Commit 5d9194
2025-02-11 10:05:03 Samuli Seppänen: Add Changes in OpenVPN 2.1 page| /dev/null .. Changelogs/ChangesInOpenVPN21.md | |
| @@ 0,0 1,1191 @@ | |
| + | ``` |
| + | OpenVPN Change Log |
| + | Copyright (C) 2002-2010 OpenVPN Technologies, Inc. < |
| + | sales@openvpn.net> |
| + | |
| + | 2010.11.09 -- Version 2.1.4 |
| + | |
| + | * Fix problem with special case route targets ('remote_host') |
| + | The init_route() function will leave &netlist untouched for |
| + | get_special_addr() routes ("remote_host" being one of them). |
| + | netlist is on stack, contains random garbage, and |
| + | netlist.len will not be 0 - thus, random stack data is copied from |
| + | netlist.data[] until the route_list is full. |
| + | Thanks to Teodo MICU and Gert Doering for finding and fixing this issue. |
| + | |
| + | |
| + | 2010.08.20 -- Version 2.1.3 |
| + | |
| + | * Windows build fixes |
| + | Attempt to fix issue where domake-win build system was not properly |
| + | signing drivers and .exe files. This change is only affecting the |
| + | Windows build scripts and not the OpenVPN code base. |
| + | |
| + | 2010.08.09 -- Version 2.1.2 |
| + | |
| + | * Windows security issue: |
| + | Fixed potential local privilege escalation vulnerability in |
| + | Windows service. The Windows service did not properly quote the |
| + | executable filename passed to CreateService. A local attacker |
| + | with write access to the root directory C:\ could create an |
| + | executable that would be run with the same privilege level as |
| + | the OpenVPN Windows service. However, since non-Administrative |
| + | users normally lack write permission on C:\, this vulnerability |
| + | is generally not exploitable except on older versions of Windows |
| + | (such as Win2K) where the default permissions on C:\ would allow |
| + | any user to create files there. |
| + | Credit: Scott Laurie, MWR InfoSecurity |
| + | |
| + | * Added Python-based based alternative build system for Windows using |
| + | Visual Studio 2008 (in win directory). |
| + | |
| + | * When aborting in a non-graceful way, try to execute do_close_tun in |
| + | init.c prior to daemon exit to ensure that the tun/tap interface is |
| + | closed and any added routes are deleted. |
| + | |
| + | * Fixed an issue where AUTH_FAILED was not being properly delivered |
| + | to the client when a bad password is given for mid-session reauth, |
| + | causing the connection to fail without an error indication. |
| + | |
| + | * Don't advance to the next connection profile on AUTH_FAILED errors. |
| + | |
| + | * Fixed an issue in the Management Interface that could cause |
| + | a process hang with 100% CPU utilization in --management-client |
| + | mode if the management interface client disconnected at the |
| + | point where credentials are queried. |
| + | |
| + | * Fixed an issue where if reneg-sec was set to 0 on the client, |
| + | so that the server-side value would take precedence, |
| + | the auth_deferred_expire_window function would incorrectly |
| + | return a window period of 0 seconds. In this case, the |
| + | correct window period should be the handshake window |
| + | period. |
| + | |
| + | * Modified ">PASSWORD:Verification Failed" management interface |
| + | notification to include a client reason string: |
| + | |
| + | >PASSWORD:Verification Failed: 'AUTH_TYPE' ['REASON_STRING'] |
| + | |
| + | * Enable exponential backoff in reliability layer |
| + | retransmits. |
| + | |
| + | * Set socket buffers (SO_SNDBUF and SO_RCVBUF) immediately after |
| + | socket is created rather than waiting until after connect/listen. |
| + | |
| + | * Management interface performance optimizations: |
| + | |
| + | 1. Added env-filter MI command to perform filtering on env vars |
| + | passed through as a part of --management-client-auth |
| + | |
| + | 2. man_write will now try to aggregate output into larger blocks |
| + | (up to 1024 bytes) for more efficient i/o |
| + | |
| + | * Fixed minor issue in Windows TAP driver DEBUG builds |
| + | where non-null-terminated unicode strings were being |
| + | printed incorrectly. |
| + | |
| + | * Fixed issue on Windows with MSVC compiler, where TCP_NODELAY support |
| + | was not being compiled in. |
| + | |
| + | * Proxy improvements: |
| + | |
| + | Improved the ability of http-auth "auto" flag to dynamically detect |
| + | the auth method required by the proxy. |
| + | |
| + | Added http-auth "auto-nct" flag to reject weak proxy auth methods. |
| + | |
| + | Added HTTP proxy digest authentication method. |
| + | |
| + | Removed extraneous openvpn_sleep calls from proxy.c. |
| + | |
| + | * Implemented http-proxy-override and http-proxy-fallback directives to make it |
| + | easier for OpenVPN client UIs to start a pre-existing client config file with |
| + | proxy options, or to adaptively fall back to a proxy connection if a direct |
| + | connection fails. |
| + | |
| + | * Implemented a key/value auth channel from client to server. |
| + | |
| + | * Fixed issue where bad creds provided by the management interface |
| + | for HTTP Proxy Basic Authentication would go into an infinite |
| + | retry-fail loop instead of requerying the management interface for |
| + | new creds. |
| + | |
| + | * Added support for MSVC debugging of openvpn.exe in settings.in: |
| + | |
| + | # Build debugging version of openvpn.exe |
| + | !define PRODUCT_OPENVPN_DEBUG |
| + | |
| + | * Implemented multi-address DNS expansion on the network field of route |
| + | commands. |
| + | |
| + | When only a single IP address is desired from a multi-address DNS |
| + | expansion, use the first address rather than a random selection. |
| + | |
| + | * Added --register-dns option for Windows. |
| + | |
| + | Fixed some issues on Windows with --log, subprocess creation |
| + | for command execution, and stdout/stderr redirection. |
| + | |
| + | * Fixed an issue where application payload transmissions on the |
| + | TLS control channel (such as AUTH_FAILED) that occur during |
| + | or immediately after a TLS renegotiation might be dropped. |
| + | |
| + | * Added warning about tls-remote option in man page. |
| + | |
| + | 2009.12.11 -- Version 2.1.1 |
| + | |
| + | * Fixed some breakage in openvpn.spec (which is required to build an |
| + | RPM distribution) where it was referencing a non-existent |
| + | subdirectory in the tarball, causing it to fail (patch from |
| + | David Sommerseth). |
| + | |
| + | 2009.12.11 -- Version 2.1.0 |
| + | |
| + | * Fixed a couple issues in sample plugins auth-pam.c and down-root.c. |
| + | (1) Fail gracefully rather than segfault if calloc returns NULL. |
