{{{ OpenVPN Change Log Copyright (C) 2002-2010 OpenVPN Technologies, Inc. < sales@openvpn.net> 2010.11.09 -- Version 2.1.4 * Fix problem with special case route targets ('remote_host') The init_route() function will leave &netlist untouched for get_special_addr() routes ("remote_host" being one of them). netlist is on stack, contains random garbage, and netlist.len will not be 0 - thus, random stack data is copied from netlist.data[] until the route_list is full. Thanks to Teodo MICU and Gert Doering for finding and fixing this issue. 2010.08.20 -- Version 2.1.3 * Windows build fixes Attempt to fix issue where domake-win build system was not properly signing drivers and .exe files. This change is only affecting the Windows build scripts and not the OpenVPN code base. 2010.08.09 -- Version 2.1.2 * Windows security issue: Fixed potential local privilege escalation vulnerability in Windows service. The Windows service did not properly quote the executable filename passed to CreateService. A local attacker with write access to the root directory C:\ could create an executable that would be run with the same privilege level as the OpenVPN Windows service. However, since non-Administrative users normally lack write permission on C:\, this vulnerability is generally not exploitable except on older versions of Windows (such as Win2K) where the default permissions on C:\ would allow any user to create files there. Credit: Scott Laurie, MWR InfoSecurity * Added Python-based based alternative build system for Windows using Visual Studio 2008 (in win directory). * When aborting in a non-graceful way, try to execute do_close_tun in init.c prior to daemon exit to ensure that the tun/tap interface is closed and any added routes are deleted. * Fixed an issue where AUTH_FAILED was not being properly delivered to the client when a bad password is given for mid-session reauth, causing the connection to fail without an error indication. * Don't advance to the next connection profile on AUTH_FAILED errors. * Fixed an issue in the Management Interface that could cause a process hang with 100% CPU utilization in --management-client mode if the management interface client disconnected at the point where credentials are queried. * Fixed an issue where if reneg-sec was set to 0 on the client, so that the server-side value would take precedence, the auth_deferred_expire_window function would incorrectly return a window period of 0 seconds. In this case, the correct window period should be the handshake window period. * Modified ">PASSWORD:Verification Failed" management interface notification to include a client reason string: >PASSWORD:Verification Failed: 'AUTH_TYPE' ['REASON_STRING'] * Enable exponential backoff in reliability layer retransmits. * Set socket buffers (SO_SNDBUF and SO_RCVBUF) immediately after socket is created rather than waiting until after connect/listen. * Management interface performance optimizations: 1. Added env-filter MI command to perform filtering on env vars passed through as a part of --management-client-auth 2. man_write will now try to aggregate output into larger blocks (up to 1024 bytes) for more efficient i/o * Fixed minor issue in Windows TAP driver DEBUG builds where non-null-terminated unicode strings were being printed incorrectly. * Fixed issue on Windows with MSVC compiler, where TCP_NODELAY support was not being compiled in. * Proxy improvements: Improved the ability of http-auth "auto" flag to dynamically detect the auth method required by the proxy. Added http-auth "auto-nct" flag to reject weak proxy auth methods. Added HTTP proxy digest authentication method. Removed extraneous openvpn_sleep calls from proxy.c. * Implemented http-proxy-override and http-proxy-fallback directives to make it easier for OpenVPN client UIs to start a pre-existing client config file with proxy options, or to adaptively fall back to a proxy connection if a direct connection fails. * Implemented a key/value auth channel from client to server. * Fixed issue where bad creds provided by the management interface for HTTP Proxy Basic Authentication would go into an infinite retry-fail loop instead of requerying the management interface for new creds. * Added support for MSVC debugging of openvpn.exe in settings.in: # Build debugging version of openvpn.exe !define PRODUCT_OPENVPN_DEBUG * Implemented multi-address DNS expansion on the network field of route commands. When only a single IP address is desired from a multi-address DNS expansion, use the first address rather than a random selection. * Added --register-dns option for Windows. Fixed some issues on Windows with --log, subprocess creation for command execution, and stdout/stderr redirection. * Fixed an issue where application payload transmissions on the TLS control channel (such as AUTH_FAILED) that occur during or immediately after a TLS renegotiation might be dropped. * Added warning about tls-remote option in man page. 2009.12.11 -- Version 2.1.1 * Fixed some breakage in openvpn.spec (which is required to build an RPM distribution) where it was referencing a non-existent subdirectory in the tarball, causing it to fail (patch from David Sommerseth). 