridging using a DHCP-proxy, where clients talk to the
OpenVPN server-side DHCP server to receive their IP address
allocation and DNS server addresses.
* Added "--route-gateway dhcp", to enable the extraction
of the gateway address from a DHCP negotiation with the
OpenVPN server-side LAN.
* Fixed minor issue with --redirect-gateway bypass-dhcp or bypass-dns
on Windows. If the bypass IP address is 0.0.0.0 or 255.255.255.255,
ignore it.
* Warn when ethernet bridging that the IP address of the bridge adapter
is probably not the same address that the LAN adapter was set to
previously.
* When running as a server, warn if the LAN network address is
the all-popular 192.168.[0|1].x, since this condition commonly
leads to subnet conflicts down the road.
* Primarily on the client, check for subnet conflicts between
the local LAN and the VPN subnet.
* Added a 'netmask' parameter to get_default_gateway, to return
the netmask of the adapter containing the default gateway.
Only implemented on Windows so far. Other platforms will
return 255.255.255.0. Currently the netmask information is
only used to warn about subnet conflicts.
* Minor fix to cryptoapi.c to not compile itself unless USE_CRYPTO
and USE_SSL flags are enabled (Alon Bar-Lev).
* Updated openvpn/t_cltsrv.sh (used by "make check") to conform to new
--script-security rules. Also adds retrying if the addresses are in
use (Matthias Andree).
* Fixed build issue with ./configure --disable-socks --disable-http.
* Fixed separate compile errors in options.c and ntlm.c that occur
on strict C compilers (such as old versions of gcc) that require
that C variable declarations occur at the start of a {} block,
not in the middle.
* Workaround bug in OpenSSL 0.9.6b ASN1_STRING_to_UTF8, which
the new implementation of extract_x509_field_ssl depends on.
* LZO compression buffer overflow errors will now invalidate
the packet rather than trigger a fatal assertion.
* Fixed minor compile issue in ntlm.c (mid-block declaration).
* Added --allow-pull-fqdn option which allows client to pull DNS names
from server (rather than only IP address) for --ifconfig, --route, and
--route-gateway. OpenVPN versions 2.1_rc7 and earlier allowed DNS names
for these options to be pulled and translated to IP addresses by default.
Now --allow-pull-fqdn will be explicitly required on the client to enable
DNS-name-to-IP-address translation of pulled options.
* 2.1_rc8 and earlier did implicit shell expansion on script
arguments since all scripts were called by system().
The security hardening changes made to 2.1_rc9 no longer
use system(), but rather use the safer execve or CreateProcess
system calls. The security hardening also introduced a
backward incompatibility with 2.1_rc8 and earlier in that
script parameters were no longer shell-expanded, so
for example:
client-connect "docc CLIENT-CONNECT"
would fail to work because execve would try to execute
a script called "docc CLIENT-CONNECT" instead of "docc"
with "CLIENT-CONNECT" as the first argument.
This patch fixes the issue, bringing the script argument
semantics back to pre 2.1_rc9 behavior in order to preserve
backward compatibility while still using execve or CreateProcess
to execute the script/executable.
* Modified ip_or_dns_addr_safe, which validates pulled DNS names,
to more closely conform to RFC 3696:
(1) DNS name length must not exceed 255 characters
(2) DNS name characters must be limited to alphanumeric,
dash ('-'), and dot ('.')
* Fixed bug in intra-session TLS key rollover that was introduced with
deferred authentication features in 2.1_rc8.
008.07.31 -- Version 2.1_rc9
* Security Fix -- affects non-Windows OpenVPN clients running
OpenVPN 2.1-beta14 through 2.1-rc8 (OpenVPN 2.0.x clients are NOT
vulnerable nor are any versions of the OpenVPN server vulnerable).
An OpenVPN client connecting to a malicious or compromised
server could potentially receive an "lladdr" or "iproute" configuration
directive from the server which could cause arbitrary code execution on
the client. A successful attack requires that (a) the client has agreed
to allow the server to push configuration directives to it by including
"pull" or the macro "client" in its configuration file, (b) the client
succesfully authenticates the server, (c) the server is malicious or has
been compromised and is under the control of the attacker, and (d) the
client is running a non-Windows OS. Credit: David Wagner.
* Miscellaneous defensive programming changes to multiple
areas of the code. In particular, use of the system() call
for calling executables such as ifconfig, route, and
user-defined scripts has been completely revamped in favor
of execve() on unix and CreateProcess() on Windows.