| + | (2) The openvpn_plugin_abort_v1 function can potentially be called |
| + | with handle == NULL. Add code to detect this case, and if so, avoid |
| + | dereferencing pointers derived from handle (Thanks to David |
| + | Sommerseth for finding this bug). |
| + | |
| + | * Documented "multihome" option in the man page. |
| + | |
| + | 2009.11.20 -- Version 2.1_rc22 |
| + | |
| + | * Fixed a client-side bug on Windows that occurred when the |
| + | "dhcp-pre-release" or "dhcp-renew" options were combined with |
| + | "route-gateway dhcp". The release/renew would not occur |
| + | because the Windows DHCP renew function is blocking and |
| + | therefore must be called from another process or thread |
| + | so as not to stall the tunnel. |
| + | |
| + | * Added a hard failure when peer provides a certificate chain |
| + | with depth > 16. Previously, a warning was issued. |
| + | |
| + | 2009.11.12 -- Version 2.1_rc21 |
| + | |
| + | * Rebuilt OpenVPN Windows installer with OpenSSL 0.9.8l to address |
| + | CVE-2009-3555. Note that OpenVPN has never relied on the session |
| + | renegotiation capabilities that are built into the SSL/TLS protocol, |
| + | therefore the fix in OpenSSL 0.9.8l (disable SSL/TLS renegotiation |
| + | completely) will not adversely affect OpenVPN mid-session SSL/TLS |
| + | renegotation or any other OpenVPN capabilities. |
| + | |
| + | * Added additional session renegotiation hardening. OpenVPN has always |
| + | required that mid-session renegotiations build up a new SSL/TLS |
| + | session from scratch. While the client certificate common name is |
| + | already locked against changes in mid-session TLS renegotiations, we |
| + | now extend this locking to the auth-user-pass username as well as all |
| + | certificate content in the full client certificate chain. |
| + | |
| + | 2009.10.01 -- Version 2.1_rc20 |
| + | |
| + | * Fixed a bug introduced in 2.1_rc17 (svn r4436) where using the |
| + | redirect-gateway option by itself, without any extra parameters, |
| + | would cause the option to be ignored. |
| + | |
| + | * Fixed build problem when ./configure --disable-server is used. |
| + | |
| + | * Fixed ifconfig command for "topology subnet" on FreeBSD (Stefan Bethke). |
| + | |
| + | * Added --remote-random-hostname option. |
| + | |
| + | * Added "load-stats" management interface command to get global server |
| + | load statistics. |
| + | |
| + | * Added new ./configure flags: |
| + | |
| + | --disable-def-auth Disable deferred authentication |
| + | --disable-pf Disable internal packet filter |
| + | |
| + | * Added "setcon" directive for interoperability with SELinux (Sebastien |
| + | Raveau). |
| + | |
| + | * Optimized PUSH_REQUEST handshake sequence to shave several seconds |
| + | off of a typical client connection initiation. |
| + | |
| + | * The maximum number of "route" directives (specified in the config |
| + | file or pulled from a server) can now be configured via the new |
| + | "max-routes" directive. |
| + | |
| + | * Eliminated the limitation on the number of options that can be pushed |
| + | to clients, including routes. Previously, all pushed options needed |
| + | to fit within a 1024 byte options string. |
| + | |
| + | * Added --server-poll-timeout option : when polling possible remote |
| + | servers to connect to in a round-robin fashion, spend no more than |
| + | n seconds waiting for a response before trying the next server. |
| + | |
| + | * Added the ability for the server to provide a custom reason string |
| + | when an AUTH_FAILED message is returned to the client. This |
| + | string can be set by the server-side managment interface and read |
| + | by the client-side management interface. |
| + | |
| + | * client-kill management interface command, when issued on server, will |
| + | now send a RESTART message to client. |
| + | This feature is intended to make UDP clients respond the same as TCP |
| + | clients in the case where the server issues a RESTART message in |
| + | order to force the client to reconnect and pull a new options/route |
| + | list. |
| + | |
| + | 2009.07.16 -- Version 2.1_rc19 |
| + | |
| + | * In Windows TAP driver, refactor DHCP/ARP packet injection code to |
| + | use a DPC (deferred procedure call) to defer packet injection until |
| + | IRQL < DISPATCH_LEVEL, rather than calling NdisMEthIndicateReceive |
| + | in the context of AdapterTransmit. This is an attempt to reduce kernel |
| + | stack usage, and prevent EXCEPTION_DOUBLE_FAULT BSODs that have been |
| + | observed on Vista. Updated TAP driver version number to 9.6. |
| + | |
| + | * In configure.ac, use datadir instead of datarootdir for compatibility |
| + | with <autoconf-2.60. |
| + | |
| + | 2009.06.07 -- Version 2.1_rc18 |
| + | |
| + | * Fixed compile error on ./configure --enable-small |
| + | |
| + | * Fixed issue introduced in r4475 (2.1-rc17) where cryptoapi.c change |
| + | does not build on Windows on non-MINGW32. |
| + | |
| + | 2009.05.30 -- Version 2.1_rc17 |
| + | |
| + | * Reduce the debug level (--verb) at which received management interface |
| + | commands are echoed from 7 to 3. Passwords will be filtered. |
| + | |
| + | * Fixed race condition in management interface recv code on |
| + | Windows, where sending a set of several commands to the |
| + | management interface in quick succession might cause the |
| + | latter commands in the set to be ignored. |
| + | |
| + | * Increased management interface input command buffer size |
| + | from 256 to 1024 bytes. |
| + | |
| + | * Minor tweaks to Windows build system. |
| + | |
| + | * Added "redirect-private" option which allows private subnets |
| + | to be pushed to the client in such a way that they don't accidently |
| + | obscure critical local addresses such as the DHCP server address and |
| + | DNS server addresses. |
| + | |
| + | * Added new 'autolocal' redirect-gateway flag. When enabled, the OpenVPN |
| + | client will examine the routing table and determine whether (a) the |
| + | OpenVPN server is reachable via a locally connected interface, or (b) |
| + | traffic to the server must be forwarded through the default router. |
| + | Only add a special bypass route for the OpenVPN server if (b) is true. |
| + | If (a) is true, behave as if the 'local' flag is specified, and do not |
| + | add a bypass route. |
| + | |
| + | The new 'autolocal' flag depends on the non-portable test_local_addr() |
| + | function in route.c, which is currently only implemented for Windows. |
| + | The 'autolocal' flag will act as a no-op on platforms that have not |
| + | yet defined a test_local_addr() function. |