2009.12.11 -- Version 2.1.0 * Fixed a couple issues in sample plugins auth-pam.c and down-root.c. (1) Fail gracefully rather than segfault if calloc returns NULL. (2) The openvpn_plugin_abort_v1 function can potentially be called with handle == NULL. Add code to detect this case, and if so, avoid dereferencing pointers derived from handle (Thanks to David Sommerseth for finding this bug). * Documented "multihome" option in the man page. 2009.11.20 -- Version 2.1_rc22 * Fixed a client-side bug on Windows that occurred when the "dhcp-pre-release" or "dhcp-renew" options were combined with "route-gateway dhcp". The release/renew would not occur because the Windows DHCP renew function is blocking and therefore must be called from another process or thread so as not to stall the tunnel. * Added a hard failure when peer provides a certificate chain with depth > 16. Previously, a warning was issued. 2009.11.12 -- Version 2.1_rc21 * Rebuilt OpenVPN Windows installer with OpenSSL 0.9.8l to address CVE-2009-3555. Note that OpenVPN has never relied on the session renegotiation capabilities that are built into the SSL/TLS protocol, therefore the fix in OpenSSL 0.9.8l (disable SSL/TLS renegotiation completely) will not adversely affect OpenVPN mid-session SSL/TLS renegotation or any other OpenVPN capabilities. * Added additional session renegotiation hardening. OpenVPN has always required that mid-session renegotiations build up a new SSL/TLS session from scratch. While the client certificate common name is already locked against changes in mid-session TLS renegotiations, we now extend this locking to the auth-user-pass username as well as all certificate content in the full client certificate chain. 2009.10.01 -- Version 2.1_rc20 * Fixed a bug introduced in 2.1_rc17 (svn r4436) where using the redirect-gateway option by itself, without any extra parameters, would cause the option to be ignored. * Fixed build problem when ./configure --disable-server is used. * Fixed ifconfig command for "topology subnet" on FreeBSD (Stefan Bethke). * Added --remote-random-hostname option. * Added "load-stats" management interface command to get global server load statistics. * Added new ./configure flags: --disable-def-auth Disable deferred authentication --disable-pf Disable internal packet filter * Added "setcon" directive for interoperability with SELinux (Sebastien Raveau). * Optimized PUSH_REQUEST handshake sequence to shave several seconds off of a typical client connection initiation. * The maximum number of "route" directives (specified in the config file or pulled from a server) can now be configured via the new "max-routes" directive. * Eliminated the limitation on the number of options that can be pushed to clients, including routes. Previously, all pushed options needed to fit within a 1024 byte options string. * Added --server-poll-timeout option : when polling possible remote servers to connect to in a round-robin fashion, spend no more than n seconds waiting for a response before trying the next server. * Added the ability for the server to provide a custom reason string when an AUTH_FAILED message is returned to the client. This string can be set by the server-side managment interface and read by the client-side management interface. * client-kill management interface command, when issued on server, will now send a RESTART message to client. This feature is intended to make UDP clients respond the same as TCP clients in the case where the server issues a RESTART message in order to force the client to reconnect and pull a new options/route list. 2009.07.16 -- Version 2.1_rc19 * In Windows TAP driver, refactor DHCP/ARP packet injection code to use a DPC (deferred procedure call) to defer packet injection until IRQL < DISPATCH_LEVEL, rather than calling NdisMEthIndicateReceive in the context of AdapterTransmit. This is an attempt to reduce kernel stack usage, and prevent EXCEPTION_DOUBLE_FAULT BSODs that have been observed on Vista. Updated TAP driver version number to 9.6. * In configure.ac, use datadir instead of datarootdir for compatibility with CLIENT:ESTABLISHED" notification. * Build fixes: 1. Fixed some issues with C++ style comments that leaked into the code. 2. Updated configure.ac to work on MinGW64. 3. Updated common.h types for _WIN64. 4. Fixed issue involving an #ifdef in a macro reference that breaks early gcc compilers. 5. In cryptoapi.c, renamed CryptAcquireCertificatePrivateKey to OpenVPNCryptAcquireCertificatePrivateKey to work around a symbol conflict in MinGW-5.1.4. 