OpenVPN Change Log
Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <
sales@openvpn.net>
2010.11.09 -- Version 2.1.4
* Fix problem with special case route targets ('remote_host')
The init_route() function will leave &netlist untouched for
get_special_addr() routes ("remote_host" being one of them).
netlist is on stack, contains random garbage, and
netlist.len will not be 0 - thus, random stack data is copied from
netlist.data[] until the route_list is full.
Thanks to Teodo MICU and Gert Doering for finding and fixing this issue.
2010.08.20 -- Version 2.1.3
* Windows build fixes
Attempt to fix issue where domake-win build system was not properly
signing drivers and .exe files. This change is only affecting the
Windows build scripts and not the OpenVPN code base.
2010.08.09 -- Version 2.1.2
* Windows security issue:
Fixed potential local privilege escalation vulnerability in
Windows service. The Windows service did not properly quote the
executable filename passed to CreateService. A local attacker
with write access to the root directory C:\ could create an
executable that would be run with the same privilege level as
the OpenVPN Windows service. However, since non-Administrative
users normally lack write permission on C:\, this vulnerability
is generally not exploitable except on older versions of Windows
(such as Win2K) where the default permissions on C:\ would allow
any user to create files there.
Credit: Scott Laurie, MWR InfoSecurity
* Added Python-based based alternative build system for Windows using
Visual Studio 2008 (in win directory).
* When aborting in a non-graceful way, try to execute do_close_tun in
init.c prior to daemon exit to ensure that the tun/tap interface is
closed and any added routes are deleted.
* Fixed an issue where AUTH_FAILED was not being properly delivered
to the client when a bad password is given for mid-session reauth,
causing the connection to fail without an error indication.
* Don't advance to the next connection profile on AUTH_FAILED errors.
* Fixed an issue in the Management Interface that could cause
a process hang with 100% CPU utilization in --management-client
mode if the management interface client disconnected at the
point where credentials are queried.
* Fixed an issue where if reneg-sec was set to 0 on the client,
so that the server-side value would take precedence,
the auth_deferred_expire_window function would incorrectly
return a window period of 0 seconds. In this case, the
correct window period should be the handshake window
period.
* Modified ">PASSWORD:Verification Failed" management interface
notification to include a client reason string:
>PASSWORD:Verification Failed: 'AUTH_TYPE' ['REASON_STRING']
* Enable exponential backoff in reliability layer
retransmits.
* Set socket buffers (SO_SNDBUF and SO_RCVBUF) immediately after
socket is created rather than waiting until after connect/listen.
* Management interface performance optimizations:
1. Added env-filter MI command to perform filtering on env vars
passed through as a part of --management-client-auth
2. man_write will now try to aggregate output into larger blocks
(up to 1024 bytes) for more efficient i/o
* Fixed minor issue in Windows TAP driver DEBUG builds
where non-null-terminated unicode strings were being
printed incorrectly.
* Fixed issue on Windows with MSVC compiler, where TCP_NODELAY support
was not being compiled in.
* Proxy improvements:
Improved the ability of http-auth "auto" flag to dynamically detect
the auth method required by the proxy.
Added http-auth "auto-nct" flag to reject weak proxy auth methods.
Added HTTP proxy digest authentication method.
Removed extraneous openvpn_sleep calls from proxy.c.
* Implemented http-proxy-override and http-proxy-fallback directives to make it
easier for OpenVPN client UIs to start a pre-existing client config file with
proxy options, or to adaptively fall back to a proxy connection if a direct
connection fails.
* Implemented a key/value auth channel from client to server.
* Fixed issue where bad creds provided by the management interface
for HTTP Proxy Basic Authentication would go into an infinite
retry-fail loop instead of requerying the management interface for
new creds.
* Added support for MSVC debugging of openvpn.exe in settings.in:
# Build debugging version of openvpn.exe
!define PRODUCT_OPENVPN_DEBUG
* Implemented multi-address DNS expansion on the network field of route
commands.
When only a single IP address is desired from a multi-address DNS
expansion, use the first address rather than a random selection.
* Added --register-dns option for Windows.
Fixed some issues on Windows with --log, subprocess creation
for command execution, and stdout/stderr redirection.
* Fixed an issue where application payload transmissions on the
TLS control channel (such as AUTH_FAILED) that occur during
or immediately after a TLS renegotiation might be dropped.
* Added warning about tls-remote option in man page.
2009.12.11 -- Version 2.1.1
* Fixed some breakage in openvpn.spec (which is required to build an
RPM distribution) where it was referencing a non-existent
subdirectory in the tarball, causing it to fail (patch from
David Sommerseth).
2009.12.11 -- Version 2.1.0
* Fixed a couple issues in sample plugins auth-pam.c and down-root.c.
(1) Fail gracefully rather than segfault if calloc returns NULL.
(2) The openvpn_plugin_abort_v1 function can potentially be called
with handle == NULL. Add code to detect this case, and if so, avoid
dereferencing pointers derived from handle (Thanks to David
Sommerseth for finding this bug).
* Documented "multihome" option in the man page.
2009.11.20 -- Version 2.1_rc22
* Fixed a client-side bug on Windows that occurred when the
"dhcp-pre-release" or "dhcp-renew" options were combined with
"route-gateway dhcp". The release/renew would not occur
because the Windows DHCP renew function is blocking and
therefore must be called from another process or thread
so as not to stall the tunnel.