| + | |
| + | * Increased TLS_CHANNEL_BUF_SIZE to 2048 from 1024 (this will allow for |
| + | more option content to be pushed from server to client). |
| + | |
| + | * Raised D_MULTI_DROPPED debug level to 4 from 3 to filter out (at debug |
| + | levels <=3) a common and usually innocuous warning. |
| + | |
| + | * Fixed issue of symbol conflicts interfering with Windows CryptoAPI |
| + | functionality (Alon Bar-Lev). |
| + | |
| + | * Fixed bug where the remote_X environmental variables were not being |
| + | set correctly when the 'local' option is specifed. |
| + | |
| + | 2009.05.17 -- Version 2.1_rc16 |
| + | |
| + | * Windows installer changes: |
| + | |
| + | 1. ifdefed out the check Windows version code which is causing |
| + | problems on Windows 7 |
| + | |
| + | 2. don't define SF_SELECTED if it is already defined |
| + | |
| + | 3. Use LZMA instead of BZIP2 compression for better compression |
| + | |
| + | 4. Upgraded OpenSSL to 0.9.8k |
| + | |
| + | * Added the ability to read the configuration file |
| + | from stdin, when "stdin" is given as the config |
| + | file name. |
| + | |
| + | * Allow "management-client" directive to be used |
| + | with unix domain sockets. |
| + | |
| + | * Added errors-to-stderr option. When enabled, fatal errors |
| + | that result in the termination of the daemon will be written |
| + | to stderr. |
| + | |
| + | * Added optional "nogw" (no gateway) flag to --server-bridge |
| + | to inhibit the pushing of the route-gateway parameter to |
| + | clients. |
| + | |
| + | * Added new management interface command "pid" to show the |
| + | process ID of the current OpenVPN process (Angelo Laub). |
| + | |
| + | * Fixed issue where SIGUSR1 restarts would fail if private |
| + | key was specified as an inline file. |
| + | |
| + | * Added daemon_start_time and daemon_pid environmental variables. |
| + | |
| + | * In management interface, added new ">CLIENT:ESTABLISHED" notification. |
| + | |
| + | * Build fixes: |
| + | |
| + | 1. Fixed some issues with C++ style comments that leaked into the code. |
| + | |
| + | 2. Updated configure.ac to work on MinGW64. |
| + | |
| + | 3. Updated common.h types for _WIN64. |
| + | |
| + | 4. Fixed issue involving an #ifdef in a macro reference that breaks early gcc |
| + | compilers. |
| + | |
| + | 5. In cryptoapi.c, renamed CryptAcquireCertificatePrivateKey to |
| + | OpenVPNCryptAcquireCertificatePrivateKey to work around |
| + | a symbol conflict in MinGW-5.1.4. |
| + | |
| + | 2008.11.19 -- Version 2.1_rc15 |
| + | |
| + | * Fixed issue introduced in 2.1_rc14 that may cause a |
| + | segfault when a --plugin module is used. |
| + | |
| + | * Added server-side --opt-verify option: clients that connect |
| + | with options that are incompatible with those of the server |
| + | will be disconnected (without this option, incompatible |
| + | clients would trigger a warning message in the server log |
| + | but would not be disconnected). |
| + | |
| + | * Added --tcp-nodelay option: Macro that sets TCP_NODELAY socket |
| + | flag on the server as well as pushes it to connecting clients. |
| + | |
| + | * Minor options check fix: --no-name-remapping is a |
| + | server-only option and should therefore generate an |
| + | error when used on the client. |
| + | |
| + | * Added --prng option to control PRNG (pseudo-random |
| + | number generator) parameters. In previous OpenVPN |
| + | versions, the PRNG was hardcoded to use the SHA1 |
| + | hash. Now any OpenSSL hash may be used. This is |
| + | part of an effort to remove hardcoded references to |
| + | a specific cipher or cryptographic hash algorithm. |
| + | |
| + | * Cleaned up man page synopsis. |
| + | |
| + | 2008.11.16 -- Version 2.1_rc14 |
| + | |
| + | * Added AC_GNU_SOURCE to configure.ac to enable struct ucred, |
| + | with the goal of fixing a build issue on Fedora 9 that was |
| + | introduced in 2.1_rc13. |
| + | |
| + | * Added additional method parameter to --script-security to preserve |
| + | backward compatibility with system() call semantics used in OpenVPN |
| + | 2.1_rc8 and earlier. To preserve backward compatibility use: |
| + | |
| + | script-security 3 system |
| + | |
| + | * Added additional warning messages about --script-security 2 |
| + | or higher being required to execute user-defined scripts or |
| + | executables. |
| + | |
| + | * Windows build system changes: |
| + | |
| + | Modified Windows domake-win build system to write all openvpn.nsi |
| + | input files to gen, so that gen can be disconnected from |
| + | the rest of the source tree and makensis openvpn.nsi will |
| + | still function correctly. |
| + | |
| + | Added additional SAMPCONF_(CA|CRT|KEY) macros to settings.in |
| + | (commented out by default). |
| + | |
| + | Added optional files SAMPCONF_CONF2 (second sample configuration |
| + | file) and SAMPCONF_DH (Diffie-Helman parameters) to Windows |
| + | build system, and may be defined in settings.in. |
| + | |
| + | * Extended Management Interface "bytecount" command |
| + | to work when OpenVPN is running as a server. |
| + | Documented Management Interface "bytecount" command in |
| + | management/management-notes.txt. |
| + | |
| + | * Fixed informational message in ssl.c to properly indicate |
| + | deferred authentication. |
| + | |
| + | * Added server-side --auth-user-pass-optional directive, to allow |
| + | connections by clients that do not specify a username/password, when a |
| + | user-defined authentication script/module is in place (via |
| + | --auth-user-pass-verify, --management-client-auth, or a plugin module). |
| + | |
| + | * Changes to easy-rsa/2.0/pkitool and related openssl.cnf: |
| + | |
| + | Calling scripts can set the KEY_NAME environmental variable to set |
| + | the "name" X509 subject field in generated certificates. |
| + | |
| + | Modified pkitool to allow flexibility in separating the Common Name |
| + | convention from the cert/key filename convention. |
| + | |
| + | For example: |
| + | |
| + | KEY_CN="James's Laptop" KEY_NAME="james" ./pkitool james |
| + | |
| + | will create a client certificate/key pair of james.crt/james.key |
| + | having a Common Name of "James's Laptop" and a Name of "james". |
| + | |
| + | * Added --no-name-remapping option to allow Common Name, X509 Subject, |
| + | and username strings to include any printable character including |
| + | space, but excluding control characters such as tab, newline, and |
| + | carriage-return (this is important for compatibility with external |
| + | authentication systems). |
| + | |
| + | As a related change, added --status-version 3 format (and "status 3" |