2008.11.19 -- Version 2.1_rc15 * Fixed issue introduced in 2.1_rc14 that may cause a segfault when a --plugin module is used. * Added server-side --opt-verify option: clients that connect with options that are incompatible with those of the server will be disconnected (without this option, incompatible clients would trigger a warning message in the server log but would not be disconnected). * Added --tcp-nodelay option: Macro that sets TCP_NODELAY socket flag on the server as well as pushes it to connecting clients. * Minor options check fix: --no-name-remapping is a server-only option and should therefore generate an error when used on the client. * Added --prng option to control PRNG (pseudo-random number generator) parameters. In previous OpenVPN versions, the PRNG was hardcoded to use the SHA1 hash. Now any OpenSSL hash may be used. This is part of an effort to remove hardcoded references to a specific cipher or cryptographic hash algorithm. * Cleaned up man page synopsis. 2008.11.16 -- Version 2.1_rc14 * Added AC_GNU_SOURCE to configure.ac to enable struct ucred, with the goal of fixing a build issue on Fedora 9 that was introduced in 2.1_rc13. * Added additional method parameter to --script-security to preserve backward compatibility with system() call semantics used in OpenVPN 2.1_rc8 and earlier. To preserve backward compatibility use: script-security 3 system * Added additional warning messages about --script-security 2 or higher being required to execute user-defined scripts or executables. * Windows build system changes: Modified Windows domake-win build system to write all openvpn.nsi input files to gen, so that gen can be disconnected from the rest of the source tree and makensis openvpn.nsi will still function correctly. Added additional SAMPCONF_(CA|CRT|KEY) macros to settings.in (commented out by default). Added optional files SAMPCONF_CONF2 (second sample configuration file) and SAMPCONF_DH (Diffie-Helman parameters) to Windows build system, and may be defined in settings.in. * Extended Management Interface "bytecount" command to work when OpenVPN is running as a server. Documented Management Interface "bytecount" command in management/management-notes.txt. * Fixed informational message in ssl.c to properly indicate deferred authentication. * Added server-side --auth-user-pass-optional directive, to allow connections by clients that do not specify a username/password, when a user-defined authentication script/module is in place (via --auth-user-pass-verify, --management-client-auth, or a plugin module). * Changes to easy-rsa/2.0/pkitool and related openssl.cnf: Calling scripts can set the KEY_NAME environmental variable to set the "name" X509 subject field in generated certificates. Modified pkitool to allow flexibility in separating the Common Name convention from the cert/key filename convention. For example: KEY_CN="James's Laptop" KEY_NAME="james" ./pkitool james will create a client certificate/key pair of james.crt/james.key having a Common Name of "James's Laptop" and a Name of "james". * Added --no-name-remapping option to allow Common Name, X509 Subject, and username strings to include any printable character including space, but excluding control characters such as tab, newline, and carriage-return (this is important for compatibility with external authentication systems). As a related change, added --status-version 3 format (and "status 3" in the management interface) which uses the version 2 format except that tabs are used as delimiters instead of commas so that there is no ambiguity when parsing a Common Name that contains a comma. Also, save X509 Subject fields to environment, using the naming convention: X509_{cert_depth}_{name}={value} This is to avoid ambiguities when parsing out the X509 subject string since "/" characters could potentially be used in the common name. * Fixed some ifconfig-pool issues that precluded it from being combined with --server directive. Now, for example, we can configure thusly: server 10.8.0.0 255.255.255.0 nopool ifconfig-pool 10.8.0.2 10.8.0.99 255.255.255.0 to have ifconfig-pool manage only a subset of the VPN subnet. * Added config file option "setenv FORWARD_COMPATIBLE 1" to relax config file syntax checking to allow directives for future OpenVPN versions to be ignored. 2008.10.07 -- Version 2.1_rc13 * Bundled OpenSSL 0.9.8i with Windows installer. * Management interface can now listen on a unix domain socket, for example: management /tmp/openvpn unix Also added management-client-user and management-client-group directives to control which processes are allowed to connect to the socket. * Copyright change to OpenVPN Technologies, Inc. 2008.09.23 -- Version 2.1_rc12 * Patched Makefile.am so that the new t_cltsrv-down.sh script becomes part of the tarball (Matthias Andree). * Fixed --lladdr bug introduced in 2.1-rc9 where input validation code was incorrectly expecting the lladdr parameter to be an IP address when it is actually a MAC address (HoverHell). 2008.09.14 -- Version 2.1_rc11 * Fixed a bug that can cause SSL/TLS negotiations in UDP mode to fail if UDP packets are dropped. 