1OpenVPN Change Log 2Copyright (C) 2002-2022 OpenVPN Inc <sales@openvpn.net> 3 42022.03.16 -- Version 2.5.6 5 6Antonio Quartulli (4): 7 GitHub Actions: update script to same version as master 8 update copyright year to 2022 9 keyingmaterialexporter.c: include strings.h 10 remove unused sitnl.h file 11 12David Sommerseth (2): 13 sample-plugin: New plugin for testing multiple auth plugins 14 plug-ins: Disallow multiple deferred authentication plug-ins 15 16Frank Lichtenheld (2): 17 doc/Makefile: rebuild rst docs if input files change 18 doc/options: clean up documentation for --proto and related options 19 20Gert Doering (4): 21 fix Changes.rst errors in 2.5.3 and 2.5.5 announcement 22 Repair --inactive with 'bytes' argument larger 2Gbytes. 23 Fix --mtu-disc maybe|yes on Linux. 24 Preparing release 2.5.6 25 26Ilya Shipitsin (1): 27 CI: github actions: keep "pdb" in artifacts 28 29Lev Stipakov (7): 30 auth_token.c: add NULL initialization 31 vcpkg-ports/pkcs11-helper: bump to release 1.28 32 vcpkg-ports/pkcs11-helper: indicate OpenSSL EC support 33 msvc: cleanup 34 vcpkg: link lzo statically 35 vcpkg-ports/pkcs11-helper: adapt to new upstream URL 36 vcpkg-ports: add openssl 1.1.1n 37 38 392021.12.14 -- Version 2.5.5 40 41Adrian (1): 42 Fix error in example firewall.sh script 43 44Antonio Quartulli (1): 45 configure: remove useless -Wno-* from default CFLAGS 46 47Arne Schwabe (2): 48 Add argv_insert_head__empty_argv__head_only to argv tests 49 Move deprecation of SWEET32/64bit block size ciphers to 2.7 50 51Gert Doering (3): 52 Include --push-remove in the output of --help. 53 Move '--push-peer-info' documentation from 'server' to 'client options' 54 add test case(s) to notice 'openvpn --show-cipher' crashing 55 56Ilya Shipitsin (1): 57 BUILD: enable CFG and Spectre mitigation for MSVC 58 59Lev Stipakov (12): 60 Fix loading PKCS12 files on Windows 61 msvc: fix product version display 62 msvc: add missing header to project file 63 config-msvc.h: fix OpenSSL-related defines 64 contrib/vcpkg-ports: remove openssl port 65 GitHub Actions: use latest working lukka/run-vcpkg 66 Use network address for emulated DHCP server as a default 67 Load OpenSSL config on Windows from trusted location 68 ring_buffer.h: fix GCC warning about unused function 69 ssh_openssl.h: remove unused declaration 70 vcpkg/pkcs11-helper: compatibility with latest vcpkg 71 config-msvc.h: indicate key material export support 72 73Max Fillinger (2): 74 Don't use BF-CBC in unit tests if we don't have it 75 Define have_blowfish variable in ncp unit tests 76 77Richard T Bonhomme (1): 78 doc link-options.rst: Use free open-source dynamic-DNS provider URL 79 80Selva Nair (3): 81 Fix some more wrong defines in config-msvc.h 82 Ensure the current common_name is in the environment for scripts 83 Require EC key support in Windows builds 84 85Sergio E. Nemirowski (1): 86 resolvconf fails with -p 87 88Todd Zullinger (2): 89 Update IRC information in CONTRIBUTING.rst 90 doc/man (vpn-network-options): fix foreign_option_{n} typo 91 92Ville Skytt� (1): 93 README.down-root: Fix plugin module name 94 95 962021.10.04 -- Version 2.5.4 97 98Antonio Quartulli (3): 99 route.c: pass the right parameter to IN6_IS_ADDR_UNSPECIFIED 100 configure: search also for rst2{man, html}.py 101 networking: add networking API net_addr_ll_set() and use it on Linux 102 103Arne Schwabe (1): 104 Move examples into openvpn-examples(5) man page 105 106David Korczynski (1): 107 Fix argv leaks in add_route() and add_route_ipv6() 108 109David Sommerseth (2): 110 doc: Use generic rules for man/html generation 111 man: Clarify IV_HWADDR 112 113Gert Doering (1): 114 Add error reporting to get_console_input_win32(). 115 116Lev Stipakov (3): 117 Fix console prompts with redirected log 118 Add building man page on Windows 119 GitHub Actions: remove Ubuntu 16.04 environment 120 121Max Fillinger (1): 122 Update Fox e-mail address in copyright notices 123 124Selva Nair (1): 125 Minor doc correction: tls-crypt-v2 key generation 126 127 1282021.06.17 -- Version 2.5.3 129 130Arne Schwabe (3): 131 Add missing free_key_ctx for auth_token 132 Add github actions 133 Implement auth-token-user 134 135David Sommerseth (1): 136 Update copyrights 137 138Lev Stipakov (8): 139 openvpnmsica: properly schedule reboot in the end of installation 140 msvc: add ARM64 configuration 141 msvc: standalone building 142 contrib/vcpkg-ports: add pkcs11-helper port 143 vcpkg-ports: restore trailing whitespaces in .patch files 144 GitHub actions: add MSVC build 145 crypto_openssl.c: disable explicit initialization on Windows (CVE-2121-3606) 146 contrib/vcpkg-ports: add openssl port with --no-autoload-config option set (CVE-2121-3606) 147 148Matthias Andree (1): 149 Fix SIGSEGV (NULL deref) receiving push "echo" 150 151Max Fillinger (1): 152 Fix build with mbedtls w/o SSL renegotiation support 153 154Selva Nair (2): 155 Improve documentation of AUTH_PENDING related directives 156 Apply the connect-retry backoff to only one side of a connection 157 158 1592021.04.20 -- Version 2.5.2 160 161Arne Schwabe (10): 162 Avoid generating unecessary mbed debug messages 163 Restore also ping related options on a reconnect 164 Cleanup print_details and add signature/ED certificate print 165 Always disable TLS renegotiations 166 Also restore/save route-gateway options on SIGUSR1 reconnects 167 Move context_auth from context_2 to tls_multi and name it multi_state 168 Fix condition to generate session keys 169 Move auth_token_state from multi to key_state 170 Ensure auth-token is only sent on a fully authenticated session 171 Ensure key state is authenticated before sending push reply 172 173Gert Doering (2): 174 Fix potential NULL ptr crash if compiled with DMALLOC 175 176Max Fillinger (2): 177 In init_ssl, open the correct CRL path pre-chroot 178 Abort if CRL file can't be stat-ed in ssl_init 179 180Richard Bonhomme (1): 181 Do not print Diffie Hellman parameters file to log file 182 183Simon Rozman (1): 184 openvpnserv: Cache last error before it is overridden 185 186Vladislav Grishenko (1): 187 Fix IPv4 default gateway with multiple route tables 188 189 1902021.02.24 -- Version 2.5.1 191 192Arne Schwabe (5): 193 Fix auth-token not being updated if auth-nocache is set 194 Remove auth_user_pass.wait_for_push variable 195 Fix port-share option with TLS-Crypt v2 196 Zero initialise msghdr prior to calling sendmesg 197 Fix tls-auth mismatch OCC message when tls-cryptv2 is used. 198 199David Sommerseth (1): 200 build: Fix missing install of man page in certain environments 201 202Domagoj Pensa (3): 203 Fix too early argv freeing when registering DNS 204 Remove 1 second delay before running netsh 205 Skip DHCP renew with Wintun adapter 206 207Gert Doering (6): 208 Change travis build scripts to use https when fetching prerequisites. 209 Fix line number reporting on config file errors after <inline> segments 210 Clarify --block-ipv6 intent and direction. 211 Document common uses of 'echo' directive, re-enable logging for 'echo'. 212 Make OPENVPN_PLUGIN_ENABLE_PF failures FATAL 213 clean up / rewrite sample-plugins/defer/simple.c 214 215Greg Cox (5): 216 Fix naming error in sample-plugins/defer/simple.c 217 Documentation fixes around openvpn_plugin_func_v3 in openvpn-plugin.h.in 218 Update openvpn_plugin_func_v2 to _v3 in sample-plugins/defer/simple.c 219 More explicit versioning compatibility in sample-plugins/defer/simple.c 220 Explain structver usage in sample defer plugin. 221 222Richard Bonhomme (1): 223 Man page sections corrections 224 225Selva Nair (1): 226 Quote the domain name argument passed to the wmic command 227 228Steffan Karger (2): 229 tls-crypt-v2: fix server memory leak 230 tls-crypt-v2: also preload tls-crypt-v2 keys (if --persist-key) 231 232 2332020.10.27 -- Version 2.5.0 234 (no changes relative to v2.5_rc3) 235 2362020.10.15 -- Version 2.5_rc3 237Arne Schwabe (2): 238 Allow 'none' cipher being specified in --data-ciphers 239 Add function for common env setting of verify user/pass calls 240 241David Sommerseth (1): 242 compat/lz4: Update to v1.9.2 243 244Gert Doering (2): 245 Fix redirecting of IPv4 default gateway if connecting over IPv6. 246 Avoid passing NULL to argv_printf_cat() in temp_file error case. 247 248Jan Seeger (1): 249 Added 'route_ipv6_metric_NN' environment variable for IPv6 route metric. 250 251Richard Bonhomme (1): 252 Improve error msg when all TAP adapters are in use 'or disabled' 253 254Steffan Karger (1): 255 networking_iproute2: fix memory leak in net_iface_mtu_set() 256 257Vladislav Grishenko (2): 258 Selectively reformat too long lines 259 Speedup TCP remote hosts connections 260 261 2622020.09.30 -- Version 2.5_rc2 263 264Lev Stipakov (1): 265 Alias ADAPTER_DOMAIN_SUFFIX to DOMAIN 266 267Selva Nair (2): 268 Set DNS Domain using iservice 269 Improve documentation of --username-as-common-name 270 271Simon Rozman (4): 272 netsh: Specify interfaces by index rather than name 273 netsh: Clear existing IPv6 DNS servers before configuring new ones 274 netsh: Delete WINS servers on TUN close 275 openvpnmsica: Simplify find_adapters() to void return 276 277Vladislav Grishenko (1): 278 Fix update_time() and openvpn_gettimeofday() coexistence 279 280 2812020.09.21 -- Version 2.5_rc1 282 283David Sommerseth (4): 284 man: Add missing --server-ipv6 285 man: Improve --remote entry 286 sample-plugins: Partially autotoolize the sample-plugins build 287 build: Fix make distclean/distcheck 288 289Gert Doering (10): 290 Fix handling of 'route remote_host' for IPv6 transport case. 291 Replace 'echo -n' with 'printf' in tests/t_lpback.sh 292 Fix description of --client-disconnect calling convention in manpage. 293 Handle NULL returns from calloc() in sample plugins. 294 Fix --show-gateway for IPv6 on NetBSD/i386. 295 socks.c: fix alen for DOMAIN type addresses, bump up buffer sizes 296 Fix netbits setting (in TAP mode) for IPv6 on Windows. 297 If IPv6 pool specification sets pool start to ::0 address, increment. 298 Add demo plugin that excercises "CLIENT_CONNECT" and "CLIENT_CONNECT_V2" paths 299 Fix combination of --dev tap and --topology subnet across multiple platforms. 300 301Lev Stipakov (1): 302 msvc: better support for 32bit architecture 303 304Selva Nair (2): 305 Add a remark on dropping privileges when --mlock is used 306 Allow --dhcp-option in config file when windows-driver is wintun 307 308Vladislav Grishenko (1): 309 Fix fatal error at switching remotes (#629) 310 311 3122020.09.10 -- Version 2.5_beta4 313 314Gert Doering (3): 315 Document that --push-remove is generally more suitable than --push-reset 316 Fix error detection / abort in --inetd corner case. 317 Fix TUNSETGROUP compatibility with very old Linux systems. 318 319Lev Stipakov (1): 320 openvpnmsica: make adapter renaming non-fatal 321 322Selva Nair (1): 323 In tap.c use DiInstallDevice to install the driver on a new adapter 324 325Vladislav Grishenko (1): 326 Fix best gateway selection over netlink 327 328 3292020.08.31 -- Version 2.5_beta3 330 331Arne Schwabe (1): 332 Fix client NCP OCC fallback when server and client cipher are identical 333 3342020.08.26 -- Version 2.5_beta2 335 336Arne Schwabe (1): 337 Fix client's poor man NCP fallback 338 339Eric Thorpe (1): 340 Fixes a bug in management_callback_send_cc_message, should be strlen instead of sizeof 341 342Gert Doering (2): 343 Fix stack overflow in OpenSolaris NEXTADDR() 344 Workaround FreeBSD 12+ race condition on tun/tap open with IPv6. 345 346Lev Stipakov (1): 347 tun.c: enable using wintun driver under SYSTEM 348 349Magnus Kroken (2): 350 doc: fix typos in cipher-negotiation.rst 351 Changes.rst: fix mistyped option names 352 353Selva Nair (1): 354 Improve the documentation for --dhcp-option 355 356 3572020.08.12 -- Version 2.5_beta1 358 359Adam Ciarcin?ski (1): 360 Fix subnet topology on NetBSD. 361 362Antonio Quartulli (113): 363 attempt to add IPv6 route even when no IPv6 address was configured 364 fix redirect-gateway behaviour when an IPv4 default route does not exist 365 CRL: use time_t instead of struct timespec to store last mtime 366 ignore remote-random-hostname if a numeric host is provided 367 Ignore auth-nocache for auth-user-pass if auth-token is pushed 368 crypto: correct typ0 in error message 369 use M_ERRNO instead of explicitly printing errno 370 don't print errno twice 371 ntlm: avoid useless cast 372 ntlm: unwrap multiple function calls 373 route: improve error message 374 management: preserve wait_for_push field when asking for user/pass 375 tls-crypt: avoid warnings when --disable-crypto is used 376 ntlm: convert binary buffers to uint8_t * 377 ntlm: restyle compressed multiple function calls 378 ntlm: improve code style and readability 379 OpenSSL: remove unreachable call to SSL_CTX_get0_privatekey() 380 make function declarations C99 compliant 381 remove unused functions 382 use NULL instead of 0 when assigning pointers 383 add missing static attribute to functions 384 ntlm: avoid breaking anti-aliasing rules 385 remove the --disable-multi config switch 386 rename mroute_extract_addr_ipv4 to mroute_extract_addr_ip 387 route: avoid definition of unused variables in certain configurations 388 fix a couple of typ0s in comments and strings 389 fragment.c: simplify boolean expression 390 tcp-server: ensure AF family is propagated to child context 391 Remove ENABLE_CRYPTO 392 Remove option to disable crypto engine 393 Remove ENABLE_PUSH_PEER_INFO 394 Remove SSL_LIB_VER_STR 395 Remove MD5SUM 396 reload HTTP proxy credentials when moving to the next connection profile 397 Allow learning iroutes with network made up of all 0s (only if netbits < 8) 398 mbedtls: fix typ0 in comment 399 manpage: fix simple typ0 400 pool: restyle ipv4/ipv6 members to improve readability 401 pool: convert pool 'type' to enum 402 tun: ensure gc and argv are properly handled 403 tun: always pass a valid tt pointer 404 tun: get rid of tt->did_ifconfig member 405 tun: ensure interface can be configured with IPv6 only 406 add support for %lu in argv_printf and prevent ASSERT 407 windows: properly configure TAP driver when no IPv4 is configured 408 socket: make stream_buf_* functions static 409 crypto: always reload tls-auth/crypt key contexts 410 make tls-auth and tls-crypt per-connection-block options 411 pf: restyle pf_c2c/addr_test() to make them 'struct context' agnostic 412 merge *-inline.h files with their main header 413 ensure function declarations are compiled with their definitions 414 buffer_list: add functions documentation 415 ifconfig-ipv6(-push): allow using hostnames 416 tls-crypt: properly cast time_t to uint64_t 417 implement platform generic networking API 418 implement networking API for iproute2 419 introduce sitnl: Simplified Interface To NetLink 420 tun.c: use new networking API to handle tun interface on Linux 421 travis.yml: add test for iproute2 net implementation 422 route.c: use new networking API to handle routing table on Linux 423 unit tests: implement test for sitnl 424 t_net.sh: make bash dep explicit and run only if SITNL is compiled 425 t_net.sh: properly perform sudo check and print test steps 426 route.c: fix windows build by removing mismatching function parameter 427 t_net.sh: fixes for the networking test script 428 route.c: use sitnl to implement get_default_gateway_ipv6() 429 networking/best_gw: remove useless prefixlen parameter 430 sitnl: harden strncpy() by forcing arguments to have the same length 431 mbedtls: fix segfault by calling mbedtls_cipher_free() in cipher_ctx_free() 432 networking: extend API for better memory management 433 tun.c: undo_ifconfig_ipv4/6 remove useless gc argument 434 networking_sitnl.c: uncrustify file 435 route.c: simplify ifdef logic 436 t_net.sh: wait for NO-CARRIER bit to settle before starting test 437 t_net.sh: execute sleep after checking exit code of previous command 438 maddr: create helper function to populate maddr object from eth_addr 439 VLAN: add basic VLAN tagging support 440 maddr: export VLAN ID from client context to maddr object 441 VLAN: filter multicast and client-to-client unicast traffic 442 is_ipv_X: add support for parsing IP header inside a 802.1q frame 443 VLAN: implement support for forwarding only pre-tagged VLAN packets 444 VLAN: allow forwarding tagged and untagged packets on the server TAP device 445 VLAN: add documentation to manpage 446 socks: use the right function when printing struct openvpn_sockaddr 447 add -Wno-stringop-truncation to CFLAGS on linux 448 get rid of 'broadcast' argument when configuring the tun device 449 auth_token_kt: ensure key_type object is initialized 450 auth.c: make cast explicit in the crypto API 451 travis: compile with -Werror on Linux 452 travis: fix CFLAGS assignment error and add -Werror only when compiling on Linux for Linux 453 sitnl: fix failure reporting by keeping error negative 454 sitnl: fix TUN/TAP confusion in error messages 455 sitnl: fix ignoring EEXIST when sending a netlink command 456 t_net.sh: use dummy interface instead of tun 457 remove bogus file check on --genkey argument 458 t_net.sh: assign MAC address directly during interface creation 459 convert *_inline attributes to bool 460 options: fix inlining auth-gen-token-secret file 461 tls-crypt-v2: fix testing of inline key 462 get rid of INLINE_FILE_TAG constant 463 pool: prevent IPv6 pools to be larger than 2^16 addresses 464 pool: allow to configure an IPv6-only ifconfig-pool 465 allow usage of --server-ipv6 even when no --server is specified 466 pool: add support for ifconfig-pool-persist with IPv6 only 467 route: warn on IPv4 routes installation when no IPv4 is configured 468 options: enable IPv4 redirection logic only if really required 469 ipv6-pool: get rid of size constraint 470 pool: remove useless 'options.h' include 471 multi: skip IPv4 logic in multi_select_virtual_addr() if no pool is configured 472 multi.c: use mi->cc_config instead of config variable 473 options: don't leak inline'd key material in logfile 474 t_net.sh: drop hard dependency on t_client.rc 475 travis: don't run t_net.sh test 476 477Arne Schwabe (124): 478 Set tls-cipher restriction before loading certificates 479 Print ec bit details, refuse management-external-key if key is not RSA 480 Replace buffer backed strings for management_android_control with simple stack variables 481 Treat dhcp-option DNS6 and DNS identical 482 show the right string for key-direction 483 Add MTU to Android IFCONFIG6 control command 484 Properly free tuntap struct on android when emulating persist-tun 485 Add OpenSSL compat definition for RSA_meth_set_sign 486 Skip error about ioctl(SIOCGIFCONF) failed on Android 487 Factor out convert_tls_list_to_openssl method 488 Remove AUTO_USERID feature 489 Remove MANAGMENT_EXTERNAL_KEY, MANAGMENT_IN_EXTRA, ENABLE_CLIENT_CR 490 Add support for tls-ciphersuites for TLS 1.3 491 Add better support for showing TLS 1.3 ciphersuites in --show-tls 492 Use right function to set TLS1.3 restrictions in show-tls 493 Refuse mbed TLS external key with non RSA certificates 494 Add message explaining early TLS client hello failure 495 Add tls-crypt-v2 to the list of supported inline options 496 Implement block-ipv6 497 Fallback to password authentication when auth-token fails 498 Fix loading inline tls-crypt-v2 keys with mbed TLS 499 Refactor tls_crypt_v2_write_server_key_file into crypto.c 500 Add send_control_channel_string_dowork variant 501 Rename tls_crypt_v2_read_keyfile into generic pem_read_key_file 502 Fix poll.h logic in syshead.h 503 Write key to stdout if filename is not given 504 Implement --genkey type keyfile syntax and migrate tls-crypt-v2 505 Add generate_ephemeral_key that allows a random ephermal key 506 Remove -no-cpp-precomp flag from Darwin builds 507 Fix check if iface name is set 508 Adjust Android code after sitnl patch merge 509 Rewrite auth-token-gen to be based on HMAC based tokens 510 Implement a permanent session id in auth-token 511 Sent indication that a session is expired to clients 512 Implement unit tests for auth-gen-token 513 Make tls_version_max return the actual maximum version 514 Add support for OpenSSL TLS 1.3 when using management-external-key 515 Document tls-ciphersuites also in --help output 516 Only announce IV_NCP=2 when we are willing to support these ciphers 517 Add strsep compat function 518 Implement dynamic NCP negotiation 519 Warn about insecure ciphers also in init_key_type 520 Move NCP related function into a seperate file and add unit tests 521 Normalise ncp-ciphers option and restrict it to 127 bytes 522 Fetch OpenSSL versions via source/old links 523 Fix OpenSSL error stack handling of tls_ctx_add_extra_certs 524 Fix off-by-one in tls-crypt-v2 client wrapping with custom metadata 525 Fix OpenSSL 1.1.1 not using auto elliptic curve selection 526 Refactor counting number of element in a : delimited list into function 527 Minor style change to improve code style 528 Another round of uncrustify code cleanup. 529 Fix tls_ctx_client/server_new leaving error on OpenSSL error stack 530 Add tls-crypt-v2 test writing metadata 531 Use crypto library functions for const time memcmp when possible 532 Fix session id in env missing first byte 533 Document reneweal mechanic of auth-token in manual 534 Fix session id and initial timestamp not being preserved 535 Do not write extra 0 byte for --gen-key with auth-token/tls-crypt-v2 536 Refuse server mode on Android 537 Add .git-blame-ignore-revs with reformat commits 538 Make cipher_kt_name always return normalised cipher name 539 Make cipher_kt_get also accept OpenVPN config cipher name 540 Implement parsing and sending INFO and INFO_PRE control messages 541 Implement support for signalling IV_SSO to server 542 Implement sending response to challenge via CR_RESPONSE 543 Implement sending AUTH_PENDING challenges to clients 544 Implement forwarding client CR_RESPONSE messages to management 545 Add unit test for cipher name translations 546 Make compression asymmetric by default and add warnings 547 Reformat files using uncrustify 548 Remove parameter config from multi_client_connect_mda 549 Remove push_reply_deferred variable 550 Remove did_open_context, defined and connection_established_flag 551 merge key_state->authenticated and key_state->auth_deferred 552 Simplify multi_connection_established. 553 Deprecate ncp-disable and add improved ncp to Changes.rst 554 Make key_state->authenticated more state machine like 555 Extract process_incoming_push_reply from process_incoming_push_msg 556 Removed unused definition 557 Code cleanup: remove superflous variable 558 Move protocol option negotiation from push_prepare to new function 559 Generate data channel keys after connect options have been parsed 560 Cleanup: Remove special case code for old poor man's NCP. 561 Allow changing fallback cipher from ccd files/client-connect 562 client-connect: Change cas_context from int to enum 563 client-connect: Move adding inotify watch into its own function 564 reformat multi_client_generate_tls_keys according to uncrustify 565 client-connect: Add CC_RET_DEFERRED and cope with deferred client-connect 566 Remove CAS_PARTIAL state 567 client-connect: Use inotify for the deferred client-connect status file 568 client-connect: Implement deferred connect support for plugin API v2 569 Drop support for OpenSSL 1.0.1 570 Require AEAD support in the crypto library 571 Remove key-method 1 572 Remove ENABLE_OCC #define 573 Implement tls-groups option to specify eliptic curves/groups 574 Avoid sending --cipher to clients not supporting NCP 575 Indicate that a client is in pull mode in IV_PROTO 576 Deprecate --inetd 577 Include utun device number in utun error messages 578 Simplify calling logic of check_connection_established_dowork 579 Avoid sending push request after receving push reply 580 Rename ncp-ciphers to data-ciphers 581 Add a note that ncp-ciphers is replaced by data-ciphers 582 client-connect: Add documentation for the deferred client connect feature 583 Rework NCP compability logic and drop BF-CBC support by default 584 Document different behaviour of dynamic cipher negotiation 585 Minor cleanup in push.c 586 Clean up a number of leftover C89 initialisations in ssl.c 587 Remove buf argument from link_socket_set_outgoing_addr 588 Remove a number of check/do_work wrapper calls from coarse_timers 589 Split pf_check_reload check and check timer in process_coarse_timers 590 Rename check_ping_restart_dowork to trigger_ping_timeout_signal 591 Eliminate check_fragment function 592 Eliminate check_incoming_control_channel wrapper function 593 Eliminate check_tls wrapper function 594 Merge check_coarse_timers and check_coarse_timers_dowork 595 Skip existing interfaces on opening the first available utun on macOS 596 Move parsing IV_PROTO to separate function 597 Remove S_OP_NORMAL key state. 598 Document comp-lzo no and compress being incompatible 599 Refactor/Reformat tls_pre_decrypt 600 Cleanup tls_pre_decrypt_lite and tls_pre_encrypt 601 Improve sections about older OpenVPN clients in cipher-negotiation.rst 602 603Bertrand Bonnefoy-Claudet (1): 604 Fix typo in error message: "optione" -> "option" 605 606Christian Ehrhardt (1): 607 systemd: extend CapabilityBoundingSet for auth_pam 608 609Christian Hesse (7): 610 man: fix formatting for alternative option 611 systemd: Use automake tools to install unit files 612 systemd: Do not race on RuntimeDirectory 613 systemd: Add more security feature for systemd units 614 Clean up plugin path handling 615 plugin: Remove GNUism in openvpn-plugin.h generation 616 fix typo in notification message 617 618Christopher Schenk (3): 619 Set the correct mtu on windows based systems 620 Log a note if someone wants to set a MTU below 1280 on IPv6 621 Unified success messages for setting mtu 622 623Conrad Hoffmann (2): 624 Use provided env vars in up/down script. 625 Document down-root plugin usage in client.down 626 627David Sommerseth (64): 628 docs: Further enhance the documentation related to SWEET32 629 man: Remove references to no longer present IV_RGI6 peer-info 630 build: Ensure Changes.rst is shipped and installed as a doc file 631 management: >REMOTE operation would overwrite ce change indicator 632 management: Remove a redundant #ifdef block 633 git: Merge .gitignore files into a single file 634 systemd: Move the READY=1 signalling to an earlier point 635 dev-tools: Simple tool which automates rebasing LZ4 compat library 636 dev-tools: lz4-rebaser tool carried a typo 637 plugin: Improve the handling of default plug-in directory 638 cleanup: Remove faulty env processing functions 639 auth-token: Ensure tokens are always wiped on de-auth 640 docs: Fixed man-page warnings discoverd by rpmlint 641 Make --cipher/--auth none more explicit on the risks 642 Require minimum OpenSSL 1.0.1 643 Fix broken ./configure on systems without openssl.pc 644 plugin: Fix documentation typo for type_mask 645 plugin: Export secure_memzero() to plug-ins 646 crypto: Enable SHA256 fingerprint checking in --verify-hash 647 copyright: Update GPLv2 license texts 648 dev-tools: Script generating the source releases in an automated fashion 649 auth-token with auth-nocache fix broke --disable-crypto builds 650 doc: The CRL processing is not a deprecated feature 651 cleanup: Move write_pid() to where it is being used 652 contrib: Remove keychain-mcd code 653 cleanup: Move init_random_seed() to where it is being used 654 Highlight deprecated features 655 Use consistent version references 656 docs: Replace all PolarSSL references to mbed TLS 657 systemd: Ensure systemd shuts down OpenVPN in a proper way 658 systemd: Enable systemd's auto-restart feature for server profiles 659 lz4: Move towards a newer LZ4 API 660 lz4: Fix confused version check 661 lz4: Fix broken builds when pkg-config is not present but system library is 662 Remove references to keychain-mcd in Changes.rst 663 lz4: Rebase compat-lz4 against upstream v1.7.5 664 systemd: Add and ship README.systemd 665 Update copyright to include 2018 plus company name change 666 man: Add .TQ groff support macro 667 man: Reword --management to prefer unix sockets over TCP 668 management: Warn if TCP port is used without password 669 plugin: Export base64 encode and decode functions 670 build: Fix build warnings related to get_random() 671 build: Fix another compile warning in console_systemd.c 672 cleanup: Remove RPM openvpn.spec build approach 673 docs: Update INSTALL 674 build: Package missing mock_msg.h 675 auth-token: Fix building with --disable-server 676 auth-token: Fix compiler complaints with --disable-management 677 Improve the comments related to auth-token-hmac patches 678 Documented all the argv related code with minor refactoring 679 build: Remove --disable-server from ./configure 680 options: Fix failing inline tls-auth/crypt with persist-key 681 options: Restore --tls-crypt-v2 inline file capability 682 doc/man: convert openvpn.8 to split-up .rst files 683 doc/man: Mark compression options as deprecated 684 doc/man: Adopt compression documentation 685 doc/man: Documentation for --bind-dev / VRFs on Linux 686 doc/man: Add misssing renegotiation.rst to Makefile.am 687 Remove --no-iv 688 doc/man: Do not install man *.rst files 689 travis: Fix make distcheck failure 690 Remove --ifconfig-pool-linear 691 Remove --client-cert-not-required 692 693Domagoj Pensa (2): 694 Fix linking issues on MinGW 695 Skip DNS address validation 696 697Emmanuel Deloget (20): 698 OpenSSL: check for the SSL reason, not the full error 699 OpenSSL: don't use direct access to the internal of X509_STORE_CTX 700 OpenSSL: don't use direct access to the internal of SSL_CTX 701 OpenSSL: don't use direct access to the internal of X509_STORE 702 OpenSSL: don't use direct access to the internal of X509_OBJECT 703 OpenSSL: don't use direct access to the internal of RSA_METHOD 704 OpenSSL: SSLeay symbols are no longer available in OpenSSL 1.1 705 OpenSSL: use EVP_CipherInit_ex() instead of EVP_CipherInit() 706 OpenSSL: don't use direct access to the internal of X509 707 OpenSSL: don't use direct access to the internal of EVP_PKEY 708 OpenSSL: don't use direct access to the internal of RSA 709 OpenSSL: don't use direct access to the internal of DSA 710 OpenSSL: force meth->name as non-const when we free() it 711 OpenSSL: don't use direct access to the internal of EVP_MD_CTX 712 OpenSSL: don't use direct access to the internal of EVP_CIPHER_CTX 713 OpenSSL: don't use direct access to the internal of HMAC_CTX 714 OpenSSL: remove pre-1.1 function from the OpenSSL compat interface 715 OpenSSL: remove EVP_CIPHER_CTX_new() from the compat layer 716 OpenSSL: remove EVP_CIPHER_CTX_free() from the compat layer 717 OpenSSL: check EVP_PKEY key types before returning the pkey 718 719Eric Thorpe (1): 720 Fix Building Using MSVC 721 722Fabian Knittel (7): 723 client-connect: Split multi_connection_established into separate functions 724 client-connect: Refactor multi_client_connect_source_ccd 725 client-connect: Move multi_client_connect_setenv into early_setup 726 client-connect: Refactor to use return values instead of modifying a passed-in flag 727 client-connect: Refactor client-connect handling to calling a bunch of hooks in a loop 728 client-connect: Add deferred support to the client-connect script handler 729 client-connect: Add deferred support to the client-connect v1 plugin handler 730 731Gert Doering (50): 732 Remove IV_RGI6=1 peer-info signalling. 733 Add openssl_compat.h to openvpn_SOURCES 734 Fix '--dev null' 735 Fix installation of IPv6 host route to VPN server when using iservice. 736 Make ENABLE_OCC no longer depend on !ENABLE_SMALL 737 Fix NCP behaviour on TLS reconnect. 738 Remove erroneous limitation on max number of args for --plugin 739 proxy.c refactoring: remove always-NULL gc parameter 740 Fix edge case with clients failing to set up cipher on empty PUSH_REPLY. 741 Fix potential 1-byte overread in TCP option parsing. 742 Fix remotely-triggerable ASSERT() on malformed IPv6 packet. 743 Update Changes.rst with relevant info for 2.4.3 release. 744 Remove warning on pushed tun-ipv6 option. 745 Fix removal of on-link prefix on windows with netsh 746 Fix potential double-free() in Interactive Service (CVE-2018-9336) 747 Add %d, %u and %lu tests to test_argv unit tests. 748 Extend push-remove to also handle 'ifconfig'. 749 Print lzo_init() return code in case of errors 750 Uncrustify sample-plugin sources according to code style 751 uncrustify openvpnserv/ sources 752 uncrustify openvpn/ sources 753 Add 'printing of port number' to mroute_addr_print_ex() for v4-mapped v6. 754 Stop complaining about IPv6 routes without gateway address. 755 Copy one byte less in strncpynt() 756 Remove cmocka submodule, rely on system-wide installation instead. 757 Increase listen() backlog queue to 32 758 repair tap mode on OpenSolaris/OpenIndiana 759 Fix IPv6 routes on tap interfaces on OpenSolaris/OpenIndiana 760 OpenSolaris/OpenIllumos: use /bin/bash if available for test scripts. 761 Force combinationation of --socks-proxy and --proto UDP to use IPv4. 762 Uncrustify the tests/unit_tests/ part of our tree. 763 Change client side of t_lpback.sh configs to use inline material. 764 Simplify pool size handling, fix possible array overrun on pool reading. 765 Change timestamps in file-based logging to ISO 8601 time format. 766 Depreciation warning for --topology net30 on servers with IPv4 pools. 767 Convert plugin/auth-pam.c from stderr logging to plugin_log(). 768 Add c1ff8f247f91c88a2df5502eeedf42857f9a6831 (engine, pool, SSO) to .git-blame-ignore-revs 769 Linux: do not change --txqueuelen OS default if not configured. 770 Fix 'engine' unit test on FreeBSD (specifically 'not GNU make') 771 t_client.sh: correctly report all failed instances in summary 772 Remove --writepid file on program exit. 773 Handle connecting clients without NCP or OCC without crashing. 774 Add deferred authentication support to plugin-auth-pam 775 Separate handling of non-deferred return values for client-connect-scripts. 776 Repair --inetd 777 Fix sequence of events for async plugin v1 handler. 778 Abort client-connect handler loop after first handler sets 'disable'. 