* In Windows build, package a statically linked openssl.exe to work around
observed instabilities in the dynamic build since the migration to
OpenSSL 0.9.8h.
2008.06.11 -- Version 2.1_rc8
* Added client authentication and packet filtering capability
to management interface. In addition, allow OpenVPN plugins
to take advantage of deferred authentication and packet
filtering capability.
* Added support for client-side connection profiles.
* Fixed unbounded memory growth bug in environmental variable
code that could have caused long-running OpenVPN sessions
with many TLS renegotiations to incrementally
increase memory usage over time.
* Windows release now packages openssl-0.9.8h.
* Build system changes -- allow building on Windows using
autoconf/automake scripts (Alon Bar-Lev).
* Changes to Windows build system to make it easier to do
partial builds, with a reduced set of prerequisites,
where only a subset of OpenVPN installer
components are built. See ./domake-win comments.
* Cleanup IP address for persistence interfaces for tap and also
using ifconfig, gentoo#209055 (Alon Bar-Lev).
* Fall back to old version of extract_x509_field for OpenSSL 0.9.6.
* Clarified tcp-queue-limit man page entry (Matti Linnanvuori).
* Added new OpenVPN icon and installer graphic.
* Minor pkitool changes.
* Added --pkcs11-id-management option, which will cause OpenVPN to
query the management interface via the new NEED-STR asynchronous
notification query to get additional PKCS#11 options (Alon Bar-Lev).
* Added NEED-STR management interface asynchronous query and
"needstr" management interface command to respond to the query
(Alon Bar-Lev).
* Added Dragonfly BSD support (Francis-Gudin).
* Quote device names before passing to up/down script (Josh Cepek).
* Bracketed struct openvpn_pktinfo with #pragma pack(1) to
prevent structure padding from causing an incorrect length
to be returned by sizeof (struct openvpn_pktinfo) on 64-bit
platforms.
* On systems that support res_init, always call it
before calling gethostbyname to ensure that
resolver configuration state is current.
* Added NTLMv2 proxy support (Miroslav Zajic).
* Fixed an issue in extract_x509_field_ssl where the extraction
would fail on the first field of the subject name, such as
the common name in: /CN=foo/emailAddress=
foo@bar.comThis e-mail address is being protected from spambots. You need
JavaScript enabled to view it
* Made "Linux ip addr del failed" error nonfatal.
* Amplified --client-cert-not-required warning.
* Added #pragma pack to proto.h.
* Added a few extra files that exist in the svn repo but were
not being copied into the tarball by make dist.
* Fixup null interface on close, don't use ip addr flush (Alon Bar-Lev).
* Fixed options checking bug introduced in rc5 where legitimate configuration
files might elicit the error: "Options error: Parameter pkcs11_private_mode
can only be specified in TLS-mode, i.e. where --tls-server or --tls-client
is also specified."
* Added "forget-passwords" command to the management interface
(Alon Bar-Lev).
* Added --management-signal option to signal SIGUSR1 when the
management interface disconnects (Alon Bar-Lev).
* Modified command line and config file parser to allow
quoted strings using single quotes ('') (Alon Bar-Lev).
* Use pkcs11-helper as external library, can be downloaded from
https://www.opensc-project.org/pkcs11-helper (Alon Bar-Lev).
* Fixed interim memory growth issue in TCP connect loop where
"TCP: connect to %s failed, will try again in %d seconds: %s"
is output.
* Fixed bug in epoll driver in event.c, where the lack of a
handler for EPOLLHUP could cause 99% CPU usage.
* Defined ALLOW_NON_CBC_CIPHERS for people who don't
want to use a CBC cipher for OpenVPN's data channel.
* Added PLUGIN_LIBDIR preprocessor string to prepend a default
plugin directory to the dlopen search list when the user
specifies the basename of the plugin only (Marius Tomaschewski).
* Rewrote extract_x509_field and modified COMMON_NAME_CHAR_CLASS
to allow forward slash characters ("/") in the X509 common name
(Pavel Shramov).
* Allow OpenVPN to run completely unprivileged under Linux
by allowing openvpn --mktun to be used with --user and --group
to set the UID/GID of the tun device node. Also added --iproute
option to allow an alternative command to be executed in place
of the default iproute2 command (Alon Bar-Lev).
* Fixed --disable-iproute2 in ./configure to actually disable
iproute2 usage (Alon Bar-Lev).