2008.09.10 -- Version 2.1_rc10 * Added "--server-bridge" (without parameters) to enable DHCP proxy mode: Configure server mode for ethernet bridging using a DHCP-proxy, where clients talk to the OpenVPN server-side DHCP server to receive their IP address allocation and DNS server addresses. * Added "--route-gateway dhcp", to enable the extraction of the gateway address from a DHCP negotiation with the OpenVPN server-side LAN. * Fixed minor issue with --redirect-gateway bypass-dhcp or bypass-dns on Windows. If the bypass IP address is 0.0.0.0 or 255.255.255.255, ignore it. * Warn when ethernet bridging that the IP address of the bridge adapter is probably not the same address that the LAN adapter was set to previously. * When running as a server, warn if the LAN network address is the all-popular 192.168.[0|1].x, since this condition commonly leads to subnet conflicts down the road. * Primarily on the client, check for subnet conflicts between the local LAN and the VPN subnet. * Added a 'netmask' parameter to get_default_gateway, to return the netmask of the adapter containing the default gateway. Only implemented on Windows so far. Other platforms will return 255.255.255.0. Currently the netmask information is only used to warn about subnet conflicts. * Minor fix to cryptoapi.c to not compile itself unless USE_CRYPTO and USE_SSL flags are enabled (Alon Bar-Lev). * Updated openvpn/t_cltsrv.sh (used by "make check") to conform to new --script-security rules. Also adds retrying if the addresses are in use (Matthias Andree). * Fixed build issue with ./configure --disable-socks --disable-http. * Fixed separate compile errors in options.c and ntlm.c that occur on strict C compilers (such as old versions of gcc) that require that C variable declarations occur at the start of a {} block, not in the middle. * Workaround bug in OpenSSL 0.9.6b ASN1_STRING_to_UTF8, which the new implementation of extract_x509_field_ssl depends on. * LZO compression buffer overflow errors will now invalidate the packet rather than trigger a fatal assertion. * Fixed minor compile issue in ntlm.c (mid-block declaration). * Added --allow-pull-fqdn option which allows client to pull DNS names from server (rather than only IP address) for --ifconfig, --route, and --route-gateway. OpenVPN versions 2.1_rc7 and earlier allowed DNS names for these options to be pulled and translated to IP addresses by default. Now --allow-pull-fqdn will be explicitly required on the client to enable DNS-name-to-IP-address translation of pulled options. * 2.1_rc8 and earlier did implicit shell expansion on script arguments since all scripts were called by system(). The security hardening changes made to 2.1_rc9 no longer use system(), but rather use the safer execve or CreateProcess system calls. The security hardening also introduced a backward incompatibility with 2.1_rc8 and earlier in that script parameters were no longer shell-expanded, so for example: client-connect "docc CLIENT-CONNECT" would fail to work because execve would try to execute a script called "docc CLIENT-CONNECT" instead of "docc" with "CLIENT-CONNECT" as the first argument. This patch fixes the issue, bringing the script argument semantics back to pre 2.1_rc9 behavior in order to preserve backward compatibility while still using execve or CreateProcess to execute the script/executable. * Modified ip_or_dns_addr_safe, which validates pulled DNS names, to more closely conform to RFC 3696: (1) DNS name length must not exceed 255 characters (2) DNS name characters must be limited to alphanumeric, dash ('-'), and dot ('.') * Fixed bug in intra-session TLS key rollover that was introduced with deferred authentication features in 2.1_rc8. 2008.07.31 -- Version 2.1_rc9 * Security Fix -- affects non-Windows OpenVPN clients running OpenVPN 2.1-beta14 through 2.1-rc8 (OpenVPN 2.0.x clients are NOT vulnerable nor are any versions of the OpenVPN server vulnerable). An OpenVPN client connecting to a malicious or compromised server could potentially receive an "lladdr" or "iproute" configuration directive from the server which could cause arbitrary code execution on the client. A successful attack requires that (a) the client has agreed to allow the server to push configuration directives to it by including "pull" or the macro "client" in its configuration file, (b) the client successfully authenticates the server, (c) the server is malicious or has been compromised and is under the control of the attacker, and (d) the client is running a non-Windows OS. Credit: David Wagner. CVE-2008-3459 * Miscellaneous defensive programming changes to multiple areas of the code. In particular, use of the system() call for calling executables such as ifconfig, route, and user-defined scripts has been completely revamped in favor of execve() on unix and CreateProcess() on Windows. * In Windows build, package a statically linked openssl.exe to work around observed instabilities in the dynamic build since the migration to OpenSSL 0.9.8h. 2008.06.11 -- Version 2.1_rc8 * Added client authentication and packet filtering capability to management interface. In addition, allow OpenVPN plugins to take advantage of deferred authentication and packet filtering capability. * Added support for client-side connection profiles. * Fixed unbounded memory growth bug in environmental