| + | in the management interface) which uses the version 2 format except |
| + | that tabs are used as delimiters instead of commas so that there |
| + | is no ambiguity when parsing a Common Name that contains a comma. |
| + | |
| + | Also, save X509 Subject fields to environment, using the naming |
| + | convention: |
| + | |
| + | X509_{cert_depth}_{name}={value} |
| + | |
| + | This is to avoid ambiguities when parsing out the X509 subject string |
| + | since "/" characters could potentially be used in the common name. |
| + | |
| + | * Fixed some ifconfig-pool issues that precluded it from being combined |
| + | with --server directive. |
| + | |
| + | Now, for example, we can configure thusly: |
| + | |
| + | server 10.8.0.0 255.255.255.0 nopool |
| + | ifconfig-pool 10.8.0.2 10.8.0.99 255.255.255.0 |
| + | |
| + | to have ifconfig-pool manage only a subset |
| + | of the VPN subnet. |
| + | |
| + | * Added config file option "setenv FORWARD_COMPATIBLE 1" to relax |
| + | config file syntax checking to allow directives for future OpenVPN |
| + | versions to be ignored. |
| + | |
| + | 2008.10.07 -- Version 2.1_rc13 |
| + | |
| + | * Bundled OpenSSL 0.9.8i with Windows installer. |
| + | |
| + | * Management interface can now listen on a unix |
| + | domain socket, for example: |
| + | |
| + | management /tmp/openvpn unix |
| + | |
| + | Also added management-client-user and management-client-group |
| + | directives to control which processes are allowed to connect |
| + | to the socket. |
| + | |
| + | * Copyright change to OpenVPN Technologies, Inc. |
| + | |
| + | 2008.09.23 -- Version 2.1_rc12 |
| + | |
| + | * Patched Makefile.am so that the new t_cltsrv-down.sh script becomes |
| + | part of the tarball (Matthias Andree). |
| + | |
| + | * Fixed --lladdr bug introduced in 2.1-rc9 where input validation code |
| + | was incorrectly expecting the lladdr parameter to be an IP address |
| + | when it is actually a MAC address (HoverHell). |
| + | |
| + | 2008.09.14 -- Version 2.1_rc11 |
| + | |
| + | * Fixed a bug that can cause SSL/TLS negotiations in UDP mode |
| + | to fail if UDP packets are dropped. |
| + | |
| + | 2008.09.10 -- Version 2.1_rc10 |
| + | |
| + | * Added "--server-bridge" (without parameters) to enable |
| + | DHCP proxy mode: Configure server mode for ethernet |
| + | bridging using a DHCP-proxy, where clients talk to the |
| + | OpenVPN server-side DHCP server to receive their IP address |
| + | allocation and DNS server addresses. |
| + | |
| + | * Added "--route-gateway dhcp", to enable the extraction |
| + | of the gateway address from a DHCP negotiation with the |
| + | OpenVPN server-side LAN. |
| + | |
| + | * Fixed minor issue with --redirect-gateway bypass-dhcp or bypass-dns |
| + | on Windows. If the bypass IP address is 0.0.0.0 or 255.255.255.255, |
| + | ignore it. |
| + | |
| + | * Warn when ethernet bridging that the IP address of the bridge adapter |
| + | is probably not the same address that the LAN adapter was set to |
| + | previously. |
| + | |
| + | * When running as a server, warn if the LAN network address is |
| + | the all-popular 192.168.[0|1].x, since this condition commonly |
| + | leads to subnet conflicts down the road. |
| + | |
| + | * Primarily on the client, check for subnet conflicts between |
| + | the local LAN and the VPN subnet. |
| + | |
| + | * Added a 'netmask' parameter to get_default_gateway, to return |
| + | the netmask of the adapter containing the default gateway. |
| + | Only implemented on Windows so far. Other platforms will |
| + | return 255.255.255.0. Currently the netmask information is |
| + | only used to warn about subnet conflicts. |
| + | |
| + | * Minor fix to cryptoapi.c to not compile itself unless USE_CRYPTO |
| + | and USE_SSL flags are enabled (Alon Bar-Lev). |
| + | |
| + | * Updated openvpn/t_cltsrv.sh (used by "make check") to conform to new |
| + | --script-security rules. Also adds retrying if the addresses are in |
| + | use (Matthias Andree). |
| + | |
| + | * Fixed build issue with ./configure --disable-socks --disable-http. |
| + | |
| + | * Fixed separate compile errors in options.c and ntlm.c that occur |
| + | on strict C compilers (such as old versions of gcc) that require |
| + | that C variable declarations occur at the start of a {} block, |
| + | not in the middle. |
| + | |
| + | * Workaround bug in OpenSSL 0.9.6b ASN1_STRING_to_UTF8, which |
| + | the new implementation of extract_x509_field_ssl depends on. |
| + | |
| + | * LZO compression buffer overflow errors will now invalidate |
| + | the packet rather than trigger a fatal assertion. |
| + | |
| + | * Fixed minor compile issue in ntlm.c (mid-block declaration). |
| + | |
| + | * Added --allow-pull-fqdn option which allows client to pull DNS names |
| + | from server (rather than only IP address) for --ifconfig, --route, and |
| + | --route-gateway. OpenVPN versions 2.1_rc7 and earlier allowed DNS names |
| + | for these options to be pulled and translated to IP addresses by default. |
| + | Now --allow-pull-fqdn will be explicitly required on the client to enable |
| + | DNS-name-to-IP-address translation of pulled options. |
| + | |
| + | * 2.1_rc8 and earlier did implicit shell expansion on script |
| + | arguments since all scripts were called by system(). |
| + | The security hardening changes made to 2.1_rc9 no longer |
| + | use system(), but rather use the safer execve or CreateProcess |
| + | system calls. The security hardening also introduced a |
| + | backward incompatibility with 2.1_rc8 and earlier in that |
| + | script parameters were no longer shell-expanded, so |
| + | for example: |
| + | |
| + | client-connect "docc CLIENT-CONNECT" |
| + | |
| + | would fail to work because execve would try to execute |
| + | a script called "docc CLIENT-CONNECT" instead of "docc" |
| + | with "CLIENT-CONNECT" as the first argument. |
| + | |
| + | This patch fixes the issue, bringing the script argument |
| + | semantics back to pre 2.1_rc9 behavior in order to preserve |
| + | backward compatibility while still using execve or CreateProcess |
| + | to execute the script/executable. |
| + | |
| + | * Modified ip_or_dns_addr_safe, which validates pulled DNS names, |
| + | to more closely conform to RFC 3696: |
| + | |
| + | (1) DNS name length must not exceed 255 characters |
| + | |
| + | (2) DNS name characters must be limited to alphanumeric, |
| + | dash ('-'), and dot ('.') |
| + | |
| + | * Fixed bug in intra-session TLS key rollover that was introduced with |
| + | deferred authentication features in 2.1_rc8. |
| + | |
| + | 2008.07.31 -- Version 2.1_rc9 |
| + | |