779 Add depreciation notice for --ncp-disable to protocol-options.rst 780 Changes.rst updates in preparation to 2.5_beta1 781 Preparing release 2.5_beta1 782 783Gert van Dijk (7): 784 Warn that DH config option is only meaningful in a tls-server context 785 Add generated openvpn.doxyfile to .gitignore 786 manpage: improve description of --status and --status-version 787 Add negotiated cipher to status file format 2 and 3 788 Minor reliability layer documentation fixes 789 Make second parameter to reliable_send_purge() const 790 Remove unneeded newline in debug message in reliable.c 791 792Gisle Vanem (2): 793 Crash in options.c 794 Wrong FILETYPE in .rc files 795 796Guido Vranken (6): 797 refactor my_strupr 798 Fix 2 memory leaks in proxy authentication routine 799 Fix memory leak in add_option() for option 'connection' 800 Ensure option array p[] is always NULL-terminated 801 Fix a null-pointer dereference in establish_http_proxy_passthru() 802 Prevent two kinds of stack buffer OOB reads and a crash for invalid input data 803 804Heiko Hund (3): 805 re-implement argv_printf_*() 806 argv: do fewer memory re-allocations 807 Add gc_arena to struct argv to save allocations 808 809Hilko Bengen (1): 810 Do not set pkcs11-helper 'safe fork mode' 811 812Hristo Venev (1): 813 Fix extract_x509_field_ssl for external objects, v2 814 815Ilya Shipitsin (18): 816 Resolve several travis-ci issues 817 github: Add PR template with contributor related information 818 travis-ci: add 'make distcheck' to test scenario, V2 819 travis-ci: remove unused files 820 v4, travis-ci: add 2 mingw "build only" configurations 821 travis-ci: added gcc and clang openssl-1.1.0 builds 822 travis-ci: update openssl to 1.0.2l, update mbedtls to 2.5.1 823 travis-ci: update pkcs11-helper to 1.22 824 travis-ci: add brew cache, remove ccache 825 travis-ci: modify openssl build script to support openssl-1.1.0 826 travis-ci: cleanup, refactor, upgrade ssl libraries 827 travis-ci: add "linux-ppc64le" to build matrix 828 travis-ci: change trusty image to xenial 829 travis-ci: update osx to xcode9.4 and modernize brew management 830 configure.ac: fix compile-time error in argv_testdriver 831 travis-ci: fix osx builds 832 travis-ci: update components versions 833 travis-ci: add arm64, s390x builds. 834 835James Bekkema (2): 836 Resolves small IV_GUI_VER typo in the documentation. 837 Adds support for setting the default IPv6 gateway for routes using the route-ipv6-gateway option. 838 839James Bottomley (7): 840 autoconf: Fix engine checks for openssl 1.1 841 openssl: add engine method for loading the key 842 crypto_openssl: add initialization to pick up local configuration 843 crypto_openssl: add include for openssl/conf.h 844 Add unit tests for engine keys 845 Fix make distcheck for new engine key unit test 846 engine-key tests: make check_engine_keys.sh work with --enable-small 847 848Jan Just Keijser (1): 849 Added support for DHCP option 119 (dns search suffix list) for Windows. 850 851Jeremie Courreges-Anglas (5): 852 Cast time_t to long long in order to print it. 853 Print time_t as long long and suseconds_t as long 854 Cast and print another suseconds_t as long 855 Use long long to format time_t-related environment variables 856 Fix build with LibreSSL 857 858Jeremy Evans (1): 859 Switch assertion failure to returning false 860 861Jonathan K. Bullard (1): 862 Clarify and expand management interface documentation 863 864Jonathan Tooker (1): 865 Fix various spelling mistakes 866 867Joost Rijneveld (1): 868 Make return code external tls key match docs 869 870J�r�mie Courr�ges-Anglas (2): 871 Fix an unaligned access on OpenBSD/sparc64 872 Missing include for socket-flags TCP_NODELAY on OpenBSD 873 874Kyle Evans (1): 875 tests/t_lpback.sh: Switch sed(1) to POSIX-compatible regex. 876 877Lev Stipakov (46): 878 win: support for Visual Studio 2017 879 Refactor NCP-negotiable options handling 880 init.c: refine functions names and description 881 openvpnserv: clarify return values type 882 crypto.h: remove unused function declaration 883 interactive.c: fix usage of potentially uninitialized variable 884 options.c: fix broken unary minus usage 885 Introduce openvpn_swprintf() with nul termination guarantee 886 Wrap openvpn_swprintf into Windows define 887 test_tls_crypt.c: fix global-buffer-overflow found by AddressSanitizer 888 crypto_openssl.c: fix heap-buffer-overflow found by AddressSanitizer 889 Fix various compiler warnings 890 Fix broken fragment/mssfix with NCP 891 crypto.c: fix Visual Studio build 892 tun.h: change tun_set() return value type to void 893 tun.h: remove TUN_PASS_BUFFER define 894 tapctl: add optional 'hardware id' parameter 895 vcxproj: add missing source files 896 push.c: fix Visual Studio build 897 Visual Studio: make it easier to build with VS 898 msvc: OpenSSL 1.1.x support 899 travis: add Visual Studio build 900 Visual Studio: upgrade project files to VS2019 901 wintun: add --windows-driver config option 902 wintun: implement opening wintun device 903 travis: bump MSVC to 2019 904 travis: bump clang version 905 wintun: ring buffers based I/O 906 wintun: interactive service support 907 wintun: set adapter properties via interactive service 908 wintun: clear adapter settings on tun close 909 tun.c: refactor open_tun() implementation 910 tun.c: do not add/remove on-link IPv4 route on tun open/close 911 options.c: do not force route delay when not using DHCP 912 configure.ac: simplify AC_CHECK_FUNCS statements 913 cryptoapi.c: fix run-time check failure in msvc debugger 914 interactive.c: remove unused function 915 tun.c: fix 'use after free' error 916 Fix building with --enable-async-push in FreeBSD 917 Fix broken async push with NCP is used 918 Fix illegal client float (CVE-2020-11810) 919 msvc: fix various level2 warnings 920 tap.c: fix adapter renaming 921 Improve Windows version detection with manifest 922 wintun: remove SYSTEM elevation hack 923 Fix compilation with --disable-lzo and --disable-lz4 924 925Matthias Andree (3): 926 Make openvpn-plugin.h self-contained again. 927 Merge Makefile.am's AUTOMAKE_OPTIONS into configure.ac's AM_INIT_AUTOMAKE. 928 Fix stack buffer overruns in NEXTADDR() macro: 929 930Maxim Plotnikov (1): 931 OpenSSL: Fix --crl-verify not loading multiple CRLs in one file 932 933Maximilian Wilhelm (1): 934 Add --bind-dev option. 935 936Michal Soltys (1): 937 man: correct the description of --capath and --crl-verify regarding CRLs 938 939Mykola Baibuz (1): 940 Fix typo in NTLM proxy debug message 941 942Olivier Wahrenberger (1): 943 Fix building with LibreSSL 2.5.1 by cleaning a hack. 944 945Richard Bonhomme (3): 946 man: Corrections to doc/openvpn.8 947 Ignore --pull-filter for --mode server 948 doc/man: Update --txqueuelen default setting (Now OS default) 949 950Richard van den Berg via Openvpn-devel (1): 951 Fix error message when using RHEL init script 952 953Rosen Penev (2): 954 Remove wrong poll.h include 955 openssl: Fix compilation without deprecated OpenSSL 1.1 APIs 956 957Samy Mahmoudi (1): 958 man: correct a --redirection-gateway option flag 959 960Santtu Lakkala (1): 961 Fix OpenSSL private key passphrase notices 962 963Selva Nair (55): 964 Fix push options digest update 965 Always release dhcp address in close_tun() on Windows. 966 Add a check for -Wl, --wrap support in linker 967 Fix user's group membership check in interactive service to work with domains 968 In auth-pam plugin clear the password after use 969 Pass correct buffer size to GetModuleFileNameW() 970 Check whether in pull_mode before warning about previous connection blocks 971 Avoid illegal memory access when malformed data is read from the pipe 972 Fix missing check for return value of malloc'd buffer 973 Return NULL if GetAdaptersInfo fails 974 Use RSA_meth_free instead of free 975 Bring cryptoapi.c upto speed with openssl 1.1 976 Add SSL_CTX_get_max_proto_version() not in openssl 1.0 977 TLS v1.2 support for cryptoapicert -- RSA only 978 Refactor ssl_openssl.c in prep for external EC key support 979 Refactor get_interface_metric to return metric and auto flag separately 980 Add management client version 981 Prompt for signature using '>PK_SIGN' if the client supports it 982 Allow external EC key through --management-external-key 983 Ensure strings read from registry are null-terminated 984 Make most registry values optional 985 Use lowest metric interface when multiple interfaces match a route 986 Move code to free cd to a function CAPI_DATA_free() 987 Disable external ec key support when building with libressl 988 Adapt to RegGetValue brokenness in Windows 7 989 Fix format spec errors in Windows builds 990 Move setting private key to a function in prep for EC support 991 Support EC certificates with cryptoapicert 992 Delete the IPv6 route to the "connected" network on tun close 993 Management: warn about password only when the option is in use 994 Avoid overflow in wakeup time computation 995 Replace M_DEBUG with D_LOW as the former is too verbose 996 Correct the declaration of handle in 'struct openvpn_plugin_args_open_return' 997 Parse static challenge response in auth-pam plugin 998 Bump version of openvpn plugin argument structs to 5 999 Accept empty password and/or response in auth-pam plugin 1000 Pass the hash without the DigestInfo header to NCryptSignHash() 1001 Move get system directory to a separate function 1002 Enable dhcp on tap adapter using interactive service 1003 Refactor sending commands to interactive service 1004 Declare Windows version of openvpn_execve() before use 1005 White-list pull-filter and script-security in interactive service 1006 Move OpenSSL vs CNG signature digest type mapping to a function 1007 Handle PSS padding in cryptoapicert 1008 Better error message when script fails due to script-security setting 1009 Correct the return value of cryptoapi RSA signature callbacks 1010 Fix ACL_CHECK_ADD_COMPILE_FLAGS to work with clang 1011 Swap the order of checks for validating interactive service user 1012 Skip expired certificates in Windows certificate store 1013 Allow unicode search string in --cryptoapicert option 1014 Fix possibly uninitialized return value in GetOpenvpnSettings() 1015 Fix possible access of uninitialized pipe handles 1016 Move querying username/password from management to a function 1017 When auth-user-pass file has no password query the management interface (if available). 1018 Persist management-query-remote and proxy prompts 1019 1020Simon Matter (2): 1021 Fix segfault when using crypto lib without AES-256-CTR or SHA256 1022 Add per session pseudo-random jitter to --reneg-sec intervals 1023 1024Simon Rozman (67): 1025 Local functions are not supported in MSVC. Bummer. 1026 Mixing wide and regular strings in concatenations is not allowed in MSVC. 1027 RtlIpv6AddressToStringW() and RtlIpv4AddressToStringW() require mstcpip.h 1028 Simplify iphlpapi.dll API calls 1029 Fix local #include to use quoted form 1030 Document ">PASSWORD:Auth-Token" real-time message 1031 Fix typo in "verb" command examples 1032 Uniform swprintf() across MinGW and MSVC compilers 1033 MSVC meta files added to .gitignore list 1034 openvpnserv: Review MSVC down-casting warnings 1035 openvpnserv: Add support for multi-instances 1036 Document missing OpenVPN states 1037 Add Interactive Service developer documentation 1038 Change quoted to angled form when #including external .h files 1039 Signed/unsigned warnings of MSVC resolved 1040 Reference msvc-generate from compat to assure correct build order 1041 msvc: Move common project settings to reusable property sheets 1042 msvc: Unify Unicode/MultiByte string setting across all cfg|plat 1043 Introduce tapctl.exe utility and openvpnmsica.dll MSI CA 1044 Set output name to libopenvpnmsica.dll in MSVC builds too 1045 Prevent __stdcall name mangling of MSVC 1046 Define _WIN32_WINNT=_WIN32_WINNT_VISTA in MSVC 1047 Add MSI custom action for reliable Windows 10 detection 1048 Detect TAP interfaces with root-enumerated hardware ID 1049 Change C++ to C comments 1050 Make MSI custom action debug pop-up more informative 1051 Delete TAP interface before the TAP driver is uninstalled 1052 Add detection of active VPN connections for MSI packages 1053 Add a MSI custom actions to close and relaunch OpenVPN GUI 1054 Make DriverCertification MSI property public 1055 Extend FindSystemInfo custom action to detect OpenVPNService state 1056 Uncrustify tapctl and openvpnmsica 1057 Strip _stdcall suffixes (@nn) for 32-bit builds 1058 Detect missing TAP driver and bail out gracefully 1059 Disambiguate thread local storage references from TLS 1060 Add NULL checks 1061 Add user manual and developer notes URL for tapctl.exe 1062 Refactor OpenVPNService state detection code 1063 Add developer notes URL for openvpnmsica.dll 1064 Limit tapctl.exe and openvpnmsica.dll to TAP-Windows6 adapters only 1065 msvc: Add vlan.c/h 1066 tun.c: make Windows device lookup functions more general 1067 tun.c: upgrade get_device_guid() to return the Windows driver type 1068 tun.c: make wintun_register_ring_buffer() non-fatal on failures 1069 wintun: register ring buffers when iterating adapters 1070 wintun: add support for --dev-node 1071 tun.c: reword the at_least_one_tap_win() error 1072 wintun: stop sending TAP-Windows6 ioctls to NDIS device 1073 wintun: refactor code to use enum driver type 1074 tun.c: refactor driver detection and make it case-insensitive 1075 tun.c: uncrustify 1076 wintun: check for conflicting options 1077 openvpnmsica: Remove required Windows driver certification detection 1078 openvpnmsica: Fix TAPInterface.DisplayName field interpretation 1079 tapctl: Update documentation 1080 wintun: upgrade error message in case of ring registration failure 1081 tun.c: reorder IPv6 ifconfig on Windows 1082 tapctl: Add functions for enabling/disabling adapters 1083 openvpnmsica: Revise MSI custom actions interop 1084 openvpnmsica: Simplify static function names 1085 openvpnmsica, tapctl: "interface" => "adapter" 1086 openvpnmsica: "TAP" => "TUN/TAP" 1087 openvpnmsica: Extend to support arbitrary HWID network adapters 1088 openvpnmsica, tapctl: Revise default hardware ID management 1089 openvpnmsica: Merge FindTUNTAPAdapters into FindSystemInfo 1090 tapctl: Support multiple hardware IDs 1091 tun.c: revise the IPv4 ifconfig flow on Windows 1092 1093Stefan Strogin (1): 1094 Use correct ifdefs for LibreSSL support 1095 1096Steffan Karger (122): 1097 Document that RSA_SIGN can also request TLS 1.2 signatures 1098 man: encourage user to read on about --tls-crypt 1099 Textual fixes for Changes.rst 1100 Remove deprecated --no-iv option 1101 More broadly enforce Allman style and braces-around-conditionals 1102 Use SHA256 for the internal digest, instead of MD5 1103 OpenSSL: 1.1 fallout - fix configure on old autoconf 1104 Fix types in WIN32 socket_listen_accept() 1105 Remove duplicate X509 env variables 1106 Fix non-C99-compliant builds: don't use const size_t as array length 1107 Deprecate --ns-cert-type 1108 Be less picky about keyUsage extensions 1109 cleanup: merge packet_id_alloc_outgoing() into packet_id_write() 1110 Don't run packet_id unit tests for --disable-crypto builds 1111 Fix Changes.rst layout 1112 Fix memory leak in x509_verify_cert_ku() 1113 mbedtls: correctly check return value in pkcs11_certificate_dn() 1114 Restore pre-NCP frame parameters for new sessions 1115 Always clear username/password from memory on error 1116 Document tls-crypt security considerations in man page 1117 Don't assert out on receiving too-large control packets (CVE-2017-7478) 1118 Drop packets instead of assert out if packet id rolls over (CVE-2017-7479) 1119 Log the negotiated (NCP) cipher 1120 Avoid a 1 byte overcopy in x509_get_subject (ssl_verify_openssl.c) 1121 Skip tls-crypt unit tests if required crypto mode not supported 1122 openssl: fix overflow check for long --tls-cipher option 1123 Add a DSA test key/cert pair to sample-keys 1124 Fix mbedtls fingerprint calculation 1125 mbedtls: fix --x509-track post-authentication remote DoS (CVE-2017-7522) 1126 mbedtls: require C-string compatible types for --x509-username-field 1127 Fix remote-triggerable memory leaks (CVE-2017-7521) 1128 Restrict --x509-alt-username extension types 1129 Fix potential double-free in --x509-alt-username (CVE-2017-7521) 1130 Fix typo in extract_x509_extension() debug message 1131 init_key_ctx: key and iv arguments can (now) be const 1132 Move adjust_power_of_2() to integer.h 1133 Undo cipher push in client options state if cipher is rejected 1134 Remove strerror_ts() 1135 Move openvpn_sleep() to manage.c 1136 fixup: also change missed openvpn_sleep() occurrences 1137 Always use default keysize for NCP'd ciphers 1138 Move create_temp_file() out of #ifdef ENABLE_CRYPTO 1139 sample-plugins: fix ASN1_STRING_to_UTF8 return value checks 1140 Deprecate --keysize 1141 Move run_up_down() to init.c 1142 tls-crypt: introduce tls_crypt_kt() 1143 crypto: create function to initialize encrypt and decrypt key 1144 Add coverity static analysis to Travis CI config 1145 tls-crypt: don't leak memory for incorrect tls-crypt messages 1146 travis: reorder matrix to speed up build 1147 Fix bounds check in read_key() 1148 buffer_list_aggregate_separator(): add unit tests 1149 doxygen: add make target and use relative paths 1150 Simplify and inline clear_buf() 1151 Add --tls-cert-profile option. 1152 pf: clean up temporary files if plugin init fails 1153 pf: reject client if PF plugin is configured, but init fails 1154 Don't throw fatal errors from create_temp_file() 1155 create_temp_file/gen_path: prevent memory leak if gc == NULL 1156 Use P_DATA_V2 for server->client packets too 1157 Fix memory leak in buffer unit tests 1158 travis: use clang's -fsanitize=address to catch more bugs 1159 Don't throw fatal errors from verify_cert_export_cert() 1160 buffer_list_aggregate_separator(): update list size after aggregating 1161 buffer_list_aggregate_separator(): don't exceed max_len 1162 buffer_list_aggregate_separator(): prevent 0-byte malloc 1163 Fix types around buffer_list_push(_data) 1164 ssl_openssl: fix compiler warning by removing getbio() wrapper 1165 Fix --tls-version-min and --tls-version-max for OpenSSL 1.1+ 1166 Add support for TLS 1.3 in --tls-version-{min, max} 1167 tls_ctx_set_tls_versions: move verify_flags to where it is used 1168 Plug memory leak if push is interrupted 1169 Log pre-handshake packet drops using D_MULTI_DROPPED 1170 Enable stricter compiler warnings by default 1171 reliable: remove reliable_unique_retry() 1172 Get rid of ax_check_compile_flag.m4 1173 mbedtls: don't use API deprecated in mbed 2.7 1174 Warn if tls-version-max < tls-version-min 1175 Check for more data in control channel 1176 Move env helper functions into their own module/file 1177 man: add security considerations to --compress section 1178 openssl: don't use deprecated SSLEAY/SSLeay symbols 1179 openssl: add missing #include statements 1180 Move file-related functions from misc.c to platform.c 1181 Move execve/run_script helper functions to run_command.c 1182 Add crypto_pem_{encode,decode}() 1183 Introduce buffer_write_file() 1184 mbedtls: print warning if random personalisation fails 1185 Fix memory leak after sighup 1186 Remove unused void_ptr_hash_function and void_ptr_compare_function 1187 Do not load certificate from tls_ctx_use_external_private_key() 1188 mbedtls: make external signing code generic 1189 mbedtls: remove dependency on mbedtls pkcs11 module 1190 Fix memory leak in SSL_CTX_use_certificate 1191 travis: add OpenSSL 1.1 Windows build 1192 Fix use-after-free in tls_ctx_use_management_external_key 1193 Simplify --genkey option syntax 1194 Don't print OCC warnings about 'key-method', 'keydir' and 'tls-auth' 1195 Add support for CHACHA20-POLY1305 in the data channel 1196 List ChaCha20-Poly1305 as stream cipher 1197 mbedtls: don't print unsupported ciphers in insecure cipher list 1198 Fix mbedtls unit tests 1199 buffer_list_aggregate_separator(): simplify code 1200 tls-crypt-v2: add specification to doc/ 1201 tls-crypt-v2: generate tls-crypt-v2 keys 1202 tls-crypt-v2: add unwrap_client_key 1203 tls-crypt-v2: add P_CONTROL_HARD_RESET_CLIENT_V3 opcode 1204 tls-crypt-v2: implement tls-crypt-v2 handshake 1205 tls-crypt-v2: add script hook to verify metadata 1206 tls-crypt-v2: clarify --tls-crypt-v2-genkey man page section 1207 tls-crypt-v2: fix client reconnect bug 1208 Remove deprecated --compat-x509-names and --no-name-remapping 1209 Extend tls-crypt-v2 unit tests 1210 Fix tls-auth/crypt in connection blocks with --persist-key 1211 cmocka: use relative paths 1212 tests: remove dependency on base64 1213 configure.ac: add lzo CFLAGS/LIBS to the test flags 1214 Update sample configs to use modern cipher, remove static key examples 1215 mbedtls: add RFC 5705 keying material exporter support 1216 Move keying material exporter check from syshead.h to configure.ac 1217 Make openvpn --version exit with exit code 0 1218 Gently push users towards --data-ciphers in --show-ciphers output 1219 1220Steven McDonald (1): 1221 Fix gateway detection with OpenBSD routing domains 1222 1223Szil�rd Pfeiffer (1): 1224 OpenSSL: Always set SSL_OP_CIPHER_SERVER_PREFERENCE flag 1225 1226Thomas Quinot (1): 1227 Fix documentation of tls-verify script argument 1228 1229Thomas Veerman via Openvpn-devel (1): 1230 Fix socks_proxy_port pointing to invalid data 1231 1232Tom van Leeuwen (1): 1233 mbedTLS: Make sure TLS session survives move 1234 1235ValdikSS (1): 1236 Set a low interface metric for tap adapter when block-outside-dns is in use 1237 1238Vladislav Grishenko (1): 1239 Log serial number of revoked certificate 1240 1241WGH (1): 1242 docs: Add reference to X509_LOOKUP_hash_dir(3) 1243 1244hashiz (1): 1245 Fix '--bind ipv6only' 1246 1247tincanteksup (1): 1248 Correct error message for --tls-crypt-v2-genkey client 1249 1250 12512016.12.16 -- Version 2.4_rc2 1252David Sommerseth (9): 1253 Fix wrong configure.ac parsing of --enable-async-push 1254 Changes: Further improve systemd unit file updates 1255 systemd: Intermediate --chroot fix with the new sd_notify() implementation 1256 Further enhance async-push feature description 1257 Changes.rst: Mainatiner update on C99 1258 dev-tools: Add reformat-all.sh for code style unification 1259 The Great Reformatting - first phase 1260 Merge 'reformatting' branch into master 1261 auth-gen-token: Hardening memory cleanup on auth-token failuers 1262 1263Gert Doering (1): 1264 Refactor setting close-on-exec for socket FDs 1265 1266Lev Stipakov (2): 1267 Arm inotify only in server mode 1268 Add "async push" feature to Changes.rst 1269 1270Magnus Kroken (1): 1271 mbedtls: include correct net/net_sockets header according to version 1272 1273Selva Nair (2): 1274 Correctly state the default dhcp server address in man page 1275 Unhide a line in man page by fixing a typo 1276 1277Steffan Karger (4): 1278 Fix (and cleanup) crypto flags in combination with NCP 1279 Deprecate --no-iv 1280 man: mention that --ecdh-curve does not work on mbed TLS builds 1281 Don't reopen tun if cipher changes 1282 1283 12842016.12.01 -- Version 2.4_rc1 1285Antonio Quartulli (1): 1286 reload CRL only if file was modified 1287 1288Christian Hesse (3): 1289 update year in copyright message 1290 Use systemd service manager notification 1291 Refuse to daemonize when running from systemd 1292 1293Gert Doering (1): 1294 Fix windows path in Changes.rst 1295 1296Samuli Seppänen (1): 1297 Mention that OpenVPN 2.4 requires Windows Vista or higher 1298 1299Selva Nair (4): 1300 Map restart signals from event loop to SIGTERM during exit-notification wait 1301 When parsing '--setenv opt xx ..' make sure a third parameter is present 1302 Force 'def1' method when --redirect-gateway is done through service 1303 Do not restart dns client service as a part of --register-dns processing 1304 1305Steffan Karger (4): 1306 tls_process: don't set variable that's never read 1307 Unconditionally enable TLS_AGGREGATE_ACK 1308 Clean up format_hex_ex() 1309 Introduce and use secure_memzero() to erase secrets 1310 1311 13122016.11.24 -- Version 2.4_beta2 1313Arne Schwabe (5): 1314 Document that tls-crypt also supports inline 1315 Fix warning that RAND_bytes is undeclared 1316 Remove compat-stdbool.h. 1317 Fix various compiler warnings 1318 Handle DNS6 option on Android 1319 1320David Sommerseth (2): 1321 Changes.rst: Fixing wrong formatting 1322 Document the --auth-token option 1323 1324Gert Doering (2): 1325 Remove remaining traces of compat-stdbool.h 1326 Stub implementation of "--dhcp-option DNS6 <v6addr>" 1327 1328Selva Nair (3): 1329 Do not set ipv6 address if '--ip-win32 manual' is used 1330 Handle --dhcp-option DNS6 on Windows using netsh 1331 Set IPv6 DNS servers using interactive service 1332 1333Steffan Karger (6): 1334 multi_process_float: revert part of c14c4a9e 1335 --tls-crypt fixes 1336 Change cmocka remote to use https in stead of git protocol 1337 generate_key_expansion: make assumption explicit, use C99 features 1338 Poor man's NCP for non-NCP peers 1339 Refactor data channel key generation API 1340 1341 13422016.11.17 -- Version 2.4_beta1 1343Arne Schwabe (1): 1344 Make Changes.rst nicer for 2.4 release 1345 1346David Sommerseth (16): 1347 Update .mailmap to unify and clean up odd names and e-mail addresses 1348 cleanup: Remove NOP code sections in ssl.c:tls_process() 1349 Remove last rest of INSTALL-win32.txt references 1350 auth-gen-token: Add --auth-gen-token option 1351 auth-gen-token: Generate an auth-token per client 1352 auth-gen-token: Push generated auth-tokens to the client 1353 auth-gen-token: Authenticate generated auth-tokens when client re-authenticates 1354 Fix builds with --disable-crypto 1355 man: Improve the --keepalive section 1356 console: Fix compiler warning 1357 systemd: Improve the systemd unit files 1358 tun: Fix compiler warnings 1359 file checks: Merge warn_if_group_others_accessible() into check_file_access() 1360 tun: Fix weird commit error causing a double assignment 1361 options: Remove --tls-remote 1362 Remove unused variable in argv_printf_arglist() 1363 1364Gert Doering (10): 1365 openvpn version line: remove [IPv6], add [AEAD] if available 1366 clean up *sig_info handling in link_socket_init_phase2() 1367 check c->c2.link_socket before calling do_init_route_ipv6_list() 1368 Check previously-unchecked buf_alloc_write() call in crypto self-test. 1369 Fix potential division by zero in shaper_reset() 1370 Repair topology subnet on FreeBSD 11 1371 Repair topology subnet on OpenBSD 1372 Add in_port_t check to configure.ac 1373 Fix compilation on MinGW with -std=c99 1374 Replace WIN32 by _WIN32 1375 1376Heiko Hund (4): 1377 put argv_* functions into own file, add unit tests 1378 Remove unused and unecessary argv interfaces 1379 remove unused system_str from struct argv 1380 Factor out %sc handling from argv_printf() 1381 1382Lev Stipakov (1): 1383 Drop recursively routed packets 1384 1385Samuli Seppänen (6): 1386 Remove INSTALL-win32.txt that is now hosted in openvpn-build 1387 Fix update_t_client_ips.sh for out of tree builds 1388 Make sure that all relevant files under test go to release tarballs 1389 Allow passing extra arguments to fping/fping6 in t_client.rc 1390 Prevent generation of duplicate EXPECT_IFCONFIG entries 1391 Fix a logic problem in handling of --up scripts in t_client.sh 1392 1393Selva Nair (2): 1394 Support --block-outside-dns on multiple tunnels 1395 Unbreak windows build 1396 1397Steffan Karger (19): 1398 Fix use-after-free bug in prepare_push_reply() 1399 Remove verbose msg() from send_push_reply() 1400 Limit --reneg-bytes to 64MB when using small block ciphers 1401 Add a revoked cert to the sample keys 1402 Fix --tls-version-max in mbed TLS builds 1403 Don't deference type-punned pointers 1404 Fix builds on compilers without anonymous union support 1405 Refactor static/tls-auth key loading 1406 Add missing includes in error.h 1407 Make argv unit tests obey {MBEDTLS, OPENSSL}_{LIBS, CFLAGS} 1408 Move private file access checks to options_postprocess_filechecks() 1409 Deprecate key-method 1 1410 Refactor CRL handling 1411 Remove unneeded check for extra_certs_file_inline 1412 Fix missing return value checks in multi_process_float() 1413 Restore pre-NCP cipher options on SIGUSR1 1414 Remove unused variables from do_init_crypto_static() 1415 Add control channel encryption (--tls-crypt) 1416 Add --tls-crypt unit tests 1417 1418 14192016.10.19 -- Version 2.4_alpha2 1420 1421David Sommerseth (1): 1422 Update .mailmap to unify and clean up odd names and e-mail addresses 1423 1424Steffan Karger (1): 1425 Fix use-after-free bug in prepare_push_reply() 1426 1427 14282016.10.17 -- Version 2.4_alpha1 1429 1430Adriaan de Jong (2): 1431 Fixed a bug where PolarSSL gave an error when using an inline file tag. 1432 Fix --show-pkcs11-ids (Bug #239) 1433 1434Alexander Pyhalov (1): 1435 Default gateway can't be determined on illumos/Solaris platforms 1436 1437Alon Bar-Lev (1): 1438 pkcs11: use generic evp key instead of rsa 1439 1440Andris Kalnozols (3): 1441 Fix some typos in the man page. 1442 Do not upcase x509-username-field for mixed-case arguments. 1443 extract_x509_extension(): hide status message during normal operation. 1444 1445Arne Schwabe (100): 1446 Document man agent-external-key 1447 Options parsing demands unnecessary configuration if PKCS11 is used 1448 Error message if max-routes used incorrectly 1449 Properly require --key even if defined(MANAGMENT_EXTERNAL_KEY) 1450 Remove dnsflags_to_socktype, it is not used anywhere 1451 Fix the proto is used inconsistently warning 1452 Remove dead code path and putenv functionality 1453 Remove unused function xor 1454 Move static prototype definition from header into c file 1455 Remove unused function no_tap_ifconfig 1456 Add the client id (CID) to the output of the status command 1457 Print client id only if compiled with man agent support. Otherwise print an empty string. 1458 Allow routes to be set before opening tun, similar to ifconfig before opening tun 1459 Add ability to send/receive file descriptors via management interface 1460 Android platform specific changes. 1461 Emulate persist-tun on Android 1462 Document the Android implementation in OpenVPN 1463 Only print script warnings when a script is used. Remove stray mention of script-security system. 1464 Fix #ifdefs for P2MP_SERVER 1465 Move settings of user script into set_user_script function 1466 Move checking of script file access into set_user_script 1467 Fix another #ifdef/#if P2MP_SERVER 1468 PATCHv3 Remove unused variables or put them to the defines they are being used in 1469 Add support of utun devices under Mac OS X 1470 Add support to ignore specific options. 1471 Add a note what setenv opt does for OpenVPN < 2.3.3 1472 Implement custom HTTP header for http-proxy, and always send user-agent: 1473 Add reporting of UI version to basic push-peer-info set. 1474 Change the type of all ports in openvpn to const char* and let getaddrinfo resolve the port together with the hostname. 1475 Fix compile error in ssl_openssl introduced by polar external-management patch 1476 Simplify print_sockaddr_ex function, merge duplicate ipv4/ipv6 logic. 1477 Split the PROTO_UDP_xx options into AF_INET/AF_INET6 and PROTO_TCP/PROTO_UDP part. 1478 Fix two instances of asserting AF_INET 1479 Fix assertion when SIGUSR1 is received while getaddrinfo is successful 1480 Split link_socket_init_phase1 and link_socket_init_phase2 into smaller more managable/readable functions. No functional changes 1481 Change proto_remote() function to return a constant string 1482 Remove the ip-remote-hint option. 1483 change the type of 'remote' to addrinfo*, and rename to 'remote_list'. 1484 When resolving fails print the error message from socket layer 1485 Implement dual stack client support for OpenVPN 1486 Move ASSERT so external-key with OpenSSL works again 1487 Implement listing on IPv4/IPv6 dual socket on all platform 1488 Add warning for using connection block variables after connection blocks 1489 Update IPv6 related readme files 1490 Introduce safety check for http proxy options 1491 Fix warning for max-routes: do not quit when parsing an old configuration. Format the message to be more like the other deprecated options 1492 Fix connecting to localhost on Android 1493 Move the initialization of the environment to the top so c2.es is initialized 1494 Workaround broken Android 4.4 VpnService API for persist-tun mode 1495 Implement an easy parsable log output that allows access to flags of the log message 1496 Introduce an option to resolve dns names in advance for --remote, --local and --http-proxy 1497 Fix for server selecting address family 1498 Don't show the connection profile store in options->ce if there is a connection_list defined. 1499 Add gateway and device to android control messages 1500 Clean up of socket code. 1501 Fix assert when using port-share 1502 Work around Solaris getaddrinfo() returing ai_protocol=0 1503 Fix man page and OSCP script: tls_serial_{n} is decimal 1504 Remove ENABLE_BUFFER_LIST 1505 Fix server routes not working in topology subnet with --server [v3] 1506 Always enable http-proxy and socks-proxy 1507 Remove deprecated --max-routes option from manual 1508 Add documentation for PERSIST_TUN_ACTION (Android specific) 1509 Remove possibility of using --tls-auth with non OpenVPN Static key files 1510 Remove unused function sock_addr_set 1511 Document the default for tls-cipher. 1512 Report missing end-tags of inline files as errors 1513 Fix commit e473b7c if an inline file happens to have a line break exactly at buffer limit 1514 Show extra-certs in current parameters, fix clang warning and logic error in preresolve 1515 Remove unused function h_errno_msg 1516 Add support for requesting the fd again to rebind to the next interface. 1517 Don't redirect the gateway on Android even if requested 1518 Fix loglevel of protect socket message 1519 Extend network-change command to allow reprotecting on the same network (for short connection losses) 1520 Use pseudo gw as default gw on Android as a workaround for not being able to read /proc/net/route 1521 Remove #ifdefs for client nat support. 1522 Do not install a host route for the VPN on Android 1523 Fix commit c67acea173dc9ee37220f5b9ff14ede081181992 1524 Do not set the buffer size by default but rely on the operation system default. 1525 Start Changes.rst that lists changes in 2.4.0 1526 Remove --enable-password-save option 1527 Reflect enable-password-save change in documentation 1528 Also remove second instance of enable-password-save in the man page 1529 Detect config lines that are too long and give a warning/error 1530 Implement the compression V2 data format for stub and lz4. 1531 Fix assert when comp is called with unknown algorithm, always call comp init method 1532 Ignore stamp-h2 we generate during build process 1533 Implement inlining of crl files 1534 Complete push-peer-info documentation and allow IV_PLAT_VER for other platforms than Windows if the client UI supplies it. 1535 Remove http-proxy-timeout, socks timeout and set default of server-poll-timeout to 120s 1536 Add documentation for http-proxy-user-pass option 1537 Remove http-proxy-retry and socks-proxy-retry. 1538 Update android documentation to match source code 1539 Use AES ciphers in our sample configuration files and add a few modern 2.4 examples 1540 Fix ENABLE_CRYPTO_OPENSSL set to YES even with --disable-crypto set 1541 Prefer RECVDSTADDR to PKTINFO for IPv4 in OS X since it actually works (unlike PKTINFO) 1542 Incorporate the Debian typo fixes where appropriate and make show_opt default message clearer 1543 Enable TCP non-linear packet ID 1544 Change the hold command to communicate the time that OpenVPN would wait to the UI. 1545 Remove tun-ipv6 Option. Instead assume that IPv6 is always supported. 