* Added --management-forget-disconnect option -- forget
passwords when management session disconnects (Alon Bar-Lev).
* Fixed 64-bit portability bug in time_string function
(Thomas Habets).
* Clean up configure on FreeBSD for recent autotool versions
that require that all .h files have to be compiled.
Also, FreeBSD install does not support GNU long options
which the Makefile in easy-rsa/2.0 uses (not checked the
others as we don't install those on Gentoo) (Roy Marples).
Added optional minimum-number-of-bytes parameter to --inactive directive.
Added --route-metric option to set a default route metric for --route
Added --lladdr option to specify the link layer (MAC) address
for the tap interface on non-Windows platforms
Security Vulnerability CVE-2006-1629
Extended tun device configure code to support ethernet bridging on NetBSD
Added --port-share option for allowing OpenVPN and HTTPS
server to share the same port number.
Added --management-client option to connect as a client to management GUI app
rather than be connected to as a server.
Added "bytecount" command to management interface.
Added --connect-timeout option to control the timeout on TCP client
connection attempts (doesn't work on all OSes). This patch also
makes OpenVPN signalable during TCP connection attempts.
Allow ca, cert, key, and dh files to be specified inline via XML-like syntax
without needing to reference an explicit file.
Allow plugin and push directives to have multi-line parameter lists
Added connect-retry-max option
Added a backtrack-hardened system time algorithm.
Added --remote-cert-ku, --remote-cert-eku, and
--remote-cert-tls options for verifying certificate attributes
Added PKCS#11 support
Added --bind option for TCP client connections
Made LZO setting pushable
Plus numerous bug fixes.
* [security] An OpenVPN client connecting to a malicious or compromised
server could potentially receive "setenv" configuration directives
from the server which could cause arbitrary code execution on the
client via a LD_PRELOAD attack. A successful attack appears to
require that (a) the client has agreed to allow the server to push
configuration directives to it by including "pull" or the macro
"client" in its configuration file, (b) the client configuration
file uses a scripting directive such as "up" or "down", (c) the
client succesfully authenticates the server, (d) the server is
malicious or has been compromised and is under the control of the
attacker, and (e) the attacker has at least some level of pre-existing
control over files on the client (this might be accomplished by
having the server respond to a client web request with a specially
crafted file). The fix is to disallow "setenv" to be pushed to
clients from the server. For those who need this capability, OpenVPN
2.1 supports a new "setenv-safe" directive which is free of this
vulnerability.
* When deleting routes under Linux, use the route metric as a
differentiator to ensure that the route teardown process only deletes
the identical route which was originally added via the "route"
directive (Roy Marples).
* Fix the t_cltsrv.sh file in FreeBSD 4 jails (Matthias Andree, Dirk
Meyer, Vasil Dimov).
* Extended tun device configure code to support ethernet bridging on
NetBSD (Emmanuel Kasper).
developer is officially maintaining the package.
The rationale for changing this from "tech-pkg" to "pkgsrc-users" is
that it implies that any user can try to maintain the package (by
submitting patches to the mailing list). Since the folks most likely
to care about the package are the folks that want to use it or are
already using it, this would leverage the energy of users who aren't
developers.
Changes:
2.0.5:
======
- Fixed bug in Linux get_default_gateway function
introduced in 2.0.4, which would cause redirect-gateway
on Linux clients to fail.
- Restored easy-rsa/2.0 tree (backported from 2.1 beta
series) which accidentally disappeared in
2.0.2 -> 2.0.4 transition.
2.0.4:
======
- Security fix -- Affects non-Windows OpenVPN clients of
version 2.0 or higher which connect to a malicious or
compromised server. A format string vulnerability
in the foreign_option function in options.c could
potentially allow a malicious or compromised server
to execute arbitrary code on the client. Only
non-Windows clients are affected. The vulnerability
only exists if (a) the client's TLS negotiation with
the server succeeds, (b) the server is malicious or
has been compromised such that it is configured to
push a maliciously crafted options string to the client,
and (c) the client indicates its willingness to accept
pushed options from the server by having "pull" or
"client" in its configuration file (Credit: Vade79).
CVE-2005-3393
- Security fix -- Potential DoS vulnerability on the
server in TCP mode. If the TCP server accept() call
returns an error status, the resulting exception handler
may attempt to indirect through a NULL pointer, causing
a segfault. Affects all OpenVPN 2.0 versions.