| + | * Security Fix -- affects non-Windows OpenVPN clients running |
| + | OpenVPN 2.1-beta14 through 2.1-rc8 (OpenVPN 2.0.x clients are NOT |
| + | vulnerable nor are any versions of the OpenVPN server vulnerable). |
| + | An OpenVPN client connecting to a malicious or compromised |
| + | server could potentially receive an "lladdr" or "iproute" configuration |
| + | directive from the server which could cause arbitrary code execution on |
| + | the client. A successful attack requires that (a) the client has agreed |
| + | to allow the server to push configuration directives to it by including |
| + | "pull" or the macro "client" in its configuration file, (b) the client |
| + | successfully authenticates the server, (c) the server is malicious or has |
| + | been compromised and is under the control of the attacker, and (d) the |
| + | client is running a non-Windows OS. Credit: David Wagner. |
| + | CVE-2008-3459 |
| + | |
| + | * Miscellaneous defensive programming changes to multiple |
| + | areas of the code. In particular, use of the system() call |
| + | for calling executables such as ifconfig, route, and |
| + | user-defined scripts has been completely revamped in favor |
| + | of execve() on unix and CreateProcess() on Windows. |
| + | |
| + | * In Windows build, package a statically linked openssl.exe to work around |
| + | observed instabilities in the dynamic build since the migration to |
| + | OpenSSL 0.9.8h. |
| + | |
| + | 2008.06.11 -- Version 2.1_rc8 |
| + | |
| + | * Added client authentication and packet filtering capability |
| + | to management interface. In addition, allow OpenVPN plugins |
| + | to take advantage of deferred authentication and packet |
| + | filtering capability. |
| + | |
| + | * Added support for client-side connection profiles. |
| + | |
| + | * Fixed unbounded memory growth bug in environmental variable |
| + | code that could have caused long-running OpenVPN sessions |
| + | with many TLS renegotiations to incrementally |
| + | increase memory usage over time. |
| + | |
| + | * Windows release now packages openssl-0.9.8h. |
| + | |
| + | * Build system changes -- allow building on Windows using |
| + | autoconf/automake scripts (Alon Bar-Lev). |
| + | |
| + | * Changes to Windows build system to make it easier to do |
| + | partial builds, with a reduced set of prerequisites, |
| + | where only a subset of OpenVPN installer |
| + | components are built. See ./domake-win comments. |
| + | |
| + | * Cleanup IP address for persistence interfaces for tap and also |
| + | using ifconfig, gentoo#209055 (Alon Bar-Lev). |
| + | |
| + | * Fall back to old version of extract_x509_field for OpenSSL 0.9.6. |
| + | |
| + | * Clarified tcp-queue-limit man page entry (Matti Linnanvuori). |
| + | |
| + | * Added new OpenVPN icon and installer graphic. |
| + | |
| + | * Minor pkitool changes. |
| + | |
| + | * Added --pkcs11-id-management option, which will cause OpenVPN to |
| + | query the management interface via the new NEED-STR asynchronous |
| + | notification query to get additional PKCS#11 options (Alon Bar-Lev). |
| + | |
| + | * Added NEED-STR management interface asynchronous query and |
| + | "needstr" management interface command to respond to the query |
| + | (Alon Bar-Lev). |
| + | |
| + | * Added Dragonfly BSD support (Francis-Gudin). |
| + | |
| + | * Quote device names before passing to up/down script (Josh Cepek). |
| + | |
| + | * Bracketed struct openvpn_pktinfo with #pragma pack(1) to |
| + | prevent structure padding from causing an incorrect length |
| + | to be returned by sizeof (struct openvpn_pktinfo) on 64-bit |
| + | platforms. |
| + | |
| + | * On systems that support res_init, always call it |
| + | before calling gethostbyname to ensure that |
| + | resolver configuration state is current. |
| + | |
| + | * Added NTLMv2 proxy support (Miroslav Zajic). |
| + | |
| + | * Fixed an issue in extract_x509_field_ssl where the extraction |
| + | would fail on the first field of the subject name, such as |
| + | the common name in: /CN=foo/emailAddress= |
| + | foo@bar.com |
| + | |
| + | * Made "Linux ip addr del failed" error nonfatal. |
| + | |
| + | * Amplified --client-cert-not-required warning. |
| + | |
| + | * Added #pragma pack to proto.h. |
| + | |
| + | 2008.01.29 -- Version 2.1_rc7 |
| + | |
| + | * Added a few extra files that exist in the svn repo but were |
| + | not being copied into the tarball by make dist. |
| + | |
| + | * Fixup null interface on close, don't use ip addr flush (Alon Bar-Lev). |
| + | |
| + | 2008.01.24 -- Version 2.1_rc6 |
| + | |
| + | * Fixed options checking bug introduced in rc5 where legitimate configuration |
| + | files might elicit the error: "Options error: Parameter pkcs11_private_mode |
| + | can only be specified in TLS-mode, i.e. where --tls-server or --tls-client |
| + | is also specified." |
| + | |
| + | 2008.01.23 -- Version 2.1_rc5 |
| + | |
| + | * Fixed Win2K TAP driver bug that was introduced by Vista fixes, |
| + | incremented driver version to 9.4. |
| + | |
| + | * Windows build system changes: |
| + | |
| + | Incremented included OpenSSL version to openssl-0.9.7m. |
| + | |
| + | Updated openssl.patch for openssl-0.9.7m and added some |
| + | brief usage comments to the head of the patch. |
| + | |
| + | Added build-pkcs11-helper.sh for building the pkcs11-helper |
| + | library. |
| + | |
| + | Integrated inclusion of pkcs11-helper into Windows build |
| + | system. |
| + | |
| + | Upgraded TAP build scripts to use WDK 6001.17121 |
| + | (Windows 2008 Server pre-RTM). |
| + | |
| + | * Windows installer changes: |
| + | |
| + | Clean up the start menu folder. |
| + | |
| + | Allow for a site-specific sample configuration file and keys |
| + | to be included in a custom installer (see SAMPCONF macros |
| + | in settings.in). |
| + | |
| + | New icon (temporary). |
| + | |
| + | * Added "forget-passwords" command to the management interface |
| + | (Alon Bar-Lev). |
| + | |
| + | * Added --management-signal option to signal SIGUSR1 when the |
| + | management interface disconnects (Alon Bar-Lev). |
| + | |
| + | * Modified command line and config file parser to allow |
| + | quoted strings using single quotes ('') (Alon Bar-Lev). |
| + | |
| + | * Use pkcs11-helper as external library, can be downloaded from |
| + | https://www.opensc-project.org/pkcs11-helper (Alon Bar-Lev). |
| + | |
| + | * Fixed interim memory growth issue in TCP connect loop where |
| + | "TCP: connect to %s failed, will try again in %d seconds: %s" |
| + | is output. |
| + | |
| + | * Fixed bug in epoll driver in event.c, where the lack of a |