1546 1547Boris Lytochkin (1): 1548 Log serial number of revoked certificate 1549 1550Christian Hesse (1): 1551 fix build with automake 1.13(.1) 1552 1553Christian Niessner (1): 1554 Fix corner case in NTLM authentication (trac #172) 1555 1556Christos Trochalakis (1): 1557 Adjust server-ipv6 documentation 1558 1559Cristian Rodriguez (1): 1560 Use SSL_MODE_RELEASE_BUFFERS if available 1561 1562Daniel Hahler (1): 1563 options: fix option check for "plugin" 1564 1565Daniel Kubec (4): 1566 Added support for TLS Keying Material Exporters [RFC-5705] 1567 Added document for TLS Keying Material Exporters [RFC-5705] 1568 sample-plugin: TLS Keying Material Exporter [RFC-5705] demonstration plug-in 1569 Fix buffer size parameter for exported keying material. 1570 1571David Sommerseth (44): 1572 Make git ignore some more files 1573 Remove the support for using system() when executing external programs or scripts 1574 Fix double-free issue in pf_destroy_context() 1575 Reset the version.m4 version for the master branch 1576 Avoid recursion in virtual_output_callback_func() 1577 The get_default_gateway() function uses warn() instead of msg() 1578 Improve the git revision tracking 1579 man page: Update man page about the tls_digest_{n} environment variable 1580 Remove the --disable-eurephia configure option 1581 plugin: Extend the plug-in v3 API to identify the SSL implementation used 1582 autoconf: Fix typo 1583 t_client.sh: Check for fping/fping6 availability 1584 t_client.sh: Write errors to stderr and document requirements 1585 t_client.sh: Add prepare/cleanup possibilties for each test case 1586 Fix file checks when --chroot is being used 1587 Adjusted autotools files to build more cleanly on newer autoconf/automake versions 1588 Improve error reporting on file access to --client-config-dir and --ccd-exclusive 1589 Don't let openvpn_popen() keep zombies around 1590 Don't try to use systemd-ask-password if it is not available 1591 Clean up the pipe closing in openvpn_popen() 1592 Add systemd unit file for OpenVPN 1593 systemd: Use systemd functions to consider systemd availability 1594 systemd: Reworked the systemd unit file to handle server and client configs better 1595 autotools: Fix wrong ./configure help screen default values 1596 down-root plugin: Replaced system() calls with execve() 1597 down-root: Improve error messages 1598 plugin, down-root: Fix compiler warnings 1599 sockets: Remove the limitation of --tcp-nodelay to be server-only 1600 plugins, down-root: Code style clean-up 1601 Provide compile time OpenVPN version information to plug-ins 1602 Provide OpenVPN runtime version information to plug-ins 1603 Avoid partial authentication state when using --disabled in CCD configs 1604 Only build and run cmocka unit tests if its submodule is initialized 1605 Another fix related to unit test framework 1606 Remove NOP function and callers 1607 Revert "Drop recursively routed packets" 1608 Fix client connection instant timeout 1609 t_client.sh: Make OpenVPN write PID file to avoid various sudo issues 1610 t_client.sh: Add support for Kerberos/ksu 1611 t_client.sh: Improve detection if the OpenVPN process did start during tests 1612 Rework the user input interface to make it more modular 1613 Re-implement the systemd support using the new query user API 1614 systemd: Do not mask usernames when querying for it via systemd-ask-password 1615 Move memcmp_constant_time() to crypto.h 1616 1617David Woodhouse (2): 1618 pkcs11: Load p11-kit-proxy.so module by default 1619 Make 'provider' option to --show-pkcs11-ids optional where p11-kit is present 1620 1621Davide Brini (2): 1622 Provide more accurate warning message 1623 Document authfile for socks server 1624 1625Dmitrij Tejblum (1): 1626 Fix is_ipv6 in case of tap interface. 1627 1628Dorian Harmans (1): 1629 Add CHACHA20-POLY1305 ciphersuite IANA name translations. 1630 1631Felix Janda (1): 1632 Use OPENVPN_ETH_P_* so that <netinet/if_ether.h> is unecessary 1633 1634Fish (1): 1635 Add lz4 support to MSVC. 1636 1637Gert Doering (110): 1638 Implement --mssfix handling for IPv6 packets. 1639 Fix option inconsistency warnings about "proto" and "tun-ipv6" 1640 Fix parameter type for IP_TOS setsockopt on non-Linux systems. 1641 Fix client crash on double PUSH_REPLY. 1642 Update README.IPv6 to match what is in 2.3.0 1643 Repair "tcp server queue overflow" brokenness, more <stdbool.h> fallout. 1644 Permit pool size of /64.../112 for ifconfig-ipv6-pool 1645 Add MIN() compatibility macro 1646 Fix directly connected routes for "topology subnet" on Solaris. 1647 Print "Virtual IPv6 Address" on management interface queries [v4] 1648 Use constrain_int() instead of MIN()+syshead.c compat definition - v2. 1649 Fix NULL-pointer crash in route_list_add_vpn_gateway(). 1650 Fix usage of 'compression ...' from global config. 1651 Make push-peer-info visible in "normal" per-instance environment. 1652 Fix problem with UDP tunneling due to mishandled pktinfo structures. 1653 Improve documentation and help text for --route-ipv6. 1654 Fix argument type warning introduced by http extra proxy header patch. 1655 Fix IPv6 examples in t_client.rc-sample 1656 Fix slow memory drain on each client renegotiation. 1657 t_client.sh: ignore fields from "ip -6 route show" output that distort results. 1658 Fix IPv6_V6ONLY logic. 1659 Implement LZ4 compression. 1660 Provide LZ4 sources in src/compat/ and use if no system lz4 library found. 1661 Document "lz4" argument to "compress" config option. 1662 Make code and documentation for --remote-random-hostname consistent. 1663 Reduce IV_OPENVPN_GUI_VERSION= to IV_GUI_VER= 1664 remove some 'unused variable' warnings 1665 Cleanup ir6->netbits handling. 1666 Document issue with --chroot, /dev/urandom and PolarSSL. 1667 Rename 'struct route' to 'struct route_ipv4' 1668 Replace copied structure elements with including <net/route.h> 1669 Add "test-driver" and "compile" to .gitignore 1670 Fix crash when using --inetd. 1671 IPv6 address/route delete fix for Win8 1672 Add SSL library version reporting. 1673 Minor t_client.sh cleanups 1674 Repair --multihome on FreeBSD for IPv4 sockets. 1675 Rewrite manpage section about --multihome 1676 More IPv6-related updates to the openvpn man page. 1677 Conditionalize calls to print_default_gateway on !ENABLE_SMALL 1678 Merge get_default_gateway() implementation for all 4+1 BSD variants. 1679 Drop incoming fe80:: packets silently now. 1680 Recognize AIX, define TARGET_AIX 1681 Add tap driver initialization and ifconfig for AIX. 1682 implement adding/deleting routes on AIX, for IPv4 and IPv6 1683 Make t_client.sh work on AIX. 1684 Fix t_lpback.sh platform-dependent failures 1685 Call init script helpers with explicit path (./) 1686 Fix windows build on older mingw versions. 1687 New approach to handle peer-id related changes to link-mtu. 1688 Print remote IPv4 address on a dual-stack v6 socket in IPv4 format 1689 Fix incorrect use of get_ipv6_addr() for iroute options. 1690 Remove count_netmask_bits(), convert users to use netmask_to_netbits2() 1691 Fix leftover 'if (false) ;' statements 1692 Print helpful error message on --mktun/--rmtun if not available. 1693 explain effect of --topology subnet on --ifconfig 1694 Add note about file permissions and --crl-verify to manpage. 1695 repair --dev null breakage caused by db950be85d37 1696 assume res_init() is always there. 1697 Correct note about DNS randomization in openvpn.8 1698 Disallow usage of --server-poll-timeout in --secret key mode. 1699 slightly enhance documentation about --cipher 1700 Enforce "serial-tests" behaviour for tests/Makefile 1701 Revert "Enforce "serial-tests" behaviour for tests/Makefile" 1702 On signal reception, return EAI_SYSTEM from openvpn_getaddrinfo(). 1703 Use configure.ac hack to apply serial_test AM option only if supported. 1704 Use EAI_AGAIN instead of EAI_SYSTEM for openvpn_getaddrinfo(). 1705 Move res_init() call to inner openvpn_getaddrinfo() loop 1706 Fix FreeBSD ifconfig for topology subnet tunnels. 1707 Produce a meaningful error message if --daemon gets in the way of asking for passwords. 1708 Document --daemon changes and consequences (--askpass, --auth-nocache). 1709 Fix build on OpenSolaris (non-gmake) 1710 Un-break --auth-user-pass on windows 1711 refactor struct route_ipv6, bring in line with struct route_ipv4 again 1712 refactor struct route_ipv6_list, bring in line with struct route_list again 1713 Add route_ipv6_gateway* data structures for rgi6 support. 1714 Create basic infrastructure for IPv6 default gateway handling / redirection. 1715 Make client delay less before sending PUSH_REQUEST 1716 get_default_gateway_ipv6(): Linux / Netlink implementation. 1717 Implement handling of overlapping IPv6 routes with IPv6 remote VPN server address 1718 Implement '--redirect-gateway ipv6' 1719 get_default_gateway_ipv6(): *BSD / MacOS / Solaris PF_ROUTE implementation 1720 Fix IPv6 host routes to LAN gateway on OpenSolaris 1721 Replace unaligned 16bit access to TCP MSS value with bytewise access 1722 Repair test_local_addr() on WIN32 1723 Add custom check for inet_pton()/inet_ntop() on MinGW/WIN32 1724 get_default_gateway_ipv6(): Win32 implementation using GetBestRoute2() 1725 Remove support for snappy compression. 1726 Fix info.af == AF_UNSPEC case for server with --mtu-disc 1727 Fix FreeBSD-specific mishandling of gc arena pointer in create_arbitrary_remote() 1728 remove unused gc_arena in FreeBSD close_tun() 1729 Un-break compilation on *BSD 1730 Fix isatty() check for good. 1731 Fix openserv/validate.o linking issues on mingw. 1732 Fix library order in -lmbedtls test. 1733 Implement push-remove option to selectively remove pushed options. 1734 Upgrade bundled compat-lz4 to upstream release r131. 1735 Change --enable-pedantic to use -std=c99 and not -ansi (C90). 1736 Fix problems with NCP and --inetd. 1737 Do not abort t_client run if OpenVPN instance does not start. 1738 Fix IP_PKTINFO related compilation failure on NetBSD 7.0 1739 Show compile-time variant for --multihome in --version output. 1740 Fix win32 building with C99 mode 1741 Fix t_client runs on OpenSolaris 1742 make t_client robust against sudoers misconfiguration 1743 add POSTINIT_CMD_suf to t_client.sh and sample config 1744 Fix --multihome for IPv6 on 64bit BSD systems. 1745 Enable -D_SVR4_2 for compilation on Solaris 1746 Revert "Enable -D_SVR4_2 for compilation on Solaris" 1747 Enable -D_XPG4_2 for compilation on Solaris 1748 1749Guy Yur (1): 1750 Fix --redirect-private in --dev tap mode. 1751 1752Heikki Hannikainen (1): 1753 Always load intermediate certificates from a PKCS#12 file 1754 1755Heiko Hund (20): 1756 Fix display of plugin hook types 1757 Support UTF-8 --client-config-dir 1758 close more file descriptors on exec 1759 Ignore UTF-8 byte order mark 1760 reintroduce --no-name-remapping option 1761 make --tls-remote compatible with pre 2.3 configs 1762 add new option for X.509 name verification 1763 Support non-ASCII TAP adapter names on Windows 1764 Support non-ASCII characters in Windows tmp path 1765 make sure sa_family_t is defined 1766 convert struct signal_info element 1767 grow route lists dynamically 1768 fix route struct name 1769 refine assertion to allow other modes than CBC 1770 Fix compilation on Windows 1771 fix warnings on Windows 1772 extend management interface command "state" 1773 put virtual IPv6 addresses into env 1774 interactive service v3 1775 Windows: do_ifconfig() after open_tun() 1776 1777Holger Kummert (1): 1778 Del ipv6 addr on close of linux tun interface 1779 1780Hubert Kario (2): 1781 ocsp_check - signature verification and cert staus results are separate 1782 ocsp_check - double check if ocsp didn't report any errors in execution 1783 1784Ilya Shipitsin (3): 1785 initial travis-ci support 1786 skip t_lpback.sh and t_cltsrv.sh if openvpn configured --disable-crypto 1787 enable "--disable-crypto" build configuration for travis 1788 1789Ivo Manca (1): 1790 Plug memory leak in mbedTLS backend 1791 1792James Bekkema (1): 1793 Fix socket-flag/TCP_NODELAY on Mac OS X 1794 1795James Geboski (1): 1796 Fix --askpass not allowing for password input via stdin 1797 1798James Yonan (14): 1799 Added support for the Snappy compression algorithm 1800 Always push basic set of peer info values to server. 1801 TLS version negotiation 1802 Added "setenv opt" directive prefix. If present, and if the directive that follows is recognized, it will be processed as if the "setenv opt" prefix was absent. If present and if the directive that follows is not recognized, the directive will be ignored rather than cause a fatal error. 1803 MSVC fixes 1804 Set SSL_OP_NO_TICKET flag in SSL context for OpenSSL builds, to disable TLS stateless session resumption. 1805 Use native strtoull() with MSVC 2013. 1806 Define PATH_SEPARATOR for MSVC builds. 1807 Fixed some compile issues with show_library_versions() 1808 Added flags parameter to format_hex_ex. 1809 Extended x509-track for OpenSSL to report SHA1 fingerprint. 1810 Fixed port-share bug with DoS potential 1811 Added directive to specify HTTP proxy credentials in config. 1812 Bind to local socket before dropping privileges 1813 1814Jan Just Keijser (5): 1815 man page patch for missing options 1816 make 'explicit-exit-notify' pullable again 1817 include ifconfig_ environment variables in --up-restart env set 1818 Author: Jan Just Keijser <janjust@nikhef.nl> 1819 Make certificate expiry warning patch (091edd8e299686) work on OpenSSL 1.0.1 and earlier. 1820 1821Jann Horn (1): 1822 Remove quadratic complexity from openvpn_base64_decode() 1823 1824Jeffrey Cutter (1): 1825 Update contrib/pull-resolv-conf/client.up for no DOMAIN 1826 1827Jens Neuhalfen (6): 1828 Make intent of utun device name validation clear 1829 Fix buffer overflow by user supplied data 1830 ignore the local config file t_client.rc in git 1831 Prevent integration test timeout bc. of sudo 1832 Add unit testing support via cmocka 1833 Add a test for auth-pam searchandreplace 1834 1835Jens Wagner (1): 1836 Fix spurious ignoring of pushed config options (trac#349). 1837 1838Jesse Glick (1): 1839 Allow use of NetBeans without saving nbproject/ directory. 1840 1841Joachim Schipper (5): 1842 doc/management-notes.txt: fix typo 1843 Fix typo in ./configure message 1844 Refactor tls_ctx_use_external_private_key() 1845 --management-external-key for PolarSSL 1846 external_pkcs1_sign: Support non-RSA_SIG_RAW hash_ids 1847 1848Jonathan K. Bullard (3): 1849 Fix mismatch of fprintf format specifier and argument type 1850 Fix null pointer dereference in options.c 1851 Fail if options have extra parameters [v2] 1852 1853Josh Cepek (7): 1854 Fix parameter listing in non-debug builds at verb 4 1855 (updated) [PATCH] Warn when using verb levels >=7 without debug 1856 Fix proto tcp6 for server & non-P2MP modes 1857 Fix Windows script execution when called from script hooks 1858 Correct error text when no Windows TAP device is present 1859 Require a 1.2.x PolarSSL version 1860 Push an IPv6 CIDR mask used by the server, not the pool's size 1861 1862Julien Muchembled (1): 1863 Fix --mtu-disc option with IPv6 transport 1864 1865Kenneth Rose (1): 1866 Fix v3 plugins to support returning values back to OpenVPN. 1867 1868Klee Dienes (1): 1869 tls_ctx_load_ca: Improve certificate error messages 1870 1871Leon Klingele (1): 1872 Add link to bug tracker 1873 1874Leonardo Basilio (1): 1875 Correctly report TCP connection timeout on windows. 1876 1877Lev Stipakov (26): 1878 Peer-id patch v7 1879 Add the peer-id to the output of the status command 1880 Prevent memory drain for long lasting floating sessions 1881 Disallow lameduck's float to an address taken by another client 1882 Fix NULL dereferencing 1883 Fix mssfix default value in connection_list context 1884 This fixes MSVS 2013 compilation. 1885 Continuation of MSVS fixes 1886 Fast recovery when host is in unreachable network 1887 Fix compilation error with --disable-crypto 1888 Send push reply right after async auth complete 1889 Fix compilation with --disable-server 1890 Refine float logging 1891 Generate openvpn-plugin.h for MSVC build 1892 Replace variable length array with malloc 1893 Use adapter index instead of name for windows IPv6 interface config 1894 Notify clients about server's exit/restart 1895 Use adapter index for add/delete_route_ipv6 1896 Pass adapter index to up/down scripts 1897 Detecting and logging Windows versions 1898 Report Windows bitness 1899 Fix "implicit declaration" compiler warning 1900 Drop recursively routed packets 1901 Support for disabled peer-id 1902 Exclude peer-id from pulled options digest 1903 Use separate list for per-client push options 1904 1905Lukasz Kutyla (1): 1906 Fix privilege drop if first connection attempt fails 1907 1908Matthias Andree (1): 1909 Enable TCP_NODELAY configuration on FreeBSD. 1910 1911Max Muster (1): 1912 Remove duplicate cipher entries from TLS translation table. 1913 1914Michael McConville (1): 1915 Fix undefined signed shift overflow 1916 1917Michal Ludvig (1): 1918 Support for username-only auth file. 1919 1920Mike Gilbert (2): 1921 Add configure check for the path to systemd-ask-password 1922 Include systemd units in the source tarball (make dist) 1923 1924Niels Ole Salscheider (1): 1925 Fix build with libressl 1926 1927Peter Sagerson (1): 1928 Fix configure interaction with static OpenSSL libraries 1929 1930Philipp Hagemeister (2): 1931 Add topology in sample server configuration file 1932 Implement on-link route adding for iproute2 1933 1934Phillip Smith (1): 1935 Use bob.example.com and alice.example.com to improve clarity of documentation 1936 1937Robert Fischer (1): 1938 Updated manpage for --rport and --lport 1939 1940Samuel Thibault (1): 1941 Ensure that client-connect files are always deleted 1942 1943Samuli Seppänen (15): 1944 Removed ChangeLog.IPv6 1945 Added cross-compilation information INSTALL-win32.txt 1946 Updated README 1947 Cleaned up and updated INSTALL 1948 Fix to --shaper documentation on the man-page 1949 Properly escape dashes on the man-page 1950 Improve documentation in --script-security section of the man-page 1951 Add CONTRIBUTING.rst 1952 Update CONTRIBUTING.rst to allow GitHub PRs for code review purposes 1953 Clarify the fact that build instructions in README are for release tarballs 1954 Mention tap-windows6 in INSTALL file 1955 Use an up-to-date easy-rsa URL on the man-page 1956 Clarify which Windows versions require which TUN/TAP driver 1957 Deprecate the automatic part of openvpnserv.exe in favor of openvpnserv2.exe 1958 Automatically cache expected IPs for t_client.sh on the first run 1959 1960Selva Nair (26): 1961 Fix termination when windows suspends/sleeps 1962 Do not hard-code windows systemroot in env_block 1963 Handle ctrl-C and ctrl-break events on Windows 1964 Unbreak read username password from management 1965 Restrict options/configs for startup through interactive service 1966 Send stdout and stderr of OpenVPN started by interactive service to NUL 1967 Handle localized Administrators group name in windows 1968 Fix interactive service ignoring stop command if openvpn is running 1969 Use appropriate buffer size for WideCharToMultiByte output in interactive.c 1970 Refactor and move the block-outside-dns code to a new file (block_dns.[ch]) 1971 Add support for block-outside-dns through the interactive service 1972 Ensure input read using systemd-ask-password is null terminated 1973 Support reading the challenge-response from console 1974 Make error non-fatal while deleting address using netsh 1975 Add support for register-dns through interactive service 1976 Fix handling of out of memory error in interactive service 1977 Fix the comparison of pull options hash on restart 1978 Set WFP engine handle to NULL in win_wfp_uninit() 1979 Make block-outside-dns work with persist-tun 1980 Add an option to filter options received from server 1981 Ignore SIGUSR1/SIGHUP during exit notification 1982 Fix management-external-cert option parsing error 1983 Return process id of openvpn from interactive service to client 1984 Exponentially back off on repeated connect retries 1985 Promptly close the netcmd_semaphore handle after use 1986 Avoid format specifier %zu for Windows compatibility 1987 1988Steffan Karger (180): 1989 PolarSSL-1.2 support 1990 Improve PolarSSL key_state_read_{cipher, plain}text messages 1991 Improve verify_callback messages 1992 Config compatibility patch. Added translate_cipher_name. 1993 Switch to IANA names for TLS ciphers. 1994 Fixed autoconf script to properly detect missing pkcs11 with polarssl. 1995 Use constant time memcmp when comparing HMACs in openvpn_decrypt. 1996 Fixed tls-cipher translation bug in openssl-build 1997 Fixed usage of stale define USE_SSL to ENABLE_SSL 1998 Do not pass struct tls_session* as void* in key_state_ssl_init(). 1999 Require polarssl >= 1.2.10 for polarssl-builds, which fixes CVE-2013-5915. 2000 Also update TLSv1_method() calls in support code to SSLv23_method() calls. 2001 Update TLSv1 error messages to SSLv23 to reflect changes from commit 4b67f98 2002 If --tls-cipher is supplied, make --show-tls parse the list. 2003 Remove OpenSSL tmp_rsa_callback. Removes support for ephemeral RSA in TLS. 2004 Make tls_ctx_restrict_ciphers accept NULL as char *cipher_list. 2005 Disable export ciphers by default for OpenSSL builds. 2006 Fix compiler warning for unused result of write() 2007 Remove unused variables from ssl_verify_polarssl.c's x509_get_serial() 2008 Fix compiler warnings in ssl_polarssl.c 2009 Bump minimum OpenSSL version to 0.9.8 2010 Add openssl-specific common cipher list names to ssl.c. 2011 Disable unsupported TLS cipher modes by default, cleans --show-tls output. 2012 configure.ac: check for SSL_OP_NO_TICKET flag in OpenSSL 2013 configure.ac: use CPPFLAGS for SSL_OP_NO_TICKET check 2014 Upgrade to PolarSSL 1.3 2015 Improve error reporting during key/cert loading with PolarSSL. 2016 Update openvpn-plugin.h for PolarSSL 1.3. 2017 Add support for elliptic curve diffie-hellmann key exchange (ECDH) 2018 Add an elliptic curve testing cert chain to the sample keys 2019 Change signedness of hash in x509_get_sha1_hash(), fixes compiler warning. 2020 Fix OCSP_check.sh to also use decimal for stdout verification. 2021 Make serial env exporting consistent amongst OpenSSL and PolarSSL builds. 2022 Fix build system to accept non-system crypto library locations for plugins. 2023 Remove function without effect (cipher_ok() always returned true). 2024 Remove unneeded wrapper functions in crypto_openssl.c 2025 Remove unneeded defines (were needed for pre-0.9.7 OpenSSL). 2026 Fix merge error in a6c573d, the ssl ctx is now abstracted. 2027 Use generic openvpn_x509_cert_t in ssl_verify_polarssl.c 2028 Fix ssl.c, ssl_verify_* includes 2029 Move #include "ssl_verify.h" from ssl.h to the source files that need it. 2030 Remove dependency on manage.h from ssl_verify.h 2031 Remove unused variable 'proxy' from socket_restart_pause() 2032 Add (default disabled) --enable-werror option to configure 2033 Fix --disable-ssl builds, were broken by cleanup in 63dc03d. 2034 configure.ac: fix SSL_OP_NO_TICKET check 2035 Fix bug that incorrectly refuses oid representation eku's in polar builds 2036 Update README.polarssl 2037 cleanup: remove #if 0'ed function initiate_untrusted_session() from ssl.c. 2038 Rename ALLOW_NON_CBC_CIPHERS to ENABLE_OFB_CFB_MODE, and add to configure. 2039 Add proper check for crypto modes (CBC or OFB/CFB) 2040 Improve --show-ciphers to show if a cipher can be used in static key mode 2041 Extend t_lpback tests to test all ciphers reported by --show-ciphers 2042 Don't issue warning for 'translate to self' tls-ciphers 2043 Don't exit daemon if opening or parsing the CRL fails. 2044 Define dummy SSL_OP_NO_TICKET flag if not present in OpenSSL. 2045 Fix typo in cipher_kt_mode_{cbc, ofb_cfb}() doxygen. 2046 Fix some unintialized variable warnings 2047 Fix clang warning in options.c 2048 Fix compiler warnings in ssl_polarssl.c. 2049 Fix regression with password protected private keys (polarssl) 2050 Remove unused variables from ssl_verify_openssl.c extract_x509_extension() 2051 Fix assertion error when using --cipher none 2052 Add --tls-version-max 2053 Modernize sample keys and sample configs 2054 Drop too-short control channel packets instead of asserting out. 2055 Really fix '--cipher none' regression 2056 Update doxygen (a bit) 2057 Set tls-version-max to 1.1 if cryptoapicert is used 2058 openssl: add crypto_msg(), to easily log openssl errors 2059 openssl: add more descriptive message for 'no shared cipher' error 2060 Remove ENABLE_SSL define (and --disable-ssl configure option) 2061 openssl: use crypto_msg(), get rid of openssl-specific code in error.c 2062 Add option to disable Diffie Hellman key exchange by setting '--dh none' 2063 Account for peer-id in frame size calculation 2064 Disable SSL compression 2065 Use tls-auth in sample config files 2066 Fix frame size calculation for non-CBC modes. 2067 Get rid of old OpenSSL workarounds. 2068 polarssl: make sure to always null-terminate the cn 2069 Allow for CN/username of 64 characters (fixes off-by-one) 2070 Change float log message to include common name, if available. 2071 Remove unneeded parameter 'first_time' from possibly_become_daemon() 2072 Remove size limit for files inlined in config 2073 polarssl: remove code duplication in key_state_write_plaintext{, _const}() 2074 Improve --tls-cipher and --show-tls man page description 2075 polarssl: disable 1/n-1 record splitting 2076 cleanup: remove md5 helper functions 2077 Re-read auth-user-pass file on (re)connect if required 2078 Clarify --capath option in manpage 2079 Call daemon() before initializing crypto library 2080 write pid file immediately after daemonizing 2081 Increase control channel packet size for faster handshakes 2082 Make __func__ work with Visual Studio too 2083 fix regression: query password before becoming daemon 2084 Fix using management interface to get passwords. 2085 reintroduce md5_digest wrapper struct to fix gcc warnings 2086 Fix out-of-tree builds; openvpn-plugin.h should be in AC_CONFIG_HEADERS 2087 Fix overflow check in openvpn_decrypt() 2088 Replace strdup() calls for string_alloc() calls 2089 Check return value of ms_error_text() 2090 polarssl: add easy logging for PolarSSL errors 2091 polarssl: Improve PolarSSL logging 2092 openssl: be less verbose about cipher translation errors 2093 hardening: add insurance to exit on a failed ASSERT() 2094 Fix memory leak in auth-pam plugin 2095 openssl: remove usage of OPENSSL_malloc() from show_available_curves 2096 polarssl: fix --client-cert-not-required 2097 polarssl: add --verify-client-cert optional support 2098 Fix (potential) memory leak in init_route_list() 2099 Add macro to ensure we exit on fatal errors 2100 polarssl: also allocate PKCS#11 certificate object on demand 2101 polarssl: don't use deprecated functions anymore 2102 polarssl: require >= 1.3.8 2103 Fix memory leak in add_option() by simplifying get_ipv6_addr 2104 remove nonsense const specifier in nonfatal() return value 2105 openssl: properly check return value of RAND_bytes() 2106 Fix rand_bytes return value checking 2107 Fix openssl builds with custom-built library: specify most-dependent first 2108 Support duplicate x509 field values in environment 2109 Warn user if their certificate has expired 2110 Disable certificate notBefore/notAfter sanity check on OpenSSL < 1.0.2 2111 Make assert_failed() print the failed condition 2112 cleanup: get rid of httpdigest.c type warnings 2113 Fix regression in setups without a client certificate 2114 polarssl: actually use polarssl debug logging 2115 polarssl: optimize polar_ok() for non-errors 2116 Update manpage: OpenSSL might also need /dev/urandom inside chroot 2117 polarssl: use wrappers to access md_info_t member functions 2118 polarssl: remove now redundant 128-bit blowfish key override 2119 socks.c: fix check on get_user_pass() return value(s) 2120 configure.ac: simplify crypto library configuration 2121 configure.ac: fix polarssl autodetection 2122 Allow NULL argument in cipher_ctx_get_cipher_kt() 2123 Remove reuse of key_type during init of data channel auth and tls-auth 2124 Move crypto_options into key_state and stop using context in SSL-mode. 2125 Move key_ctx_bi into crypto_options 2126 Move packet_id into crypto_options 2127 Change openvpn_encrypt() to append to work buffer only 2128 Create separate function for replay check 2129 Add AEAD cipher support (GCM) 2130 Add cipher name translation for OpenSSL. 2131 Add preliminary server-side support for negotiable crypto parameters 2132 Minor AEAD patch cleanup 2133 Clean up get_tls_handhake_key() 2134 Fix OCSP_check.sh 2135 Make AEAD modes work with OpenSSL 1.0.1-1.0.1c 2136 hardening: add safe FD_SET() wrapper openvpn_fd_set() 2137 Only include aead encrypt/decrypt functions if AEAD modes are supported 2138 Fix potential null-pointer dereference 2139 Fix memory leak in argv_extract_cmd_name() 2140 Replace MSG_TEST() macro for static inline msg_test() 2141 fixup: change init_key_type() param name in declaration too 2142 Further restrict default cipher list 2143 PolarSSL x509_get_sha1_hash now returns correct SHA1 fingerprint. 2144 Implemented x509-track for PolarSSL. 2145 Migrate to mbed TLS 2.x 2146 Rename files with 'polarssl' in the name to 'mbedtls' 2147 configure.ac: link to all mbed TLS libs during library detection 2148 mbedtls: check that private key and certificate match on start 2149 mbedtls: improve error reporting in tls verify callback 2150 Remove trailing newline from verify callback error messages 2151 Don't limit max incoming message size based on c2->frame 2152 cleanup: remove alloc_buffers argument from multi_top_init() 2153 mbedtls: don't set debug threshold if compiled without MBEDTLS_DEBUG_C 2154 Add client-side support for cipher negotiation 2155 Add options to restrict cipher negotiation 2156 Add server-side support for cipher negotiation 2157 Allow ncp-disable and ncp-ciphers to be specified in ccd files 2158 Fix '--cipher none --cipher' crash 2159 Discourage using 64-bit block ciphers 2160 Fix unittests for out-of-source builds 2161 Fix --mssfix when using NCP 2162 Drop gnu89/c89 support, switch to c99 2163 cleanup: remove code duplication in msg_test() 2164 Add SHA256 fingerprint support 2165 Make sure options->ciphername and options->authname are always defined 2166 Update cipher-related man page text 2167 Fix duplicate PUSH_REPLY options 2168 Check --ncp-ciphers list on startup 2169 2170TDivine (1): 2171 Fix "code=995" bug with windows NDIS6 tap driver. 2172 2173Tamas TEVESZ (1): 2174 Add support for client-cert-not-required for PolarSSL. 2175 2176Thomas Veerman (2): 2177 Fix "." in description of utun. 2178 Update expiry date in management event loop 2179 2180ValdikSS (4): 2181 Add Windows DNS Leak fix using WFP ('block-outside-dns') 2182 Clarify mssfix documentation 2183 Clarify --block-outside-dns documentation 2184 Update --block-outside-dns to work on Windows Vista 2185 2186Vasily Kulikov (1): 2187 Mac OS X Keychain management client 2188 2189Yawning Angel (1): 2190 Fix SOCKSv5 method selection 2191 2192Yegor Yefremov (3): 2193 socket: remove duplicate expression 2194 polarssl: fix unreachable code 2195 cert_data: fix memory leak 2196 2197janjust (1): 2198 Fix "White space before end tags can break the config parser" 2199 2200kangsterizer (1): 2201 Fix typo in sample build script to use LDFLAGS 2202 2203svimik (1): 2204 Fix segfault when enabling pf plug-ins 2205 2206 22072012.09.12 -- Version 2.3_beta1 2208Arne Schwabe (7): 2209 Fixes error: --key fails with EXTERNAL_PRIVATE_KEY: No such file or directory if --management-external-key is used 2210 Merge almost identical create_socket_tcp and create_socket_tcp6 2211 Document the inlining of files in openvpn and document key-direction 2212 Merge getaddr_multi and getaddr6 into one function 2213 Document --management-client and --management-signal a bit better 2214 Document that keep alive will double the second value in server mode and give a short explanation why the value is chosen. 2215 Add checks for external-key-managements 2216 2217David Sommerseth (1): 2218 Fix reconnect issues when --push and UDP is used on the server 2219 2220Gert Doering (4): 2221 Reduce --version string detail about IPv6 to just "[IPv6]". 2222 Put actual OpenVPN command line on top of corresponding log file. 2223 Keep pre-existing tun/tap devices around on *BSD 2224 make "ipv6 ifconfig" on linux compatible with busybox ifconfig 2225 2226Heiko Hund (6): 2227 fix regression with --http-proxy[-*] options 2228 add x_msg_va() log function 2229 add API for plug-ins to write to openvpn log 2230 remove stale _openssl_get_subject() prototype 2231 remove unused flag SSLF_NO_NAME_REMAPPING 2232 Add --compat-names option 2233 22342012.07.20 -- Version 2.3_alpha3 2235Arne Schwabe (1): 2236 Fix compiling with --disable-management 2237 2238Gert Doering (1): 2239 Repair "tap server" mode brokenness caused by <stdbool.h> fallout 2240 2241Heiko Hund (4): 2242 make non-blocking connect work on Windows 2243 don't treat socket related errors special anymore 2244 remove unused show_connection_list debug function 2245 add option --management-query-proxy 2246 22472012.06.29 -- Version 2.3_alpha2 2248Adriaan de Jong (11): 2249 Fixed off-by-one in serial length calculation 2250 Migrated x509_get_subject to use of the garbage collector 2251 Migrated x509_get_serial to use the garbage collector 2252 Migrated x509_get_sha1_hash to use the garbage collector 2253 Ensure sys/un.h autoconf detection includes sys/socket.h 2254 Added support for new PolarSSL 1.1 RNG 2255 Added a configuration option to enable prediction resistance in the PolarSSL random number generator. 2256 Use POLARSSL_CFLAGS instead of POLARSSL_CRYPTO_CFLAGS in configure.ac 2257 Removed support for PolarSSL < 1.1 2258 Updated README.polarssl with build system changes. 2259 Removed stray "Fox-IT hardening" string. 