CVE-2005-3409
- Fix attempt of assertion at multi.c:1586 (note that
this precise line number will vary across different
versions of OpenVPN).
- Added ".PHONY: plugin" to Makefile.am to work around
"make dist" issue.
- Fixed double fork issue that occurs when --management-hold
is used.
- Moved TUN/TAP read/write log messages from --verb 8 to 6.
- Warn when multiple clients having the same common name or
username usurp each other when --duplicate-cn is not used.
- Modified Windows and Linux versions of get_default_gateway
to return the route with the smallest metric
if multiple 0.0.0.0/0.0.0.0 entries are present.
2.0.3:
======
- openvpn_plugin_abort_v1 function wasn't being properly
registered on Windows.
- Fixed a bug where --mode server --proto tcp-server --cipher none
operation could cause tunnel packet truncation.
SIGUSR1 reset of the openvpn process. This is useful for simplifying
dhclient-exit-hooks hook scripts that need to tell the openvpn process
to reset and re-run its "up" script.
Bump the PKGREVISION of net/openvpn to 1.
* Fixed bug in route.c in FreeBSD, Darwin, OpenBSD and NetBSD
version of get_default_gateway. Allocated socket for route
manipulation is never freed so number of mbufs continuously
grow and exhaust system resources after a while (Jaroslav Klaus).
* Fixed bug where "--proto tcp-server --mode p2p --management
host port" would cause the management port to not respond until
the OpenVPN peer connects.
include:
Adding a highly scalable server for handling multiple TCP/UDP
clients over point-to-point TUN interfaces, all using a single
port number. The server has been designed so that it can run with
reduced privilege.
On the client side, "pull" has been added, which basically says
"accept certain config file options which the server pushes back
to you." The major win of the push/pull capability is that the
same client configuration file can be used on each client provided
each client has its own set of SSL/TLS keys which have been signed
by the master CA.
A management interface has been developed which can be used to
remotely control or centrally manage an OpenVPN daemon.
"remote" can now specify a set of machines, or a hostname can be
configured with multiple addresses in DNS. A server will be
randomly chosen from the list, and if the connect fails, another
will be tried (see the "remote-random" option)
A package for easy RSA key management (easy-rsa-2.0rc1) has been
included to aid in generating SSL keys and certificates for use
with OpenVPN.
While here port it properly so that the route statements in the configuration
file work. Also add patches so that der Mouse's if_tap driver can be used.
Changes since 1.5.0:
2004.05.09 -- Version 1.6.0
* Unchanged from 1.6-rc4 except for version number
upgrade.
2004.04.01 -- Version 1.6-rc4
* Made minor customizations to devcon and
renamed as tapinstall.exe for Windows version.
* Fixed "storage size of `iv' isn't known" build
problem on FreeBSD.
* OpenSSL 0.9.7d bundled with Windows self-install.
2004.03.13 -- Version 1.6-rc3
* Minor Windows fixes for --ip-win32 dynamic, relating to
the way the TAP-Win32 driver responds to a DHCP request
from the Windows DHCP client.
* The net_gateway environmental variable wasn't being
set correctly for called scripts (Paul Zuber).
* Added code to determine the default gateway on FreeBSD,
allowing the --redirect-gateway option to work
(Juan Rodriguez Hervella).
2004.03.04 -- Version 1.6-rc2
* Fixed bug in Windows version where the NetBIOS node-type
DHCP option might have been passed even if it was not
specified.
* Fixed bug in Windows version introduced in 1.6-rc1, where
DHCP timeout would be set to 0 seconds if --ifconfig option
was used and --ip-win32 option was not explicitly specified.
* Added some new --dhcp-option types for Windows version.
2004.03.02 -- Version 1.6-rc1
* For Windows, make "--ip-win32 dynamic" the default.
* For Windows, make "--route-delay 10" the default
unless --ip-win32 dynamic is not used or --route-delay
is explicitly specified.
* L_TLS mutex could have been left in a locked state
for certain kinds of TLS errors.
2004.02.22 -- Version 1.6-beta7
* Allow scheduling priority increase (--nice) together
with UID/GID downgrade (--user/--group).
* Code that causes SIGUSR1 restart on TLS errors in TCP
mode was not activated in pthread builds.
* Save the certificate serial number in an environmental
variable called tls_serial_{n} prior to calling the
--tls-verify script. n is the current cert chain level.