| + | handler for EPOLLHUP could cause 99% CPU usage. |
| + | |
| + | * Defined ALLOW_NON_CBC_CIPHERS for people who don't |
| + | want to use a CBC cipher for OpenVPN's data channel. |
| + | |
| + | * Added PLUGIN_LIBDIR preprocessor string to prepend a default |
| + | plugin directory to the dlopen search list when the user |
| + | specifies the basename of the plugin only (Marius Tomaschewski). |
| + | |
| + | * Rewrote extract_x509_field and modified COMMON_NAME_CHAR_CLASS |
| + | to allow forward slash characters ("/") in the X509 common name |
| + | (Pavel Shramov). |
| + | |
| + | * Allow OpenVPN to run completely unprivileged under Linux |
| + | by allowing openvpn --mktun to be used with --user and --group |
| + | to set the UID/GID of the tun device node. Also added --iproute |
| + | option to allow an alternative command to be executed in place |
| + | of the default iproute2 command (Alon Bar-Lev). |
| + | |
| + | * Fixed --disable-iproute2 in ./configure to actually disable |
| + | iproute2 usage (Alon Bar-Lev). |
| + | |
| + | * Added --management-forget-disconnect option -- forget |
| + | passwords when management session disconnects (Alon Bar-Lev). |
| + | |
| + | 2007.04.25 -- Version 2.1_rc4 |
| + | |
| + | * Worked out remaining issues with TAP driver signing |
| + | on Vista x64. OpenVPN will now run on Vista x64 |
| + | with driver signing enforcement enabled. |
| + | |
| + | * Fixed 64-bit portability bug in time_string function |
| + | (Thomas Habets). |
| + | |
| + | 2007.04.22 -- Version 2.1_rc3 |
| + | |
| + | * Additional fixes to TAP driver for Windows x64. Driver |
| + | now runs successfully on Vista x64 if driver signing |
| + | enforcement is disabled. |
| + | |
| + | * The Windows Installer and TAP driver are now signed by |
| + | OpenVPN Solutions LLC (in addition to the usual GnuPG |
| + | signatures). |
| + | |
| + | * Added OpenVPN GUI (Mathias Sundman version) as install |
| + | option in Windows installer. |
| + | |
| + | * Clean up configure on FreeBSD for recent autotool versions |
| + | that require that all .h files have to be compiled. |
| + | Also, FreeBSD install does not support GNU long options |
| + | which the Makefile in easy-rsa/2.0 uses (not checked the |
| + | others as we don't install those on Gentoo) (Roy Marples). |
| + | |
| + | * Added additional scripts to easy-rsa/Windows for working |
| + | with password-protected keys; also add -extensions server |
| + | option when generating server cert via |
| + | build-key-server-pass.bat (Daniel Zauft). |
| + | |
| + | 2007.02.27 -- Version 2.1_rc2 |
| + | |
| + | * auth-pam change: link with -lpam rather |
| + | than dlopen (Roy Marples). |
| + | |
| + | * Prevent SIGUSR1 or SIGHUP from causing program |
| + | exit from initial management hold. |
| + | |
| + | * SO_REUSEADDR should not be set on Windows TCP sockets |
| + | because it will cause bind to succeed on port conflicts. |
| + | |
| + | * Added time_ascii, time_duration, and time_unix |
| + | environmental variables for plugins and callback |
| + | scripts. |
| + | |
| + | * Fixed issue where OpenVPN does not apply the --txqueuelen option |
| + | to persistent interfaces made with --mktun (Roy Marples). |
| + | |
| + | * Attempt at rational signal handling when in the |
| + | management hold state. During management hold, ignore |
| + | SIGUSR1/SIGHUP signals thrown with the "signal" command. |
| + | Also, "signal" command will now apply remapping as |
| + | specified with the --remap-usr1 option. |
| + | When a signal entered using the "signal" command from a management |
| + | hold is ignored, output: >HOLD:Waiting for hold release |
| + | |
| + | * Fixed issue where struct env_set methods that |
| + | change the value of an existing name=value pair |
| + | would delay the freeing of the memory held by |
| + | the previous name=value pair until the underlying |
| + | client instance object is closed. |
| + | This could cause a server that handles long-term |
| + | client connections, resulting in many periodic calls |
| + | to verify_callback, to needlessly grow the env_set |
| + | memory allocation until the underlying client instance |
| + | object is closed. |
| + | |
| + | * Renamed TAP-Win32 driver from tap0801.sys to tap0901.sys |
| + | to reflect the fact that Vista has blacklisted the tap0801.sys |
| + | file name due to previous compatibility issues which have now |
| + | been resolved. TAP-Win32 major/minor version number is now 9/1. |
| + | |
| + | * Windows installer will delete a previously installed |
| + | tap0801.sys TAP driver before installing tap0901.sys. |
| + | |
| + | * Added code to Windows installer to fail gracefully on 64 bit |
| + | installs until 64-bit TAP driver issues can be resolved. |
| + | |
| + | * Added code to Windows installer to fail gracefully on |
| + | versions of Windows which are not explicitly supported. |
| + | |
| + | * The Windows version will now use a default route-delay |
| + | of 5 seconds to deal with an apparent routing table race |
| + | condition on Vista. |
| + | |
| + | * Worked around an incompatibility in the Windows Vista |
| + | version of CreateIpForwardEntry as described in |
| + | http://www.nynaeve.net/?p=59 |
| + | This issue would cause route additions using the |
| + | IP Helper API to fail on Vista. |
| + | |
| + | * On Windows, revert to "ip-win32 dynamic" as the default. |
| + | |
| + | 2006.10.31 -- Version 2.1_rc1 |
| + | |
| + | * Support recovery (return to hold) from signal at |
| + | management password prompt. |
| + | |
| + | * Added workaround for OpenSC PKCS#11 bug#108 |
| + | (Alon Bar-Lev). |
| + | |
| + | 2006.10.01 -- Version 2.1-beta16 |
| + | |
| + | * Windows installer updated with OpenSSL 0.9.7l DLLs to fix |
| + | published vulnerabilities. |
| + | |
| + | * Fixed TAP-Win32 bug that caused BSOD on Windows Vista |
| + | (Henry Nestler). |
| + | |
| + | * Autodetect 32/64 bit Windows in installer and install |
| + | appropriate TAP driver (Mathias Sundman, Hypherion). |
| + | |
| + | * Fixed bug in loopback self-test introduced |
| + | in 2.1-beta15 where self test as invoked by |
| + | "make check" would not properly exit after |
| + | 2 minutes (Paul Howarth). |
| + | |
| + | 2006.09.12 -- Version 2.1-beta15 |
| + | |
| + | * Windows installer updated with OpenSSL 0.9.7k DLLs to fix |
| + | RSA Signature Forgery (CVE-2006-4339). |
| + | |
| + | * Fixed bug introduced with the --port-share directive |
| + | (back in 2.1-beta9 which causes TLS soft resets |
| + | (1 per hour by default) in TCP server mode to force |
| + | a blockage of tunnel packets and later time-out and |
| + | restart the connection. |
| + | |
