head 1.9; access; symbols pkgsrc-2017Q1:1.8.0.6 pkgsrc-2017Q1-base:1.8 pkgsrc-2016Q4:1.8.0.4 pkgsrc-2016Q4-base:1.8 pkgsrc-2016Q3:1.8.0.2 pkgsrc-2016Q3-base:1.8 pkgsrc-2016Q2:1.7.0.24 pkgsrc-2016Q2-base:1.7 pkgsrc-2016Q1:1.7.0.22 pkgsrc-2016Q1-base:1.7 pkgsrc-2015Q4:1.7.0.20 pkgsrc-2015Q4-base:1.7 pkgsrc-2015Q3:1.7.0.18 pkgsrc-2015Q3-base:1.7 pkgsrc-2015Q2:1.7.0.16 pkgsrc-2015Q2-base:1.7 pkgsrc-2015Q1:1.7.0.14 pkgsrc-2015Q1-base:1.7 pkgsrc-2014Q4:1.7.0.12 pkgsrc-2014Q4-base:1.7 pkgsrc-2014Q3:1.7.0.10 pkgsrc-2014Q3-base:1.7 pkgsrc-2014Q2:1.7.0.8 pkgsrc-2014Q2-base:1.7 pkgsrc-2014Q1:1.7.0.6 pkgsrc-2014Q1-base:1.7 pkgsrc-2013Q4:1.7.0.4 pkgsrc-2013Q4-base:1.7 pkgsrc-2013Q3:1.7.0.2 pkgsrc-2013Q3-base:1.7 pkgsrc-2013Q2:1.6.0.4 pkgsrc-2013Q2-base:1.6 pkgsrc-2013Q1:1.6.0.2 pkgsrc-2013Q1-base:1.6 pkgsrc-2012Q4:1.5.0.14 pkgsrc-2012Q4-base:1.5 pkgsrc-2012Q3:1.5.0.12 pkgsrc-2012Q3-base:1.5 pkgsrc-2012Q2:1.5.0.10 pkgsrc-2012Q2-base:1.5 pkgsrc-2012Q1:1.5.0.8 pkgsrc-2012Q1-base:1.5 pkgsrc-2011Q4:1.5.0.6 pkgsrc-2011Q4-base:1.5 pkgsrc-2011Q3:1.5.0.4 pkgsrc-2011Q3-base:1.5 pkgsrc-2011Q2:1.5.0.2 pkgsrc-2011Q2-base:1.5 pkgsrc-2011Q1:1.4.0.4 pkgsrc-2011Q1-base:1.4 pkgsrc-2010Q4:1.4.0.2 pkgsrc-2010Q4-base:1.4 pkgsrc-2010Q3:1.3.0.16 pkgsrc-2010Q3-base:1.3 pkgsrc-2010Q2:1.3.0.14 pkgsrc-2010Q2-base:1.3 pkgsrc-2010Q1:1.3.0.12 pkgsrc-2010Q1-base:1.3 pkgsrc-2009Q4:1.3.0.10 pkgsrc-2009Q4-base:1.3 pkgsrc-2009Q3:1.3.0.8 pkgsrc-2009Q3-base:1.3 pkgsrc-2009Q2:1.3.0.6 pkgsrc-2009Q2-base:1.3 pkgsrc-2009Q1:1.3.0.4 pkgsrc-2009Q1-base:1.3 pkgsrc-2008Q4:1.3.0.2 pkgsrc-2008Q4-base:1.3 pkgsrc-2008Q3:1.2.0.16 pkgsrc-2008Q3-base:1.2 cube-native-xorg:1.2.0.14 cube-native-xorg-base:1.2 pkgsrc-2008Q2:1.2.0.12 pkgsrc-2008Q2-base:1.2 cwrapper:1.2.0.10 pkgsrc-2008Q1:1.2.0.8 pkgsrc-2008Q1-base:1.2 pkgsrc-2007Q4:1.2.0.6 pkgsrc-2007Q4-base:1.2 pkgsrc-2007Q3:1.2.0.4 pkgsrc-2007Q3-base:1.2 pkgsrc-2007Q2:1.2.0.2 pkgsrc-2007Q2-base:1.2 pkgsrc-2007Q1:1.1.0.10 pkgsrc-2007Q1-base:1.1 pkgsrc-2006Q4:1.1.0.8 pkgsrc-2006Q4-base:1.1 pkgsrc-2006Q3:1.1.0.6 pkgsrc-2006Q3-base:1.1 pkgsrc-2006Q2:1.1.0.4 pkgsrc-2006Q2-base:1.1 pkgsrc-2006Q1:1.1.0.2; locks; strict; comment @# @; 1.9 date 2017.05.24.20.35.12; author adam; state dead; branches; next 1.8; commitid Gfltr6pV0iCvqGSz; 1.8 date 2016.07.08.08.49.41; author jperkin; state Exp; branches; next 1.7; commitid pkh3J8yf3R0FNudz; 1.7 date 2013.07.31.06.53.21; author adam; state Exp; branches; next 1.6; commitid mFpK3VdJDQqAEAZw; 1.6 date 2013.02.10.05.55.07; author manu; state Exp; branches; next 1.5; 1.5 date 2011.04.28.07.27.25; author adam; state Exp; branches; next 1.4; 1.4 date 2010.11.30.08.50.17; author adam; state Exp; branches; next 1.3; 1.3 date 2008.10.09.10.57.23; author sborrill; state Exp; branches; next 1.2; 1.2 date 2007.06.21.21.44.42; author jlam; state Exp; branches; next 1.1; 1.1 date 2006.04.11.20.09.52; author jlam; state Exp; branches 1.1.2.1; next ; 1.1.2.1 date 2006.04.11.20.09.52; author salo; state dead; branches; next 1.1.2.2; 1.1.2.2 date 2006.04.13.16.08.25; author salo; state Exp; branches; next ; desc @@ 1.9 log @OpenVPN 2.4.2 Compared to OpenVPN 2.3 this is a major update with a large number of new features, improvements and fixes. Some of the major features are AEAD (GCM) cipher and Elliptic Curve DH key exchange support, improved IPv4/IPv6 dual stack support and more seamless connection migration when client's IP address changes (Peer-ID). Also, the new --tls-crypt feature can be used to increase users' connection privacy. Compared to OpenVPN 2.4.1 there are several bugfixes and small enhancements. A summary of the changes is available in Changes.rst. @ text @$NetBSD: patch-ae,v 1.8 2016/07/08 08:49:41 jperkin Exp $ Support IP_PKTINFO and net/if_tap.h --- configure.ac.orig 