* Added a hard failure when peer provides a certificate chain
with depth > 16. Previously, a warning was issued.
2009.11.12 -- Version 2.1_rc21
* Rebuilt OpenVPN Windows installer with OpenSSL 0.9.8l to address
CVE-2009-3555. Note that OpenVPN has never relied on the session
renegotiation capabilities that are built into the SSL/TLS protocol,
therefore the fix in OpenSSL 0.9.8l (disable SSL/TLS renegotiation
completely) will not adversely affect OpenVPN mid-session SSL/TLS
renegotation or any other OpenVPN capabilities.
* Added additional session renegotiation hardening. OpenVPN has always
required that mid-session renegotiations build up a new SSL/TLS
session from scratch. While the client certificate common name is
already locked against changes in mid-session TLS renegotiations, we
now extend this locking to the auth-user-pass username as well as all
certificate content in the full client certificate chain.
2009.10.01 -- Version 2.1_rc20
* Fixed a bug introduced in 2.1_rc17 (svn r4436) where using the
redirect-gateway option by itself, without any extra parameters,
would cause the option to be ignored.
* Fixed build problem when ./configure --disable-server is used.
* Fixed ifconfig command for "topology subnet" on FreeBSD (Stefan Bethke).
* Added --remote-random-hostname option.
* Added "load-stats" management interface command to get global server
load statistics.
* Added new ./configure flags:
--disable-def-auth Disable deferred authentication
--disable-pf Disable internal packet filter
* Added "setcon" directive for interoperability with SELinux (Sebastien
Raveau).
* Optimized PUSH_REQUEST handshake sequence to shave several seconds
off of a typical client connection initiation.
* The maximum number of "route" directives (specified in the config
file or pulled from a server) can now be configured via the new
"max-routes" directive.
* Eliminated the limitation on the number of options that can be pushed
to clients, including routes. Previously, all pushed options needed
to fit within a 1024 byte options string.
* Added --server-poll-timeout option : when polling possible remote
servers to connect to in a round-robin fashion, spend no more than
n seconds waiting for a response before trying the next server.
* Added the ability for the server to provide a custom reason string
when an AUTH_FAILED message is returned to the client. This
string can be set by the server-side managment interface and read
by the client-side management interface.
* client-kill management interface command, when issued on server, will
now send a RESTART message to client.
This feature is intended to make UDP clients respond the same as TCP
clients in the case where the server issues a RESTART message in
order to force the client to reconnect and pull a new options/route
list.
2009.07.16 -- Version 2.1_rc19
* In Windows TAP driver, refactor DHCP/ARP packet injection code to
use a DPC (deferred procedure call) to defer packet injection until
IRQL < DISPATCH_LEVEL, rather than calling NdisMEthIndicateReceive
in the context of AdapterTransmit. This is an attempt to reduce kernel
stack usage, and prevent EXCEPTION_DOUBLE_FAULT BSODs that have been
observed on Vista. Updated TAP driver version number to 9.6.
* In configure.ac, use datadir instead of datarootdir for compatibility
with <autoconf-2.60.
2009.06.07 -- Version 2.1_rc18
* Fixed compile error on ./configure --enable-small
* Fixed issue introduced in r4475 (2.1-rc17) where cryptoapi.c change
does not build on Windows on non-MINGW32.
2009.05.30 -- Version 2.1_rc17
* Reduce the debug level (--verb) at which received management interface
commands are echoed from 7 to 3. Passwords will be filtered.
* Fixed race condition in management interface recv code on
Windows, where sending a set of several commands to the
management interface in quick succession might cause the
latter commands in the set to be ignored.
* Increased management interface input command buffer size
from 256 to 1024 bytes.
* Minor tweaks to Windows build system.
* Added "redirect-private" option which allows private subnets
to be pushed to the client in such a way that they don't accidently
obscure critical local addresses such as the DHCP server address and
DNS server addresses.
* Added new 'autolocal' redirect-gateway flag. When enabled, the OpenVPN
client will examine the routing table and determine whether (a) the
OpenVPN server is reachable via a locally connected interface, or (b)
traffic to the server must be forwarded through the default router.
Only add a special bypass route for the OpenVPN server if (b) is true.
If (a) is true, behave as if the 'local' flag is specified, and do not
add a bypass route.
The new 'autolocal' flag depends on the non-portable test_local_addr()
function in route.c, which is currently only implemented for Windows.
The 'autolocal' flag will act as a no-op on platforms that have not
yet defined a test_local_addr() function.
* Increased TLS_CHANNEL_BUF_SIZE to 2048 from 1024 (this will allow for
more option content to be pushed from server to client).
* Raised D_MULTI_DROPPED debug level to 4 from 3 to filter out (at debug
levels <=3) a common and usually innocuous warning.
* Fixed issue of symbol conflicts interfering with Windows CryptoAPI
functionality (Alon Bar-Lev).
* Fixed bug where the remote_X environmental variables were not being
set correctly when the 'local' option is specifed.