2260 2261Alon Bar-Lev (94): 2262 build: version should not contain '-' 2263 package: rpm: strip should be handled by package management 2264 cleanup: options.c: remove redundant include 2265 cleanup: remove C++ warnings 2266 cleanup: win32.c: wrong printf format 2267 cleanup: remove redundant ';' 2268 cleanup: crypto_openssl.c: remove support for pre-openssl-0.9.6 2269 cleanup: tun.c: fix incorrect option in message (ip-win32) 2270 cleanup: memcmp.c: remove unused source 2271 fixup: init.c: add missing conditional for ENABLE_CLIENT_CR 2272 build: correct place to alter WINVER is at build system 2273 Update .gitignore 2274 build: handle printf style format in mingw 2275 build: rename plugin directory to plugins 2276 build: plugins: properly use CC, CFLAGS and LDFLAGS 2277 build: we need the sample.ovpn in future 2278 Remove install-win32 2279 Remove easy-rsa 2280 Remove tap-win32 2281 cleanup: rename tap-windows function from win32 to win 2282 build: remove windows specific build system 2283 build: split acinclude.m4 into m4/* 2284 build: m4/ax_varargs.m4: cleanup 2285 build: m4/ax_emptyarray.m4: cleanup 2286 build: m4/ax_socklen_t.m4: cleanup 2287 build: autotools: first pass of trivial autotools changes 2288 build: autoconf: remove OPENVPN_ADD_LIBS useless macro 2289 build: remove awk and non-standard autoconf output processing 2290 build: standard directory layout 2291 build: add libtool + windows resources for executables 2292 build: autoconf: commands as environment 2293 build: libdl usage 2294 build: properly detect and use socket libs 2295 build: autoconf: minor cleanups 2296 build: proper selinux detection and usage 2297 build: distribute pkg.m4 2298 build: proper pkcs11-helper detection and usage 2299 build: properly process lzo-stub 2300 build: proper lzo detection and usage 2301 build: proper crypto detection and usage 2302 build: autoconf: update defaults for options 2303 build: win-msvc: msbuild format 2304 build: move out config.h include from syshead 2305 build: split out compat 2306 build: move gettimeofday() emulation to compat 2307 build: move daemon() emulation into compat 2308 build: move inet_ntop(), inet_pton() emulation into compat 2309 cleanup: move console related function into its own module 2310 build: move wrappers into platform module 2311 build: windows: install version.sh to allow installer read version 2312 build: distribute samples in windows 2313 build: use tap-windows.h as external dependency 2314 build: ax_varargs.m4: fixups 2315 build: autoconf: misc sockets fixups 2316 build: enable lzo by default 2317 build: windows: set vendor to openvpn project + cleanups 2318 build: assume dlfcn is available on all supported platforms 2319 build: openbsd: detect netinet/ip.h correctly 2320 build: tap: search for tap header 2321 build: msvc: upgrade to Visual Studio 2010 + fixups 2322 Enable pedantic in windows compilation 2323 cleanup: flags should not be bool 2324 cleanup: avoid using ~0 - generic 2325 cleanup: avoid using ~0 - ipv6 2326 cleanup: avoid using ~0 - netmask 2327 cleanup: avoid using ~0 - windows 2328 cleanup: gc usage 2329 build: fix some statement left from conversion 2330 build: properly detect netinet/ip.h structs 2331 build: properly detect TUNSETPERSIST 2332 cleanup: plugin: support C++ plugin 2333 cleanup: remove C++ comments 2334 cleanup: add .gitattributes to control eol style explicitly 2335 crash: packet_id_debug_print: sl may be null 2336 build: use stdbool.h if available 2337 build: fix typo in --enable-save-password 2338 build: windows: convert resources to UTF-8 2339 build: check minimum polarssl version 2340 cleanup: update .gitignore 2341 cleanup: spec: make space/tab consistent 2342 build: spec: we support openssl >= 0.9.7 2343 build: insall README* document using build system 2344 build: detect sys/wait.h required for *bsd 2345 build: add git revision to --version output if build from git repository 2346 build: cleanup: yet another forgotten brackets 2347 build: update INSTALL to recent changes 2348 build: support platforms that does not need explicit tun headers 2349 build: do not support <polarssl-1.1.0 2350 build: add --with-special-build to provide special build string 2351 cleanup: pkcs11.c: resolve wanings 2352 build: integrate plugins build into core build 2353 build: plugins: set defaults based on platform 2354 cleanup: windows: convert argv (UCS-2 to UTF-8) at earliest 2355 build: msvc: chdir with change drive to script location 2356 2357Arne Schwabe (7): 2358 Add the query to the error message. 2359 Explain that route-nopull also causes the client to ignore dhcp options. 2360 Add the name of the context where option is not allowed to the error message. 2361 Only use tmpdir if tmp_dir is really used. 2362 Completely remove ancient IANA port warning. 2363 Remove ENABLE_INLINE_FILES conditionals 2364 Remove ENABLE_CONNECTIONS ifdefs 2365 2366David Sommerseth (5): 2367 Clean-up: Presume that Linux is always IPv6 capable at build time 2368 Simplify check_cmd_access() function 2369 Change version to indicate the master branch is not a version 2370 Some filesystems don't like ':', which is a path 'make dist' would use 2371 Remove two unused functions 2372 2373Frank de Brabander (1): 2374 Fix reported compile issues on OSX 10.6.8 2375 2376Gert Doering (10): 2377 repair t_client.sh test after build system revolution 2378 t_client.sh iproute2 script fixes 2379 t_client.sh - fix for iproute2, print summary line 2380 Implement search for "first free" tun/tap device on Solaris 2381 cleanup and redefine metric handling for IPv6 routes 2382 remove "*option" element in "struct route_ipv6" 2383 Remove warning about explicit support for IPv6 support not provided MacOS X 2384 Add missing pieces to IPv6 route gateway handling. 2385 Update TODO.IPv6 list 2386 Remove #include "config.h" from ssl_polarssl.h 2387 2388Heiko Hund (3): 2389 remove wrapper code for Windows CryptoAPI function 2390 fix warnings in event.c when building for win32-64 2391 remove the --auto-proxy option from openvpn 2392 2393Igor Novgorodov (1): 2394 Remove calls to OpenSSL when building with --disable-ssl 2395 2396Jonathan K. Bullard (2): 2397 Fix file access checks on commands 2398 Clarified the docs and help screen about what a 'cmd' is 2399 2400Samuli Seppänen (1): 2401 Added notes about upgrading from 2.3-alpha1 and earlier to INSTALL-win32.txt 2402 24032012.02.21 -- Version 2.3-alpha1 2404Adriaan de Jong (127): 2405 Added Doxygen doxyfile 2406 Changed configure to accept --with-ssl-type=openssl 2407 Refactored to rand_bytes for OpenSSL-independency 2408 Refactored OpenSSL-specific constants 2409 Refactored maximum cipher and hmac length constants 2410 Refactored show_available_* functions 2411 Refactored SSL_clear_error() 2412 Refactored crypto initialisation functions 2413 Refactored DES key manipulation functions 2414 Refactored NTLM DES key generation 2415 Refactored message digest type functions 2416 Refactored message digest functions 2417 Refactored HMAC functions 2418 Refactored cipher key types 2419 Refactored cipher functions 2420 Added PRNG doxygen 2421 Refactored: Moved crypto.h inline functions to end of file 2422 Removed stale OpenSSL defines from crypto.h 2423 Added a check for Openssl or PolarSSL defines 2424 Refactored: Added stubs for new files 2425 Refactored SSL initialisation functions 2426 Refactored TLS_PRF to new hmac and md primitives 2427 Refactored tls_show_available_ciphers 2428 Refactored get_highest_preference_tls_cipher 2429 Refactored root SSL context initialisation 2430 Refactored new external key code 2431 Refactored DH paramater loading 2432 Refactored root TLS option settings 2433 Refactored PKCS#12 key loading 2434 Refactored PKCS#11 loading 2435 Refactored windows cert loading 2436 Refactored load certificate functions 2437 Refactored private key loading code 2438 Refactored external key loading from management 2439 Refactored CA and extra certs code 2440 Refactored cipher restriction code 2441 Refactored tls_options, key_state, and key_source data structures 2442 Refactored initalisation of key_states 2443 Refactored key_state free code 2444 Refactored print_details 2445 Refactored key_state read code (including bio_read()) 2446 Refactored key_state write functions 2447 Refactored: Moved BIO debug functions to OpenSSL backend 2448 Refactored: removed ks and ks_lame macro for clarity 2449 Refactored: moved write_empty_string function back 2450 Refactored Doxygen for tls_multi functions 2451 Migrated data structures needed by verification functions to ssl_common.h 2452 Refactored client_config_dir_exclusive function 2453 Refactored certificate hash lock checks 2454 Refactored common name locking functions 2455 Refactored username and password authentication code 2456 Add some extra comments 2457 Refactored: split verify_callback into two parts 2458 Added function to extract and verify the subject from a certificate 2459 Added function to verify and extract the username 2460 Refactored: removed global x509_username_field 2461 Refactored: separated environment setup during verification 2462 Refactored: Netscape certificate type verification 2463 Refactored key usage verification code 2464 Refactored EKU verification 2465 Refactored tls-remote checking 2466 Refactored tls-verify-plugin code 2467 Refactored tls-verify script code 2468 Refactored CRL checks 2469 Minor cleanup in verify_cert: 2470 Refactored: Moved verify_cert to ssl_verify 2471 Cleaned up ssl.h 2472 Refactored: made M_SSL dependent on USE_OPENSSL 2473 Refactored: renamed X509 functions from verify_* 2474 Separated OpenSSL-specific parts of the PKCS#11 driver 2475 Modified base64 code in preparation for PolarSSL merge 2476 Final cleanup before PolarSSL addition: 2477 Refactored X509 track feature to be contained within the openssl backend 2478 Added PolarSSL support: 2479 Fixed a missing include in ssl_backend.h 2480 Fixed a bug in the hash generation in ssl_verify_openssl.c 2481 Added SHA_DIGEST_SIZE definition 2482 Changed PolarSSL crypto backend to support v0.99-pre5 2483 Updated ssl_polarssl.c to work with 0.99-pre5 2484 Fixed a compilation warning for size_t key sizes 2485 Added a warning that the PolarSSL library does not support pkcs12 files. 2486 Added warning that --capath is not available with PolarSSL 2487 Disable CryptoAPI when not using OpenSSL, and document that fact. 2488 Removed support for management external keys in PolarSSL 2489 Removed stray X509_free from ssl.c 2490 Refactored (and disabled for PolarSSL) support for writing external cert files in scripts 2491 Added an extra define to allow building without PKCS#11 2492 Added SSL library to title string 2493 Disabled X.509 track and username selection for PolarSSL 2494 Hardening: periodically reset the PRNG's nonce value 2495 Fixes for the plugin system: 2496 Further improvements to plugin support: 2497 Fixed an unintentional change in the options calculated key size. 2498 Moved print messages back to generic crypto.c from cipher backends 2499 Moved HMAC prints back to main crypto module 2500 Added back checks for ks->authenticated in verify_user_pass 2501 Moved gc_new and gc_free to begin end of function 2502 Fixed a bug in the return value of ssl_verify when pre_verify failed 2503 Unified verification function return values: 2504 Removed a stray Fox-IT tag 2505 Fixed a typo: print the subject instead of the serial for verification errors 2506 Made SSL_CIPHER const in print_details, to fix warning 2507 Moved to PolarSSL 1.0.0: 2508 Added missing #ifdef to allow --disable-managent to work again 2509 Fixed disabling crypto and SSL 2510 Got rid of a few magic numbers in ntlm.c 2511 Removed obsolete des_cblock and des_keyschedule 2512 Further removal of des_old.h based calls 2513 Fixed missing comma in plugin.h 2514 Moved prng_uninit out of crypto_uninit_lib 2515 Moved CryptoAPI header include to the ssl_openssl.c 2516 Reordered functions to ensure warning-free Windows build 2517 Added options to switch between OpenSSL and PolarSSL and PKCS11... 2518 Moved from strsep to strtok, for Windows compatibility 2519 Minor cleanup to enable warning-free Windows build: 2520 Fixed a typo when initialising cryptoapi certs 2521 Minor code cleanup: cleaned up error handling in verify_cert. 2522 Moved out of memory prototype to error.h, as the definition is in error.c 2523 Removed support for calling gc_malloc with a NULL gc_arena struct 2524 2525 (The follwing patches from Adriaan was mistakenly merged with 2526 the wrong commit author in the git tree) 2527 Doxygen: Added data channel crypto docs 2528 Added control channel crypto docs 2529 Added compression docs 2530 Added reliability layer documentation 2531 Added memory management documentation 2532 Added data channel fragmentation docs 2533 Added main/control docs 2534 Moved doxygen-specific files to a separate directory 2535 2536Byron Ellacott (1): 2537 autoconf fixes for building on OSX 2538 2539David Sommerseth (50): 2540 Provide 'dev_type' environment variable to plug-ins and script hooks 2541 Define the new openvpn_plugin_{open,func}_v3() API 2542 Implement the core v3 plug-in function calls. 2543 Extend the v3 plug-in API to send over X509 certificates 2544 Added a simple plug-in demonstrating the v3 plug-in API. 2545 Separate the general plug-in version constant and v3 plug-in structs version 2546 Use a version-less version identifier on the master branch 2547 Fix the --client-cert-not-required feature 2548 Change the default --tmp-dir path to a more suitable path 2549 Improve the mysprintf() issue in openvpnserv.c 2550 Add a simple comment regarding openvpn_snprintf() is duplicated 2551 Merge branch 'feat_ipv6_transport' 2552 Merge branch 'feat_ipv6_payload' 2553 Merge branch 'svn-branch-2.1' into merge 2554 Solved hidden merge conflicts between master and svn-branch-2.1 2555 Fix const declarations in plug-in v3 structs 2556 Merge remote-tracking branch 'cron2/feat_ipv6_payload_2.3' 2557 Don't define ENABLE_PUSH_PEER_INFO if SSL is not available 2558 Fix compiling issues with pkcs11 when --disable-management is configured 2559 Remove support for Linux 2.2 configuration fallback 2560 Revert "Add new openssl.cnf to easy-rsa/Windows" 2561 Merge remote branch SVN 2.1 into the git tree 2562 Merge branch 'svn-merger' 2563 Fix Microsoft Visual Studio incompatibility in plugin.c 2564 Fixed compile issues on FreeBSD and Solaris 2565 Fix PolarSSL and --pkcs12 option issues 2566 Fix FreeBSD/OpenBSD/NetBSD compiler warnings in get_default_gateway() 2567 Make '--win-sys env' default 2568 Do some file/directory tests before really starting openvpn 2569 Fix bug after removing Linux 2.2 support 2570 Don't look for 'stdin' file when using --auth-user-pass 2571 Fix compiling with --disable-crypto and/or --disable-ssl 2572 Fix a couple of issues in openvpn_execve() 2573 Move away from openvpn_basename() over to platform provided basename() 2574 Enable access() when building in Visual Studio 2575 New Windows build fixes 2576 Fix compilation errors on Linux platforms without SO_MARK 2577 autotools ./configure don't like compat.h 2578 Fix pool logging when IPv6 is not enabled 2579 Don't check for file presence on inline files 2580 Add --route-pre-down/OPENVPN_PLUGIN_ROUTE_PREDOWN script/plug-in hook 2581 Enhance the error handling in _openssl_get_subject() 2582 Fix assert() situations where gc_malloc() is called without a gc_arena object 2583 Fix compile issues when plug-ins are disabled. 2584 Remove --show-gateway if debug info is not enabled (--disable-debug) 2585 Fix compile issues with status.c 2586 Connection entry {tun,link}_mtu_defined not set correctly 2587 Makefile.am referenced a now non-existing config-win32.h 2588 Makefile.am was missing ssl_common.h 2589 Revamp check_file_access() checks in stdin scenarios 2590 2591Davide Guerri (1): 2592 New feauture: Add --stale-routes-check 2593 2594Frank de Brabander (1): 2595 Fixed wrong return type of cipher_kt_mode 2596 2597Frederic Crozat (1): 2598 Add support to forward console query to systemd 2599 2600Gert Doering (45): 2601 Add more detailed explanation regarding the function of "--rdns-internal" 2602 Enable IPv6 Payload in OpenVPN p2mp tun server mode. 20100104-1 release. 2603 remove NOTES file from commit - private scribbling 2604 NetBSD fixes - on 4.0 and up, use multi-af mode. 2605 new feature: "ifconfig-ipv6-push" (from ccd/ config) 2606 add some TODOs to TODO.IPv6 2607 undo accidential duplication of existing "--iroute" line in the help text 2608 basic documentation of IPv6 related options and their syntax 2609 Enable IPv6 Payload in OpenVPN p2mp tun server mode. 2610 remove NOTES file from commit - private scribbling 2611 env_block(): if PATH is not set, add standard PATH setting to env 2612 add IPv6 route add / route delete code for windows (using "netsh") 2613 - Win32 IPv6 ifconfig support, using "netsh" calls 2614 drop "book ipv6" from open_tun() and tuncfg() prototypes 2615 document recent changes and open TODOs, adapt --version info, tag release 2616 Win32: set next-hop for IPv6 routes according to TUN/TAP mode 2617 when deleting a route on win32, also add gateway address 2618 WIN32: if IPv6 requested in TUN mode, check if TUN/TAP driver < 9.7 2619 revert unconditionally-enabling of setenv_es() logging 2620 implement IPv6 ifconfig + route setup/deletion on OpenBSD 2621 full "VPN client connect" test framework for OpenVPN t_client.rc-sample 2622 renamed t_client.sh to t_client.sh.in 2623 2.2-beta3 has a signed TAP driver with the IPv6 code - test for 9.8 2624 correct URL for "more information about IPv6 patch is *here*" 2625 bugfix for linux/iproute2: IPv6 ifconfig code block was not called for "dev tun"+"topology subnet" 2626 bump IPv6 version number (openvpn --version) to 20100922-1 2627 Implement "ipv6 ifconfig" for TAP interfaces on Solaris interfaces 2628 rebased to 2.2RC2 (beta 2.2 branch) 2629 Windows IPv6 cleanup - properly remove IPv6 routes and interface config 2630 For all accesses to "struct route_list * rl", check first that rl is non-NULL 2631 Replace 32-bit-based add_in6_addr() implementation by an 8-bit based one 2632 Platform cleanup for NetBSD 2633 Move block for "stale-routes-check" config inside #ifdef P2MP_SERVER block 2634 add missing break between "case IPv4" and "case IPv6" 2635 bump tap driver version from 9.8 to 9.9 2636 log error message and exit for "win32, tun mode, tap driver version 9.8" 2637 work around inet_ntop/inet_pton problems for MSVC builds on WinXP 2638 Fix build-up of duplicate IPv6 routes on reconnect. 2639 Fix list-overrun checks in copy_route_[ipv6_]option_list() 2640 add "print test titles" and "use sudo" functionality to t_client.rc 2641 Platform cleanup for FreeBSD 2642 Implement IPv6 interface config with non-/64 prefix lengths. 2643 Fix RUN_SUDO functionality for t_client.sh 2644 Document IPv6-related environment variables. 2645 Platform cleanup for OpenBSD 2646 2647Gisle Vanem (1): 2648 Avoid re-defining uint32_t when using mingw compiler 2649 2650Gustavo Zacarias (1): 2651 Fix compile issues when using --enable-small and --disable-ssl/--disable-crypto 2652 2653Heiko Hund (16): 2654 add .gitignore to official repository 2655 remove function is_proto_tcp() 2656 remove legacy code to query IE proxy information 2657 lowercase include header name in syshead.h 2658 define IN6_ARE_ADDR_EQUAL macro for WIN32 2659 add --mark option to set SO_MARK sockopt 2660 Windows UTF-8 input/output 2661 UTF-8 X.509 distinguished names 2662 set Windows environment variables as UCS-2 2663 handle Windows unicode paths 2664 replace check for TARGET_WIN32 with WIN32 2665 do not use mode_t on Windows 2666 use the underscore version of stat on Windows 2667 make MSVC link against shell32 as well 2668 move variable declaration to top of function 2669 define access mode flag X_OK as 0 on Windows 2670 2671Igor Novgorodov (1): 2672 The code blocks enabled by ENABLE_CLIENT_CR depends on management 2673 2674James Yonan (57): 2675 Added "management-external-key" option. 2676 Minor addition of logging info before and after execution of Windows net commands. 2677 Misc fixes to r6708. 2678 Added --x509-track option. 2679 * added --management-up-down option to allow management interface to be notified of tunnel up/down events. 2680 Fixed minor compile issue triggered on builds where MANAGEMENT_DEF_AUTH is not enabled. 2681 Implemented get_default_gateway_mac_addr for Mac OS X 2682 Fixes to r6925. 2683 Properly handle certificate serial numbers > 32 bits. 2684 Added "client-nat" option for stateless, one-to-one NAT on the client side. 2685 Renamed branch to reflect that it is no longer beta. 2686 env_filter_match now includes the serial number of all certs 2687 Fixed issue where a client might receive multiple push replies from a server 2688 Fixed bug introduced in r7031 that might cause this error message: 2689 Extended "client-kill" management interface command (server-side) 2690 Client will now try to reconnect if no push reply received within handshake-window seconds. 2691 Version 2.1.3n 2692 Fixed compiling issues when using --disable-crypto 2693 Added "management-external-key" option. 2694 Misc fixes to r6708. 2695 win/sign.py now accepts an optional tap-dir argument. 2696 Added "auth-token" client directive 2697 Added ./configure --enable-osxipconfig option for Mac OS X 2698 Added more packet ID debug info at debug level 3 for debugging false positive packet replays. 2699 Fixed bug that incorrectly placed stricter TCP packet replay rules on UDP sessions 2700 Fixed bug in port-share that could cause port share process to crash 2701 For Mac OSX, when DARWIN_USE_IPCONFIG is defined, retry ipconfig command on failure 2702 Version 2.1.3t 2703 Revert r7092 and r7151, i.e. remove --enable-osxipconfig configure option. 2704 Added 'dir' flag to "crl-verify" (see man page for info). 2705 Added new "extra-certs" and "verify-hash" options 2706 Fixed compile issues on Windows. 2707 Added --enable-lzo-stub configure option to build an OpenVPN client without LZO 2708 Added optional journal directory argument to "port-share" directive 2709 Reduce log verbosity at level 3, with a focus on removing excessive log verbosity generated by port-share activity. 2710 env_filter_match now includes the serial number of all certs in chain 2711 Added support for static challenge/response protocol. 2712 r7316 fixes. 2713 Added redirect-gateway block-local flag, with support for Linux, Mac OS X 2714 Extended x509-track to allow SHA1 certificate hash to be extracted 2715 Added "management-query-remote" directive (client) to allow the management interface to override the "remote" directive. 2716 Version 2.1.5. 2717 Fixed MSVC compile error related to r7408. 2718 Redact "echo" directive strings from log, since these strings (going forward) could conceivably contain security-sensitive data. 2719 Modified sanitize_control_message to remove redacted data from control string rather than blotting it out with "_" chars. 2720 Changed CC_PRINT character class to allow UTF-8 chars. 2721 Increased the --verb threshold for "PID_ERR replay" messages to 4 from 3. 2722 Fixed issue where redirect-gateway block-local code was not correctly calculating... 2723 CC_PRINT character class now allows any 8-bit character value >= 32. 2724 "status" management interface command (version >= 2) will now include the username for each connected user. 2725 Minor fix to CC_PRINT char class 2726 Fixed management interface bug where >FATAL notifications were not being output properly 2727 Raised D_PID_DEBUG_LOW from level 3 to 4 to reduce replay error verbosity at level 3. 2728 Added "memstats" option to maintain real-time operating stats in a memory-mapped file. 2729 Fixed client issues with DHCP Router option extraction/deletion when using layer 2 with DHCP proxy: 2730 Allow "tap-win32 dynamic <offset>" to be used in topology subnet mode. 2731 Added support for "on-link" routes on Linux client 2732 2733Jan Just Keijser (1): 2734 Made some options connection-entry specific 2735 2736Joe Patterson (1): 2737 common_name passing in auth_pam plugin 2738 2739JuanJo Ciarlante (40): 2740 * rebased openvpn-2.1_rc1b.jjo.20061206.d.patch 2741 * created getaddr6(), use it from resolve_remote() 2742 * migrated all getaddrinfo() to getaddr6 2743 * socket.c: use USE_PF_INET6 in switch constructs to actually toss them out, 2744 * support --disable-ipv6 build properly: 2745 * important fix for tcp6 reconnection was incorrectly creating a PF_INET socket 2746 * added README.ipv6.txt 2747 * fixed win32 non-ipv6 build 2748 * ipv6 on win32 "milestone": 1st snapshot that passes all unittests 2749 * document ipv6 milestone status 2750 * doc update w/unittests results 2751 * make possible to x-compile openvpn/win32 in Linux 2752 * correctly setup hints.ai_socktype for getaddrinfo(), althought sorta hacky, see TODO.ipv6. 2753 * renamed README.ipv6{.txt,} 2754 * updated {README,TODO}.ipv6 from feedback at openvpn-devel mlist 2755 * init.c: document the ENABLE_MANAGEMENT place to work on 2756 * init.c: small in-doc tweaks 2757 * fix multi-tcp crash (corrected assertion) 2758 * TODO.ipv6 update 2759 * socket.c: better buf logic in print_sockaddr_ex 2760 * fixed segfault for undef address family in print_sockaddr_ex (thanks Marcel!) 2761 * doc updates 2762 * openbsd: no IFF_MULTICAST, #ifdef around it 2763 * no new funcionality, just small cleanups 2764 * (prototype) fix for supporting "redirect-gateway" for tunneled ipv4 over ipv6 endpoints 2765 * polished redirect-gateway (ipv4 on ipv6 endpoints) support 2766 * updated doc 2767 * fix --disable-ipv6 build 2768 * doc updates 2769 * rebased to v2.1.1 release 2770 * undo mroute.c changes related to ipv6 payload 2771 * fix --multihome for ipv4 2772 * fix --multihome for ipv6 2773 * ipv6-0.4.14: fix xinetd usage 2774 * ipv6-0.4.15: add --multihome support to xBSD 2775 * ipv6-0.4.15b: rebase over openvpn-testing-master 2776 * ipv6-0.4.16: fix mingw32 build 2777 * make ipv6_payload compile under windowze 2778 USE_PF_INET6 by default for v2.3 2779 fix ipv6 compilation under macosx >= 1070 - v3 2780 2781Markus Koetter (1): 2782 Add extv3 X509 field support to --x509-username-field 2783 2784Matthew L. Creech (1): 2785 Fix 2.2.0 build failure when management interface disabled 2786 2787Matthias Andree (1): 2788 Skip rather than fail test in addressless FreeBSD jails. 2789 2790Robert Fischer (8): 2791 Update man page with info about --capath 2792 Update man page with info about --connect-timeout 2793 Added info about --show-proxy-settings 2794 Documented --x509-username-field option 2795 Documented --errors-to-stderr option 2796 Documented --push-peer-info option 2797 Update man page with info about --remote-random-hostname 2798 Added man page entry for --management-client 2799 2800Samuli Seppänen (19): 2801 Add man page entry for --redirect-private 2802 Change all CRLF linefeeds to LF linefeeds 2803 Fix a bug in devcon source code handling 2804 Removed Win2k from supported platforms list in INSTALL and win/openvpn.nsi 2805 Fixed copying of tapinstall.exe to dist/bin when using prebuilt TAP-drivers 2806 Fixed a bug with GUI icon deletion on upgrade from 2.2-RC or earlier 2807 Fix a build-ca issue on Windows 2808 Add new openssl.cnf to easy-rsa/Windows 2809 Updated "easy-rsa" for OpenSSL 1.0.0 2810 Made domake-win builds to use easy-rsa/2.0/openssl-1.0.0.cnf 2811 Fixes to easy-rsa/2.0 2812 Merged TODO.IPv6 with TODO.ipv6 and README.IPv6 with README.ipv6 2813 Fixed a number of fatal build errors on Visual Studio 2008 2814 Fix a Visual Studio 2008 build issue in socket.c 2815 Additional Visual Studio 2008 build fixes to tun.c 2816 Fixed a typo in win32.h that prevented building with Visual Studio 2817 Fixed a regression causing VS2008/Python build failure 2818 Fix a Visual Studio 2008 build error in tun.c 2819 Fix a Visual Studio 2008 build error in options.c 2820 2821Simon Matter (1): 2822 Fix issues with some older GCC compilers 2823 2824Stefan Hellermann (2): 2825 plugin.h: update prototype of plugin_call dummy in !ENABLE_PLUGIN case 2826 Fixed typo in plugin.h 2827 2828chantra (1): 2829 Clarify --tmp-dir option 2830 2831smos (1): 2832 Change the netsh.exe command from "add" to "set". 2833 28342011.12.25 -- Version 2.x-master 2835James Yonan (1): 2836 Added support for "on-link" routes on Linux client -- these are 2837 routes where the gateway is specified as an interface rather than 2838 an address. This allows redirect-gateway to work on Linux clients 2839 whose connection to the internet is via a point-to-point link 2840 such as PPP. 2841 2842 Note that at the moment, this capability is incompatible with 2843 the "redirect-gateway block-local" directive -- this is because 2844 the block-local directive blocks all traffic from the local LAN 2845 except for the local and gateway addresses. Since a PPP link 2846 is essentially a subnet of two addresses, local and remote (i.e. 2847 gateway), the set of addresses that would be blocked by block-local 2848 is empty. Therefore, the "redirect-gateway block-local" directive 2849 will be ignored on PPP links. 2850 2851 To view the OpenVPN client's current determination of the default 2852 gateway, use this command: 2853 2854 ./openvpn --show-gateway 2855 28562011.03.24 -- Version 2.2-RC2 2857Alon Bar-Lev (1): 2858 Windows cross-compile cleanup 2859 2860David Sommerseth (2): 2861 Open log files as text files on Windows 2862 Clarify default value for the --inactive option. 2863 2864Gert Doering (1): 2865 Implement IPv6 in TUN mode for Windows TAP driver. 2866 2867Samuli Seppänen (6): 2868 Added support for prebuilt TAP-drivers. Automated embedding manifests. 2869 Fixes to win/openvpn.nsi 2870 Replaced config-win32.h with win/config.h.in 2871 Updated INSTALL-win32.txt 2872 Fixes to Makefile.am 2873 Clarified --client-config-dir section on the man-page. 2874 2875Ville Skyttä (1): 2876 Fix line continuation in chkconfig init script description. 2877 28782011.02.28 -- Version 2.2-RC 2879David Sommerseth (3): 2880 Make the --x509-username-field feature an opt-in feature 2881 Fix compiler warning when compiling against OpenSSL 1.0.0 2882 Fix packaging of config-win32.h and service-win32/msvc.mak 2883 2884James Yonan (1): 2885 Minor addition of logging info before and after execution of Windows net commands. 2886 2887Matthias Andree (1): 2888 Change variadic macros to C99 style. 2889 2890Samuli Seppänen (15): 2891 Added ENABLE_PASSWORD_SAVE to config-win32.h 2892 Added a nmake makefile for openvpnserv.exe building 2893 Moved TAP-driver version info to version.m4. Cleaned up win/settings.in. 2894 Added helper functionality to win/wb.py 2895 Added support for viewing config-win32.h paramters to win/show.py 2896 Added comments and made small modifications to win/msvc.mak.in 2897 Added command-line switch to win/build_all.py to skip TAP driver building 2898 Added configure.h and version.m4 variable parsing to win/config.py 2899 Added openvpnserv.exe building to win/build.py 2900 Added comments to win/build_ddk.py 2901 Several modifications to win/make_dist.py to allow building the NSI installer 2902 Copied install-win32/setpath.nsi to win/setpath.nsi 2903 Added first version of NSI installer script to win/openvpn.nsi 2904 Changes to buildsystem patchset 2905 Temporary snprintf-related fix to service-win32/openvpnserv.c 2906 29072010.11.25 -- Version 2.2-beta5 2908 2909Samuli Seppänen (1): 2910 Fixed an issue causing a build failure with MS Visual Studio 2008. 2911 29122010.11.18 -- Version 2.2-beta4 2913 2914David Sommerseth (10): 2915 Clarified --explicit-exit-notify man page entry 2916 Clean-up: Remove pthread and mutex locking code 2917 Clean-up: Remove more dead and inactive code paths 2918 Clean-up: Removing useless code - hash related functions 2919 Use stricter snprintf() formatting in socks_username_password_auth() (v3) 2920 Fix compiler warnings about not used dummy() functions 2921 Fixed potential misinterpretation of boolean logic 2922 Only add some functions when really needed 2923 Removed functions not being used anywhere 2924 Merged add_bypass_address() and add_host_route_if_nonlocal() 2925 2926Gert Doering (3): 2927 Integrate support for TAP mode on Solaris, written by Kazuyoshi Aizawa <admin2@whiteboard.ne.jp>. 2928 Make "topology subnet" work on Solaris 2929 Improved man page entry for script_type 2930 2931James Yonan (5): 2932 Fixed initialization bug in route_list_add_default_gateway (Gert Doering). 2933 Implement challenge/response authentication support in client mode 2934 Make base64.h have the same conditional compilation expression as base64.c. 2935 Fixed compiling issues when using --disable-crypto 2936 In verify_callback, the subject var should be freed by OPENSSL_free, not free 2937 2938Jesse Young (1): 2939 Remove hardcoded path to resolvconf 2940 2941Lars Hupel (1): 2942 Add HTTP/1.1 Host header 2943 2944Pierre Bourdon (1): 2945 Adding support for SOCKS plain text authentication 2946 2947Samuli Seppänen (2): 2948 Added check for variable CONFIGURE_DEFINES into options.c 2949 Added command-line option parser and an unsigned build option to build_all.py 2950 29512010.08.21 -- Version 2.2-beta3 2952 2953* Attempt to fix issue where domake-win build system was not properly 2954 signing drivers and .exe files. 2955 2956 Added win/tap_span.py for building multiple versions of the TAP driver 2957 and tapinstall binaries using different DDK versions to span from Win2K 2958 to Win7 and beyond. 2959 2960* Community patches 2961 David Sommerseth (2): 2962 Test framework improvment - Do not FAIL if t_client.rc is missing 2963 More t_client.sh updates - exit with SKIP when we want to skip 2964 2965 Gert Doering (4): 2966 Fix compile problems on NetBSD and OpenBSD 2967 Fix <net/if.h> compile time problems on OpenBSD for good 2968 full "VPN client connect" test framework for OpenVPN 2969 Build t_client.sh by configure at run-time. 2970 2971 chantra (1): 2972 Fixes openssl-1.0.0 compilation warning 2973 29742010.08.16 -- Version 2.2-beta2 2975 2976* Windows security issue: 2977 Fixed potential local privilege escalation vulnerability in 2978 Windows service. The Windows service did not properly quote the 2979 executable filename passed to CreateService. A local attacker 2980 with write access to the root directory C:\ could create an 2981 executable that would be run with the same privilege level as 2982 the OpenVPN Windows service. However, since non-Administrative 2983 users normally lack write permission on C:\, this vulnerability 2984 is generally not exploitable except on older versions of Windows 2985 (such as Win2K) where the default permissions on C:\ would allow 2986 any user to create files there. 2987 Credit: Scott Laurie, MWR InfoSecurity 2988 2989* Added Python-based based alternative build system for Windows using 2990 Visual Studio 2008 (in win directory). 2991 2992* When aborting in a non-graceful way, try to execute do_close_tun in 2993 init.c prior to daemon exit to ensure that the tun/tap interface is 2994 closed and any added routes are deleted. 2995 2996* Fixed an issue where AUTH_FAILED was not being properly delivered 2997 to the client when a bad password is given for mid-session reauth, 2998 causing the connection to fail without an error indication. 2999 3000* Don't advance to the next connection profile on AUTH_FAILED errors. 3001 3002* Fixed an issue in the Management Interface that could cause 3003 a process hang with 100% CPU utilization in --management-client 3004 mode if the management interface client disconnected at the 3005 point where credentials are queried. 3006 3007* Fixed an issue where if reneg-sec was set to 0 on the client, 3008 so that the server-side value would take precedence, 3009 the auth_deferred_expire_window function would incorrectly 3010 return a window period of 0 seconds. In this case, the 3011 correct window period should be the handshake window 3012 period. 3013 3014* Modified ">PASSWORD:Verification Failed" management interface 3015 notification to include a client reason string: 3016 3017 >PASSWORD:Verification Failed: 'AUTH_TYPE' ['REASON_STRING'] 3018 3019* Enable exponential backoff in reliability layer 3020 retransmits. 3021 3022* Set socket buffers (SO_SNDBUF and SO_RCVBUF) immediately after 3023 socket is created rather than waiting until after connect/listen. 3024 3025* Management interface performance optimizations: 3026 3027 1. Added env-filter MI command to perform filtering on env vars 3028 passed through as a part of --management-client-auth 3029 3030 2. man_write will now try to aggregate output into larger blocks 3031 (up to 1024 bytes) for more efficient i/o 3032 3033* Fixed minor issue in Windows TAP driver DEBUG builds 3034 where non-null-terminated unicode strings were being 3035 printed incorrectly. 