| + | * easy-rsa update (Alon Bar-Lev) |
| + | Makefile (install) is now available so that |
| + | distribs will be able to install it safely. |
| + | |
| + | * PKCS#11 changes: (Alon Bar-Lev) |
| + | - Modified ssl.c to not FATAL and return to init.c |
| + | so auth-retry will work. |
| + | - Modifed pkcs11-helper.c to fix some problem with |
| + | multiple providers. |
| + | - Added retry counter to PKCS#11 PIN hook. |
| + | - Modified PKCS#11 PIN retry loop to return correct error |
| + | code when PIN is incorrect. |
| + | - Fix handling (ignoring) zero sized attributes. |
| + | - Fix gcc-2 issues. |
| + | - Fix openssl 0.9.6 (first version) issues. |
| + | |
| + | * Minor fixes of lladdr (Alon Bar-Lev) |
| + | Updated makefile.w32-vc to include lladdr.*, updated |
| + | linkage libraries. |
| + | Modified lladdr.c to be compiled under visual C. |
| + | |
| + | * Added two new management states: |
| + | OPENVPN_STATE_RESOLVE -- DNS lookup |
| + | OPENVPN_STATE_TCP_CONNECT -- Connecting to TCP server |
| + | |
| + | * Echo management state change to log. |
| + | |
| + | * Minor syshead.h change for NetBSD to allow |
| + | TCP_NODELAY flag to work. |
| + | |
| + | * Modified --port-share code to remove the assumption that |
| + | CMSG_SPACE always evaluates to a constant, to enable |
| + | compilation on NetBSD and possibly other BSDs as well. |
| + | |
| + | * Eliminated gcc 3.3.3 warnings on NetBSD |
| + | when ./configure --enable-strict is used. |
| + | |
| + | * Added optional minimum-number-of-bytes parameter |
| + | to --inactive directive. |
| + | |
| + | 2006.04.13 -- Version 2.1-beta14 |
| + | |
| + | * Fixed Windows server bug in time backtrack handling code which |
| + | could cause TLS negotiation failures on legitimate clients. |
| + | |
| + | * Rewrote gettimeofday function for Windows to be |
| + | simpler and more efficient. |
| + | |
| + | * Merged PKCS#11 extensions to easy-rsa/2.0 (Alon Bar-Lev). |
| + | |
| + | * Added --route-metric option to set a default route metric |
| + | for --route (Roy Marples). |
| + | |
| + | * Added --lladdr option to specify the link layer (MAC) address |
| + | for the tap interface on non-Windows platforms (Roy Marples). |
| + | |
| + | 2006.04.12 -- Version 2.1-beta13 |
| + | |
| + | * Code added in 2.1-beta7 and 2.0.6-rc1 to extend byte counters |
| + | to 64 bits caused a bug in the Windows version which has now |
| + | been fixed. The bug could cause intermittent crashes. |
| + | |
| + | 2006.04.05 -- Version 2.1-beta12 |
| + | |
| + | * Security Vulnerability -- An OpenVPN client connecting to a |
| + | malicious or compromised server could potentially receive |
| + | "setenv" configuration directives from the server which could |
| + | cause arbitrary code execution on the client via a LD_PRELOAD |
| + | attack. A successful attack appears to require that (a) the |
| + | client has agreed to allow the server to push configuration |
| + | directives to it by including "pull" or the macro "client" in |
| + | its configuration file, (b) the client configuration file uses |
| + | a scripting directive such as "up" or "down", (c) the client |
| + | succesfully authenticates the server, (d) the server is |
| + | malicious or has been compromised and is under the control of |
| + | the attacker, and (e) the attacker has at least some level of |
| + | pre-existing control over files on the client (this might be |
| + | accomplished by having the server respond to a client web request |
| + | with a specially crafted file). Credit: Hendrik Weimer. |
| + | CVE-2006-1629. |
| + | |
| + | The fix is to disallow "setenv" to be pushed to clients from |
| + | the server, and to add a new directive "setenv-safe" which is |
| + | pushable from the server, but which appends "OPENVPN_" to the |
| + | name of each remotely set environmental variable. |
| + | |
| + | * "topology subnet" fix for FreeBSD (Benoit Bourdin). |
| + | |
| + | * PKCS11 fixes (Alon Bar-Lev). For full description: |
| + | svn log -r990 http://svn.openvpn.net/projects/openvpn/branches/BETA21 |
| + | |
| + | * When deleting routes under Linux, use the route metric |
| + | as a differentiator to ensure that the route teardown |
| + | process only deletes the identical route which was originally |
| + | added via the "route" directive (Roy Marples). |
| + | |
| + | * Fix the t_cltsrv.sh file in FreeBSD 4 jails |
| + | (Matthias Andree, Dirk Meyer, Vasil Dimov). |
| + | |
| + | * Extended tun device configure code to support ethernet |
| + | bridging on NetBSD (Emmanuel Kasper). |
| + | |
| + | 2006.02.19 -- Version 2.1-beta11 |
| + | |
| + | * Fixed --port-share bug that caused premature closing |
| + | of proxied sessions. |
| + | |
| + | 2006.02.17 -- Version 2.1-beta10 |
| + | |
| + | * Fixed --port-share breakage introduced in 2.1-beta9. |
| + | |
| + | 2006.02.16 -- Version 2.1-beta9 |
| + | |
| + | * Added --port-share option for allowing OpenVPN and HTTPS |
| + | server to share the same port number. |
| + | * Added --management-client option to connect as a client |
| + | to management GUI app rather than be connected to as a |
| + | server. |
| + | * Added "bytecount" command to management interface. |
| + | * --remote-cert-tls fixes (Alon Bar-Lev). |
| + | |
| + | 2006.01.03 -- Version 2.1-beta8 |
| + | |
| + | * --remap-usr1 will now also remap signals thrown during |
| + | initialization. |
| + | * Added --connect-timeout option to control the timeout |
| + | on TCP client connection attempts (doesn't work on all |
| + | OSes). This patch also makes OpenVPN signalable during |
| + | TCP connection attempts. |
| + | * Fixed bug in acinclude.m4 where capability of compiler |
| + | to handle zero-length arrays in structs is tested |
| + | (David Stipp). |
| + | * Fixed typo in manage.c where inline function declaration |
| + | was declared without the "static" keyword (David Stipp). |
| + | * Patch to support --topology subnet on Mac OS X (Mathias Sundman). |
| + | * Added --auto-proxy directive to auto-detect HTTP or SOCKS |
| + | proxy settings (currently Windows only). |
| + | * Removed redundant base64 code. |
| + | * Better sanity checking of --server and --server-bridge |
| + | IP pool ranges, so as not to hit the assertion at |
| + | pool.c:119 (2.0.5). |
| + | * Fixed bug where --daemon and --management-query-passwords |
| + | used together would cause OpenVPN to block prior to |
| + | daemonization. |
| + | * Fixed client/server race condition which could occur |
| + | when --auth-retry interact is set and the initially |
| + | provided auth-user-pass credentials are incorrect, |
| + | forcing a username/password re-query. |