2009.05.17 -- Version 2.1_rc16
* Windows installer changes:
1. ifdefed out the check Windows version code which is causing
problems on Windows 7
2. don't define SF_SELECTED if it is already defined
3. Use LZMA instead of BZIP2 compression for better compression
4. Upgraded OpenSSL to 0.9.8k
* Added the ability to read the configuration file
from stdin, when "stdin" is given as the config
file name.
* Allow "management-client" directive to be used
with unix domain sockets.
* Added errors-to-stderr option. When enabled, fatal errors
that result in the termination of the daemon will be written
to stderr.
* Added optional "nogw" (no gateway) flag to --server-bridge
to inhibit the pushing of the route-gateway parameter to
clients.
* Added new management interface command "pid" to show the
process ID of the current OpenVPN process (Angelo Laub).
* Fixed issue where SIGUSR1 restarts would fail if private
key was specified as an inline file.
* Added daemon_start_time and daemon_pid environmental variables.
* In management interface, added new ">CLIENT:ESTABLISHED" notification.
* Build fixes:
1. Fixed some issues with C++ style comments that leaked into the code.
2. Updated configure.ac to work on MinGW64.
3. Updated common.h types for _WIN64.
4. Fixed issue involving an #ifdef in a macro reference that breaks early gcc
compilers.
5. In cryptoapi.c, renamed CryptAcquireCertificatePrivateKey to
OpenVPNCryptAcquireCertificatePrivateKey to work around
a symbol conflict in MinGW-5.1.4.
2008.11.19 -- Version 2.1_rc15
* Fixed issue introduced in 2.1_rc14 that may cause a
segfault when a --plugin module is used.
* Added server-side --opt-verify option: clients that connect
with options that are incompatible with those of the server
will be disconnected (without this option, incompatible
clients would trigger a warning message in the server log
but would not be disconnected).
* Added --tcp-nodelay option: Macro that sets TCP_NODELAY socket
flag on the server as well as pushes it to connecting clients.
* Minor options check fix: --no-name-remapping is a
server-only option and should therefore generate an
error when used on the client.
* Added --prng option to control PRNG (pseudo-random
number generator) parameters. In previous OpenVPN
versions, the PRNG was hardcoded to use the SHA1
hash. Now any OpenSSL hash may be used. This is
part of an effort to remove hardcoded references to
a specific cipher or cryptographic hash algorithm.
* Cleaned up man page synopsis.
2008.11.16 -- Version 2.1_rc14
* Added AC_GNU_SOURCE to configure.ac to enable struct ucred,
with the goal of fixing a build issue on Fedora 9 that was
introduced in 2.1_rc13.
* Added additional method parameter to --script-security to preserve
backward compatibility with system() call semantics used in OpenVPN
2.1_rc8 and earlier. To preserve backward compatibility use:
script-security 3 system
* Added additional warning messages about --script-security 2
or higher being required to execute user-defined scripts or
executables.
* Windows build system changes:
Modified Windows domake-win build system to write all openvpn.nsi
input files to gen, so that gen can be disconnected from
the rest of the source tree and makensis openvpn.nsi will
still function correctly.
Added additional SAMPCONF_(CA|CRT|KEY) macros to settings.in
(commented out by default).
Added optional files SAMPCONF_CONF2 (second sample configuration
file) and SAMPCONF_DH (Diffie-Helman parameters) to Windows
build system, and may be defined in settings.in.
* Extended Management Interface "bytecount" command
to work when OpenVPN is running as a server.
Documented Management Interface "bytecount" command in
management/management-notes.txt.
* Fixed informational message in ssl.c to properly indicate
deferred authentication.
* Added server-side --auth-user-pass-optional directive, to allow
connections by clients that do not specify a username/password, when a
user-defined authentication script/module is in place (via
--auth-user-pass-verify, --management-client-auth, or a plugin module).
* Changes to easy-rsa/2.0/pkitool and related openssl.cnf:
Calling scripts can set the KEY_NAME environmental variable to set
the "name" X509 subject field in generated certificates.
Modified pkitool to allow flexibility in separating the Common Name
convention from the cert/key filename convention.
For example:
KEY_CN="James's Laptop" KEY_NAME="james" ./pkitool james
will create a client certificate/key pair of james.crt/james.key
having a Common Name of "James's Laptop" and a Name of "james".
* Added --no-name-remapping option to allow Common Name, X509 Subject,
and username strings to include any printable character including
space, but excluding control characters such as tab, newline, and
carriage-return (this is important for compatibility with external
authentication systems).
As a related change, added --status-version 3 format (and "status 3"
in the management interface) which uses the version 2 format except
that tabs are used as delimiters instead of commas so that there
is no ambiguity when parsing a Common Name that contains a comma.
Also, save X509 Subject fields to environment, using the naming
convention:
X509_{cert_depth}_{name}={value}
This is to avoid ambiguities when parsing out the X509 subject string
since "/" characters could potentially be used in the common name.
* Fixed some ifconfig-pool issues that precluded it from being combined
with --server directive.
Now, for example, we can configure thusly:
server 10.8.0.0 255.255.255.0 nopool
ifconfig-pool 10.8.0.2 10.8.0.99 255.255.255.0
to have ifconfig-pool manage only a subset
of the VPN subnet.
* Added config file option "setenv FORWARD_COMPATIBLE 1" to relax
config file syntax checking to allow directives for future OpenVPN
versions to be ignored.