3036 3037* Fixed issue on Windows with MSVC compiler, where TCP_NODELAY support 3038 was not being compiled in. 3039 3040* Proxy improvements: 3041 3042 Improved the ability of http-auth "auto" flag to dynamically detect 3043 the auth method required by the proxy. 3044 3045 Added http-auth "auto-nct" flag to reject weak proxy auth methods. 3046 3047 Added HTTP proxy digest authentication method. 3048 3049 Removed extraneous openvpn_sleep calls from proxy.c. 3050 3051* Implemented http-proxy-override and http-proxy-fallback directives to make it 3052 easier for OpenVPN client UIs to start a pre-existing client config file with 3053 proxy options, or to adaptively fall back to a proxy connection if a direct 3054 connection fails. 3055 3056* Implemented a key/value auth channel from client to server. 3057 3058* Fixed issue where bad creds provided by the management interface 3059 for HTTP Proxy Basic Authentication would go into an infinite 3060 retry-fail loop instead of requerying the management interface for 3061 new creds. 3062 3063* Added support for MSVC debugging of openvpn.exe in settings.in: 3064 3065 # Build debugging version of openvpn.exe 3066 !define PRODUCT_OPENVPN_DEBUG 3067 3068* Implemented multi-address DNS expansion on the network field of route 3069 commands. 3070 3071 When only a single IP address is desired from a multi-address DNS 3072 expansion, use the first address rather than a random selection. 3073 3074* Added --register-dns option for Windows. 3075 3076 Fixed some issues on Windows with --log, subprocess creation 3077 for command execution, and stdout/stderr redirection. 3078 3079* Fixed an issue where application payload transmissions on the 3080 TLS control channel (such as AUTH_FAILED) that occur during 3081 or immediately after a TLS renegotiation might be dropped. 3082 3083* Added warning about tls-remote option in man page. 3084 30852009.12.11 -- Version 2.1.1 3086 3087* Fixed some breakage in openvpn.spec (which is required to build an 3088 RPM distribution) where it was referencing a non-existent 3089 subdirectory in the tarball, causing it to fail (patch from 3090 David Sommerseth). 3091 30922009.12.11 -- Version 2.1.0 3093 3094* Fixed a couple issues in sample plugins auth-pam.c and down-root.c. 3095 (1) Fail gracefully rather than segfault if calloc returns NULL. 3096 (2) The openvpn_plugin_abort_v1 function can potentially be called 3097 with handle == NULL. Add code to detect this case, and if so, avoid 3098 dereferencing pointers derived from handle (Thanks to David 3099 Sommerseth for finding this bug). 3100 3101* Documented "multihome" option in the man page. 3102 31032009.11.20 -- Version 2.1_rc22 3104 3105* Fixed a client-side bug on Windows that occurred when the 3106 "dhcp-pre-release" or "dhcp-renew" options were combined with 3107 "route-gateway dhcp". The release/renew would not occur 3108 because the Windows DHCP renew function is blocking and 3109 therefore must be called from another process or thread 3110 so as not to stall the tunnel. 3111 3112* Added a hard failure when peer provides a certificate chain 3113 with depth > 16. Previously, a warning was issued. 3114 31152009.11.12 -- Version 2.1_rc21 3116 3117* Rebuilt OpenVPN Windows installer with OpenSSL 0.9.8l to address 3118 CVE-2009-3555. Note that OpenVPN has never relied on the session 3119 renegotiation capabilities that are built into the SSL/TLS protocol, 3120 therefore the fix in OpenSSL 0.9.8l (disable SSL/TLS renegotiation 3121 completely) will not adversely affect OpenVPN mid-session SSL/TLS 3122 renegotation or any other OpenVPN capabilities. 3123 3124* Added additional session renegotiation hardening. OpenVPN has always 3125 required that mid-session renegotiations build up a new SSL/TLS 3126 session from scratch. While the client certificate common name is 3127 already locked against changes in mid-session TLS renegotiations, we 3128 now extend this locking to the auth-user-pass username as well as all 3129 certificate content in the full client certificate chain. 3130 31312009.10.01 -- Version 2.1_rc20 3132 3133* Fixed a bug introduced in 2.1_rc17 (svn r4436) where using the 3134 redirect-gateway option by itself, without any extra parameters, 3135 would cause the option to be ignored. 3136 3137* Fixed build problem when ./configure --disable-server is used. 3138 3139* Fixed ifconfig command for "topology subnet" on FreeBSD (Stefan Bethke). 3140 3141* Added --remote-random-hostname option. 3142 3143* Added "load-stats" management interface command to get global server 3144 load statistics. 3145 3146* Added new ./configure flags: 3147 3148 --disable-def-auth Disable deferred authentication 3149 --disable-pf Disable internal packet filter 3150 3151* Added "setcon" directive for interoperability with SELinux (Sebastien 3152 Raveau). 3153 3154* Optimized PUSH_REQUEST handshake sequence to shave several seconds 3155 off of a typical client connection initiation. 3156 3157* The maximum number of "route" directives (specified in the config 3158 file or pulled from a server) can now be configured via the new 3159 "max-routes" directive. 3160 3161* Eliminated the limitation on the number of options that can be pushed 3162 to clients, including routes. Previously, all pushed options needed 3163 to fit within a 1024 byte options string. 3164 3165* Added --server-poll-timeout option : when polling possible remote 3166 servers to connect to in a round-robin fashion, spend no more than 3167 n seconds waiting for a response before trying the next server. 3168 3169* Added the ability for the server to provide a custom reason string 3170 when an AUTH_FAILED message is returned to the client. This 3171 string can be set by the server-side managment interface and read 3172 by the client-side management interface. 3173 3174* client-kill management interface command, when issued on server, will 3175 now send a RESTART message to client. 3176 This feature is intended to make UDP clients respond the same as TCP 3177 clients in the case where the server issues a RESTART message in 3178 order to force the client to reconnect and pull a new options/route 3179 list. 3180 31812009.07.16 -- Version 2.1_rc19 3182 3183* In Windows TAP driver, refactor DHCP/ARP packet injection code to 3184 use a DPC (deferred procedure call) to defer packet injection until 3185 IRQL < DISPATCH_LEVEL, rather than calling NdisMEthIndicateReceive 3186 in the context of AdapterTransmit. This is an attempt to reduce kernel 3187 stack usage, and prevent EXCEPTION_DOUBLE_FAULT BSODs that have been 3188 observed on Vista. Updated TAP driver version number to 9.6. 3189 3190* In configure.ac, use datadir instead of datarootdir for compatibility 3191 with <autoconf-2.60. 3192 31932009.06.07 -- Version 2.1_rc18 3194 3195* Fixed compile error on ./configure --enable-small 3196 3197* Fixed issue introduced in r4475 (2.1-rc17) where cryptoapi.c change 3198 does not build on Windows on non-MINGW32. 3199 32002009.05.30 -- Version 2.1_rc17 3201 3202* Reduce the debug level (--verb) at which received management interface 3203 commands are echoed from 7 to 3. Passwords will be filtered. 3204 3205* Fixed race condition in management interface recv code on 3206 Windows, where sending a set of several commands to the 3207 management interface in quick succession might cause the 3208 latter commands in the set to be ignored. 3209 3210* Increased management interface input command buffer size 3211 from 256 to 1024 bytes. 3212 3213* Minor tweaks to Windows build system. 3214 3215* Added "redirect-private" option which allows private subnets 3216 to be pushed to the client in such a way that they don't accidently 3217 obscure critical local addresses such as the DHCP server address and 3218 DNS server addresses. 3219 3220* Added new 'autolocal' redirect-gateway flag. When enabled, the OpenVPN 3221 client will examine the routing table and determine whether (a) the 3222 OpenVPN server is reachable via a locally connected interface, or (b) 3223 traffic to the server must be forwarded through the default router. 3224 Only add a special bypass route for the OpenVPN server if (b) is true. 3225 If (a) is true, behave as if the 'local' flag is specified, and do not 3226 add a bypass route. 3227 3228 The new 'autolocal' flag depends on the non-portable test_local_addr() 3229 function in route.c, which is currently only implemented for Windows. 3230 The 'autolocal' flag will act as a no-op on platforms that have not 3231 yet defined a test_local_addr() function. 3232 3233* Increased TLS_CHANNEL_BUF_SIZE to 2048 from 1024 (this will allow for 3234 more option content to be pushed from server to client). 3235 3236* Raised D_MULTI_DROPPED debug level to 4 from 3 to filter out (at debug 3237 levels <=3) a common and usually innocuous warning. 3238 3239* Fixed issue of symbol conflicts interfering with Windows CryptoAPI 3240 functionality (Alon Bar-Lev). 3241 3242* Fixed bug where the remote_X environmental variables were not being 3243 set correctly when the 'local' option is specifed. 3244 32452009.05.17 -- Version 2.1_rc16 3246 3247* Windows installer changes: 3248 3249 1. ifdefed out the check Windows version code which is causing 3250 problems on Windows 7 3251 3252 2. don't define SF_SELECTED if it is already defined 3253 3254 3. Use LZMA instead of BZIP2 compression for better compression 3255 3256 4. Upgraded OpenSSL to 0.9.8k 3257 3258* Added the ability to read the configuration file 3259 from stdin, when "stdin" is given as the config 3260 file name. 3261 3262* Allow "management-client" directive to be used 3263 with unix domain sockets. 3264 3265* Added errors-to-stderr option. When enabled, fatal errors 3266 that result in the termination of the daemon will be written 3267 to stderr. 3268 3269* Added optional "nogw" (no gateway) flag to --server-bridge 3270 to inhibit the pushing of the route-gateway parameter to 3271 clients. 3272 3273* Added new management interface command "pid" to show the 3274 process ID of the current OpenVPN process (Angelo Laub). 3275 3276* Fixed issue where SIGUSR1 restarts would fail if private 3277 key was specified as an inline file. 3278 3279* Added daemon_start_time and daemon_pid environmental variables. 3280 3281* In management interface, added new ">CLIENT:ESTABLISHED" notification. 3282 3283* Build fixes: 3284 3285 1. Fixed some issues with C++ style comments that leaked into the code. 3286 3287 2. Updated configure.ac to work on MinGW64. 3288 3289 3. Updated common.h types for _WIN64. 3290 3291 4. Fixed issue involving an #ifdef in a macro reference that breaks early gcc 3292 compilers. 3293 3294 5. In cryptoapi.c, renamed CryptAcquireCertificatePrivateKey to 3295 OpenVPNCryptAcquireCertificatePrivateKey to work around 3296 a symbol conflict in MinGW-5.1.4. 3297 32982008.11.19 -- Version 2.1_rc15 3299 3300* Fixed issue introduced in 2.1_rc14 that may cause a 3301 segfault when a --plugin module is used. 3302 3303* Added server-side --opt-verify option: clients that connect 3304 with options that are incompatible with those of the server 3305 will be disconnected (without this option, incompatible 3306 clients would trigger a warning message in the server log 3307 but would not be disconnected). 3308 3309* Added --tcp-nodelay option: Macro that sets TCP_NODELAY socket 3310 flag on the server as well as pushes it to connecting clients. 3311 3312* Minor options check fix: --no-name-remapping is a 3313 server-only option and should therefore generate an 3314 error when used on the client. 3315 3316* Added --prng option to control PRNG (pseudo-random 3317 number generator) parameters. In previous OpenVPN 3318 versions, the PRNG was hardcoded to use the SHA1 3319 hash. Now any OpenSSL hash may be used. This is 3320 part of an effort to remove hardcoded references to 3321 a specific cipher or cryptographic hash algorithm. 3322 3323* Cleaned up man page synopsis. 3324 33252008.11.16 -- Version 2.1_rc14 3326 3327* Added AC_GNU_SOURCE to configure.ac to enable struct ucred, 3328 with the goal of fixing a build issue on Fedora 9 that was 3329 introduced in 2.1_rc13. 3330 3331* Added additional method parameter to --script-security to preserve 3332 backward compatibility with system() call semantics used in OpenVPN 3333 2.1_rc8 and earlier. To preserve backward compatibility use: 3334 3335 script-security 3 system 3336 3337* Added additional warning messages about --script-security 2 3338 or higher being required to execute user-defined scripts or 3339 executables. 3340 3341* Windows build system changes: 3342 3343 Modified Windows domake-win build system to write all openvpn.nsi 3344 input files to gen, so that gen can be disconnected from 3345 the rest of the source tree and makensis openvpn.nsi will 3346 still function correctly. 3347 3348 Added additional SAMPCONF_(CA|CRT|KEY) macros to settings.in 3349 (commented out by default). 3350 3351 Added optional files SAMPCONF_CONF2 (second sample configuration 3352 file) and SAMPCONF_DH (Diffie-Helman parameters) to Windows 3353 build system, and may be defined in settings.in. 3354 3355* Extended Management Interface "bytecount" command 3356 to work when OpenVPN is running as a server. 3357 Documented Management Interface "bytecount" command in 3358 management/management-notes.txt. 3359 3360* Fixed informational message in ssl.c to properly indicate 3361 deferred authentication. 3362 3363* Added server-side --auth-user-pass-optional directive, to allow 3364 connections by clients that do not specify a username/password, when a 3365 user-defined authentication script/module is in place (via 3366 --auth-user-pass-verify, --management-client-auth, or a plugin module). 3367 3368* Changes to easy-rsa/2.0/pkitool and related openssl.cnf: 3369 3370 Calling scripts can set the KEY_NAME environmental variable to set 3371 the "name" X509 subject field in generated certificates. 3372 3373 Modified pkitool to allow flexibility in separating the Common Name 3374 convention from the cert/key filename convention. 3375 3376 For example: 3377 3378 KEY_CN="James's Laptop" KEY_NAME="james" ./pkitool james 3379 3380 will create a client certificate/key pair of james.crt/james.key 3381 having a Common Name of "James's Laptop" and a Name of "james". 3382 3383* Added --no-name-remapping option to allow Common Name, X509 Subject, 3384 and username strings to include any printable character including 3385 space, but excluding control characters such as tab, newline, and 3386 carriage-return (this is important for compatibility with external 3387 authentication systems). 3388 3389 As a related change, added --status-version 3 format (and "status 3" 3390 in the management interface) which uses the version 2 format except 3391 that tabs are used as delimiters instead of commas so that there 3392 is no ambiguity when parsing a Common Name that contains a comma. 3393 3394 Also, save X509 Subject fields to environment, using the naming 3395 convention: 3396 3397 X509_{cert_depth}_{name}={value} 3398 3399 This is to avoid ambiguities when parsing out the X509 subject string 3400 since "/" characters could potentially be used in the common name. 3401 3402* Fixed some ifconfig-pool issues that precluded it from being combined 3403 with --server directive. 3404 3405 Now, for example, we can configure thusly: 3406 3407 server 10.8.0.0 255.255.255.0 nopool 3408 ifconfig-pool 10.8.0.2 10.8.0.99 255.255.255.0 3409 3410 to have ifconfig-pool manage only a subset 3411 of the VPN subnet. 3412 3413* Added config file option "setenv FORWARD_COMPATIBLE 1" to relax 3414 config file syntax checking to allow directives for future OpenVPN 3415 versions to be ignored. 3416 34172008.10.07 -- Version 2.1_rc13 3418 3419* Bundled OpenSSL 0.9.8i with Windows installer. 3420 3421* Management interface can now listen on a unix 3422 domain socket, for example: 3423 3424 management /tmp/openvpn unix 3425 3426 Also added management-client-user and management-client-group 3427 directives to control which processes are allowed to connect 3428 to the socket. 3429 3430* Copyright change to OpenVPN Technologies, Inc. 3431 34322008.09.23 -- Version 2.1_rc12 3433 3434* Patched Makefile.am so that the new t_cltsrv-down.sh script becomes 3435 part of the tarball (Matthias Andree). 3436 3437* Fixed --lladdr bug introduced in 2.1-rc9 where input validation code 3438 was incorrectly expecting the lladdr parameter to be an IP address 3439 when it is actually a MAC address (HoverHell). 3440 34412008.09.14 -- Version 2.1_rc11 3442 3443* Fixed a bug that can cause SSL/TLS negotiations in UDP mode 3444 to fail if UDP packets are dropped. 3445 34462008.09.10 -- Version 2.1_rc10 3447 3448* Added "--server-bridge" (without parameters) to enable 3449 DHCP proxy mode: Configure server mode for ethernet 3450 bridging using a DHCP-proxy, where clients talk to the 3451 OpenVPN server-side DHCP server to receive their IP address 3452 allocation and DNS server addresses. 3453 3454* Added "--route-gateway dhcp", to enable the extraction 3455 of the gateway address from a DHCP negotiation with the 3456 OpenVPN server-side LAN. 3457 3458* Fixed minor issue with --redirect-gateway bypass-dhcp or bypass-dns 3459 on Windows. If the bypass IP address is 0.0.0.0 or 255.255.255.255, 3460 ignore it. 3461 3462* Warn when ethernet bridging that the IP address of the bridge adapter 3463 is probably not the same address that the LAN adapter was set to 3464 previously. 3465 3466* When running as a server, warn if the LAN network address is 3467 the all-popular 192.168.[0|1].x, since this condition commonly 3468 leads to subnet conflicts down the road. 3469 3470* Primarily on the client, check for subnet conflicts between 3471 the local LAN and the VPN subnet. 3472 3473* Added a 'netmask' parameter to get_default_gateway, to return 3474 the netmask of the adapter containing the default gateway. 3475 Only implemented on Windows so far. Other platforms will 3476 return 255.255.255.0. Currently the netmask information is 3477 only used to warn about subnet conflicts. 3478 3479* Minor fix to cryptoapi.c to not compile itself unless USE_CRYPTO 3480 and USE_SSL flags are enabled (Alon Bar-Lev). 3481 3482* Updated openvpn/t_cltsrv.sh (used by "make check") to conform to new 3483 --script-security rules. Also adds retrying if the addresses are in 3484 use (Matthias Andree). 3485 3486* Fixed build issue with ./configure --disable-socks --disable-http. 3487 3488* Fixed separate compile errors in options.c and ntlm.c that occur 3489 on strict C compilers (such as old versions of gcc) that require 3490 that C variable declarations occur at the start of a {} block, 3491 not in the middle. 3492 3493* Workaround bug in OpenSSL 0.9.6b ASN1_STRING_to_UTF8, which 3494 the new implementation of extract_x509_field_ssl depends on. 3495 3496* LZO compression buffer overflow errors will now invalidate 3497 the packet rather than trigger a fatal assertion. 3498 3499* Fixed minor compile issue in ntlm.c (mid-block declaration). 3500 3501* Added --allow-pull-fqdn option which allows client to pull DNS names 3502 from server (rather than only IP address) for --ifconfig, --route, and 3503 --route-gateway. OpenVPN versions 2.1_rc7 and earlier allowed DNS names 3504 for these options to be pulled and translated to IP addresses by default. 3505 Now --allow-pull-fqdn will be explicitly required on the client to enable 3506 DNS-name-to-IP-address translation of pulled options. 3507 3508* 2.1_rc8 and earlier did implicit shell expansion on script 3509 arguments since all scripts were called by system(). 3510 The security hardening changes made to 2.1_rc9 no longer 3511 use system(), but rather use the safer execve or CreateProcess 3512 system calls. The security hardening also introduced a 3513 backward incompatibility with 2.1_rc8 and earlier in that 3514 script parameters were no longer shell-expanded, so 3515 for example: 3516 3517 client-connect "docc CLIENT-CONNECT" 3518 3519 would fail to work because execve would try to execute 3520 a script called "docc CLIENT-CONNECT" instead of "docc" 3521 with "CLIENT-CONNECT" as the first argument. 3522 3523 This patch fixes the issue, bringing the script argument 3524 semantics back to pre 2.1_rc9 behavior in order to preserve 3525 backward compatibility while still using execve or CreateProcess 3526 to execute the script/executable. 3527 3528* Modified ip_or_dns_addr_safe, which validates pulled DNS names, 3529 to more closely conform to RFC 3696: 3530 3531 (1) DNS name length must not exceed 255 characters 3532 3533 (2) DNS name characters must be limited to alphanumeric, 3534 dash ('-'), and dot ('.') 3535 3536* Fixed bug in intra-session TLS key rollover that was introduced with 3537 deferred authentication features in 2.1_rc8. 3538 35392008.07.31 -- Version 2.1_rc9 3540 3541* Security Fix -- affects non-Windows OpenVPN clients running 3542 OpenVPN 2.1-beta14 through 2.1-rc8 (OpenVPN 2.0.x clients are NOT 3543 vulnerable nor are any versions of the OpenVPN server vulnerable). 3544 An OpenVPN client connecting to a malicious or compromised 3545 server could potentially receive an "lladdr" or "iproute" configuration 3546 directive from the server which could cause arbitrary code execution on 3547 the client. A successful attack requires that (a) the client has agreed 3548 to allow the server to push configuration directives to it by including 3549 "pull" or the macro "client" in its configuration file, (b) the client 3550 successfully authenticates the server, (c) the server is malicious or has 3551 been compromised and is under the control of the attacker, and (d) the 3552 client is running a non-Windows OS. Credit: David Wagner. 3553 CVE-2008-3459 3554 3555* Miscellaneous defensive programming changes to multiple 3556 areas of the code. In particular, use of the system() call 3557 for calling executables such as ifconfig, route, and 3558 user-defined scripts has been completely revamped in favor 3559 of execve() on unix and CreateProcess() on Windows. 3560 3561* In Windows build, package a statically linked openssl.exe to work around 3562 observed instabilities in the dynamic build since the migration to 3563 OpenSSL 0.9.8h. 3564 35652008.06.11 -- Version 2.1_rc8 3566 3567* Added client authentication and packet filtering capability 3568 to management interface. In addition, allow OpenVPN plugins 3569 to take advantage of deferred authentication and packet 3570 filtering capability. 3571 3572* Added support for client-side connection profiles. 3573 3574* Fixed unbounded memory growth bug in environmental variable 3575 code that could have caused long-running OpenVPN sessions 3576 with many TLS renegotiations to incrementally 3577 increase memory usage over time. 3578 3579* Windows release now packages openssl-0.9.8h. 3580 3581* Build system changes -- allow building on Windows using 3582 autoconf/automake scripts (Alon Bar-Lev). 3583 3584* Changes to Windows build system to make it easier to do 3585 partial builds, with a reduced set of prerequisites, 3586 where only a subset of OpenVPN installer 3587 components are built. See ./domake-win comments. 3588 3589* Cleanup IP address for persistence interfaces for tap and also 3590 using ifconfig, gentoo#209055 (Alon Bar-Lev). 3591 3592* Fall back to old version of extract_x509_field for OpenSSL 0.9.6. 3593 3594* Clarified tcp-queue-limit man page entry (Matti Linnanvuori). 3595 3596* Added new OpenVPN icon and installer graphic. 3597 3598* Minor pkitool changes. 3599 3600* Added --pkcs11-id-management option, which will cause OpenVPN to 3601 query the management interface via the new NEED-STR asynchronous 3602 notification query to get additional PKCS#11 options (Alon Bar-Lev). 3603 3604* Added NEED-STR management interface asynchronous query and 3605 "needstr" management interface command to respond to the query 3606 (Alon Bar-Lev). 3607 3608* Added Dragonfly BSD support (Francis-Gudin). 3609 3610* Quote device names before passing to up/down script (Josh Cepek). 3611 3612* Bracketed struct openvpn_pktinfo with #pragma pack(1) to 3613 prevent structure padding from causing an incorrect length 3614 to be returned by sizeof (struct openvpn_pktinfo) on 64-bit 3615 platforms. 3616 3617* On systems that support res_init, always call it 3618 before calling gethostbyname to ensure that 3619 resolver configuration state is current. 3620 3621* Added NTLMv2 proxy support (Miroslav Zajic). 3622 3623* Fixed an issue in extract_x509_field_ssl where the extraction 3624 would fail on the first field of the subject name, such as 3625 the common name in: /CN=foo/emailAddress=foo@bar.com 3626 3627* Made "Linux ip addr del failed" error nonfatal. 3628 3629* Amplified --client-cert-not-required warning. 3630 3631* Added #pragma pack to proto.h. 3632 36332008.01.29 -- Version 2.1_rc7 3634 3635* Added a few extra files that exist in the svn repo but were 3636 not being copied into the tarball by make dist. 3637 3638* Fixup null interface on close, don't use ip addr flush (Alon Bar-Lev). 3639 36402008.01.24 -- Version 2.1_rc6 3641 3642* Fixed options checking bug introduced in rc5 where legitimate configuration 3643 files might elicit the error: "Options error: Parameter pkcs11_private_mode 3644 can only be specified in TLS-mode, i.e. where --tls-server or --tls-client 3645 is also specified." 3646 36472008.01.23 -- Version 2.1_rc5 3648 3649* Fixed Win2K TAP driver bug that was introduced by Vista fixes, 3650 incremented driver version to 9.4. 3651 3652* Windows build system changes: 3653 3654 Incremented included OpenSSL version to openssl-0.9.7m. 3655 3656 Updated openssl.patch for openssl-0.9.7m and added some 3657 brief usage comments to the head of the patch. 3658 3659 Added build-pkcs11-helper.sh for building the pkcs11-helper 3660 library. 3661 3662 Integrated inclusion of pkcs11-helper into Windows build 3663 system. 3664 3665 Upgraded TAP build scripts to use WDK 6001.17121 3666 (Windows 2008 Server pre-RTM). 3667 3668* Windows installer changes: 3669 3670 Clean up the start menu folder. 3671 3672 Allow for a site-specific sample configuration file and keys 3673 to be included in a custom installer (see SAMPCONF macros 3674 in settings.in). 3675 3676 New icon (temporary). 3677 3678* Added "forget-passwords" command to the management interface 3679 (Alon Bar-Lev). 3680 3681* Added --management-signal option to signal SIGUSR1 when the 3682 management interface disconnects (Alon Bar-Lev). 3683 3684* Modified command line and config file parser to allow 3685 quoted strings using single quotes ('') (Alon Bar-Lev). 3686 3687* Use pkcs11-helper as external library, can be downloaded from 3688 https://www.opensc-project.org/pkcs11-helper (Alon Bar-Lev). 3689 3690* Fixed interim memory growth issue in TCP connect loop where 3691 "TCP: connect to %s failed, will try again in %d seconds: %s" 3692 is output. 3693 3694* Fixed bug in epoll driver in event.c, where the lack of a 3695 handler for EPOLLHUP could cause 99% CPU usage. 3696 3697* Defined ALLOW_NON_CBC_CIPHERS for people who don't 3698 want to use a CBC cipher for OpenVPN's data channel. 3699 3700* Added PLUGIN_LIBDIR preprocessor string to prepend a default 3701 plugin directory to the dlopen search list when the user 3702 specifies the basename of the plugin only (Marius Tomaschewski). 3703 3704* Rewrote extract_x509_field and modified COMMON_NAME_CHAR_CLASS 3705 to allow forward slash characters ("/") in the X509 common name 3706 (Pavel Shramov). 3707 3708* Allow OpenVPN to run completely unprivileged under Linux 3709 by allowing openvpn --mktun to be used with --user and --group 3710 to set the UID/GID of the tun device node. Also added --iproute 3711 option to allow an alternative command to be executed in place 3712 of the default iproute2 command (Alon Bar-Lev). 3713 3714* Fixed --disable-iproute2 in ./configure to actually disable 3715 iproute2 usage (Alon Bar-Lev). 3716 3717* Added --management-forget-disconnect option -- forget 3718 passwords when management session disconnects (Alon Bar-Lev). 3719 37202007.04.25 -- Version 2.1_rc4 3721 3722* Worked out remaining issues with TAP driver signing 3723 on Vista x64. OpenVPN will now run on Vista x64 3724 with driver signing enforcement enabled. 3725 3726* Fixed 64-bit portability bug in time_string function 3727 (Thomas Habets). 3728 37292007.04.22 -- Version 2.1_rc3 3730 3731* Additional fixes to TAP driver for Windows x64. Driver 3732 now runs successfully on Vista x64 if driver signing 3733 enforcement is disabled. 3734 3735* The Windows Installer and TAP driver are now signed by 3736 OpenVPN Solutions LLC (in addition to the usual GnuPG 3737 signatures). 3738 3739* Added OpenVPN GUI (Mathias Sundman version) as install 3740 option in Windows installer. 3741 3742* Clean up configure on FreeBSD for recent autotool versions 3743 that require that all .h files have to be compiled. 3744 Also, FreeBSD install does not support GNU long options 3745 which the Makefile in easy-rsa/2.0 uses (not checked the 3746 others as we don't install those on Gentoo) (Roy Marples). 3747 3748* Added additional scripts to easy-rsa/Windows for working 3749 with password-protected keys; also add -extensions server 3750 option when generating server cert via 3751 build-key-server-pass.bat (Daniel Zauft). 3752 37532007.02.27 -- Version 2.1_rc2 3754 3755* auth-pam change: link with -lpam rather 3756 than dlopen (Roy Marples). 3757 3758* Prevent SIGUSR1 or SIGHUP from causing program 3759 exit from initial management hold. 3760 3761* SO_REUSEADDR should not be set on Windows TCP sockets 3762 because it will cause bind to succeed on port conflicts. 3763 3764* Added time_ascii, time_duration, and time_unix 3765 environmental variables for plugins and callback 3766 scripts. 3767 3768* Fixed issue where OpenVPN does not apply the --txqueuelen option 3769 to persistent interfaces made with --mktun (Roy Marples). 3770 3771* Attempt at rational signal handling when in the 3772 management hold state. During management hold, ignore 3773 SIGUSR1/SIGHUP signals thrown with the "signal" command. 3774 Also, "signal" command will now apply remapping as 3775 specified with the --remap-usr1 option. 3776 When a signal entered using the "signal" command from a management 3777 hold is ignored, output: >HOLD:Waiting for hold release 3778 3779* Fixed issue where struct env_set methods that 3780 change the value of an existing name=value pair 3781 would delay the freeing of the memory held by 3782 the previous name=value pair until the underlying 3783 client instance object is closed. 3784 This could cause a server that handles long-term 3785 client connections, resulting in many periodic calls 3786 to verify_callback, to needlessly grow the env_set 3787 memory allocation until the underlying client instance 3788 object is closed. 3789 3790* Renamed TAP-Win32 driver from tap0801.sys to tap0901.sys 3791 to reflect the fact that Vista has blacklisted the tap0801.sys 3792 file name due to previous compatibility issues which have now 3793 been resolved. TAP-Win32 major/minor version number is now 9/1. 3794 3795* Windows installer will delete a previously installed 3796 tap0801.sys TAP driver before installing tap0901.sys. 3797 3798* Added code to Windows installer to fail gracefully on 64 bit 3799 installs until 64-bit TAP driver issues can be resolved. 3800 3801* Added code to Windows installer to fail gracefully on 3802 versions of Windows which are not explicitly supported. 3803 3804* The Windows version will now use a default route-delay 3805 of 5 seconds to deal with an apparent routing table race 3806 condition on Vista. 3807 3808* Worked around an incompatibility in the Windows Vista 3809 version of CreateIpForwardEntry as described in 3810 http://www.nynaeve.net/?p=59 3811 This issue would cause route additions using the 3812 IP Helper API to fail on Vista. 3813 3814* On Windows, revert to "ip-win32 dynamic" as the default. 3815 38162006.10.31 -- Version 2.1_rc1 3817 3818* Support recovery (return to hold) from signal at 3819 management password prompt. 3820 3821* Added workaround for OpenSC PKCS#11 bug#108 3822 (Alon Bar-Lev). 3823 38242006.10.01 -- Version 2.1-beta16 3825 3826* Windows installer updated with OpenSSL 0.9.7l DLLs to fix 3827 published vulnerabilities. 3828 3829* Fixed TAP-Win32 bug that caused BSOD on Windows Vista 3830 (Henry Nestler). 3831 3832* Autodetect 32/64 bit Windows in installer and install 3833 appropriate TAP driver (Mathias Sundman, Hypherion). 3834 3835* Fixed bug in loopback self-test introduced 3836 in 2.1-beta15 where self test as invoked by 3837 "make check" would not properly exit after 3838 2 minutes (Paul Howarth). 3839 38402006.09.12 -- Version 2.1-beta15 3841 3842* Windows installer updated with OpenSSL 0.9.7k DLLs to fix 3843 RSA Signature Forgery (CVE-2006-4339). 3844 3845* Fixed bug introduced with the --port-share directive 3846 (back in 2.1-beta9 which causes TLS soft resets 3847 (1 per hour by default) in TCP server mode to force 3848 a blockage of tunnel packets and later time-out and 3849 restart the connection. 3850 3851* easy-rsa update (Alon Bar-Lev) 3852 Makefile (install) is now available so that 3853 distribs will be able to install it safely. 3854 3855* PKCS#11 changes: (Alon Bar-Lev) 3856 - Modified ssl.c to not FATAL and return to init.c 3857 so auth-retry will work. 3858 - Modifed pkcs11-helper.c to fix some problem with 3859 multiple providers. 3860 - Added retry counter to PKCS#11 PIN hook. 3861 - Modified PKCS#11 PIN retry loop to return correct error 3862 code when PIN is incorrect. 3863 - Fix handling (ignoring) zero sized attributes. 3864 - Fix gcc-2 issues. 3865 - Fix openssl 0.9.6 (first version) issues. 3866 3867* Minor fixes of lladdr (Alon Bar-Lev) 3868 Updated makefile.w32-vc to include lladdr.*, updated 3869 linkage libraries. 3870 Modified lladdr.c to be compiled under visual C. 3871 3872* Added two new management states: 3873 OPENVPN_STATE_RESOLVE -- DNS lookup 3874 OPENVPN_STATE_TCP_CONNECT -- Connecting to TCP server 3875 3876* Echo management state change to log. 3877 3878* Minor syshead.h change for NetBSD to allow 3879 TCP_NODELAY flag to work. 3880 3881* Modified --port-share code to remove the assumption that 3882 CMSG_SPACE always evaluates to a constant, to enable 3883 compilation on NetBSD and possibly other BSDs as well. 3884 3885* Eliminated gcc 3.3.3 warnings on NetBSD 3886 when ./configure --enable-strict is used. 3887 3888* Added optional minimum-number-of-bytes parameter 3889 to --inactive directive. 3890 38912006.04.13 -- Version 2.1-beta14 3892 3893* Fixed Windows server bug in time backtrack handling code which 3894 could cause TLS negotiation failures on legitimate clients. 3895 3896* Rewrote gettimeofday function for Windows to be 3897 simpler and more efficient. 3898 3899* Merged PKCS#11 extensions to easy-rsa/2.0 (Alon Bar-Lev). 