variable code that could have caused long-running OpenVPN sessions with many TLS renegotiations to incrementally increase memory usage over time. * Windows release now packages openssl-0.9.8h. * Build system changes -- allow building on Windows using autoconf/automake scripts (Alon Bar-Lev). * Changes to Windows build system to make it easier to do partial builds, with a reduced set of prerequisites, where only a subset of OpenVPN installer components are built. See ./domake-win comments. * Cleanup IP address for persistence interfaces for tap and also using ifconfig, gentoo#209055 (Alon Bar-Lev). * Fall back to old version of extract_x509_field for OpenSSL 0.9.6. * Clarified tcp-queue-limit man page entry (Matti Linnanvuori). * Added new OpenVPN icon and installer graphic. * Minor pkitool changes. * Added --pkcs11-id-management option, which will cause OpenVPN to query the management interface via the new NEED-STR asynchronous notification query to get additional PKCS#11 options (Alon Bar-Lev). * Added NEED-STR management interface asynchronous query and "needstr" management interface command to respond to the query (Alon Bar-Lev). * Added Dragonfly BSD support (Francis-Gudin). * Quote device names before passing to up/down script (Josh Cepek). * Bracketed struct openvpn_pktinfo with #pragma pack(1) to prevent structure padding from causing an incorrect length to be returned by sizeof (struct openvpn_pktinfo) on 64-bit platforms. * On systems that support res_init, always call it before calling gethostbyname to ensure that resolver configuration state is current. * Added NTLMv2 proxy support (Miroslav Zajic). * Fixed an issue in extract_x509_field_ssl where the extraction would fail on the first field of the subject name, such as the common name in: /CN=foo/emailAddress= foo@bar.com * Made "Linux ip addr del failed" error nonfatal. * Amplified --client-cert-not-required warning. * Added #pragma pack to proto.h. 2008.01.29 -- Version 2.1_rc7 * Added a few extra files that exist in the svn repo but were not being copied into the tarball by make dist. * Fixup null interface on close, don't use ip addr flush (Alon Bar-Lev). 2008.01.24 -- Version 2.1_rc6 * Fixed options checking bug introduced in rc5 where legitimate configuration files might elicit the error: "Options error: Parameter pkcs11_private_mode can only be specified in TLS-mode, i.e. where --tls-server or --tls-client is also specified." 2008.01.23 -- Version 2.1_rc5 * Fixed Win2K TAP driver bug that was introduced by Vista fixes, incremented driver version to 9.4. * Windows build system changes: Incremented included OpenSSL version to openssl-0.9.7m. Updated openssl.patch for openssl-0.9.7m and added some brief usage comments to the head of the patch. Added build-pkcs11-helper.sh for building the pkcs11-helper library. Integrated inclusion of pkcs11-helper into Windows build system. Upgraded TAP build scripts to use WDK 6001.17121 (Windows 2008 Server pre-RTM). * Windows installer changes: Clean up the start menu folder. Allow for a site-specific sample configuration file and keys to be included in a custom installer (see SAMPCONF macros in settings.in). New icon (temporary). * Added "forget-passwords" command to the management interface (Alon Bar-Lev). * Added --management-signal option to signal SIGUSR1 when the management interface disconnects (Alon Bar-Lev). * Modified command line and config file parser to allow quoted strings using single quotes ('') (Alon Bar-Lev). * Use pkcs11-helper as external library, can be downloaded from https://www.opensc-project.org/pkcs11-helper (Alon Bar-Lev). * Fixed interim memory growth issue in TCP connect loop where "TCP: connect to %s failed, will try again in %d seconds: %s" is output. * Fixed bug in epoll driver in event.c, where the lack of a handler for EPOLLHUP could cause 99% CPU usage. * Defined ALLOW_NON_CBC_CIPHERS for people who don't want to use a CBC cipher for OpenVPN's data channel. * Added PLUGIN_LIBDIR preprocessor string to prepend a default plugin directory to the dlopen search list when the user specifies the basename of the plugin only (Marius Tomaschewski). * Rewrote extract_x509_field and modified COMMON_NAME_CHAR_CLASS to allow forward slash characters ("/") in the X509 common name (Pavel Shramov). * Allow OpenVPN to run completely unprivileged under Linux by allowing openvpn --mktun to be used with --user and --group to set the UID/GID of the tun device node. Also added --iproute option to allow an alternative command to be executed in place of the default iproute2 command (Alon Bar-Lev). * Fixed --disable-iproute2 in ./configure to actually disable iproute2 usage (Alon Bar-Lev). * Added --management-forget-disconnect option -- forget passwords when management session disconnects (Alon Bar-Lev). 2007.04.25 -- Version 2.1_rc4 * Worked out remaining issues with TAP driver signing on Vista x64. OpenVPN will now run on Vista x64 with driver signing enforcement enabled. * Fixed 64-bit portability bug in time_string function (Thomas Habets). 