2008.10.07 -- Version 2.1_rc13
* Bundled OpenSSL 0.9.8i with Windows installer.
* Management interface can now listen on a unix
domain socket, for example:
management /tmp/openvpn unix
Also added management-client-user and management-client-group
directives to control which processes are allowed to connect
to the socket.
* Copyright change to OpenVPN Technologies, Inc.
2008.09.23 -- Version 2.1_rc12
* Patched Makefile.am so that the new t_cltsrv-down.sh script becomes
part of the tarball (Matthias Andree).
* Fixed --lladdr bug introduced in 2.1-rc9 where input validation code
was incorrectly expecting the lladdr parameter to be an IP address
when it is actually a MAC address (HoverHell).
2008.09.14 -- Version 2.1_rc11
* Fixed a bug that can cause SSL/TLS negotiations in UDP mode
to fail if UDP packets are dropped.
2008.09.10 -- Version 2.1_rc10
* Added "--server-bridge" (without parameters) to enable
DHCP proxy mode: Configure server mode for ethernet
bridging using a DHCP-proxy, where clients talk to the
OpenVPN server-side DHCP server to receive their IP address
allocation and DNS server addresses.
* Added "--route-gateway dhcp", to enable the extraction
of the gateway address from a DHCP negotiation with the
OpenVPN server-side LAN.
* Fixed minor issue with --redirect-gateway bypass-dhcp or bypass-dns
on Windows. If the bypass IP address is 0.0.0.0 or 255.255.255.255,
ignore it.
* Warn when ethernet bridging that the IP address of the bridge adapter
is probably not the same address that the LAN adapter was set to
previously.
* When running as a server, warn if the LAN network address is
the all-popular 192.168.[0|1].x, since this condition commonly
leads to subnet conflicts down the road.
* Primarily on the client, check for subnet conflicts between
the local LAN and the VPN subnet.
* Added a 'netmask' parameter to get_default_gateway, to return
the netmask of the adapter containing the default gateway.
Only implemented on Windows so far. Other platforms will
return 255.255.255.0. Currently the netmask information is
only used to warn about subnet conflicts.
* Minor fix to cryptoapi.c to not compile itself unless USE_CRYPTO
and USE_SSL flags are enabled (Alon Bar-Lev).
* Updated openvpn/t_cltsrv.sh (used by "make check") to conform to new
--script-security rules. Also adds retrying if the addresses are in
use (Matthias Andree).
* Fixed build issue with ./configure --disable-socks --disable-http.
* Fixed separate compile errors in options.c and ntlm.c that occur
on strict C compilers (such as old versions of gcc) that require
that C variable declarations occur at the start of a {} block,
not in the middle.
* Workaround bug in OpenSSL 0.9.6b ASN1_STRING_to_UTF8, which
the new implementation of extract_x509_field_ssl depends on.
* LZO compression buffer overflow errors will now invalidate
the packet rather than trigger a fatal assertion.
* Fixed minor compile issue in ntlm.c (mid-block declaration).
* Added --allow-pull-fqdn option which allows client to pull DNS names
from server (rather than only IP address) for --ifconfig, --route, and
--route-gateway. OpenVPN versions 2.1_rc7 and earlier allowed DNS names
for these options to be pulled and translated to IP addresses by default.
Now --allow-pull-fqdn will be explicitly required on the client to enable
DNS-name-to-IP-address translation of pulled options.
* 2.1_rc8 and earlier did implicit shell expansion on script
arguments since all scripts were called by system().
The security hardening changes made to 2.1_rc9 no longer
use system(), but rather use the safer execve or CreateProcess
system calls. The security hardening also introduced a
backward incompatibility with 2.1_rc8 and earlier in that
script parameters were no longer shell-expanded, so
for example:
client-connect "docc CLIENT-CONNECT"
would fail to work because execve would try to execute
a script called "docc CLIENT-CONNECT" instead of "docc"
with "CLIENT-CONNECT" as the first argument.
This patch fixes the issue, bringing the script argument
semantics back to pre 2.1_rc9 behavior in order to preserve
backward compatibility while still using execve or CreateProcess
to execute the script/executable.
* Modified ip_or_dns_addr_safe, which validates pulled DNS names,
to more closely conform to RFC 3696:
(1) DNS name length must not exceed 255 characters
(2) DNS name characters must be limited to alphanumeric,
dash ('-'), and dot ('.')
* Fixed bug in intra-session TLS key rollover that was introduced with
deferred authentication features in 2.1_rc8.
2008.07.31 -- Version 2.1_rc9
* Security Fix -- affects non-Windows OpenVPN clients running
OpenVPN 2.1-beta14 through 2.1-rc8 (OpenVPN 2.0.x clients are NOT
vulnerable nor are any versions of the OpenVPN server vulnerable).
An OpenVPN client connecting to a malicious or compromised
server could potentially receive an "lladdr" or "iproute" configuration
directive from the server which could cause arbitrary code execution on
the client. A successful attack requires that (a) the client has agreed
to allow the server to push configuration directives to it by including
"pull" or the macro "client" in its configuration file, (b) the client
successfully authenticates the server, (c) the server is malicious or has
been compromised and is under the control of the attacker, and (d) the
client is running a non-Windows OS. Credit: David Wagner.