3900 3901* Added --route-metric option to set a default route metric 3902 for --route (Roy Marples). 3903 3904* Added --lladdr option to specify the link layer (MAC) address 3905 for the tap interface on non-Windows platforms (Roy Marples). 3906 39072006.04.12 -- Version 2.1-beta13 3908 3909* Code added in 2.1-beta7 and 2.0.6-rc1 to extend byte counters 3910 to 64 bits caused a bug in the Windows version which has now 3911 been fixed. The bug could cause intermittent crashes. 3912 39132006.04.05 -- Version 2.1-beta12 3914 3915* Security Vulnerability -- An OpenVPN client connecting to a 3916 malicious or compromised server could potentially receive 3917 "setenv" configuration directives from the server which could 3918 cause arbitrary code execution on the client via a LD_PRELOAD 3919 attack. A successful attack appears to require that (a) the 3920 client has agreed to allow the server to push configuration 3921 directives to it by including "pull" or the macro "client" in 3922 its configuration file, (b) the client configuration file uses 3923 a scripting directive such as "up" or "down", (c) the client 3924 succesfully authenticates the server, (d) the server is 3925 malicious or has been compromised and is under the control of 3926 the attacker, and (e) the attacker has at least some level of 3927 pre-existing control over files on the client (this might be 3928 accomplished by having the server respond to a client web request 3929 with a specially crafted file). Credit: Hendrik Weimer. 3930 CVE-2006-1629. 3931 3932 The fix is to disallow "setenv" to be pushed to clients from 3933 the server, and to add a new directive "setenv-safe" which is 3934 pushable from the server, but which appends "OPENVPN_" to the 3935 name of each remotely set environmental variable. 3936 3937* "topology subnet" fix for FreeBSD (Benoit Bourdin). 3938 3939* PKCS11 fixes (Alon Bar-Lev). For full description: 3940 svn log -r990 http://svn.openvpn.net/projects/openvpn/branches/BETA21 3941 3942* When deleting routes under Linux, use the route metric 3943 as a differentiator to ensure that the route teardown 3944 process only deletes the identical route which was originally 3945 added via the "route" directive (Roy Marples). 3946 3947* Fix the t_cltsrv.sh file in FreeBSD 4 jails 3948 (Matthias Andree, Dirk Meyer, Vasil Dimov). 3949 3950* Extended tun device configure code to support ethernet 3951 bridging on NetBSD (Emmanuel Kasper). 3952 39532006.02.19 -- Version 2.1-beta11 3954 3955* Fixed --port-share bug that caused premature closing 3956 of proxied sessions. 3957 39582006.02.17 -- Version 2.1-beta10 3959 3960* Fixed --port-share breakage introduced in 2.1-beta9. 3961 39622006.02.16 -- Version 2.1-beta9 3963 3964* Added --port-share option for allowing OpenVPN and HTTPS 3965 server to share the same port number. 3966* Added --management-client option to connect as a client 3967 to management GUI app rather than be connected to as a 3968 server. 3969* Added "bytecount" command to management interface. 3970* --remote-cert-tls fixes (Alon Bar-Lev). 3971 39722006.01.03 -- Version 2.1-beta8 3973 3974* --remap-usr1 will now also remap signals thrown during 3975 initialization. 3976* Added --connect-timeout option to control the timeout 3977 on TCP client connection attempts (doesn't work on all 3978 OSes). This patch also makes OpenVPN signalable during 3979 TCP connection attempts. 3980* Fixed bug in acinclude.m4 where capability of compiler 3981 to handle zero-length arrays in structs is tested 3982 (David Stipp). 3983* Fixed typo in manage.c where inline function declaration 3984 was declared without the "static" keyword (David Stipp). 3985* Patch to support --topology subnet on Mac OS X (Mathias Sundman). 3986* Added --auto-proxy directive to auto-detect HTTP or SOCKS 3987 proxy settings (currently Windows only). 3988* Removed redundant base64 code. 3989* Better sanity checking of --server and --server-bridge 3990 IP pool ranges, so as not to hit the assertion at 3991 pool.c:119 (2.0.5). 3992* Fixed bug where --daemon and --management-query-passwords 3993 used together would cause OpenVPN to block prior to 3994 daemonization. 3995* Fixed client/server race condition which could occur 3996 when --auth-retry interact is set and the initially 3997 provided auth-user-pass credentials are incorrect, 3998 forcing a username/password re-query. 3999* Fixed bug where if --daemon and --management-hold are 4000 used together, --user or --group options would be ignored. 4001* --ip-win32 adaptive is now the default. 4002* --ip-win32 netsh (or --ip-win32 adaptive when in netsh 4003 mode) can now set DNS/WINS addresses on the TAP-Win32 4004 adapter. 4005* Added new option --route-method adaptive (Win32) 4006 which tries IP helper API first, then falls back to 4007 route.exe. 4008* Made --route-method adaptive the default. 4009 40102005.11.12 -- Version 2.1-beta7 4011 4012* Allow blank passwords to be passed via the management 4013 interface. 4014* Fixed bug where "make check" inside a FreeBSD "jail" 4015 would never complete (Matthias Andree). 4016* Fixed bug where --server directive in --dev tap mode 4017 claimed that it would support subnets of /30 or less 4018 but actually would only accept /29 or less. 4019* Extend byte counters to 64 bits (M. van Cuijk). 4020* Fixed bug in Linux get_default_gateway function 4021 introduced in 2.0.4, which would cause redirect-gateway 4022 on Linux clients to fail. 4023* Moved easy-rsa 2.0 scripts to easy-rsa/2.0 to 4024 be compatible with 2.0.x distribution. 4025* Documented --route-nopull. 4026* Documented --ip-win32 adaptive. 4027* Windows build now linked with LZO2. 4028* Allow ca, cert, key, and dh files to be specified 4029 inline via XML-like syntax without needing to 4030 reference an explicit file. 4031 For example: 4032 <ca> 4033 data here... 4034 </ca> 4035* Allow plugin and push directives to have multi-line 4036 parameter lists such as: 4037 <plugin> 4038 my-plugin.so 4039 parm1 4040 parm2 4041 </plugin> 4042* Added connect-retry-max option (Alon Bar-Lev). 4043* Fixed problems where signals thrown during initialization 4044 were not returning to a management-hold state. 4045* Added a backtrack-hardened system time algorithm. 4046* Added --remote-cert-ku, --remote-cert-eku, and 4047 --remote-cert-tls options for verifying certificate 4048 attributes (Alon Bar-Lev). 4049* For Windows, reverted --ip-win32 default back to "dynamic". 4050 To use new adaptive mode, set explicitly. 4051 40522005.11.01 -- Version 2.1-beta6 4053 4054* Security fix (merged from 2.0.4) -- Affects non-Windows 4055 OpenVPN clients of version 2.0 or higher which connect to 4056 a malicious or compromised server. A format string 4057 vulnerability in the foreign_option function in options.c 4058 could potentially allow a malicious or compromised server 4059 to execute arbitrary code on the client. Only 4060 non-Windows clients are affected. The vulnerability 4061 only exists if (a) the client's TLS negotiation with 4062 the server succeeds, (b) the server is malicious or 4063 has been compromised such that it is configured to 4064 push a maliciously crafted options string to the client, 4065 and (c) the client indicates its willingness to accept 4066 pushed options from the server by having "pull" or 4067 "client" in its configuration file (Credit: Vade79). 4068 CVE-2005-3393 4069* Security fix -- (merged from 2.0.4) Potential DoS 4070 vulnerability on the server in TCP mode. If the TCP 4071 server accept() call returns an error status, the resulting 4072 exception handler may attempt to indirect through a NULL 4073 pointer, causing a segfault. Affects all OpenVPN 2.0 versions. 4074 CVE-2005-3409 4075* Fix attempt of assertion at multi.c:1586 (note that 4076 this precise line number will vary across different 4077 versions of OpenVPN). 4078* Windows reliability changes: 4079 (a) Added code to make sure that the local PATH environmental 4080 variable points to the Windows system32 directory. 4081 (b) Added new --ip-win32 adaptive mode which tries 'dynamic' 4082 and then fails over to 'netsh' if the DHCP negotiation fails. 4083 (c) Made --ip-win32 adaptive the default. 4084* More PKCS#11 additions/changes (Alon Bar-Lev). 4085* Added ".PHONY: plugin" to Makefile.am to work around 4086 "make dist" issue. 4087* Fixed double fork issue that occurs when --management-hold 4088 is used. 4089* Moved TUN/TAP read/write log messages from --verb 8 to 6. 4090* Warn when multiple clients having the same common name or 4091 username usurp each other when --duplicate-cn is not used. 4092* Modified Windows and Linux versions of get_default_gateway 4093 to return the route with the smallest metric 4094 if multiple 0.0.0.0/0.0.0.0 entries are present. 4095* Added ">NEED-OK" alert and "needok" command to management 4096 interface to provide a general interface for sending 4097 alerts to the end-user. Used by the PKCS#11 code 4098 to send Token Insertion Requests to the user. 4099* Added actual remote address used to the ">STATE" alert 4100 in the management interface (Rolf Fokkens). 4101 41022005.10.17 -- Version 2.1-beta4 4103 4104* Fixed bug introduced in 2.1-beta3 where management 4105 socket bind would fail. 4106* --capath fix in ssl.c (Zhuang Yuyao). 4107* Added ".PHONY: plugin" to Makefile.am, reverted 4108 location of "plugin" directory (thanks to 4109 Matthias Andree for figuring this out). 4110 41112005.10.16 -- Version 2.1-beta3 4112 4113* Added PKCS#11 support (Alon Bar-Lev). 4114* Enable the use of --ca together with --pkcs12. If --ca is 4115 used at the same time as --pkcs12, the CA certificate is loaded 4116 from the file specified by --ca regardless if the pkcs12 file 4117 contains a CA cert or not (Mathias Sundman). 4118* Merged --capath patch (Thomas Noel). 4119* Merged --multihome patch. 4120* Added --bind option for TCP client connections (Ewan Bhamrah 4121 Harley). 4122* Moved "plugin" directory to "plugins" to deal with strange 4123 automake problem that ended up being also fixable with 4124 ".PHONY: plugin" in Makefile.am. 4125 41262005.10.13 -- Version 2.1-beta2 4127 4128* Made --sndbuf and --rcvbuf pushable. 4129 41302005.10.01 -- Version 2.1-beta1 4131 4132* Made LZO setting pushable. 4133* Renamed sample-keys/tmp-ca.crt to ca.crt. 4134* Fixed bug where remove_iroutes_from_push_route_list 4135 was missing routes if those routes had 4136 an implied netmask (by omission) of 255.255.255.255. 4137* Merged with 2.0.3-rc1 4138* easy-rsa/2.0 moved to easy-rsa 4139* old easy-rsa moved to easy-rsa/1.0 4140 41412005.09.23 -- Version 2.0.2-TO4 4142 4143* Added feature to TAP-Win32 adapter to allow it to be 4144 opened from non-administrator mode. This feature 4145 is enabled by default, and can be enabled/disabled 4146 in the adapter advanced properties dialog. 4147* Added --allow-nonadmin standalone option for Windows to 4148 set TAP adapter to allow non-admin access. This 4149 is a user-mode version of the code, and duplicates 4150 the same feature as the above entry. 4151* Added fix that attempts to solve corner case of tunnel not 4152 forwarding packets when system clock is reset to an earlier time. 4153* Added --redirect-gateway bypass-dns option. (Developers: 4154 To add bypass-dhcp or bypass-dns support to other OSes, 4155 add a get_bypass_addresses function to route.c for 4156 your OS.) 4157* Added OPENVPN_PLUGIN_CLIENT_CONNECT_V2 plugin callback, which 4158 allows a client-connect plugin to return configuration text 4159 in memory, rather than via a file. 4160* Fixed a bug where --mode server --proto tcp-server --cipher none 4161 operation could cause tunnel packet truncation. 4162* openvpn --version will show [LZO1] or [LZO2], depending on 4163 version that was linked. 4164 41652005.09.07 -- Version 2.0.2-TO1 4166 4167* Added --topology directive. See man page. 4168* Added --redirect-gateway bypass-dhcp option to add a route 4169 allowing DHCP packets to bypass the tunnel, when the 4170 DHCP server is non-local. Currently only implemented 4171 on Windows clients. 4172* Modified OpenVPN Service on Windows to declare the DHCP 4173 client service as a dependency. 4174* Extended the plugin interface to allow plugins to declare 4175 per-client constructor and destructor functions, to make 4176 it simpler for plugins to maintain per-client state. 4177 41782005.09.25 -- Version 2.0.3-rc1 4179 4180* openvpn_plugin_abort_v1 function wasn't being properly 4181 registered on Windows. 4182* Fixed a bug where --mode server --proto tcp-server --cipher none 4183 operation could cause tunnel packet truncation. 4184 41852005.08.25 -- Version 2.0.2 4186 4187* No change from 2.0.2-rc1. 4188 41892005.08.24 -- Version 2.0.2-rc1 4190 4191* Fixed regression bug in Win32 installer, introduced in 2.0.1, 4192 which incorrectly set OpenVPN service to autostart. 4193* Don't package source code zip file in Windows installer 4194 in order to reduce the size of the installer. The source 4195 zip file can always be downloaded separately if needed. 4196* Fixed bug in route.c in FreeBSD, Darwin, OpenBSD and NetBSD 4197 version of get_default_gateway. Allocated socket for route 4198 manipulation is never freed so number of mbufs continuously 4199 grow and exhaust system resources after a while (Jaroslav Klaus). 4200* Fixed bug where "--proto tcp-server --mode p2p --management 4201 host port" would cause the management port to not respond until 4202 the OpenVPN peer connects. 4203* Modified pkitool script to be /bin/sh compatible (Johnny Lam). 4204 42052005.08.16 -- Version 2.0.1 4206 4207* Security Fix -- DoS attack against server when run with "verb 0" and 4208 without "tls-auth". If a client connection to the server fails 4209 certificate verification, the OpenSSL error queue is not properly 4210 flushed, which can result in another unrelated client instance on the 4211 server seeing the error and responding to it, resulting in disconnection 4212 of the unrelated client (CAN-2005-2531). 4213* Security Fix -- DoS attack against server by authenticated client. 4214 This bug presents a potential DoS attack vector against the server 4215 which can only be initiated by a connected and authenticated client. 4216 If the client sends a packet which fails to decrypt on the server, 4217 the OpenSSL error queue is not properly flushed, which can result in 4218 another unrelated client instance on the server seeing the error and 4219 responding to it, resulting in disconnection of the unrelated client 4220 (CAN-2005-2532). Credit: Mike Ireton. 4221* Security Fix -- DoS attack against server by authenticated client. 4222 A malicious client in "dev tap" ethernet bridging mode could 4223 theoretically flood the server with packets appearing to come from 4224 hundreds of thousands of different MAC addresses, causing the OpenVPN 4225 process to deplete system virtual memory as it expands its internal 4226 routing table. A --max-routes-per-client directive has been added 4227 (default=256) to limit the maximum number of routes in OpenVPN's 4228 internal routing table which can be associated with a given client 4229 (CAN-2005-2533). 4230* Security Fix -- DoS attack against server by authenticated client. 4231 If two or more client machines try to connect to the server at the 4232 same time via TCP, using the same client certificate, and when 4233 --duplicate-cn is not enabled on the server, a race condition can 4234 crash the server with "Assertion failed at mtcp.c:411" 4235 (CAN-2005-2534). 4236* Fixed server bug where under certain circumstances, the client instance 4237 object deletion function would try to delete iroutes which had never been 4238 added in the first place, triggering "Assertion failed at mroute.c:349". 4239* Added --auth-retry option to prevent auth errors from being fatal 4240 on the client side, and to permit username/password requeries in case 4241 of error. Also controllable via new "auth-retry" management interface 4242 command. See man page for more info. 4243* Added easy-rsa 2.0 scripts to the tarball in easy-rsa/2.0 4244* Fixed bug in openvpn.spec where rpmbuild --define 'without_pam 1' 4245 would fail to build. 4246* Implement "make check" to perform loopback tests (Matthias Andree). 4247 42482005.07.21 -- Version 2.0.1-rc7 4249 4250* Support LZO 2.01 which renamed its library to lzo2 (Matthias Andree). 4251* Include linux/types.h before checking for linux/errqueue.h (Matthias 4252 Andree). 4253 42542005.07.15 -- Version 2.0.1-rc6 4255 4256* Commented out "user nobody" and "group nobody" in sample 4257 client/server config files. 4258* Allow '@' character to be used in --client-config-dir 4259 file names. 4260 42612005.07.04 -- Version 2.0.1-rc5 4262 4263* Windows version will log a for-further-info URL when 4264 initialization sequence is completed with errors. 4265* Added DLOPEN_PAM parameter to plugin/auth-pam/Makefile 4266 to control whether auth-pam plugin links to PAM via 4267 dlopen or -lpam. By default, DLOPEN_PAM=1 so pre-existing 4268 behavior should be preserved. DLOPEN_PAM=0 is the preferred 4269 setting to link via -lpam, but DLOPEN_PAM=1 works around 4270 a bug in SuSE 9.1 (and possibly other distros as well) 4271 where the PAM modules are not linked with -lpam. See 4272 thread on openvpn-devel for more discussion about this 4273 patch (Simon Perreault). 4274 42752005.06.15 -- Version 2.0.1-rc4 4276 4277* Support LZO 2.00, including changes to configure script to 4278 autodetect LZO version. 4279 42802005.06.12 -- Version 2.0.1-rc3 4281 4282* Fixed a bug which caused standard file handles to not be closed 4283 after daemonization when --plugin and --daemon are used together, 4284 and if the plugin initialization function forks (as does auth-pam 4285 and down-root) (Simon Perreault). 4286* Added client-side up/down scripts in contrib/pull-resolv-conf 4287 for accepting server-pushed "dhcp-option DOMAIN" and "dhcp-option DNS" 4288 on Linux/Unix systems (Jesse Adelman). 4289* Fixed bug where if client-connect scripts/plugins were cascaded, 4290 and one (but not all) of them returned an error status, there might 4291 be cases where for an individual script/plugin, client-connect was 4292 called but not client-disconnect. The goal of this fix is to 4293 ensure that if client-connect is called on a given client instance, 4294 then client-disconnect will definitely be called. A potential 4295 complication of this fix is that when client-connect functions are 4296 cascaded, it's possible that the client-disconnect function would 4297 be called in cases where the related client-connect function returned 4298 an error status. This fix should not alter OpenVPN behavior when 4299 scripts/plugins are not cascaded. 4300* Changed the hard-to-reproduce "Assertion failed at fragment.c:312" 4301 fatal error to a warning: "FRAG: outgoing buffer is not empty". 4302 Need more info on how to reproduce this one. 4303* When --duplicate-cn is used, the --ifconfig-pool allocation 4304 algorithm will now allocate the first available IP address. 4305* When --daemon and --management-hold are used together, 4306 OpenVPN will daemonize before it enters the management hold state. 4307 43082005.05.16 -- Version 2.0.1-rc2 4309 4310* Modified vendor test in openvpn.spec file to match against 4311 "Mandrakesoft" in addition to "MandrakeSoft". 4312* Using --iroute in a --client-config-dir file while in --dev tap 4313 mode is not currently supported and will produce a warning 4314 message. Fixed bug where in certain cases, in addition to 4315 generating a warning message, this combination of options 4316 would also produce a fatal assertion in mroute.c. 4317* Pass --auth-user-pass username to server-side plugin without 4318 performing any string remapping (plugins, unlike scripts, 4319 don't get any security benefit from string remapping). 4320 This is intended to fix an issue with openvpn-auth-pam/pam_winbind 4321 where backslash characters in a username ('\') were being remapped 4322 to underscore ('_'). 4323* Updated OpenSSL DLLs in Windows build to 0.9.7g. 4324* Documented --explicit-exit-notify in man page. 4325* --explicit-exit-notify seconds parameter defaults to 1 if 4326 unspecified. 4327 43282005.04.30 -- Version 2.0.1-rc1 4329 4330* Fixed bug where certain kinds of fatal errors after 4331 initialization (such as port in use) would leave plugin 4332 processes (such as openvpn-auth-pam) still running. 4333* Added optional openvpn_plugin_abort_v1 plugin function for 4334 closing initialized plugin objects in the event of a fatal 4335 error by main OpenVPN process. 4336* When the --remote list is > 1, and --resolv-retry is not 4337 specified (meaning that it defaults to "infinite"), apply the 4338 infinite timeout to the --remote list as a whole, but try each 4339 list item only once before moving on to the next item. 4340* Added new --syslog directive which redirects output 4341 to syslog without requiring the use of the --daemon or --inetd 4342 directives. 4343* Added openvpn.spec option to allow RPM to be built with support 4344 for passwords read from a file: 4345 rpmbuild -tb [openvpn.x.tar.gz] --define 'with_password_save 1' 4346 43472005.04.17 -- Version 2.0 4348 4349* Fixed minor options string typo in options.c. 4350 43512005.04.10 -- Version 2.0-rc21 4352 4353* Change license description from "GPL Version 2 or (at your 4354 option) any later version" to just "GPL Version 2". 4355 43562005.04.04 -- Version 2.0-rc20 4357 4358* Dag Wieers has put together an OpenVPN/LZO binary RPM set with 4359 excellent distro/version coverage for RH/EL/Fedora, though 4360 using his own SPEC. I modified openvpn.spec to follow some of 4361 the same conventions such as putting sample scripts and doc 4362 files in %doc rather than /usr/share/openvpn. 4363* Minor change to init scripts to run the user-defined script 4364 /etc/openvpn/openvpn-startup (if it exists) before any OpenVPN 4365 configs are started, and to run /etc/openvpn/openvpn-shutdown 4366 after all OpenVPN configs have been stopped. The 4367 openvpn-startup script can be used for stuff like 4368 insmod tun.o, setting up firewall rules, or starting 4369 ethernet bridges. 4370 43712005.03.29 -- Version 2.0-rc19 4372 4373* Omit additions of routes where the network and 4374 gateway are equal and the netmask is 255.255.255.255. 4375 This can come up if you are using both 4376 server/ifconfig-pool and client-config-dir with 4377 ifconfig-push static addresses for some subset of clients 4378 which directly reference the server IP address as the 4379 remote endpoint. 4380 43812005.03.28 -- Version 2.0-rc18 4382 4383* Packaged Windows installer with OpenSSL 0.9.7f. 4384* Built Windows installer with NSIS 2.06. 4385 43862005.03.12 -- Version 2.0-rc17 4387 4388* "MANAGEMENT: CMD" log file output will now only occur 4389 at --verb 7 or greater. 4390* Added an optional name/value configuration list to 4391 the openvpn-auth-pam plugin module argument list. See 4392 plugin/auth-pam/README for documentation. This is necessary 4393 in order for openvpn-auth-pam to work with queries generated 4394 by arbitrary PAM modules. 4395* In both auth-pam and down-root plugins, in the forked process, 4396 a read error on the parent process socket is no longer fatal. 4397* MandrakeSoft liblzo1 RPM only Provides for a 'liblzo1'. 4398 A conditional test of the vendor has been added to 4399 Require the appropriately named 'lzo' (liblzo1 / lzo). 4400 (Tom Walsh - http://openhardware.net) 4401 4402 44032005.02.20 -- Version 2.0-rc16 4404 4405* Fixed bug introduced in rc13 where Windows service wrapper 4406 would be installed with a startup type of Automatic. 4407 This fix restores the previous behavior of installing 4408 with a startup type of Manual. 4409 44102005.02.19 -- Version 2.0-rc15 4411 4412* Added warning when --keepalive is not used in a server 4413 configuration. 4414* Don't include OpenSSL md4.h file if we are not building 4415 NTLM proxy support (Waldemar Brodkorb). 4416* Added easy-rsa/build-key-pkcs12 and 4417 easy-rsa/Windows/build-key-pkcs12.bat scripts 4418 (Mathias Sundman). 4419 44202005.02.16 -- Version 2.0-rc14 4421 4422* Fixed small memory leak that occurs when --crl-verify 4423 is used. 4424* Upgraded Windows installer and .nsi script to NSIS 2.05 4425 (Mathias Sundman). 4426* Changed #include backslash usage in cryptoapi.c to use 4427 forward slashes instead (Gisle Vanem). 4428* Created easy-rsa/revoke-full to handle revocations in 4429 a single step: (a) revoke crt, (b) regenerate CRL, and 4430 (c) verify that revocation succeeded. 4431* Renamed easy-rsa/Windows/revoke-key to revoke-full so 4432 that both *nix and Windows scripts are equivalent. 4433 44342005.02.11 -- Version 2.0-rc13 4435 4436* Improve human-readability of local/remote options 4437 diff, when inconsistencies are present. 4438* For Windows easy-rsa, distribute vars.bat.sample and 4439 openssl.cnf.sample, then copy them to their normal 4440 filenames (without the .sample) when init-config.bat 4441 is run. This is to prevent OpenVPN upgrades from 4442 wiping out vars.bat and openssl.cnf edits. 4443* Modified service wrapper (Windows) to use a 4444 case-insensitive search when scanning for .ovpn files 4445 in \Program Files\OpenVPN\config. Prior versions 4446 required an all-lower-case .ovpn file extension. 4447* Miscellaneous service wrapper code cleanup. 4448* If --user/--group is used on Windows, treat it 4449 as a no-op with a warning (this makes it easier to 4450 distribute the same client config file to Windows 4451 and *nix users). 4452* Warn if --ifconfig-pool-persist is used with 4453 --duplicate-cn. 4454 44552005.02.05 -- Version 2.0-rc12 4456 4457* Removed some debugging code inadvertently included 4458 in rc11 which would print the --auth-user-pass 4459 username/password provided by clients in the server 4460 logfile. 4461* Client code for cycling through --remote list will 4462 retry the last address which successfully authenticated 4463 before moving on through the list. 4464* Windows installer will now install sample configuration 4465 files in \Program Files\OpenVPN\sample-configs as well 4466 as generate a start menu shortcut to this directory. 4467* Minor type change in buffer.[ch] to work around char-type 4468 ambiguity bug. Caused management interface lock-ups on 4469 ARM when building with armv4b-hardhat-linux-gcc 2.95.3. 4470 44712005.02.03 -- Version 2.0-rc11 4472 4473* Windows installer will now install easy-rsa directory 4474 in \Program Files\OpenVPN 4475* Allow syslog facility to be controlled at compile time, 4476 e.g. -DLOG_OPENVPN=LOG_LOCAL6 (P Kern). 4477* Changed certain shell scripts in distribution to use 4478 #!/bin/sh rather than #!/bin/bash for better portability. 4479* If --ifconfig-pool-persist seconds parameter is 0, treat 4480 persist file as an allocation of fixed IP addresses 4481 (previous versions took IP-to-common-name associations 4482 from this list as hints, not mandatory static allocations). 4483* Fixed bug on *nix where if --auth-user-pass and --log 4484 were used together, the username prompt would be sent to 4485 the log file rather than /dev/tty. 4486* Spurious text in openvpn.8 detected by doclifter 4487 (Eric S. Raymond). 4488* Call closelog later on daemon kill so that process 4489 exit message is written to syslog. 4490 44912005.01.27 -- Version 2.0-rc10 4492 4493* When ./configure is run with plugins enabled (the default), 4494 check whether or not dlopen exists in libc before testing 4495 for libdl. This is to fix an issue on FreeBSD and possibly 4496 other OSes which bundle libdl functions in libc. 4497* On Windows, filter initial WSAEINVAL warning which occurs 4498 on the initial read attempt of an unbound socket. 4499* The easy-rsa scripts build-key, build-key-pass, and 4500 build-key-server will now chmod the .key file 4501 to 0600. This is in addition to the fact the generated 4502 keys directory has always been similarly protected 4503 (Pete Harlan). 4504 45052005.01.23 -- Version 2.0-rc9 4506 4507* Fixed error "ROUTE: route addition failed using 4508 CreateIpForwardEntry ..." on Windows when --redirect-gateway 4509 is used over a RRAS internet link. 4510* When using --route-method exe on Windows, include the 4511 gateway parameter on route delete commands (Mathias Sundman). 4512* Try not to do a hard reset (i.e. SIGHUP) when two 4513 SIGUSR1 signals are received in close succession. 4514* If the push list tries to grow beyond its buffer capacity, 4515 the resulting error will be non-fatal. 4516* To increase the push list capacity (must be done on both 4517 client and server), increase TLS_CHANNEL_BUF_SIZE in 4518 common.h (default=1024). 4519 45202005.01.15 -- Version 2.0-rc8 4521 4522* Fixed bug introduced in rc7 where options error 4523 "--auth-user-pass requires --pull" might occur even 4524 if --pull was correctly specified. 4525* Changed management interface code to bind once 4526 to TCP socket, rather than rebinding after every 4527 client disconnect. 4528* Added "disable" directive for client-config-dir 4529 files. 4530* Windows binary install is now distributed with 4531 OpenSSL 0.9.7e. 4532* Query the management interface for --http-proxy 4533 username/password if authfile is set to "stdin". 4534* Added current OpenVPN version number to "Unrecognized 4535 option or missing parameter" error message. 4536* Added "-extensions server" to "openssl req" command 4537 in easy-rsa/build-key-server (Nir Yeffet). 4538 45392005.01.10 -- Version 2.0-rc7 4540 4541* Fixed bug in management interface which could cause 4542 100% CPU utilization in --proto tcp-server mode 4543 on all *nix OSes except for Linux 2.6. 4544* --ifconfig-push now accepts DNS names as well as 4545 IP addresses. 4546* Added sanity check errors when --pull or 4547 --auth-user-pass is used in an incorrect mode. 4548* Updated man page entries for --client-connect and 4549 --ifconfig-push. 4550* Added "String Types and Remapping" section to man 4551 page to consisely document the way which OpenVPN 4552 may convert certain types of characters in strings 4553 to ('_'). 4554* Modified bridging description in HOWTO to emphasize 4555 the fact that bridging allows Windows file and print 4556 sharing without a WINS server (Charles Duffy). 4557 45582004.12.20 -- Version 2.0-rc6 4559 4560* Improved checking for epoll support in ./configure 4561 to fix false positive on RH9 (Jan Just Keijser). 4562* Made the "MULTI TCP: I/O wait required blocking in 4563 multi_tcp_action, action=7" error nonfatal and replaced 4564 with "MULTI: Outgoing TUN queue full, dropped packet". 4565 So far the issue only seems to occur on Linux 2.2 4566 in --mode server --proto tcp mode. It occurs when 4567 the TUN/TAP driver locks up and refuses to accept 4568 new packet writes for a second or more. 4569* Fixed bug where if a --client-config-dir file tried 4570 to include another file using "config", and if that 4571 include failed, OpenVPN would abort with a fatal 4572 error. Now such inclusion failures will be logged 4573 but are no longer fatal. 4574* Global changes to the way that packet buffer alignment 4575 is handled. Previously we didn't care about alignment 4576 and took care, when handling 16 and 32 bit words 4577 in buffers, to always use alignment-safe transfers. 4578 This approach appears to be inadequate on some 4579 architectures such as alpha. The new approach is 4580 to initialize packet buffers in a way that anticipates 4581 how component structures will be allocated within 4582 them, to maintain correct alignment. 4583* Added --dhcp-option DISABLE-NBT to disable NetBIOS 4584 over TCP (Jan Just Keijser). 4585* Added --http-proxy-option directive for controlling 4586 miscellaneous HTTP proxy options. 4587* Management state will no longer transition to "WAIT" 4588 during TLS renegotiations. 4589 45902004.12.16 -- Version 2.0-rc5 4591 4592* The --client-config-dir option will now try to open 4593 a default file called "DEFAULT" if no file matching 4594 the common name of the incoming client was found. 4595* The --client-connect script/plugin can now veto client 4596 authentication by returning a failure code. 4597* The --learn-address script/plugin can now prevent a 4598 client-instance/address association from being learned 4599 by returning a failure code. 4600* Changed RPM group in .spec file to Applications/Internet. 4601 46022004.12.14 -- Version 2.0-rc4 4603 4604* SuSE only -- Fixed interaction between openvpn.spec and 4605 suse/openvpn.init where the .spec file was writing the 4606 OpenVPN binary to a different location than where the 4607 .init script was referencing it (Stefan Engel). 4608* Solaris only -- Split Solaris ifconfig command into two 4609 parts (Jan Just Keijser). 4610* Some cleanup in add_option(). 4611* Better error checking on input dotted quad IP addresses. 4612* Verify that --push argument is quoted, if there is 4613 more than one. 4614* More miscellaneous option sanity checks. 4615 46162004.12.13 -- Version 2.0-rc3 4617 4618* On Windows, when --log or --log-append is used, 4619 save the original stderr for username and password 4620 prompts. 4621* Fixed a bug introduced in the late 2.0 betas where 4622 if a "verb" parameter >= 16 was used, it would be 4623 ignored and the actual verb level would remain at 1. 4624* Fixed a bug mostly seen on OS X where --management-hold 4625 or --management-query-passwords would cause the management 4626 interface to be unresponsive to incoming client connections. 4627* Trigger an options error if one of the management-modifying 4628 options is used without "management" itself. 4629 46302004.12.12 -- Version 2.0-rc2 4631 4632* Amplified warnings in documentation about possible 4633 man-in-the-middle attack when clients do not properly 4634 verify server certificate. Changes to easy-rsa README, 4635 FAQ, HOWTO, man page, and sample client config file. 4636* Added a warning message if --tls-client or --client 4637 is used without also specifying one of either 4638 --ns-cert-type, --tls-remote, or --tls-verify. 4639* status_open() fixes for MSVC builds (Blaine Fleming). 4640* Fix attempt of "ntlm.c:55: error: `des_cblock' undeclared" 4641 compiler error which has been reported on some platforms. 4642* The openvpn.spec file for rpmbuild has several 4643 new build-time options. See comments in the file. 4644* Plugins are now built and packaged in the RPM and 4645 will be saved in /usr/share/openvpn/plugin/lib. 4646* Added --management-hold directive to start OpenVPN 4647 in a hibernating state until released by the 4648 management interface. Also added "hold" command 4649 to the management interface. 4650 46512004.12.07 -- Version 2.0-rc1 4652 4653* openvpn.spec workaround for SuSE confusion regarding 4654 /etc/init.d vs. /etc/rc.d/init.d (Stefan Engel). 4655 46562004.12.05 -- Version 2.0-beta20 4657 4658* The ability to read --askpass and --auth-user-pass 4659 passwords from a file has been disabled by default. 4660 To re-enable, use ./configure --enable-password-save. 4661* Added additional pre-connected states to management 4662 interface. See management/management-notes.txt 4663 for more info. 4664* State history is now recorded by the management 4665 interface, and the "state" command now works like 4666 the log or echo commands. 