2007.04.22 -- Version 2.1_rc3 * Additional fixes to TAP driver for Windows x64. Driver now runs successfully on Vista x64 if driver signing enforcement is disabled. * The Windows Installer and TAP driver are now signed by OpenVPN Solutions LLC (in addition to the usual GnuPG signatures). * Added OpenVPN GUI (Mathias Sundman version) as install option in Windows installer. * Clean up configure on FreeBSD for recent autotool versions that require that all .h files have to be compiled. Also, FreeBSD install does not support GNU long options which the Makefile in easy-rsa/2.0 uses (not checked the others as we don't install those on Gentoo) (Roy Marples). * Added additional scripts to easy-rsa/Windows for working with password-protected keys; also add -extensions server option when generating server cert via build-key-server-pass.bat (Daniel Zauft). 2007.02.27 -- Version 2.1_rc2 * auth-pam change: link with -lpam rather than dlopen (Roy Marples). * Prevent SIGUSR1 or SIGHUP from causing program exit from initial management hold. * SO_REUSEADDR should not be set on Windows TCP sockets because it will cause bind to succeed on port conflicts. * Added time_ascii, time_duration, and time_unix environmental variables for plugins and callback scripts. * Fixed issue where OpenVPN does not apply the --txqueuelen option to persistent interfaces made with --mktun (Roy Marples). * Attempt at rational signal handling when in the management hold state. During management hold, ignore SIGUSR1/SIGHUP signals thrown with the "signal" command. Also, "signal" command will now apply remapping as specified with the --remap-usr1 option. When a signal entered using the "signal" command from a management hold is ignored, output: >HOLD:Waiting for hold release * Fixed issue where struct env_set methods that change the value of an existing name=value pair would delay the freeing of the memory held by the previous name=value pair until the underlying client instance object is closed. This could cause a server that handles long-term client connections, resulting in many periodic calls to verify_callback, to needlessly grow the env_set memory allocation until the underlying client instance object is closed. * Renamed TAP-Win32 driver from tap0801.sys to tap0901.sys to reflect the fact that Vista has blacklisted the tap0801.sys file name due to previous compatibility issues which have now been resolved. TAP-Win32 major/minor version number is now 9/1. * Windows installer will delete a previously installed tap0801.sys TAP driver before installing tap0901.sys. * Added code to Windows installer to fail gracefully on 64 bit installs until 64-bit TAP driver issues can be resolved. * Added code to Windows installer to fail gracefully on versions of Windows which are not explicitly supported. * The Windows version will now use a default route-delay of 5 seconds to deal with an apparent routing table race condition on Vista. * Worked around an incompatibility in the Windows Vista version of CreateIpForwardEntry as described in http://www.nynaeve.net/?p=59 This issue would cause route additions using the IP Helper API to fail on Vista. * On Windows, revert to "ip-win32 dynamic" as the default. 2006.10.31 -- Version 2.1_rc1 * Support recovery (return to hold) from signal at management password prompt. * Added workaround for OpenSC PKCS#11 bug#108 (Alon Bar-Lev). 2006.10.01 -- Version 2.1-beta16 * Windows installer updated with OpenSSL 0.9.7l DLLs to fix published vulnerabilities. * Fixed TAP-Win32 bug that caused BSOD on Windows Vista (Henry Nestler). * Autodetect 32/64 bit Windows in installer and install appropriate TAP driver (Mathias Sundman, Hypherion). * Fixed bug in loopback self-test introduced in 2.1-beta15 where self test as invoked by "make check" would not properly exit after 2 minutes (Paul Howarth). 2006.09.12 -- Version 2.1-beta15 * Windows installer updated with OpenSSL 0.9.7k DLLs to fix RSA Signature Forgery (CVE-2006-4339). * Fixed bug introduced with the --port-share directive (back in 2.1-beta9 which causes TLS soft resets (1 per hour by default) in TCP server mode to force a blockage of tunnel packets and later time-out and restart the connection. * easy-rsa update (Alon Bar-Lev) Makefile (install) is now available so that distribs will be able to install it safely. * PKCS#11 changes: (Alon Bar-Lev) - Modified ssl.c to not FATAL and return to init.c so auth-retry will work. - Modifed pkcs11-helper.c to fix some problem with multiple providers. - Added retry counter to PKCS#11 PIN hook. - Modified PKCS#11 PIN retry loop to return correct error code when PIN is incorrect. - Fix handling (ignoring) zero sized attributes. - Fix gcc-2 issues. - Fix openssl 0.9.6 (first version) issues. * Minor fixes of lladdr (Alon Bar-Lev) Updated makefile.w32-vc to include lladdr.