CVE-2008-3459
* Miscellaneous defensive programming changes to multiple
areas of the code. In particular, use of the system() call
for calling executables such as ifconfig, route, and
user-defined scripts has been completely revamped in favor
of execve() on unix and CreateProcess() on Windows.
* In Windows build, package a statically linked openssl.exe to work around
observed instabilities in the dynamic build since the migration to
OpenSSL 0.9.8h.
2008.06.11 -- Version 2.1_rc8
* Added client authentication and packet filtering capability
to management interface. In addition, allow OpenVPN plugins
to take advantage of deferred authentication and packet
filtering capability.
* Added support for client-side connection profiles.
* Fixed unbounded memory growth bug in environmental variable
code that could have caused long-running OpenVPN sessions
with many TLS renegotiations to incrementally
increase memory usage over time.
* Windows release now packages openssl-0.9.8h.
* Build system changes -- allow building on Windows using
autoconf/automake scripts (Alon Bar-Lev).
* Changes to Windows build system to make it easier to do
partial builds, with a reduced set of prerequisites,
where only a subset of OpenVPN installer
components are built. See ./domake-win comments.
* Cleanup IP address for persistence interfaces for tap and also
using ifconfig, gentoo#209055 (Alon Bar-Lev).
* Fall back to old version of extract_x509_field for OpenSSL 0.9.6.
* Clarified tcp-queue-limit man page entry (Matti Linnanvuori).
* Added new OpenVPN icon and installer graphic.
* Minor pkitool changes.
* Added --pkcs11-id-management option, which will cause OpenVPN to
query the management interface via the new NEED-STR asynchronous
notification query to get additional PKCS#11 options (Alon Bar-Lev).
* Added NEED-STR management interface asynchronous query and
"needstr" management interface command to respond to the query
(Alon Bar-Lev).
* Added Dragonfly BSD support (Francis-Gudin).
* Quote device names before passing to up/down script (Josh Cepek).
* Bracketed struct openvpn_pktinfo with #pragma pack(1) to
prevent structure padding from causing an incorrect length
to be returned by sizeof (struct openvpn_pktinfo) on 64-bit
platforms.
* On systems that support res_init, always call it
before calling gethostbyname to ensure that
resolver configuration state is current.
* Added NTLMv2 proxy support (Miroslav Zajic).
* Fixed an issue in extract_x509_field_ssl where the extraction
would fail on the first field of the subject name, such as
the common name in: /CN=foo/emailAddress=
foo@bar.com
* Made "Linux ip addr del failed" error nonfatal.
* Amplified --client-cert-not-required warning.
* Added #pragma pack to proto.h.
2008.01.29 -- Version 2.1_rc7
* Added a few extra files that exist in the svn repo but were
not being copied into the tarball by make dist.
* Fixup null interface on close, don't use ip addr flush (Alon Bar-Lev).
2008.01.24 -- Version 2.1_rc6
* Fixed options checking bug introduced in rc5 where legitimate configuration
files might elicit the error: "Options error: Parameter pkcs11_private_mode
can only be specified in TLS-mode, i.e. where --tls-server or --tls-client
is also specified."
2008.01.23 -- Version 2.1_rc5
* Fixed Win2K TAP driver bug that was introduced by Vista fixes,
incremented driver version to 9.4.
* Windows build system changes:
Incremented included OpenSSL version to openssl-0.9.7m.
Updated openssl.patch for openssl-0.9.7m and added some
brief usage comments to the head of the patch.
Added build-pkcs11-helper.sh for building the pkcs11-helper
library.
Integrated inclusion of pkcs11-helper into Windows build
system.
Upgraded TAP build scripts to use WDK 6001.17121
(Windows 2008 Server pre-RTM).
* Windows installer changes:
Clean up the start menu folder.
Allow for a site-specific sample configuration file and keys
to be included in a custom installer (see SAMPCONF macros
in settings.in).
New icon (temporary).
* Added "forget-passwords" command to the management interface
(Alon Bar-Lev).
* Added --management-signal option to signal SIGUSR1 when the
management interface disconnects (Alon Bar-Lev).
* Modified command line and config file parser to allow
quoted strings using single quotes ('') (Alon Bar-Lev).
* Use pkcs11-helper as external library, can be downloaded from
https://www.opensc-project.org/pkcs11-helper (Alon Bar-Lev).
* Fixed interim memory growth issue in TCP connect loop where
"TCP: connect to %s failed, will try again in %d seconds: %s"
is output.
* Fixed bug in epoll driver in event.c, where the lack of a
handler for EPOLLHUP could cause 99% CPU usage.
* Defined ALLOW_NON_CBC_CIPHERS for people who don't
want to use a CBC cipher for OpenVPN's data channel.
* Added PLUGIN_LIBDIR preprocessor string to prepend a default
plugin directory to the dlopen search list when the user
specifies the basename of the plugin only (Marius Tomaschewski).
* Rewrote extract_x509_field and modified COMMON_NAME_CHAR_CLASS
to allow forward slash characters ("/") in the X509 common name
(Pavel Shramov).
* Allow OpenVPN to run completely unprivileged under Linux
by allowing openvpn --mktun to be used with --user and --group
to set the UID/GID of the tun device node. Also added --iproute
option to allow an alternative command to be executed in place
of the default iproute2 command (Alon Bar-Lev).