4667* State history and real-time state change notifications 4668 are now prepended with an integer unix timestamp. 4669* Added --http-proxy-timeout option, previously 4670 the timeout was hardcoded to 5 seconds. 4671 46722004.12.02 -- Version 2.0-beta19 4673 4674* Fixed bug in management interface line termination 4675 where output lines incorrectly contained a \00 char 4676 after the customary \0d \0a. 4677* Fixed bug introduced in beta18 where Windows version 4678 would segfault on options errors. 4679* Fixed bug in management interface where an empty 4680 quoted string ("") entered as a parameter would cause 4681 a segfault. 4682* Fixed bug where --resolv-retry was not working 4683 properly with multiple --remote hosts. 4684* Added additional ./configure options to reduce 4685 executable size for embedded applications. 4686 See ./configure --help. 4687 46882004.11.28 -- Version 2.0-beta18 4689 4690* Added management interface. See new --management-* 4691 options or the full management interface documentation 4692 in management/management-notes.txt in the tarball. 4693 Management interface inclusion can be disabled by 4694 ./configure --disable-management. 4695* Added two new plugin modules: auth-pam and down-root. 4696 Auth-pam supports pam-based authentication using a 4697 split privilege execution model, while down-root enables 4698 a down script to be executed with root privileges, even 4699 when --user/--group is used to drop root privileges. 4700 See the plugin directory in the tarball for READMEs, 4701 source code, and Makefiles. 4702* Plugin developers should note that some changes were 4703 made to the plugin interface since beta17. See 4704 openvpn-plugin.h for details. 4705 Plugin interface inclusion can be disabled with 4706 ./configure --disable-plugins 4707* Added easy-rsa/build-key-server script which will 4708 build a certificate with with nsCertType=server. 4709* Added --ns-cert-type option for verification 4710 of nsCertType field in peer certificate. 4711* If --fragment n is specified and --mssfix is specified 4712 without a parameter, default --mssfix to n. This restores 4713 the 1.6 behavior when using --mssfix without a parameter. 4714* Fixed SSL context initialization bug introduced in beta14 4715 where this error might occur on restarts: "Cannot load 4716 certificate chain ... PEM_read_bio:no start line". 4717 47182004.11.11 -- Version 2.0-beta17 4719 4720* Changed default port number to 1194 per IANA official 4721 port number assignment. 4722* Added --plugin directive which allows compiled 4723 modules to intercept script callbacks. See 4724 plugin folder in tarball for more info. 4725* Fixed bug introduced in beta12 where --key-method 1 4726 authentications which should have succeeded would fail. 4727* Ignore SIGUSR1 during DNS resolution. 4728* Added SuSE support to openvpn.spec (Umberto Nicoletti). 4729* Fixed --cryptoapicert SUBJ: parsing bug (Peter 'Luna' 4730 Runestig). 4731 47322004.11.07 -- Version 2.0-beta16 4733 4734* Modified sample-scripts/auth-pam.pl to get username 4735 and password from OpenVPN via a file rather than 4736 via environmental variables. 4737* Added bytes_sent and bytes_received environmental 4738 variables to be set prior to client-disconnect script. 4739* Changed client virtual IP derivation precedence: 4740 (1) use --ifconfig-push directive from --client-connect 4741 script, (2) use --ifconfig-push directive from 4742 --client-config-dir, and (3) use --ifconfig-pool 4743 address. 4744* If a --client-config-dir file specifies --ifconfig-push, 4745 it will be visible to the --client-connect-script in 4746 the ifconfig_pool_remote_ip environmental variable. 4747* For tun-style tunnels, the ifconfig_pool_local_ip 4748 environmental variable will be set, while for 4749 tap-style tunnels, the ifconfig_pool_netmask variable 4750 will be set. 4751* Added intelligence to autoconf script to test 4752 compiler for the accepted form of zero-length arrays. 4753* Fixed a bug introduced in beta12 where --ip-win32 4754 netsh would fail if --dev-node was not explicitly 4755 specified. 4756* --ip-win32 netsh will now work on hidden adapters. 4757* Fix attempt of "Assertion failed at crypto.c:149". 4758 This assertion has also been reported on 1.x with a 4759 slightly different line number. The fix is twofold: 4760 (1) In previous releases, --mtu-test may trigger this 4761 assertion -- this bug has been fixed. (2) If something 4762 else causes the assertion to be thrown, don't panic, 4763 just output a nonfatal warning to the log and drop 4764 the packet which generated the error. 4765* Support TAP interfaces on Mac OS X (Waldemar Brodkorb). 4766* Added --echo directive. 4767* Added --auth-nocache directive. 4768 47692004.10.28 -- Version 2.0-beta15 4770 4771* Changed environmental variable character classes 4772 so that names must consist of alphanumeric or 4773 underbar chars and values must consist of printable 4774 characters. Illegal chars will be deleted. 4775 Versions prior to 2.0-beta12 were more restrictive 4776 and would map spaces to '.'. 4777* On Windows, when the TAP adapter fails to 4778 initialize with the correct IP address, output 4779 "Initialization Sequence Completed with Errors" 4780 to the console or log file. 4781* Added a warning when user/group/chroot is used 4782 without persist-tun and persist-key. 4783* Added cryptoapi.[ch] to tarball and source zip. 4784* --tls-remote option now works with common name 4785 prefixes as well as with the full X509 subject 4786 string. This is a useful alternative to using 4787 a CRL on the client. 4788* common names associated with a static 4789 --ifconfig-push setting will no longer leave 4790 any state in the --ifconfig-pool-persist file. 4791* Hard TLS errors (TLS handshake failed) will now 4792 trigger either a SIGUSR1 signal by default 4793 or SIGTERM (if --tls-exit is specified). In TCP 4794 mode, all TLS errors are considered to be hard. 4795 In server mode, the signal will be local to the 4796 client instance. 4797* Added method parameter to --auth-user-pass-verify 4798 directive to select whether username/password 4799 is passed to script via environment or a temporary 4800 file. 4801* Added --status-version option to control format 4802 of --status file. The --mode server 4803 --status-version 2 format now includes a line 4804 type token, the virtual IP address is shown 4805 in the client list (even in --dev tap mode), 4806 and the integer time_t value is shown anywhere 4807 an ascii-formatted time/date is also shown. 4808* Added --remap-usr1 directive which can be used 4809 to control whether internally or externally 4810 generated SIGUSR1 signals are remapped to 4811 SIGHUP (restart without persisting state) or 4812 SIGTERM (exit). 4813* When running as a Windows service (using 4814 --service option), check the exit event before 4815 and after reading one line of input from 4816 stdin, when reading username/password info. 4817* For developers: Extended the --gremlin function 4818 to better stress-test the new 2.0 features, 4819 added Valgrind support on Linux and Dmalloc 4820 support on Windows. 4821 48222004.10.19 -- Version 2.0-beta14 4823 4824* Fixed a bug introduced in Beta12 that would occur 4825 if you use a --client-connect script without also 4826 defining --tmp-dir. 4827* Fixed a bug introduced in Beta12 where a learn-address 4828 script might segfault on the delete method. 4829* Added Crypto API support in Windows version via 4830 the --cryptoapicert option (Peter 'Luna' Runestig). 4831 48322004.10.18 -- Version 2.0-beta13 4833 4834* Fixed an issue introduced in Beta12 where the private 4835 key password would not be prompted for unless --askpass 4836 was explicitly specified in the config. 4837 48382004.10.17 -- Version 2.0-beta12 4839 4840* Added support for username/password-based authentication. 4841 Clients can now authentication themselves with the server 4842 using either a certificate, a username/password, or both. 4843 New directives: --auth-user-pass, --auth-user-pass-verify, 4844 --client-cert-not-required, and --username-as-common-name. 4845* Added NTLM proxy patch (William Preston). 4846* Added --ifconfig-pool-linear server flag to allocate 4847 individual tun addresses for clients rather than /30 4848 subnets (won't work with Windows clients). 4849* Modified --http-proxy code to cache username/password 4850 across restarts. 4851* Modified --http-proxy code to read username/password 4852 from the console when the auth file is given as "stdin". 4853* Modified --askpass to take an optional filename argument. 4854* --persist-tun and --persist-key now work in client mode 4855 and can be pushed to clients as well. 4856* Added --ifconfig-pool-persist directive, to maintain 4857 ifconfig-pool info in a file which is persistent across 4858 daemon instantiations. 4859* --user and --group privilege downgrades as well as 4860 --chroot now also work in client mode (the 4861 dowgrade/chroot will be delayed until the initialization 4862 sequence is completed). 4863* Added --show-engines standalone directive to show 4864 available OpenSSL crypto accelerator engine support. 4865* --engine directive now accepts an optional engine-ID 4866 parameter to control which engine is used. 4867* "Connection reset, restarting" log message now shows 4868 which client is being reset. 4869* Added --dhcp-pre-release directive in Windows version. 4870* Second parm to --ip-win32 can be "default", e.g. 4871 --ip-win32 dynamic default 60. 4872* Fixed documentation bug regarding environmental 4873 variable settings for --ifconfig-pool IP addresses. 4874 The correct environmental variable names are: 4875 ifconfig_pool_local_ip and ifconfig_pool_remote_ip. 4876* ifconfig_pool_local_ip and ifconfig_pool_remote_ip 4877 environmental variables are now passed to the 4878 client-disconnect script. 4879* In server mode, environmental variables are now scoped 4880 according to the client they are associated with, 4881 to solve the problem of "crosstalk" between different 4882 client's environmental variable sets. 4883* Added --down-pre flag to cause --down script to be 4884 called before TUN/TAP close (rather than after). 4885* Added --tls-exit flag which will cause OpenVPN 4886 to exit on any TLS errors. 4887* Don't push a route to a client if it exactly 4888 matches an iroute (this lets you push routes to 4889 all clients, and OpenVPN will automatically remove 4890 the route from the route push list only for that client 4891 which the route actually belongs to). 4892* Made '--resolv-retry infinite' the default. 4893 --resolv-retry can be disabled by using a parameter of 0. 4894* For clients which plan to pull config info from server, 4895 set an initial default ping-restart of 60 seconds. 4896* Optimized mute code to lessen the load on the processor 4897 when messages are being muted at a higher frequency. 4898* Made route log messages non-mutable. 4899* Silence the Linux "No buffer space available" message. 4900* Added miscellaneous additional option sanity checks. 4901* Added Windows version of easy-rsa scripts in 4902 easy-rsa/Windows directory (Andrew J. Richardson). 4903* Added NetBSD route patch (Ed Ravin). 4904* Added OpenBSD patch for TAP + --redirect-gateway 4905 (Waldemar Brodkorb). 4906* Directives which prompt for a username and/or password 4907 will now work with --daemon (OpenVPN will prompt 4908 before forking). 4909* Warn if CRL is from a different issuer than the 4910 issuer of the peer certificate (Bernhard Weisshuhn). 4911* Changed init script chkconfig parameters to start 4912 OpenVPN daemon(s) before NFS. 4913* Bug fix attempt of "too many I/O wait events" which occurs 4914 on OSes which prefer select() over poll() such as Mac OS X. 4915* Added --ccd-exclusive flag. This flag will require, as a 4916 condition of authentication, that a connecting client has 4917 a --client-config-dir file. 4918* TAP-Win32 open code will attempt to open a free adapter 4919 if --dev-node is not specified (Mathias Sundman). 4920* Resequenced --nice and --chroot ordering so that --nice 4921 occurs first. 4922* Added --suppress-timestamps flag (Charles Duffy). 4923* Source code changes to allow compilation by MSVC 4924 (Peter 'Luna' Runestig). 4925* Added experimental --fast-io flag which optimizes 4926 TUN/TAP/UDP writes on non-Windows systems. 4927 49282004.08.18 -- Version 2.0-beta11 4929 4930* Added --server, --server-bridge, --client, and 4931 --keepalive helper directives. See client.conf 4932 and server.conf in sample-config-files for sample 4933 configurations which use the new directives. 4934* On Windows, added --route-method to control 4935 whether IP Helper API or route.exe is used 4936 to add/delete routes. 4937* On Windows, added a second parameter to 4938 --route-delay to control the maximum time period 4939 to wait for the TAP-Win32 adapter to come up 4940 before adding routes. 4941* Fixed bug in Windows version where configurations 4942 which omit --ifconfig might fail to recognize when 4943 the TAP adapter is up. 4944* Proxy connection failures will now retry according 4945 to the --connect-retry parameter. 4946* Fixed --dev null handling on Windows so that TLS 4947 loopback test described in INSTALL file works 4948 correctly on Windows. 4949* Added "Initialization Sequence Completed" message 4950 after all initialization steps have been completed 4951 and the VPN can be considered "up". 4952* Better sanity-checking on --ifconfig-pool parameters. 4953* Added --tcp-queue-limit option to control 4954 TUN/TAP -> TCP socket overflow. 4955* --ifconfig-nowarn flag will now silence general 4956 warnings about possible --ifconfig address 4957 conflicts, including the warning about --ifconfig 4958 and --remote addresses being in same /24 subnet. 4959* Fixed case where server mode did not correctly 4960 identify certain types of ethernet multicast packets 4961 (Marcel de Kogel). 4962* Added --explicit-exit-notify option (experimental). 4963 49642004.08.02 -- Version 2.0-beta10 4965 4966* Fixed possible reference after free of option strings 4967 after a restart, bug was introduced in beta8. 4968* Fixed segfault at route.c:919 in the beta9 4969 Windows version that was being caused by indirection 4970 through a NULL pointer. 4971* Mistakenly built debug version of TAP-Win32 driver 4972 for beta9. Beta10 has correct release build. 4973 49742004.07.30 -- Version 2.0-beta9 4975 4976* Fixed --route issue on Windows that was introduced with 4977 the new beta8 route implementation based on the 4978 IP Helper API. 4979 49802004.07.27 -- Version 2.0-beta8 4981 4982* Added TCP support in server mode. 4983* Added PKCS #12 support (Mathias Sundman). 4984* Added patch to make revoke-crt and make-crl work 4985 seamlessly within the easy-rsa environment (Jan Kiszka). 4986* Modified --mode server ethernet bridge code to forward 4987 special IEEE 802.1d MAC Groups, i.e. 01:80:C2:XX:XX:XX. 4988* Added --dhcp-renew and --dhcp-release flags to Windows 4989 version. Normally DHCP renewal and release on the TAP 4990 adapter occurs automatically under Windows, however 4991 if you set the TAP-Win32 adapter Media Status property 4992 to "Always Connected", you may need these flags. 4993* Added --show-net standalone flag to Windows version to 4994 show OpenVPN's view of the system adapter and routing 4995 tables. 4996* Added --show-net-up flag to Windows version to output 4997 the system routing table and network adapter list to 4998 the log file after the TAP-Win32 adapter has been brought 4999 up and any routes have been added. 5000* Modified Windows version to add routes using the IP Helper 5001 API rather than by calling route.exe. 5002* Fixed bug where --route-up script was not being called 5003 if no --route options were specified. 5004* Added --mute-replay-warnings to suppress packet replay 5005 warnings. This is a common false alarm on WiFi nets. 5006* Added "def1" flag to --redirect-gateway option to override 5007 the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 5008 rather than 0.0.0.0/0. This has the benefit of overriding 5009 but not wiping out the original default gateway. 5010 (Thanks to Jim Carter for pointing out this idea). 5011* You can now run OpenVPN with a single config file argument. 5012 For example, you can now say "openvpn config.conf" 5013 rather than "openvpn --config config.conf". 5014* On Windows, made --route and --route-delay more adaptive 5015 with respect to waiting for interfaces referenced by the 5016 route destination to come up. Routes added by --route 5017 should now be added as soon as the interface comes up, 5018 rather than after an obligatory 10 second delay. The 5019 way this works internally is that --route-delay now 5020 defaults to 0 on Windows. Previous versions would 5021 wait for --route-delay seconds then add the routes. 5022 This version will wait --route-delay seconds and then 5023 test the routing table at one second intervals for the 5024 next 30 seconds and will not add the routes until they 5025 can be added without errors. 5026* On Windows, don't setsockopt SO_SNDBUF or SO_RCVBUF by 5027 default on TCP/UDP socket in light of reports that this 5028 action can have undesirable global side effects on the 5029 MTU settings of other adapters. These parameters can 5030 still be set, but you need to explicitly specify 5031 --sndbuf and/or --rcvbuf. 5032* Added --max-clients option to limit the maximum number 5033 of simultaneously connected clients in server mode. 5034* Added error message to illuminate shell escape gotcha when 5035 single backslashes are used in Windows path names. 5036* Added optional netmask parm to --ifconfig-pool. 5037* Fixed bug where http-proxy connect retry attempts were 5038 incorrectly going to the remote OpenVPN server, 5039 not to the HTTP proxy server. 5040 50412004.06.29 -- Version 2.0-beta7 5042 5043* Fixed bug in link_socket_verify_incoming_addr() which 5044 under certain circumstances could have caused --float 5045 behavior even if --float was not specified. 5046* --tls-auth option now works with --mode server. 5047 All clients and the server should use the same 5048 --tls-auth key when operating in client/server mode. 5049* Added --engine option to make use of OpenSSL-supported 5050 crypto acceleration hardware. 5051* Fixed some high verbosity print format size issues 5052 in event.c for 64 bit platforms (Janne Johansson). 5053* Made failure to open --log or --log-append file 5054 a non-fatal error. 5055 50562004.06.23 -- Version 2.0-beta6 5057 5058* Fixed Windows installer to intelligently put 5059 up a reboot dialog only if tapinstall tells 5060 us that it's really necessary. 5061* Fixed "Assertion failed at fragment.c:309" 5062 bug when --mode server and --fragment are used 5063 together. 5064* Ignore HUP, USR1, and USR2 signals during 5065 initialization. Prior versions would abort. 5066* Fixed bug on OS X: "Assertion failed at event.c:406". 5067* Added --service option to Windows version, for use 5068 when OpenVPN is being programmatically instantiated 5069 by another process (see man page for info). 5070* --log and --log-append options now work on Windows. 5071* Update OpenBSD INSTALL notes (Janne Johansson). 5072* Enable multicast on tun interface when running on 5073 OpenBSD (Pavlin Radoslavov). 5074* Fixed recent --test-crypto breakage, where options 5075 such as --cipher were not being parsed correctly. 5076* Modified options compatibility string by removing 5077 ifconfig substring if it is empty. Incremented 5078 options compatibility string version number to 4. 5079* Fixed typo in --tls-timeout option parsing 5080 (Mikael Lonnroth). 5081 50822004.06.13 -- Version 2.0-beta5 5083 5084* Fixed rare --mode server crash that could occur 5085 if data was being routed to a client at 5086 high bandwidth at the precise moment that the 5087 client instance object on the server was being 5088 deleted. 5089* Fixed issue on machines which have epoll.h and 5090 the epoll_create glibc call defined, but which 5091 don't actually implement epoll in the kernel. 5092 OpenVPN will now gracefully fall back to the 5093 poll API in this case. 5094* Fixed Windows bug which would cause the following 5095 error in a --mode server --dev tap configuration: 5096 "resource limit WSA_MAXIMUM_WAIT_EVENTS has been 5097 exceeded". 5098* Added CRL (certificate revocation list) management 5099 scripts to easy-rsa directory (Jon Bendtsen). 5100* Do a better job of getting the ifconfig component 5101 of the options consistency check to work correctly 5102 when --up-delay is used. 5103* De-inlined some functions which were too complex 5104 to be inlined anyway with gcc. 5105* If a --dhcp-option option is pushed to a non-windows 5106 client, the option will be saved in the client's 5107 environment before the --up script is called, under 5108 the name "foreign_option_{n}". 5109* Added --learn-address script (see man page) which 5110 allows for firewall access through the VPN to be 5111 controlled based on the client common name. 5112* In mode --server mode, when a client connects to 5113 the server, the server will disconnect any 5114 still-active clients which use the same common 5115 name. Use --duplicate-cn flag to revert to 5116 previous behavior of allowing multiple clients 5117 to concurrently connect with the same common name. 5118 51192004.06.08 -- Version 2.0-beta4 5120 5121* Fixed issue with beta3 where Win32 service wrapper 5122 was keying off of old TAP HWID as a dependency. To 5123 ensure that the new service wrapper is correctly 5124 installed, the Windows install script will uninstall 5125 the old wrapper before installing the new one, 5126 causing a reset of service properties. 5127* Fixed permissions issue on --status output file, 5128 with default access permissions of owner read/write 5129 only (default permissions can be changed of course with 5130 chmod). 5131 51322004.06.05 -- Version 2.0-beta3 5133 5134* More changes to TAP-Win32 driver's INF file which 5135 affects the placement of the driver in the Windows 5136 device namespace. This is done to work around an 5137 apparent bug in Windows when short HWIDs are used, 5138 and will also ease the upgrade from 1.x to 2.0 by 5139 reducing the chances that a reboot will be needed 5140 on upgrade. Like beta2, this upgrade will 5141 delete existing TAP-Win32 interfaces, and reinstall 5142 a single new interface with default properties. 5143* Major rewrite of I/O event wait layer in the style 5144 of libevent. This is a precursor to TCP support 5145 in --mode server. 5146* New feature: --status. Outputs a SIGUSR2-like 5147 status summary to a given file, updated once 5148 per n seconds. The status file is comma delimited 5149 for easy machine parsing. 5150* --ifconfig-pool now remembers common names and 5151 will try to assign a consistent IP to a given 5152 common name. Still to do: persist --ifconfig-pool 5153 memory across restarts by saving state in file. 5154* Fixed bug in event timer queue which could cause 5155 recurring timer events such as --ping to not 5156 correctly schedule again after firing. This in 5157 turn would cause spurrious ping restarts and possible 5158 connection outages. Thanks to Denis Vlasenko for 5159 tracking this down. 5160* Possible fix to reported bug where --daemon argument 5161 was not printing to syslog correctly after restart. 5162* Fixed bug where pulling --route or --dhcp-option 5163 directives from a server would problematically 5164 interact with --persist-tun on the client. 5165* Updated contrib/multilevel-init.patch (Farkas Levente). 5166* Added RPM build option to .spec and .spec.in files 5167 to optionally disable LZO inclusion (Ian Pilcher). 5168* The latest MingW runtime and headers define 5169 'ssize_t', so a patch is needed (Gisle Vanem). 5170 51712004.05.14 -- Version 2.0-beta2 5172 5173* Fixed signal handling bug in --mode server, where 5174 SIGHUP and SIGUSR1 were treated as SIGTERM. 5175* Changed the TAP-Win32 HWID from "TAP" to "TAPDEV". 5176 Apparently the larger string may work around 5177 a problem where the TAP adapter is sometimes missing 5178 from the network connections panel, especially under 5179 XP SP2. Also note that installing this upgrade will 5180 uninstall any pre-existing TAP-Win32 adapters, and then 5181 install a single new adapter, meaning that old adapter 5182 properties will be lost. Thanks to Md5Chap for solving 5183 this one. 5184* For --mode server --dev tap, the options --ifconfig and 5185 --ifconfig-pool are now optional. This allows address 5186 assignment via DHCP or use of a TAP VPN without 5187 IP support, as has always been possible with 1.x. 5188* Fixed bug where --ifconfig may not work correctly on 5189 Linux 2.2. 5190* Added 'local' flag to --redirect-gateway for use on 5191 networks where both OpenVPN daemons are connected 5192 to a shared subnet, such as wireless. 5193 51942004.05.09 -- Version 2.0-beta1 5195 5196* Unchanged from test29 except for version number 5197 upgrade. 5198 51992004.05.08 -- Version 2.0-test29 5200 5201* Modified --dev-node on Windows to accept a TAP-Win32 5202 GUID name. In addition, --show-adapters will now 5203 display the high-level name and GUID of each adapter. 5204 This is an attempt to work around an issue in Windows 5205 where sometimes the TAP-Win32 adapter installs correctly 5206 but has no icon in the network connections control 5207 panel. In such cases, being able to specify 5208 --dev-node {TAP-GUID} can work around the missing icon. 5209 52102004.05.07 -- Version 2.0-test28 5211 5212* Fixed bug which could cause segfault on program 5213 shutdown if --route and --persist-tun are used 5214 together. 5215 52162004.05.06 -- Version 2.0-test27 5217 5218* Fixed bug in close_instance() which might cause 5219 memory to be accessed after it had already been freed. 5220* Fixed bug in verify_callback() that might have 5221 caused uninitialized data to be referenced. 5222* --iroute now allows full CIDR subnet routing. 5223* In "--mode server --dev tun" usage, source addresses 5224 on VPN packets coming from a particular client must 5225 be associated with that client in the OpenVPN internal 5226 routing table. 5227 52282004.04.28 -- Version 2.0-test26 5229 5230* Optimized broadcast path in multi-client mode. 5231* Added socket buffer size options --rcvbuf & --sndbuf. 5232* Configure Linux tun/tap driver to use a more sensible 5233 txqueuelen default. Also allow explicit setting 5234 via --txqueuelen option (Harald Roelle). 5235* The --remote option now allows the port number 5236 to be specified as the second parameter. If 5237 unspecified, the port number defaults to the 5238 --rport value. 5239* Multiple --remote options on the client can now be 5240 specified for load balancing and failover. The 5241 --remote-random flag can be used to initially randomize 5242 the --remote list for basic load balancing. 5243* If a remote DNS name resolves to multiple DNS addresses, 5244 one will be chosen by random as a kind of basic 5245 load-balancing feature if --remote-random is used. 5246* Added --connect-freq option to control maximum 5247 new connection frequency in multi-client mode. 5248* In multi-client mode, all syslog messages associated 5249 with a specific client now include a client-ID prefix. 5250* For Windows, use a gettimeofday() function based 5251 on QueryPerformanceCounter (Derek Burdick). 5252* Fixed bug in interaction between --key-method 2 5253 and DES ciphers, where dynamic keys would be generated 5254 with bad parity and then be rejected. 5255 52562004.04.17 -- Version 2.0-test24 5257 5258* Reworked multi-client broadcast handling. 5259 52602004.04.13 -- Version 2.0-test23 5261 5262* Fixed bug in --dev tun --client-to-client routing. 5263* Fixed a potential deadlock in --pull. 5264* Fixed a problem with select() usage which could 5265 cause a repeating sequence of "select : Invalid 5266 argument (code=22)" 5267 52682004.04.11 -- Version 2.0-test22 5269 5270* Fixed bug where --mode server + --daemon was 5271 prematurely closing syslog connection. 5272* Added support for --redirect-gateway on Mac OS X 5273 (Jeremy Apple). 5274* Minor changes to TAP-Win32 driver based on feedback 5275 from the NDISTest tool. 5276 52772004.04.11 -- Version 2.0-test21 5278 5279* Optimizations in multi-client server event loop. 5280 52812004.04.10 -- Version 2.0-test20 5282 5283* --mode server capability now works with either tun 5284 or tap interfaces. When used with tap interfaces, 5285 OpenVPN will internally bridge all client tap 5286 interfaces with the server tap interface. 5287* Connecting clients can now have a client-specific 5288 configuration on the server, based on the client 5289 common name embedded in the client certificate. 5290 See --client-config-dir and --client-connect. 5291 These options can be used to configure client-specific 5292 routes. 5293* Added an option --client-to-client that enables 5294 internal client-to-client routing or bridging. 5295 Otherwise, clients will only "see" the server, 5296 not other connected clients. 5297* Fixed bug in route scheduling which would have caused 5298 --mode server to not work on Windows in test18 5299 and test19 with the sample config file. 5300* Man page is up to date with all new options. 5301* OpenVPN 2.0 release notes on web site updated 5302 with tap-style tunnel examples. 5303 53042004.04.02 -- Version 2.0-test19 5305 5306* Fixed bug where routes pushed from server were 5307 not working correctly on Windows clients. 5308* Added Mac OS X route patch (Jeremy Apple). 5309 53102004.03.30 -- Version 2.0-test18 5311 5312* Minor fixes + Windows self-install modified 5313 to use OpenSSL 0.9.7d. 5314 53152004.03.29 -- Version 2.0-test17 5316 5317* Fixed some bugs related to instance timeout and deletion. 5318* Extended --push/--pull option to support additional 5319 option classes. 5320 53212004.03.28 -- Version 2.0-test16 5322 5323* Successful test of --mode udp-server, --push, 5324 --pull, and --ifconfig-pool with server on 5325 Linux 2.4 and clients on Linux and Windows. 5326 53272004.03.25 -- Version 2.0-test15 5328 5329* Implemented hash-table lookup of client instances 5330 based either on remote UDP address/port or remote 5331 ifconfig endpoint. 5332* Implemented a randomized binary tree based 5333 scheduler for scalably scheduling a large number 5334 of client instance events. Uses the treap 5335 data structure and node rotation algorithm 5336 to keep the tree balanced. 5337* Initial implementation of ifconfig-pool. 5338* Made --key-method 2 the default. 5339 53402004.03.20 -- Version 2.0-test14 5341 5342* Implemented --push and --pull. 5343 53442004.03.20 -- Version 2.0-test13 5345 5346* Reduced struct tls_multi and --single-session 5347 memory footprint. 5348* Modified --single-session flag to be used 5349 in multi-client UDP server client instances. 5350 53512004.03.19 -- Version 2.0-test12 5352 5353* Added the key multi-client UDP server options, 5354 --mode, --push, --pull, and --ifconfig-pool. 5355* Revamped GC (garbage collection) code to not rely 5356 on any global data. 5357* Modifications to thread.[ch] to allow a more 5358 flexible thread model. 5359 53602004.03.16 -- Version 2.0-test11 5361 5362* Moved all timer code to interval.h, added new file 5363 interval.c. 5364* Fixed missing include. 5365 53662004.03.16 -- Version 2.0-test10 5367 5368* More TAP-Win32 fixes. 5369* Initial debugging and testing of multi.[ch]. 5370 53712004.03.14 -- Version 2.0-test9 5372 5373* Branch merge with 1.6-rc3 5374* More point-to-multipoint work in multi.[ch]. 5375* Major TAP-Win32 driver restructuring to use 5376 NdisMRegisterDevice instead of 5377 IoCreateDevice/IoCreateSymbolicLink. 5378* Changed TAP-Win32 symbolic links to use \DosDevices\Global\ 5379 pathname prefix. 5380* In the majority of cases, TAP-Win32 should now be 5381 able to install and uninstall on Win2K without requiring 5382 a reboot. 5383* TAP-Win32 MAC address can now be explicitly set in the 5384 adapter advanced properties page. 5385 53862004.03.04 -- Version 2.0-test8 5387 5388* Branch merge with 1.6-rc2. 5389 53902004.03.03 -- Version 2.0-test7 5391 5392* Branch merge with 1.6-rc1.2. 5393 53942004.03.02 -- Version 2.0-test6 5395 5396* Branch merge with 1.6-rc1. 5397 53982004.03.02 -- Version 2.0-test5 5399 5400* Move Socks5 UDP header append/remove to socks.c, and is 5401 called from forward.c. 5402* Moved verify statics from ssl.c into struct tls_session. 5403* Wrote multi.[ch] to handle top level of point-to-multipoint 5404 mode. 5405* Wrote some code to allow a struct link_socket in a child context 5406 to be slaved to the parent context. 5407* Broke up packet read and process functions in forward.c 5408 (from socket or tuntap) into separate functions for read 5409 and process, so that point-to-point and point-to-multipoint can 5410 share the same code. 5411* Expand TLS control channel to allow the passing of configuration 5412 commands. 5413* Wrote mroute.[ch] to handle internal packet routing for 5414 point-to-multipoint mode. 5415 54162004.02.22 -- Version 2.0-test3 5417 5418* Initial work on UDP multi-client server. 5419* Branch merge of 1.6-beta7 5420 54212004.02.14 -- Version 2.0-test2 5422 5423* Refactorization of openvpn.c into openvpn.[ch] 5424 init.[ch] forward.[ch] forward-inline.h 5425 occ.[ch] occ-inline.h ping.[ch] ping-inline.h 5426 sig.[ch]. Created a master per-tunnel 5427 struct context in openvpn.h. 5428* Branch merge of 1.6-beta6.2 5429 54302003.11.06 -- Version 2.0-test1 5431 5432* Initial testbed for 2.0. 5433 54342004.05.09 -- Version 1.6.0 5435 5436* Unchanged from 1.6-rc4 except for version number 5437 upgrade. 5438 54392004.04.01 -- Version 1.6-rc4 5440 5441* Made minor customizations to devcon and 5442 renamed as tapinstall.exe for Windows version. 5443* Fixed "storage size of `iv' isn't known" build 5444 problem on FreeBSD. 5445* OpenSSL 0.9.7d bundled with Windows self-install. 5446 54472004.03.13 -- Version 1.6-rc3 5448 5449* Minor Windows fixes for --ip-win32 dynamic, relating to 5450 the way the TAP-Win32 driver responds to a DHCP request 5451 from the Windows DHCP client. 5452* The net_gateway environmental variable wasn't being 5453 set correctly for called scripts (Paul Zuber). 5454* Added code to determine the default gateway on FreeBSD, 5455 allowing the --redirect-gateway option to work 5456 (Juan Rodriguez Hervella). 5457 54582004.03.04 -- Version 1.6-rc2 5459 5460* Fixed bug in Windows version where the NetBIOS node-type 5461 DHCP option might have been passed even if it was not 5462 specified. 5463* Fixed bug in Windows version introduced in 1.6-rc1, where 5464 DHCP timeout would be set to 0 seconds if --ifconfig option 5465 was used and --ip-win32 option was not explicitly specified. 5466* Added some new --dhcp-option types for Windows version. 5467 54682004.03.02 -- Version 1.6-rc1 5469 5470* For Windows, make "--ip-win32 dynamic" the default. 5471* For Windows, make "--route-delay 10" the default 5472 unless --ip-win32 dynamic is not used or --route-delay 5473 is explicitly specified. 