*, updated linkage libraries. Modified lladdr.c to be compiled under visual C. * Added two new management states: OPENVPN_STATE_RESOLVE -- DNS lookup OPENVPN_STATE_TCP_CONNECT -- Connecting to TCP server * Echo management state change to log. * Minor syshead.h change for NetBSD to allow TCP_NODELAY flag to work. * Modified --port-share code to remove the assumption that CMSG_SPACE always evaluates to a constant, to enable compilation on NetBSD and possibly other BSDs as well. * Eliminated gcc 3.3.3 warnings on NetBSD when ./configure --enable-strict is used. * Added optional minimum-number-of-bytes parameter to --inactive directive. 2006.04.13 -- Version 2.1-beta14 * Fixed Windows server bug in time backtrack handling code which could cause TLS negotiation failures on legitimate clients. * Rewrote gettimeofday function for Windows to be simpler and more efficient. * Merged PKCS#11 extensions to easy-rsa/2.0 (Alon Bar-Lev). * Added --route-metric option to set a default route metric for --route (Roy Marples). * Added --lladdr option to specify the link layer (MAC) address for the tap interface on non-Windows platforms (Roy Marples). 2006.04.12 -- Version 2.1-beta13 * Code added in 2.1-beta7 and 2.0.6-rc1 to extend byte counters to 64 bits caused a bug in the Windows version which has now been fixed. The bug could cause intermittent crashes. 2006.04.05 -- Version 2.1-beta12 * Security Vulnerability -- An OpenVPN client connecting to a malicious or compromised server could potentially receive "setenv" configuration directives from the server which could cause arbitrary code execution on the client via a LD_PRELOAD attack. A successful attack appears to require that (a) the client has agreed to allow the server to push configuration directives to it by including "pull" or the macro "client" in its configuration file, (b) the client configuration file uses a scripting directive such as "up" or "down", (c) the client succesfully authenticates the server, (d) the server is malicious or has been compromised and is under the control of the attacker, and (e) the attacker has at least some level of pre-existing control over files on the client (this might be accomplished by having the server respond to a client web request with a specially crafted file). Credit: Hendrik Weimer. CVE-2006-1629. The fix is to disallow "setenv" to be pushed to clients from the server, and to add a new directive "setenv-safe" which is pushable from the server, but which appends "OPENVPN_" to the name of each remotely set environmental variable. * "topology subnet" fix for FreeBSD (Benoit Bourdin). * PKCS11 fixes (Alon Bar-Lev). For full description: svn log -r990 http://svn.openvpn.net/projects/openvpn/branches/BETA21 * When deleting routes under Linux, use the route metric as a differentiator to ensure that the route teardown process only deletes the identical route which was originally added via the "route" directive (Roy Marples). * Fix the t_cltsrv.sh file in FreeBSD 4 jails (Matthias Andree, Dirk Meyer, Vasil Dimov). * Extended tun device configure code to support ethernet bridging on NetBSD (Emmanuel Kasper). 2006.02.19 -- Version 2.1-beta11 * Fixed --port-share bug that caused premature closing of proxied sessions. 2006.02.17 -- Version 2.1-beta10 * Fixed --port-share breakage introduced in 2.1-beta9. 2006.02.16 -- Version 2.1-beta9 * Added --port-share option for allowing OpenVPN and HTTPS server to share the same port number. * Added --management-client option to connect as a client to management GUI app rather than be connected to as a server. * Added "bytecount" command to management interface. * --remote-cert-tls fixes (Alon Bar-Lev). 2006.01.03 -- Version 2.1-beta8 * --remap-usr1 will now also remap signals thrown during initialization. * Added --connect-timeout option to control the timeout on TCP client connection attempts (doesn't work on all OSes). This patch also makes OpenVPN signalable during TCP connection attempts. * Fixed bug in acinclude.m4 where capability of compiler to handle zero-length arrays in structs is tested (David Stipp). * Fixed typo in manage.c where inline function declaration was declared without the "static" keyword (David Stipp). * Patch to support --topology subnet on Mac OS X (Mathias Sundman). * Added --auto-proxy directive to auto-detect HTTP or SOCKS proxy settings (currently Windows only). * Removed redundant base64 code. * Better sanity checking of --server and --server-bridge IP pool ranges, so as not to hit the assertion at pool.c:119 (2.0.5). * Fixed bug where --daemon and --management-query-passwords used together would cause OpenVPN to block prior to daemonization. * Fixed client/server race condition which could occur when --auth-retry interact is set and the initially provided auth-user-pass credentials are incorrect, forcing a username/password re-query. * Fixed bug where if --daemon and --management-hold are used together, --user or --group options would be ignored. * --ip-win32 adaptive is now the default. * --ip-win32 netsh (or --ip-win32 adaptive when in netsh mode) can now set DNS/WINS addresses on the TAP-Win32 adapter. * Added new option --route-method adaptive (Win32) which tries IP helper API first, then falls back to route.exe. * Made --route-method adaptive the default. 