* Fixed --disable-iproute2 in ./configure to actually disable
iproute2 usage (Alon Bar-Lev).
* Added --management-forget-disconnect option -- forget
passwords when management session disconnects (Alon Bar-Lev).
2007.04.25 -- Version 2.1_rc4
* Worked out remaining issues with TAP driver signing
on Vista x64. OpenVPN will now run on Vista x64
with driver signing enforcement enabled.
* Fixed 64-bit portability bug in time_string function
(Thomas Habets).
2007.04.22 -- Version 2.1_rc3
* Additional fixes to TAP driver for Windows x64. Driver
now runs successfully on Vista x64 if driver signing
enforcement is disabled.
* The Windows Installer and TAP driver are now signed by
OpenVPN Solutions LLC (in addition to the usual GnuPG
signatures).
* Added OpenVPN GUI (Mathias Sundman version) as install
option in Windows installer.
* Clean up configure on FreeBSD for recent autotool versions
that require that all .h files have to be compiled.
Also, FreeBSD install does not support GNU long options
which the Makefile in easy-rsa/2.0 uses (not checked the
others as we don't install those on Gentoo) (Roy Marples).
* Added additional scripts to easy-rsa/Windows for working
with password-protected keys; also add -extensions server
option when generating server cert via
build-key-server-pass.bat (Daniel Zauft).
2007.02.27 -- Version 2.1_rc2
* auth-pam change: link with -lpam rather
than dlopen (Roy Marples).
* Prevent SIGUSR1 or SIGHUP from causing program
exit from initial management hold.
* SO_REUSEADDR should not be set on Windows TCP sockets
because it will cause bind to succeed on port conflicts.
* Added time_ascii, time_duration, and time_unix
environmental variables for plugins and callback
scripts.
* Fixed issue where OpenVPN does not apply the --txqueuelen option
to persistent interfaces made with --mktun (Roy Marples).
* Attempt at rational signal handling when in the
management hold state. During management hold, ignore
SIGUSR1/SIGHUP signals thrown with the "signal" command.
Also, "signal" command will now apply remapping as
specified with the --remap-usr1 option.
When a signal entered using the "signal" command from a management
hold is ignored, output: >HOLD:Waiting for hold release
* Fixed issue where struct env_set methods that
change the value of an existing name=value pair
would delay the freeing of the memory held by
the previous name=value pair until the underlying
client instance object is closed.
This could cause a server that handles long-term
client connections, resulting in many periodic calls
to verify_callback, to needlessly grow the env_set
memory allocation until the underlying client instance
object is closed.
* Renamed TAP-Win32 driver from tap0801.sys to tap0901.sys
to reflect the fact that Vista has blacklisted the tap0801.sys
file name due to previous compatibility issues which have now
been resolved. TAP-Win32 major/minor version number is now 9/1.
* Windows installer will delete a previously installed
tap0801.sys TAP driver before installing tap0901.sys.
* Added code to Windows installer to fail gracefully on 64 bit
installs until 64-bit TAP driver issues can be resolved.
* Added code to Windows installer to fail gracefully on
versions of Windows which are not explicitly supported.
* The Windows version will now use a default route-delay
of 5 seconds to deal with an apparent routing table race
condition on Vista.
* Worked around an incompatibility in the Windows Vista
version of CreateIpForwardEntry as described in
http://www.nynaeve.net/?p=59
This issue would cause route additions using the
IP Helper API to fail on Vista.
* On Windows, revert to "ip-win32 dynamic" as the default.
2006.10.31 -- Version 2.1_rc1
* Support recovery (return to hold) from signal at
management password prompt.
* Added workaround for OpenSC PKCS#11 bug#108
(Alon Bar-Lev).
2006.10.01 -- Version 2.1-beta16
* Windows installer updated with OpenSSL 0.9.7l DLLs to fix
published vulnerabilities.
* Fixed TAP-Win32 bug that caused BSOD on Windows Vista
(Henry Nestler).
* Autodetect 32/64 bit Windows in installer and install
appropriate TAP driver (Mathias Sundman, Hypherion).
* Fixed bug in loopback self-test introduced
in 2.1-beta15 where self test as invoked by
"make check" would not properly exit after
2 minutes (Paul Howarth).
2006.09.12 -- Version 2.1-beta15
* Windows installer updated with OpenSSL 0.9.7k DLLs to fix
RSA Signature Forgery (CVE-2006-4339).
* Fixed bug introduced with the --port-share directive
(back in 2.1-beta9 which causes TLS soft resets
(1 per hour by default) in TCP server mode to force
a blockage of tunnel packets and later time-out and
restart the connection.
* easy-rsa update (Alon Bar-Lev)
Makefile (install) is now available so that
distribs will be able to install it safely.
* PKCS#11 changes: (Alon Bar-Lev)
- Modified ssl.c to not FATAL and return to init.c
so auth-retry will work.
- Modifed pkcs11-helper.c to fix some problem with
multiple providers.
- Added retry counter to PKCS#11 PIN hook.
- Modified PKCS#11 PIN retry loop to return correct error
code when PIN is incorrect.
- Fix handling (ignoring) zero sized attributes.
- Fix gcc-2 issues.
- Fix openssl 0.9.6 (first version) issues.