| + | * Fixed bug where if --daemon and --management-hold are |
| + | used together, --user or --group options would be ignored. |
| + | * --ip-win32 adaptive is now the default. |
| + | * --ip-win32 netsh (or --ip-win32 adaptive when in netsh |
| + | mode) can now set DNS/WINS addresses on the TAP-Win32 |
| + | adapter. |
| + | * Added new option --route-method adaptive (Win32) |
| + | which tries IP helper API first, then falls back to |
| + | route.exe. |
| + | * Made --route-method adaptive the default. |
| + | |
| + | 2005.11.12 -- Version 2.1-beta7 |
| + | |
| + | * Allow blank passwords to be passed via the management |
| + | interface. |
| + | * Fixed bug where "make check" inside a FreeBSD "jail" |
| + | would never complete (Matthias Andree). |
| + | * Fixed bug where --server directive in --dev tap mode |
| + | claimed that it would support subnets of /30 or less |
| + | but actually would only accept /29 or less. |
| + | * Extend byte counters to 64 bits (M. van Cuijk). |
| + | * Fixed bug in Linux get_default_gateway function |
| + | introduced in 2.0.4, which would cause redirect-gateway |
| + | on Linux clients to fail. |
| + | * Moved easy-rsa 2.0 scripts to easy-rsa/2.0 to |
| + | be compatible with 2.0.x distribution. |
| + | * Documented --route-nopull. |
| + | * Documented --ip-win32 adaptive. |
| + | * Windows build now linked with LZO2. |
| + | * Allow ca, cert, key, and dh files to be specified |
| + | inline via XML-like syntax without needing to |
| + | reference an explicit file. |
| + | For example: |
| + | <ca> |
| + | data here... |
| + | </ca> |
| + | * Allow plugin and push directives to have multi-line |
| + | parameter lists such as: |
| + | <plugin> |
| + | my-plugin.so |
| + | parm1 |
| + | parm2 |
| + | </plugin> |
| + | * Added connect-retry-max option (Alon Bar-Lev). |
| + | * Fixed problems where signals thrown during initialization |
| + | were not returning to a management-hold state. |
| + | * Added a backtrack-hardened system time algorithm. |
| + | * Added --remote-cert-ku, --remote-cert-eku, and |
| + | --remote-cert-tls options for verifying certificate |
| + | attributes (Alon Bar-Lev). |
| + | * For Windows, reverted --ip-win32 default back to "dynamic". |
| + | To use new adaptive mode, set explicitly. |
| + | |
| + | 2005.11.01 -- Version 2.1-beta6 |
| + | |
| + | * Security fix (merged from 2.0.4) -- Affects non-Windows |
| + | OpenVPN clients of version 2.0 or higher which connect to |
| + | a malicious or compromised server. A format string |
| + | vulnerability in the foreign_option function in options.c |
| + | could potentially allow a malicious or compromised server |
| + | to execute arbitrary code on the client. Only |
| + | non-Windows clients are affected. The vulnerability |
| + | only exists if (a) the client's TLS negotiation with |
| + | the server succeeds, (b) the server is malicious or |
| + | has been compromised such that it is configured to |
| + | push a maliciously crafted options string to the client, |
| + | and (c) the client indicates its willingness to accept |
| + | pushed options from the server by having "pull" or |
| + | "client" in its configuration file (Credit: Vade79). |
| + | CVE-2005-3393 |
| + | * Security fix -- (merged from 2.0.4) Potential DoS |
| + | vulnerability on the server in TCP mode. If the TCP |
| + | server accept() call returns an error status, the resulting |
| + | exception handler may attempt to indirect through a NULL |
| + | pointer, causing a segfault. Affects all OpenVPN 2.0 versions. |
| + | CVE-2005-3409 |
| + | * Fix attempt of assertion at multi.c:1586 (note that |
| + | this precise line number will vary across different |
| + | versions of OpenVPN). |
| + | * Windows reliability changes: |
| + | (a) Added code to make sure that the local PATH environmental |
| + | variable points to the Windows system32 directory. |
| + | (b) Added new --ip-win32 adaptive mode which tries 'dynamic' |
| + | and then fails over to 'netsh' if the DHCP negotiation fails. |
| + | (c) Made --ip-win32 adaptive the default. |
| + | * More PKCS#11 additions/changes (Alon Bar-Lev). |
| + | * Added ".PHONY: plugin" to Makefile.am to work around |
| + | "make dist" issue. |
| + | * Fixed double fork issue that occurs when --management-hold |
| + | is used. |
| + | * Moved TUN/TAP read/write log messages from --verb 8 to 6. |
| + | * Warn when multiple clients having the same common name or |
| + | username usurp each other when --duplicate-cn is not used. |
| + | * Modified Windows and Linux versions of get_default_gateway |
| + | to return the route with the smallest metric |
| + | if multiple 0.0.0.0/0.0.0.0 entries are present. |
| + | * Added ">NEED-OK" alert and "needok" command to management |
| + | interface to provide a general interface for sending |
| + | alerts to the end-user. Used by the PKCS#11 code |
| + | to send Token Insertion Requests to the user. |
| + | * Added actual remote address used to the ">STATE" alert |
| + | in the management interface (Rolf Fokkens). |
| + | |
| + | 2005.10.17 -- Version 2.1-beta4 |
| + | |
| + | * Fixed bug introduced in 2.1-beta3 where management |
| + | socket bind would fail. |
| + | * --capath fix in ssl.c (Zhuang Yuyao). |
| + | * Added ".PHONY: plugin" to Makefile.am, reverted |
| + | location of "plugin" directory (thanks to |
| + | Matthias Andree for figuring this out). |
| + | |
| + | 2005.10.16 -- Version 2.1-beta3 |
| + | |
| + | * Added PKCS#11 support (Alon Bar-Lev). |
| + | * Enable the use of --ca together with --pkcs12. If --ca is |
| + | used at the same time as --pkcs12, the CA certificate is loaded |
| + | from the file specified by --ca regardless if the pkcs12 file |
| + | contains a CA cert or not (Mathias Sundman). |
| + | * Merged --capath patch (Thomas Noel). |
| + | * Merged --multihome patch. |
| + | * Added --bind option for TCP client connections (Ewan Bhamrah |
| + | Harley). |
| + | * Moved "plugin" directory to "plugins" to deal with strange |
| + | automake problem that ended up being also fixable with |
| + | ".PHONY: plugin" in Makefile.am. |
| + | |
| + | 2005.10.13 -- Version 2.1-beta2 |
| + | |
| + | * Made --sndbuf and --rcvbuf pushable. |
| + | |
| + | 2005.10.01 -- Version 2.1-beta1 |
| + | |
| + | * Made LZO setting pushable. |
| + | * Renamed sample-keys/tmp-ca.crt to ca.crt. |
| + | * Fixed bug where remove_iroutes_from_push_route_list |
| + | was missing routes if those routes had |
| + | an implied netmask (by omission) of 255.255.255.255. |
| + | * Merged with 2.0.3-rc1 |
| + | * easy-rsa/2.0 moved to easy-rsa |
| + | * old easy-rsa moved to easy-rsa/1.0 |
| + | ``` |