5474* L_TLS mutex could have been left in a locked state 5475 for certain kinds of TLS errors. 5476 54772004.02.22 -- Version 1.6-beta7 5478 5479* Allow scheduling priority increase (--nice) together 5480 with UID/GID downgrade (--user/--group). 5481* Code that causes SIGUSR1 restart on TLS errors in TCP 5482 mode was not activated in pthread builds. 5483* Save the certificate serial number in an environmental 5484 variable called tls_serial_{n} prior to calling the 5485 --tls-verify script. n is the current cert chain level. 5486* Added NetBSD IPv6 tunnel capability (also requires 5487 a kernel patch) (Horst Laschinsky). 5488* Fixed bug in checking the return value of the nice() 5489 function (Ian Pilcher). 5490* Bug fix in new FreeBSD IPv6 over TUN code which was 5491 originally added in 1.6-beta5 (Nathanael Rensen). 5492* More Socks5 fixes -- extended the struct frame 5493 infrastructure to accomodate proxy-based encapsulation 5494 overhead. 5495* Added --dhcp-option to Windows version for setting 5496 adapter properties such as WINS & DNS servers. 5497* Use a default route-delay of 5 seconds when 5498 --ip-win32 dynamic is specified (only applicable when 5499 --route-delay is not explicitly specified). 5500* Added "log_append" registry variable to control 5501 whether the OpenVPN service wrapper on Windows 5502 opens log files in append (log_append="1") or 5503 truncate (log_append="0") mode. The default 5504 is truncate. 5505 55062004.02.05 -- Version 1.6-beta6 5507 5508* UDP over Socks5 fix to accomodate Socks5 encapsulation 5509 overhead (Christof Meerwald). 5510* Minor --ip-win32 dynamic tweaks (use long lease time, 5511 invalidate existing lease with DHCPNAK). 5512 55132004.02.01 -- Version 1.6-beta5 5514 5515* Added Socks5 proxy support (Christof Meerwald). 5516* IPv6 tun support for FreeBSD (Thomas Glanzmann). 5517* Special TAP-Win32 debug mode for Windows self-install that was 5518 enabled in beta4 is now turned off. 5519* Added some new Solaris notes to INSTALL (Koen Maris). 5520* More work on --ip-win32 dynamic. 5521 55222004.01.27 -- Version 1.6-beta4 5523 5524* For this beta, the Windows self-install is a debug version 5525 and will run slower -- use only for testing. 5526* Reverted the --ip-win32 default back to 'ipapi' 5527 from 'dynamic'. 5528* Added the offset parameter to '--ip-win32 dynamic' which 5529 can be used to control the address of the masqueraded 5530 DHCP server which replies to Windows DHCP requests. 5531* Added a wait/nowait option to --inetd (nowait can only 5532 be used with TCP sockets, TLS authentication, and over 5533 a bridged configuration -- see FAQ for more info) 5534 (Stefan `Sec` Zehl). 5535* Added a build-time capability where TAP-Win32 driver 5536 debug messages can be output by OpenVPN at --verb 6 5537 or higher. 5538 55392004.01.20 -- Version 1.6-beta2 5540 5541* Added ./configure --enable-iproute2 flag which 5542 uses iproute2 instead of route + ifconfig -- 5543 this is necessary for the LEAF Linux distro 5544 (Martin Hejl). 5545* Added renewal-time and rebind-time to set of 5546 DHCP options returned by the TAP-Win32 driver when 5547 "--ip-win32 dynamic" is used. 5548 55492004.01.14 -- Version 1.6-beta1 5550 5551* Fixed --proxy bug that sometimes caused plaintext 5552 control info generated by the proxy prior to http 5553 CONNECT method establishment to be incorrectly 5554 parsed as OpenVPN data. 5555* For Windows version, implemented the 5556 "--ip-win32 dynamic" method and made it the default. 5557 This method sets the TAP-Win32 adapter IP address 5558 and netmask by replying to the kernel's DHCP queries. 5559 See the man page for more detailed info. 5560* Added --connect-retry parameter which controls 5561 the time interval (in seconds) between connect() 5562 retries when --proto tcp-client is used. Previously, 5563 this value was hardcoded to 5 seconds, and still 5564 defaults as such. 5565* --resolv-retry can now be used with a parameter 5566 of "infinite" to retry indefinitely. 5567* Added SSL_CTX_use_certificate_chain_file() to ssl.c 5568 for support of multi-level certificate chains 5569 (Sten Kalenda). 5570* Fixed --tls-auth incompatibility with 1.4.x and earlier 5571 versions of OpenVPN when the passphrase file is an 5572 OpenVPN static key file (as generated by --genkey). 5573* Added shell-escape support in config files using 5574 the backslash character ("\") so that (for example) 5575 double quotes can be passed to the shell. 5576* Added "contrib" subdirectory on tarball, source zip, 5577 and CVS containing user-submitted contributions. 5578* Added an optional patch to the Redhat init script to 5579 allow the configuration file directory to be a 5580 multi-level directory hierarchy (Farkas Levente). 5581 See contrib/multilevel-init.patch 5582* Added some scripts and documentation on using 5583 Linux "fwmark" iptables rules to enable 5584 fine-grained routing control over the VPN 5585 (Sean Reifschneider, <jafo@tummy.com>). 5586 See contrib/openvpn-fwmarkroute-1.00 5587 55882003.11.20 -- Version 1.5.0 5589 5590* Minor documentation changes. 5591 55922003.11.04 -- Version 1.5-beta14 5593 5594* Fixed build problem with ./configure --disable-ssl 5595 that was reported on Debian woody. 5596* Fixed bug where --redirect-gateway could not be used 5597 together with --resolv-retry. 5598 55992003.11.03 -- Version 1.5-beta13 5600 5601* Added CRL (certificate revocation list) capability using 5602 --crl-verify option (Stefano Bracalenti). 5603* Added --replay-window option for variable replay-protection 5604 window sizes. 5605* Fixed --fragment bug which might have caused certain large 5606 packets to be sent unfragmented. 5607* Modified --secret and --tls-auth to permit different cipher and 5608 HMAC keys to be used for each data flow direction. Also 5609 increased static key file size generated by --genkey from 5610 1024 to 2048 bits, where 512 bits each are reserved for 5611 send-HMAC, encrypt, receive-HMAC, and decrypt. Key file forward 5612 and backward compatibility is maintained. See --secret option 5613 documentation on the man page for more info. 5614* Added --tls-remote option (Teemu Kiviniemi). 5615* Fixed --tls-cipher documention regarding correct delimiter 5616 usage (Teemu Kiviniemi). 5617* Added --key-method option for selecting alternative data 5618 channel key negotiation methods. Method 1 is the default. 5619 Method 2 has been added (see man page for more info). 5620* Added French translation of HOWTO to web site 5621 (Guillaume Lehmann). 5622* Fixed problem caused by late resolver library load on 5623 certain platforms when --resolv-retry and --chroot are 5624 used together (Teemu Kiviniemi). 5625* In TCP mode, all decryption or TLS errors will abort the current 5626 connection (this is not done in UDP mode because UDP is 5627 "connectionless"). 5628* Fixed a TCP client reconnect bug that only occurs on the 5629 BSDs, where connect() fails with an invalid argument. This 5630 bug was partially (but not completely) fixed in beta7. 5631* Added "route_net_gateway" environmental variable which contains 5632 the pre-existing default gateway address from the routing table 5633 (there's no standard API for getting the default gateway, so 5634 right now this feature only works on Windows or Linux). 5635* Renamed the "route_default_gateway" enviromental variable to 5636 "route_vpn_gateway" -- this is the remote VPN endpoint. 5637* The special keywords vpn_gateway, net_gateway, and remote_host 5638 can now be used for the network or gateway components of the 5639 --route option. See the man page for more info. 5640* Added the --redirect-gateway option to configure the VPN 5641 as the default gateway (implemented on Linux and Windows only). 5642* Added the --http-proxy option with basic authentication 5643 support for use in TCP client mode. Successfully tested 5644 using Squid as the HTTP proxy, with and without authentication. 5645 56462003.10.12 -- Version 1.5-beta12 5647 5648* Fixed Linux-only bug in --mktun and --rmtun which was 5649 introduced around beta8 or so, which would cause 5650 an error such as "I don't recognize device tun0 as a 5651 tun or tap device1". 5652* Added --ifconfig-nowarn option to disable options 5653 consistency warnings about --ifconfig parameters. 5654* Don't allow any kind of sequence number backtracking or 5655 message reordering when in TCP mode. 5656* Changed beta naming convention to use '_' (underscore) 5657 rather than '-' (dash) to pacify rpmbuild. 5658 56592003.10.08 -- Version 1.5-beta11 5660 5661* Modified code in the Windows version which sets the IP address 5662 and netmask of the TAP-Win32 adapter using the IP Helper API. 5663 Most of the changes involve better error recovery when 5664 the IP Helper API returns an error status. See the 5665 manual page entry on --ip-win32 for more info. 5666 56672003.10.08 -- Version 1.5-beta10 5668 5669* Added getpass() function for Windows version so that --askpass 5670 option works correctly (Stefano Bracalenti). 5671* Added reboot advisory to end of Win32 install script. 5672* Changed crypto code to use pseudo-random IVs rather than 5673 carrying forward the IV state from the previous packet. 5674 This is in response to item 2 in the following document: 5675 http://www.openssl.org/~bodo/tls-cbc.txt which points 5676 out weaknesses in TLS's use of the same IV carryforward 5677 approach. This change does not break protocol compatibility 5678 with previous versions of OpenVPN. 5679* Made a change to the crypto replay protection code to also 5680 protect against certain kinds of packet reordering attacks. 5681 This change does not break protocol compatibility with 5682 previous versions of OpenVPN. 5683* Added --ip-win32 option to provide several choices for 5684 setting the IP address on the TAP-Win32 adapter. 5685* #ifdefed out non-CBC crypto modes by default. 5686* Added --up-delay option to delay TUN/TAP open and --up script 5687 execution until after connection establishment. This option 5688 replaces the earlier windows-only option --tap-delay. 5689 56902003.10.01 -- Version 1.5-beta9 5691 5692* Fixed --route-noexec bug where option was not parsed correctly. 5693* Complain if --dev tun is specified without --ifconfig on Windows. 5694* Fixed bug where TCP connections on windows would sometimes cause 5695 an assertion failure. 5696* Added a new flag to TAP-Win32 advanced properties that allows one 5697 to set the adapter to be always "connected" even when an OpenVPN 5698 process doesn't have it open. The default behavior is to report 5699 a media status of connected only when an OpenVPN process has the 5700 adapter open. 5701* Rebuilt the Windows self-install distribution with OpenSSL 0.9.7c 5702 DLLs in response to an OpenSSL security advisory. 5703 57042003.09.30 -- Version 1.5-beta8 5705 5706* Extended the --ifconfig option to work on tap devices as well 5707 as tun devices. 5708* Implemented the --ifconfig option for Windows, by calling the 5709 netsh tool. 5710* By default, do an "arp -d *" on Windows after TAP-Win32 open to 5711 refresh the MAC cache. This behaviour can be disabled with 5712 --no-arp-del. 5713* On Windows, allow the --dev-node parameter (which specifies 5714 the name of the TAP-Win32 adapter) to be omitted in cases where 5715 there is a single TAP-Win32 adapter on the system which can be 5716 assumed to be the default. 5717* Modified the diagnostic --verb 5 debugging level to print 'R' 5718 for TCP/UDP read, 'W' for TCP/UDP write, 'r' for TUN/TAP read, 5719 and 'w' for TUN/TAP write. 5720* Conditionalize OpenBSD read_tun and write_tun based on tun or tap 5721 mode. 5722* Added IPv6 tun support to OpenBSD (Thomas Glanzmann). 5723* Make the --enable-mtu-dynamic ./configure option enabled by 5724 default. 5725* Deprecated the --mtu-dynamic run-time option, in favor of 5726 --fragment. 5727* DNS names can now be used as --ifconfig parameters. 5728* Significant work on TAP-Win32 driver to bring up to SMP standards. 5729* On Windows, fixed dangling IRP problem if TAP-Win32 driver is 5730 unloaded or disabled, while a user-space process has it open. 5731* On Windows, if --tun-mtu is not specified, it will be read from 5732 the TAP-Win32 driver via ioctl. 5733* On Windows, added TAP-Win32 driver status info to "F2" keyboard 5734 signal (only when run from a console window). 5735* Added --mssfix option to control TCP MSS size (YANO Hirokuni). 5736* Renamed --mtu-dynamic option to --fragment to more accurately 5737 reflect its function. Fragment accepts a single parameter which 5738 is the upper limit on acceptable UDP packet size. 5739* Changed default --tun-mtu-extra parameter to 32 from 64. 5740* Eliminated reference to malloc.o in configure.ac. 5741* Added tun device emulation to the TAP-Win32 driver. 5742* Added --route and related options. 5743* Added init script for SuSE Linux (Frank Plohmann). 5744* Extended option consistency check between peers to function 5745 in all crypto modes, including static-key and cleartext modes. 5746 Previously only TLS mode was supported. Disable with 5747 --disable-occ. 5748* Overall, increased the amount of configuration option sanity 5749 checking, especially of networking parameters. 5750* Added --mtu-test option for empirical MTU measurement. 5751* Added Windows-only option --tap-delay to not set the TAP-Win32 5752 adapter media state to 'connected' until TCP/UDP connection 5753 establishment with peer. 5754* Slightly modified --route/--route-delay semantics so that when 5755 --route is given without --route-delay, routes are added 5756 immediately after tun/tap device open. When --route-delay is 5757 specified, routes will be added n seconds after connection 5758 initiation, where n is the --route-delay parameter (which 5759 can be set to 0). 5760* Made TCP framing error into a non-fatal error that triggers a 5761 connection reset. 5762 57632003.08.28 -- Version 1.5-beta7 5764 5765* Fixed bug that caused OpenVPN not to respond to exit/restart 5766 signals when --resolv-retry is used and a local or remote DNS 5767 name cannot be resolved. 5768* Exported a series of environmental variables with useful 5769 info for scripts. See man page for more info. Based 5770 on a suggestion by Anthony Ciaravalo. 5771* Moved TCP/UDP socket bind to a point in the initialization 5772 before the --up script gets called. This is desirable 5773 because (a) a socket bind failure will happen before 5774 daemonization, allowing an error status code to be returned 5775 to the shell and (b) the possibility is eliminated of a 5776 socket bind failure causing the --up script to be run 5777 but not the --down script. This change has a side effect 5778 that --resolv-retry will no longer work with --local. 5779* Fixed bug where if an OpenVPN TCP server went down and back 5780 up again, Solaris or FreeBSD clients would fail to reconnect 5781 to it. 5782* Fixed bug that prevented OpenVPN from being run by 5783 inetd/xinetd in TCP mode. 5784* Added --log and --log-append options for logging messages to 5785 a file. 5786* On Windows, check that the current user is a member of the 5787 Administrator group before attempting install or uninstall. 5788 57892003.08.16 -- Version 1.5-beta6 5790 5791* Fixed TAP-Win32 driver to properly increment the Rx/Tx count. 5792 57932003.08.14 -- Version 1.5-beta5 5794 5795* Added user-configurability of the TAP-Win32 adapter MTU 5796 through the adapter advanced properties page. 5797* Added Windows Service support. 5798* On Windows, added file association and right-clickability 5799 for .ovpn files (OpenVPN config files). 5800 58012003.08.05 -- Version 1.5-beta4 5802 5803* Extra refinements and error checking added to Windows 5804 NSIS install script. 5805 58062003.08.05 -- Version 1.5-beta3 5807 5808* Added md5.h include to crypto.c to fix build problem on 5809 OpenBSD. 5810* Created a Win32 installer using NSIS. 5811* Removed DelService command from TAP-Win32 INF file. It appears 5812 to be not necessary and it interfered with the ability to 5813 uninstall and reinstall the driver without needing to reboot. 5814* On Windows version, added "addtap" and "deltapall" batch 5815 files to add and delete TAP-Win32 adapter instances. 5816 58172003.07.31 -- Version 1.5-beta2 5818 5819* Renamed INSTALL.w32 to INSTALL-win32.txt and reformatted 5820 in Windows ASCII so it's easier to click and view. 5821* Added postscript and PDF versions of the HOWTO to the web 5822 site (C R Zamana). 5823* Merged Michael Clarke's stability patch into TAP-Win32 5824 driver which appears to fix the suspend/resume driver bug 5825 and significantly improve driver stability. 5826* Added Christof Meerwald's Media Status patch to the 5827 TAP-Win32 driver which shows the TAP adapter to be 5828 disconnected when OpenVPN is not running. 5829* Moved socket connect and TCP server listen code to a later 5830 point in openvpn() function so that the TCP server listen 5831 state is entered after daemonization. 5832* Added keyboard shortcuts to simulate signals in the Windows 5833 version, see the window title bar for descriptions. 5834 58352003.07.24 -- Version 1.5-beta1 5836 5837* Added TCP support via the new --proto option. 5838* Renamed udp-centric options such as --udp-mtu to 5839 --link-mtu (old option names preserved for compatibility). 5840* Ported to Windows 2000 + XP using mingw and a TAP driver 5841 derived from the Cipe-Win32 project by Damion K. Wilson. 5842* Added --show-adapters flag for windows version. 5843* Reworked the SSL/TLS packet acknowledge code to better 5844 handle certain corner cases. 5845* Turned off the default enabling of IP forwarding in the 5846 sample-scripts/openvpn.init script for Redhat. 5847 Forwarding can be enabled by users in their --up scripts 5848 or firewall config. 5849* Added --up-restart option based on suggestion from Sean 5850 Reifschneider. 5851* If --dev tap or --dev-type tap is specified, --tun-mtu 5852 defaults to 1500 and --tun-mtu-extra defaults to 64. 5853* Enabled --verb 5 debugging mode that prints 'R' and 'W' 5854 for each packet read or write on the TCP/UDP socket. 5855 58562003.08.04 -- Version 1.4.3 5857 5858* Added md5.h include to crypto.c 5859 to fix build problem on OpenBSD. 5860 58612003.07.15 -- Version 1.4.2 5862 5863* Removed adaptive bandwidth from 5864 --mtu-dynamic -- its absence appears 5865 to work better than its existence (1.4.1.2). 5866* Minor changes to --shaper to fix long 5867 retransmit timeouts at low bandwidth 5868 (1.4.1.2). 5869* Added LOG_RW flag to openvpn.h for 5870 debugging (1.4.1.2). 5871* Silenced spurious configure warnings (1.4.1.2). 5872* Backed out --dev-name patch, modified --dev 5873 to offer equivalent functionality (1.4.1.4). 5874* Added an optional parameter to --daemon and 5875 --inetd to support the passing of a custom 5876 program name to the system logger (1.4.1.5). 5877* Add compiled-in options to the program title 5878 (1.4.1.5). 5879* Coded the beginnings of a WIN32 port (1.4.1.5). 5880* Succeeded in porting to Win32 Mingw environment 5881 and running loopback tests (1.4.1.6). Still 5882 need a kernel driver for full Win32 5883 functionality. 5884* Fixed a bug in error.h where 5885 HAVE_CPP_VARARG_MACRO_GCC was misspelled. 5886 This would have caused a significant slowdown 5887 of OpenVPN when built by compilers that 5888 lack ISO C99 vararg macros (1.4.1.6). 5889* Created an init script for Gentoo Linux 5890 in ./gentoo directory (1.4.1.6). 5891 58922003.05.15 -- Version 1.4.1 5893 5894* Modified the Linux 2.4 TUN/TAP open code to 5895 fall back to the 2.2 TUN/TAP interface if the 5896 open or ioctl fails. 5897* Fixed bug when --verb is set to 0 and non-fatal 5898 socket errors occur, causing 100% CPU utilization. 5899 Occurs on platorms where 5900 EXTENDED_SOCKET_ERROR_CAPABILITY is defined, 5901 such as Linux 2.4. 5902* Fixed typo in tun.c that was preventing 5903 OpenBSD build. 5904* Added --enable-mtu-dynamic configure option 5905 to enable --mtu-dynamic experimental option. 5906 59072003.05.07 -- Version 1.4.0 5908 5909* Added --replay-persist feature to allow replay 5910 protection across sessions. 5911* Fixed bug where --ifconfig could not be used 5912 with --tun-mtu. 5913* Added --tun-mtu-extra parameter to deal with 5914 the situation where a read on a TUN/TAP device 5915 returns more data than the device's MTU size. 5916* Fixed bug where some IPv6 support code for 5917 Linux was not being properly ifdefed out for 5918 Linux 2.2, causing compile errors. 5919* Added OPENVPN_EXIT_STATUS_x codes to 5920 openvpn.h to control which status value 5921 openvpn returns to its caller (such as 5922 a shell or inetd/xinetd) for various conditions. 5923* Added OPENVPN_DEBUG_COMMAND_LINE flag to 5924 openvpn.h to allow debugging in situations 5925 where stdout, stderr, and syslog cannot be used 5926 for message output, such as when OpenVPN is 5927 instantiated by inetd/xinetd. 5928* Removed owner-execute permission from file 5929 created by static key generator (Herbert Xu 5930 and Alberto Gonzalez Iniesta). 5931* Added --passtos option to allow IPv4 TOS bits 5932 to be passed from TUN/TAP input packets to 5933 the outgoing UDP socket (Craig Knox). 5934* Added code to prevent open socket file descriptors 5935 from being accessible to called scripts. 5936* Added --dev-name option (Christian Lademann). 5937* Added --mtu-disc option for manual control 5938 over MTU options. 5939* Show OS MTU value on UDP socket write failures 5940 (linux only). 5941* Numerous build system and portability 5942 fixes (Matthias Andree). 5943* Added better sensing of compiler support for 5944 variable argument macros, including (a) gcc 5945 style, (b) ISO C 1999 style, and (c) no support. 5946* Removed generated files from CVS. Note INSTALL 5947 file for new CVS build commands. 5948* Changed certain internal symbol names 5949 for C standards compliance. 5950* Added TUN/TAP open code to cycle dynamically 5951 through unit numbers until it finds a free 5952 unit (based on code from Thomas Gielfeldt 5953 and VTun). 5954* Added dynamic MTU and fragmenting infrastructure 5955 (Experimental). Rebuild with FRAGMENT_ENABLE 5956 defined to enable. 5957* Minor changes to SSL/TLS negotiation, use 5958 exponential backoff on retransmits, and use 5959 a smaller MTU size (note that no protocol 5960 changes have been made which would break 5961 compatibility with 1.3.x). 5962* Added --enable-strict-options flag 5963 to ./configure. This option will cause 5964 a more strict check for options compatibility 5965 between peers when SSL/TLS negotiation is used, 5966 but should only be used when both OpenVPN peers 5967 are of the same version. 5968* Reorganization of debugging levels. 5969* Added a workaround in configure.ac for 5970 default SSL header location on Linux 5971 to fix RH9 build problem. 5972* Fixed potential deadlock when pthread support 5973 is used on OSes that allocate a small socketpair() 5974 message buffer. 5975* Fixed openvpn.init to be sh compliant 5976 (Bishop Clark). 5977* Changed --daemon to wait until all 5978 initialization is finished before becoming a 5979 daemon, for the benefit of initialization 5980 scripts that want a useful return status from 5981 the openvpn command. 5982* Made openvpn.init script more robust, including 5983 positive indication of initialization errors 5984 in the openvpn daemon and better sanity checks. 5985* Changed --chroot to wait until initialization 5986 is finished before calling chroot(), and allow 5987 the use of --user and --group with --chroot. 5988* When syslog logging is enabled (--daemon or 5989 --inetd), set stdin/stdout/stderr to point 5990 to /dev/null. 5991* For inetd instantiations, dup socket descriptor 5992 to a >2 value. 5993* Fixed bug in verify-cn script, where test would 5994 incorrectly fail if CN=x was the last component 5995 of the X509 composite string (Anonymous). 5996* Added Markus F.X.J. Oberhumer's special 5997 license exception to COPYING. 5998 59992002.10.23 -- Version 1.3.2 6000 6001* Added SSL_CTX_set_client_CA_list call 6002 to follow the canonical form for TLS initialization 6003 recommended by the OpenSSL docs. This change allows 6004 better support for intermediate CAs and has no impact 6005 on security. 6006* Added build-inter script to easy-rsa package, to 6007 facilitate the generation of intermediate CAs. 6008* Ported to NetBSD (Dimitri Goldin). 6009* Fixed minor bug in easy-rsa/sign-req. It refers to 6010 openssl.cnf file, instead of $KEY_CONFIG, like all 6011 other scripts (Ernesto Baschny). 6012* Added --days 3650 to the root CA generation command 6013 in the HOWTO to override the woefully small 30 day 6014 default (Dominik 'Aeneas' Schnitzer). 6015* Fixed bug where --ping-restart would sometimes 6016 not re-resolve remote DNS hostname. 6017* Added --tun-ipv6 option and related infrastructure 6018 support for IPv6 over tun. 6019* Added IPv6 over tun support for Linux (Aaron Sethman). 6020* Added FreeBSD 4.1.1+ TUN/TAP driver notes to 6021 INSTALL (Matthias Andree). 6022* Added inetd/xinetd support (--inetd) including 6023 documentation in the HOWTO. 6024* Added "Important Note on the use of commercial certificate 6025 authorities (CAs) with OpenVPN" to HOWTO based on 6026 issues raised on the openvpn-users list. 6027 60282002.07.10 -- Version 1.3.1 6029 6030* Fixed bug in openvpn.spec and openvpn.init 6031 which caused RPM upgrade to fail. 6032 60332002.07.10 -- Version 1.3.0 6034 6035* Added --dev-node option to allow explicit selection of 6036 tun/tap device node. 6037* Removed mlockall call from child thread, as it doesn't 6038 appear to be necessary (child thread inherits mlockall 6039 state from parent). 6040* Added --ping-timer-rem which causes timer for --ping-exit 6041 and --ping-restart not to run unless we have a remote IP 6042 address. 6043* Added condrestart to openvpn.init and openvpn.spec 6044 (Bishop Clark). 6045* Added --ifconfig case for FreeBSD (Matthias Andree). 6046* Call openlog with facility=LOG_DAEMON (Matthias Andree). 6047* Changed LOG_INFO messages to LOG_NOTICE. 6048* Added warning when key files are group/others accessible. 6049* Added --single-session flag for TLS mode. 6050* Fixed bug where --writepid would segfault if used with 6051 an invalid filename. 6052* Fixed bug where --ipchange status message was formatted 6053 incorrectly. 6054* Print more concise error message when system() call 6055 fails. 6056* Added --disable-occ option. 6057* Added --local, --remote, and --ifconfig options sanity 6058 check. 6059* Changed default UDP MTU to 1300 and TUN/TAP MTU to 6060 1300. 6061* Successfully tested with OpenSSL 0.9.7 Beta 2. 6062* Broke out debug level definitions to errlevel.h 6063* Minor documentation and web site changes. 6064* All changes maintain protocol compatibility 6065 with OpenVPN versions since 1.1.0, however default 6066 MTU changes will require setting the MTU explicitly 6067 by command line option, if you want 1.3.0 to 6068 communicate with previous versions. 6069 60702002.06.12 -- Version 1.2.1 6071 6072* Added --ping-restart option to restart 6073 connection on ping timeout using SIGUSR1 6074 logic (Matthias Andree). 6075* Added --persist-tun, --persist-key, 6076 --persist-local-ip, and --persist-remote-ip 6077 options for finer-grained control over SIGUSR1 6078 and --ping-restart restarts. To 6079 replicate previous SIGUSR1 functionality, 6080 use --persist-remote-ip. 6081* Changed residual IV fetching code to take 6082 IV from tail of ciphertext. 6083* Added check to make sure that CFB or OFB 6084 cipher modes are only used with SSL/TLS 6085 authentication mode, and added a caveat 6086 to INSTALL. 6087* Changed signal handling during initialization 6088 (including re-initialization during restarts) 6089 to exit on SIGTERM or SIGINT and ignore other 6090 signals which would ordinarily be caught. 6091* Added --resolv-retry option to allow 6092 retries on hostname resolution. 6093* Expanded the --float option to also 6094 allow dynamic changes in source port number 6095 on incoming datagrams. 6096* Added --mute option to limit repetitive 6097 logging of similar message types. 6098* Added --group option to downgrade GID 6099 after initialization. 6100* Try to set ifconfig path automatically 6101 in configure. 6102* Added --ifconfig code for Mac OS X 6103 (Christoph Pfisterer). 6104* Moved "Peer Connection Initiated" message 6105 to --verb level 1. 6106* Successfully tested with 6107 OpenSSL 0.9.7 Beta 1 and AES cipher. 6108* Added RPM notes to INSTALL. 6109* Added ACX_PTHREAD (from the autoconf 6110 macro archive) to configure.ac 6111 to figure out the right pthread 6112 options for a given platform. 6113* Broke out macro definitions from 6114 configure.ac to acinclude.m4. 6115* Minor changes to docs and HOWTO. 6116* All changes maintain protocol compatibility 6117 with OpenVPN versions since 1.1.0. 6118 61192002.05.22 -- Version 1.2.0 6120 6121* Added configuration file support via 6122 the --config option. 6123* Added pthread support to improve latency. 6124 With pthread support, OpenVPN 6125 will offload CPU-intensive tasks such as RSA 6126 key number crunching to a background thread 6127 to improve tunnel packet forwarding 6128 latency. pthread support can be enabled 6129 with the --enable-pthread configure option. 6130 Pthread support is currently available 6131 only for Linux and Solaris. 6132* Added --dev-type option so that tun/tap 6133 device names don't need to begin with 6134 "tun" or "tap". 6135* Added --writepid option to write main 6136 process ID to a file. 6137* Numerous portability fixes to ease 6138 porting to other OSes including changing 6139 all network types to uint8_t and uint32_t, 6140 and not assuming that time_t is 32 bits. 6141* Backported to OpenSSL 0.9.5. 6142* Ported to Solaris. 6143* Finished OpenBSD port except for 6144 pthread support. 6145* Added initialization script: 6146 sample-scripts/openvpn.init 6147 (Douglas Keller) 6148* Ported to Mac OS X (Christoph Pfisterer). 6149* Improved resilience to DoS attacks when 6150 TLS mode is used without --remote or 6151 --tls-auth, or when --float is used 6152 with --remote. Note however that the best 6153 defense against DoS attacks in TLS mode 6154 is to use --tls-auth. 6155* Eliminated automake/autoconf dependency 6156 for non-developers. 6157* Ported configure.in to configure.ac 6158 and autoconf 2.50+. 6159* SIGHUP signal now causes OpenVPN to restart 6160 and re-read command line and or config file, 6161 in conformance with canonical daemon behaviour. 6162* SIGUSR1 now does what SIGHUP did in 6163 version 1.1.1 and earlier -- close and reopen 6164 the UDP socket for use when DHCP changes 6165 host's IP address and preserve most recently 6166 authenticated peer address without rereading 6167 config file. 6168* SIGUSR2 added -- outputs current statistics, 6169 including compression statistics. 6170* All changes maintain protocol compatibility 6171 with 1.1.1 and 1.1.0. 6172 61732002.04.22 -- Version 1.1.1 6174 6175* Added --ifconfig option to automatically configure 6176 TUN device. 6177* Added inactivity disconnect (--inactive 6178 and --ping-exit options). 6179* Added --ping option to keep stateful firewalls 6180 from timing out. 6181* Added sanity check to command line parser to 6182 err if any TLS options are used in non-TLS mode. 6183* Fixed build problem with compiler environments that 6184 define printf as a macro. 6185* Fixed build problem on linux systems that have 6186 an integrated TUN/TAP driver but lack the persistent 6187 tunnel feature (TUNSETPERSIST). Some linux kernels 6188 >= 2.4.0 and < 2.4.7 fall into this category. 6189* Changed all calls to EVP_CipherInit to use explicit 6190 encrypt/decrypt mode in order to fix problem with 6191 IDEA-CBC and AES-256-CBC ciphers. 6192* Minor changes to control channel transmit limiter 6193 algorithm to fix problem where TLS control channel 6194 might not renegotiate within the default 60 second window. 6195* Simplified man page examples by taking advantage 6196 of the new --ifconfig option. 6197* Minor changes to configure.in to check more 6198 rigourously for OpenSSL 0.9.6 or greater. 6199* Put back openvpn.spec, eliminated 6200 openvpn.spec.in. 6201* Modified openvpn.spec to reflect new automake-based 6202 build environment (Bishop Clark). 6203* Other documentation changes. 6204* Added --test-crypto option for debugging. 6205* Added "missing" and "mkinstalldirs" automake 6206 support files. 6207 6208 62092002.04.09 -- Version 1.1.0 6210 6211* Strengthened replay protection and IV handling, 6212 extending it fully to both static key and 6213 TLS dynamic key exchange modes. 6214* Added --mlock option to disable paging and ensure that key 6215 material and tunnel data is never paged to disk. 6216* Added optional traffic shaping feature to cap the maximum 6217 data rate of the tunnel. 6218* Converted to automake (The Platypus Brothers 2002-04-01). 6219* Ported to OpenBSD by Janne Johansson. 6220* Added --tun-af-inet option to work around an incompatibility 6221 between Linux and BSD tun drivers. 6222* Sequence number-based replay protection using the 6223 IPSec sliding window model is now the default, 6224 disable with --no-replay. 6225* Explicit IV is now the default, disable with --no-iv. 6226* Disabled all cipher modes except CBC, CFB, and OFB. 6227* In CBC mode, use explicit IV and carry forward residuals, 6228 using IPSec model. 6229* In CFB/OFB mode, IV is timestamp, sequence number. 6230* Eliminated --packet-id, --timestamp, and max-delta parameter to 6231 the --tls-auth option as they are now supplanted by improved 6232 replay code which is enabled by default. 6233* Eliminated --rand-iv as it is now obsolete with improved 6234 IV code. 6235* Eliminated --reneg-err option as it increases vulnerability 6236 to DoS attacks. 6237* Added weak key check for DES ciphers. 6238* --tls-freq option is no longer specified on the command line, 6239 instead it now inherits its parameter from the 6240 --tls-timeout option. 6241* Fixed bug that would try to free memory on exit that was 6242 never malloced if --comp-lzo was not specified. 6243* Errata fixed in the man page examples: "test-ca" should be 6244 "tmp-ca". 6245* Updated manual page. 6246* Preliminary work in porting to OpenSSL 0.9.7. 6247* Changed license to allowing linking with OpenSSL. 6248 62492002.03.29 -- Version 1.0.3 6250 6251* Fixed a problem in configure with library ordering on the 6252 command line. 6253 62542002.03.28 -- Version 1.0.2 6255 6256* Improved the efficiency of the inner event loop. 6257* Fixed a minor bug with timeout handling. 6258* Improved the build system to build on RH 6.2 through 7.2. 6259* Added an openvpn.spec file for RPM builders (Bishop Clark). 6260 62612002.03.23 -- Version 1.0 6262 6263* Added TLS-based authentication and key exchange. 6264* Added gremlin mode to stress test. 6265* Wrote man page. 6266 62672001.12.26 -- Version 0.91 6268 6269* Added any choice of cipher or HMAC digest. 6270 62712001.5.13 -- Version 0.90 6272 6273* Initial release. 6274* IP tunnel over UDP, with blowfish cipher and SHA1 HMAC signature. 6275