* Added NetBSD IPv6 tunnel capability (also requires
a kernel patch) (Horst Laschinsky).
* Fixed bug in checking the return value of the nice()
function (Ian Pilcher).
* Bug fix in new FreeBSD IPv6 over TUN code which was
originally added in 1.6-beta5 (Nathanael Rensen).
* More Socks5 fixes -- extended the struct frame
infrastructure to accomodate proxy-based encapsulation
overhead.
* Added --dhcp-option to Windows version for setting
adapter properties such as WINS & DNS servers.
* Use a default route-delay of 5 seconds when
--ip-win32 dynamic is specified (only applicable when
--route-delay is not explicitly specified).
* Added "log_append" registry variable to control
whether the OpenVPN service wrapper on Windows
opens log files in append (log_append="1") or
truncate (log_append="0") mode. The default
is truncate.
2004.02.05 -- Version 1.6-beta6
* UDP over Socks5 fix to accomodate Socks5 encapsulation
overhead (Christof Meerwald).
* Minor --ip-win32 dynamic tweaks (use long lease time,
invalidate existing lease with DHCPNAK).
2004.02.01 -- Version 1.6-beta5
* Added Socks5 proxy support (Christof Meerwald).
* IPv6 tun support for FreeBSD (Thomas Glanzmann).
* Special TAP-Win32 debug mode for Windows self-install that was
enabled in beta4 is now turned off.
* Added some new Solaris notes to INSTALL (Koen Maris).
* More work on --ip-win32 dynamic.
2004.01.27 -- Version 1.6-beta4
* For this beta, the Windows self-install is a debug version
and will run slower -- use only for testing.
* Reverted the --ip-win32 default back to 'ipapi'
from 'dynamic'.
* Added the offset parameter to '--ip-win32 dynamic' which
can be used to control the address of the masqueraded
DHCP server which replies to Windows DHCP requests.
* Added a wait/nowait option to --inetd (nowait can only
be used with TCP sockets, TLS authentication, and over
a bridged configuration -- see FAQ for more info)
(Stefan `Sec` Zehl).
* Added a build-time capability where TAP-Win32 driver
debug messages can be output by OpenVPN at --verb 6
or higher.
2004.01.20 -- Version 1.6-beta2
* Added ./configure --enable-iproute2 flag which
uses iproute2 instead of route + ifconfig --
this is necessary for the LEAF Linux distro
(Martin Hejl).
* Added renewal-time and rebind-time to set of
DHCP options returned by the TAP-Win32 driver when
"--ip-win32 dynamic" is used.
2004.01.14 -- Version 1.6-beta1
* Fixed --proxy bug that sometimes caused plaintext
control info generated by the proxy prior to http
CONNECT method establishment to be incorrectly
parsed as OpenVPN data.
* For Windows version, implemented the
"--ip-win32 dynamic" method and made it the default.
This method sets the TAP-Win32 adapter IP address
and netmask by replying to the kernel's DHCP queries.
See the man page for more detailed info.
* Added --connect-retry parameter which controls
the time interval (in seconds) between connect()
retries when --proto tcp-client is used. Previously,
this value was hardcoded to 5 seconds, and still
defaults as such.
* --resolv-retry can now be used with a parameter
of "infinite" to retry indefinitely.
* Added SSL_CTX_use_certificate_chain_file() to ssl.c
for support of multi-level certificate chains
(Sten Kalenda).
* Fixed --tls-auth incompatibility with 1.4.x and earlier
versions of OpenVPN when the passphrase file is an
OpenVPN static key file (as generated by --genkey).
* Added shell-escape support in config files using
the backslash character ("\") so that (for example)
double quotes can be passed to the shell.
* Added "contrib" subdirectory on tarball, source zip,
and CVS containing user-submitted contributions.
* Added an optional patch to the Redhat init script to
allow the configuration file directory to be a
multi-level directory hierarchy (Farkas Levente).
See contrib/multilevel-init.patch
* Added some scripts and documentation on using
Linux "fwmark" iptables rules to enable
fine-grained routing control over the VPN
(Sean Reifschneider, <jafo@tummy.com>).
See contrib/openvpn-fwmarkroute-1.00
in the process. (More information on tech-pkg.)
Bump PKGREVISION and BUILDLINK_DEPENDS of all packages using libtool and
installing .la files.
Bump PKGREVISION (only) of all packages depending directly on the above
via a buildlink3 include.