* Minor fixes of lladdr (Alon Bar-Lev)
Updated makefile.w32-vc to include lladdr.*, updated
linkage libraries.
Modified lladdr.c to be compiled under visual C.
* Added two new management states:
OPENVPN_STATE_RESOLVE -- DNS lookup
OPENVPN_STATE_TCP_CONNECT -- Connecting to TCP server
* Echo management state change to log.
* Minor syshead.h change for NetBSD to allow
TCP_NODELAY flag to work.
* Modified --port-share code to remove the assumption that
CMSG_SPACE always evaluates to a constant, to enable
compilation on NetBSD and possibly other BSDs as well.
* Eliminated gcc 3.3.3 warnings on NetBSD
when ./configure --enable-strict is used.
* Added optional minimum-number-of-bytes parameter
to --inactive directive.
2006.04.13 -- Version 2.1-beta14
* Fixed Windows server bug in time backtrack handling code which
could cause TLS negotiation failures on legitimate clients.
* Rewrote gettimeofday function for Windows to be
simpler and more efficient.
* Merged PKCS#11 extensions to easy-rsa/2.0 (Alon Bar-Lev).
* Added --route-metric option to set a default route metric
for --route (Roy Marples).
* Added --lladdr option to specify the link layer (MAC) address
for the tap interface on non-Windows platforms (Roy Marples).
2006.04.12 -- Version 2.1-beta13
* Code added in 2.1-beta7 and 2.0.6-rc1 to extend byte counters
to 64 bits caused a bug in the Windows version which has now
been fixed. The bug could cause intermittent crashes.
2006.04.05 -- Version 2.1-beta12
* Security Vulnerability -- An OpenVPN client connecting to a
malicious or compromised server could potentially receive
"setenv" configuration directives from the server which could
cause arbitrary code execution on the client via a LD_PRELOAD
attack. A successful attack appears to require that (a) the
client has agreed to allow the server to push configuration
directives to it by including "pull" or the macro "client" in
its configuration file, (b) the client configuration file uses
a scripting directive such as "up" or "down", (c) the client
succesfully authenticates the server, (d) the server is
malicious or has been compromised and is under the control of
the attacker, and (e) the attacker has at least some level of
pre-existing control over files on the client (this might be
accomplished by having the server respond to a client web request
with a specially crafted file). Credit: Hendrik Weimer.
CVE-2006-1629.
The fix is to disallow "setenv" to be pushed to clients from
the server, and to add a new directive "setenv-safe" which is
pushable from the server, but which appends "OPENVPN_" to the
name of each remotely set environmental variable.
* "topology subnet" fix for FreeBSD (Benoit Bourdin).
* PKCS11 fixes (Alon Bar-Lev). For full description:
svn log -r990 http://svn.openvpn.net/projects/openvpn/branches/BETA21
* When deleting routes under Linux, use the route metric
as a differentiator to ensure that the route teardown
process only deletes the identical route which was originally
added via the "route" directive (Roy Marples).
* Fix the t_cltsrv.sh file in FreeBSD 4 jails
(Matthias Andree, Dirk Meyer, Vasil Dimov).
* Extended tun device configure code to support ethernet
bridging on NetBSD (Emmanuel Kasper).
2006.02.19 -- Version 2.1-beta11
* Fixed --port-share bug that caused premature closing
of proxied sessions.
2006.02.17 -- Version 2.1-beta10
* Fixed --port-share breakage introduced in 2.1-beta9.
2006.02.16 -- Version 2.1-beta9
* Added --port-share option for allowing OpenVPN and HTTPS
server to share the same port number.
* Added --management-client option to connect as a client
to management GUI app rather than be connected to as a
server.
* Added "bytecount" command to management interface.
* --remote-cert-tls fixes (Alon Bar-Lev).
2006.01.03 -- Version 2.1-beta8
* --remap-usr1 will now also remap signals thrown during
initialization.
* Added --connect-timeout option to control the timeout
on TCP client connection attempts (doesn't work on all
OSes). This patch also makes OpenVPN signalable during
TCP connection attempts.
* Fixed bug in acinclude.m4 where capability of compiler
to handle zero-length arrays in structs is tested
(David Stipp).
* Fixed typo in manage.c where inline function declaration
was declared without the "static" keyword (David Stipp).
* Patch to support --topology subnet on Mac OS X (Mathias Sundman).
* Added --auto-proxy directive to auto-detect HTTP or SOCKS
proxy settings (currently Windows only).
* Removed redundant base64 code.
* Better sanity checking of --server and --server-bridge
IP pool ranges, so as not to hit the assertion at
pool.c:119 (2.0.5).
* Fixed bug where --daemon and --management-query-passwords
used together would cause OpenVPN to block prior to
daemonization.
* Fixed client/server race condition which could occur
when --auth-retry interact is set and the initially
provided auth-user-pass credentials are incorrect,
forcing a username/password re-query.
* Fixed bug where if --daemon and --management-hold are
used together, --user or --group options would be ignored.
* --ip-win32 adaptive is now the default.
* --ip-win32 netsh (or --ip-win32 adaptive when in netsh
mode) can now set DNS/WINS addresses on the TAP-Win32
adapter.
* Added new option --route-method adaptive (Win32)
which tries IP helper API first, then falls back to
route.exe.
* Made --route-method adaptive the default.