2005.11.12 -- Version 2.1-beta7 * Allow blank passwords to be passed via the management interface. * Fixed bug where "make check" inside a FreeBSD "jail" would never complete (Matthias Andree). * Fixed bug where --server directive in --dev tap mode claimed that it would support subnets of /30 or less but actually would only accept /29 or less. * Extend byte counters to 64 bits (M. van Cuijk). * Fixed bug in Linux get_default_gateway function introduced in 2.0.4, which would cause redirect-gateway on Linux clients to fail. * Moved easy-rsa 2.0 scripts to easy-rsa/2.0 to be compatible with 2.0.x distribution. * Documented --route-nopull. * Documented --ip-win32 adaptive. * Windows build now linked with LZO2. * Allow ca, cert, key, and dh files to be specified inline via XML-like syntax without needing to reference an explicit file. For example: data here... * Allow plugin and push directives to have multi-line parameter lists such as: my-plugin.so parm1 parm2 * Added connect-retry-max option (Alon Bar-Lev). * Fixed problems where signals thrown during initialization were not returning to a management-hold state. * Added a backtrack-hardened system time algorithm. * Added --remote-cert-ku, --remote-cert-eku, and --remote-cert-tls options for verifying certificate attributes (Alon Bar-Lev). * For Windows, reverted --ip-win32 default back to "dynamic". To use new adaptive mode, set explicitly. 2005.11.01 -- Version 2.1-beta6 * Security fix (merged from 2.0.4) -- Affects non-Windows OpenVPN clients of version 2.0 or higher which connect to a malicious or compromised server. A format string vulnerability in the foreign_option function in options.c could potentially allow a malicious or compromised server to execute arbitrary code on the client. Only non-Windows clients are affected. The vulnerability only exists if (a) the client's TLS negotiation with the server succeeds, (b) the server is malicious or has been compromised such that it is configured to push a maliciously crafted options string to the client, and (c) the client indicates its willingness to accept pushed options from the server by having "pull" or "client" in its configuration file (Credit: Vade79). CVE-2005-3393 * Security fix -- (merged from 2.0.4) Potential DoS vulnerability on the server in TCP mode. If the TCP server accept() call returns an error status, the resulting exception handler may attempt to indirect through a NULL pointer, causing a segfault. Affects all OpenVPN 2.0 versions. CVE-2005-3409 * Fix attempt of assertion at multi.c:1586 (note that this precise line number will vary across different versions of OpenVPN). * Windows reliability changes: (a) Added code to make sure that the local PATH environmental variable points to the Windows system32 directory. (b) Added new --ip-win32 adaptive mode which tries 'dynamic' and then fails over to 'netsh' if the DHCP negotiation fails. (c) Made --ip-win32 adaptive the default. * More PKCS#11 additions/changes (Alon Bar-Lev). * Added ".PHONY: plugin" to Makefile.am to work around "make dist" issue. * Fixed double fork issue that occurs when --management-hold is used. * Moved TUN/TAP read/write log messages from --verb 8 to 6. * Warn when multiple clients having the same common name or username usurp each other when --duplicate-cn is not used. * Modified Windows and Linux versions of get_default_gateway to return the route with the smallest metric if multiple 0.0.0.0/0.0.0.0 entries are present. * Added ">NEED-OK" alert and "needok" command to management interface to provide a general interface for sending alerts to the end-user. Used by the PKCS#11 code to send Token Insertion Requests to the user. * Added actual remote address used to the ">STATE" alert in the management interface (Rolf Fokkens). 2005.10.17 -- Version 2.1-beta4 * Fixed bug introduced in 2.1-beta3 where management socket bind would fail. * --capath fix in ssl.c (Zhuang Yuyao). * Added ".PHONY: plugin" to Makefile.am, reverted location of "plugin" directory (thanks to Matthias Andree for figuring this out). 2005.10.16 -- Version 2.1-beta3 * Added PKCS#11 support (Alon Bar-Lev). * Enable the use of --ca together with --pkcs12. If --ca is used at the same time as --pkcs12, the CA certificate is loaded from the file specified by --ca regardless if the pkcs12 file contains a CA cert or not (Mathias Sundman). * Merged --capath patch (Thomas Noel). * Merged --multihome patch. * Added --bind option for TCP client connections (Ewan Bhamrah Harley). * Moved "plugin" directory to "plugins" to deal with strange automake problem that ended up being also fixable with ".PHONY: plugin" in Makefile.am. 2005.10.13 -- Version 2.1-beta2 * Made --sndbuf and --rcvbuf pushable. 2005.10.01 -- Version 2.1-beta1 * Made LZO setting pushable. * Renamed sample-keys/tmp-ca.crt to ca.crt. * Fixed bug where remove_iroutes_from_push_route_list was missing routes if those routes had an implied netmask (by omission) of 255.255.255.255. * Merged with 2.0.3-rc1 * easy-rsa/2.0 moved to easy-rsa * old easy-rsa moved to easy-rsa/1.0 }}}