2005.11.12 -- Version 2.1-beta7
* Allow blank passwords to be passed via the management
interface.
* Fixed bug where "make check" inside a FreeBSD "jail"
would never complete (Matthias Andree).
* Fixed bug where --server directive in --dev tap mode
claimed that it would support subnets of /30 or less
but actually would only accept /29 or less.
* Extend byte counters to 64 bits (M. van Cuijk).
* Fixed bug in Linux get_default_gateway function
introduced in 2.0.4, which would cause redirect-gateway
on Linux clients to fail.
* Moved easy-rsa 2.0 scripts to easy-rsa/2.0 to
be compatible with 2.0.x distribution.
* Documented --route-nopull.
* Documented --ip-win32 adaptive.
* Windows build now linked with LZO2.
* Allow ca, cert, key, and dh files to be specified
inline via XML-like syntax without needing to
reference an explicit file.
For example:
<ca>
data here...
</ca>
* Allow plugin and push directives to have multi-line
parameter lists such as:
<plugin>
my-plugin.so
parm1
parm2
</plugin>
* Added connect-retry-max option (Alon Bar-Lev).
* Fixed problems where signals thrown during initialization
were not returning to a management-hold state.
* Added a backtrack-hardened system time algorithm.
* Added --remote-cert-ku, --remote-cert-eku, and
--remote-cert-tls options for verifying certificate
attributes (Alon Bar-Lev).
* For Windows, reverted --ip-win32 default back to "dynamic".
To use new adaptive mode, set explicitly.
2005.11.01 -- Version 2.1-beta6
* Security fix (merged from 2.0.4) -- Affects non-Windows
OpenVPN clients of version 2.0 or higher which connect to
a malicious or compromised server. A format string
vulnerability in the foreign_option function in options.c
could potentially allow a malicious or compromised server
to execute arbitrary code on the client. Only
non-Windows clients are affected. The vulnerability
only exists if (a) the client's TLS negotiation with
the server succeeds, (b) the server is malicious or
has been compromised such that it is configured to
push a maliciously crafted options string to the client,
and (c) the client indicates its willingness to accept
pushed options from the server by having "pull" or
"client" in its configuration file (Credit: Vade79).
CVE-2005-3393
* Security fix -- (merged from 2.0.4) Potential DoS
vulnerability on the server in TCP mode. If the TCP
server accept() call returns an error status, the resulting
exception handler may attempt to indirect through a NULL
pointer, causing a segfault. Affects all OpenVPN 2.0 versions.
CVE-2005-3409
* Fix attempt of assertion at multi.c:1586 (note that
this precise line number will vary across different
versions of OpenVPN).
* Windows reliability changes:
(a) Added code to make sure that the local PATH environmental
variable points to the Windows system32 directory.
(b) Added new --ip-win32 adaptive mode which tries 'dynamic'
and then fails over to 'netsh' if the DHCP negotiation fails.
(c) Made --ip-win32 adaptive the default.
* More PKCS#11 additions/changes (Alon Bar-Lev).
* Added ".PHONY: plugin" to Makefile.am to work around
"make dist" issue.
* Fixed double fork issue that occurs when --management-hold
is used.
* Moved TUN/TAP read/write log messages from --verb 8 to 6.
* Warn when multiple clients having the same common name or
username usurp each other when --duplicate-cn is not used.
* Modified Windows and Linux versions of get_default_gateway
to return the route with the smallest metric
if multiple 0.0.0.0/0.0.0.0 entries are present.
* Added ">NEED-OK" alert and "needok" command to management
interface to provide a general interface for sending
alerts to the end-user. Used by the PKCS#11 code
to send Token Insertion Requests to the user.
* Added actual remote address used to the ">STATE" alert
in the management interface (Rolf Fokkens).
2005.10.17 -- Version 2.1-beta4
* Fixed bug introduced in 2.1-beta3 where management
socket bind would fail.
* --capath fix in ssl.c (Zhuang Yuyao).
* Added ".PHONY: plugin" to Makefile.am, reverted
location of "plugin" directory (thanks to
Matthias Andree for figuring this out).
2005.10.16 -- Version 2.1-beta3
* Added PKCS#11 support (Alon Bar-Lev).
* Enable the use of --ca together with --pkcs12. If --ca is
used at the same time as --pkcs12, the CA certificate is loaded
from the file specified by --ca regardless if the pkcs12 file
contains a CA cert or not (Mathias Sundman).
* Merged --capath patch (Thomas Noel).
* Merged --multihome patch.
* Added --bind option for TCP client connections (Ewan Bhamrah
Harley).
* Moved "plugin" directory to "plugins" to deal with strange
automake problem that ended up being also fixable with
".PHONY: plugin" in Makefile.am.
2005.10.13 -- Version 2.1-beta2
* Made --sndbuf and --rcvbuf pushable.
2005.10.01 -- Version 2.1-beta1
* Made LZO setting pushable.
* Renamed sample-keys/tmp-ca.crt to ca.crt.
* Fixed bug where remove_iroutes_from_push_route_list
was missing routes if those routes had
an implied netmask (by omission) of 255.255.255.255.
* Merged with 2.0.3-rc1
* easy-rsa/2.0 moved to easy-rsa
* old easy-rsa moved to easy-rsa/1.0