2013-05-31 12:00:25.000000000 +0000 +++ configure.ac @@@@ -419,6 +419,7 @@@@ AC_CHECK_HEADERS([ \ sys/mman.h sys/file.h sys/wait.h \ unistd.h signal.h libgen.h stropts.h \ syslog.h pwd.h grp.h \ + net/if_tap.h \ sys/sockio.h sys/uio.h linux/sockios.h \ linux/types.h sys/poll.h sys/epoll.h err.h \ ]) @@@@ -433,6 +434,9 @@@@ SOCKET_INCLUDES=" #ifdef HAVE_SYS_SOCKET_H #include #endif +#ifdef HAVE_NET_IF_H +#include +#endif #ifdef HAVE_NETINET_IN_H #include #endif @@@@ -496,6 +500,12 @@@@ AC_CHECK_TYPE( , [[${SOCKET_INCLUDES}]] ) +AC_CHECK_MEMBER( + [struct in_pktinfo.ipi_spec_dst], + [AC_DEFINE([HAVE_IPI_SPEC_DST], [1], [struct in_pktinfo.ipi_spec_dst needed for IP_PKTINFO support])], + , + [[${SOCKET_INCLUDES}]] +) AC_CHECK_TYPE( [struct sockaddr_in6], , @ 1.8 log @Update net/openvpn to 2.3.11. Changes since 2.3.6: 2016.05.09 -- Version 2.3.11 Fixed port-share bug with DoS potential Make intent of utun device name validation clear Fix buffer overflow by user supplied data Correctly report TCP connection timeout on windows. Report Windows bitness Fix undefined signed shift overflow Fix build with libressl Improve LZO, PAM and OpenSSL documentation Ensure input read using systemd-ask-password is null terminated Support reading the challenge-response from console openssl: improve logging polarssl: improve logging Update manpage: OpenSSL might also need /dev/urandom inside chroot socks.c: fix check on get_user_pass() return value(s) Fix OCSP_check.sh hardening: add safe FD_SET() wrapper openvpn_fd_set() Fix memory leak in argv_extract_cmd_name() Replace MSG_TEST() macro for static inline msg_test() Restrict default TLS cipher list Various Changes.rst fixes Clarify mssfix documentation Clarify --block-outside-dns documentation Update --block-outside-dns to work on Windows Vista 2016.01.04 -- Version 2.3.10 Prepare for v2.3.10 release, list PolarSSL 1.2 to 1.3 upgrade Make certificate expiry warning patch (091edd8e299686) work on OpenSSL 1.0.1 and earlier. Repair IPv6 netsh calls if Win XP is detected Use bob.example.com and alice.example.com to improve clarity of documentation Remove unused variables from ssl_verify_polarssl.c's x509_get_serial() Upgrade OpenVPN 2.3 to PolarSSL 1.3 Warn user if their certificate has expired Make assert_failed() print the failed condition cleanup: get rid of httpdigest.c type warnings Fix regression in setups without a client certificate polarssl: fix unreachable code 2015.12.15 -- Version 2.3.9 Show extra-certs in current parameters. Fix commit a3160fc1bd7368395745b9cee6e40fb819f5564c Do not set the buffer size by default but rely on the operation system default. Remove --enable-password-save option Reflect enable-password-save change in documentation Also remove second instance of enable-password-save in the man page Detect config lines that are too long and give a warning/error Log serial number of revoked certificate Adjust server-ipv6 documentation Avoid partial authentication state when using --disabled in CCD configs Make "block-outside-dns" option platform agnostic Un-break --auth-user-pass on windows Replace unaligned 16bit access to TCP MSS value with bytewise access Repair test_local_addr() on WIN32 Fix possible heap overflow on read accessing getaddrinfo() result. Fix FreeBSD-specific mishandling of gc arena pointer in create_arbitrary_remote() remove unused gc_arena in FreeBSD close_tun() Fix isatty() check for good. put virtual IPv6 addresses into env Use adapter index instead of name for windows IPv6 interface config Client-side part for server restart notification Use adapter index for add/delete_route_ipv6 Pass adapter index to up/down scripts Fix VS2013 compilation Fix privilege drop if first connection attempt fails Support for username-only auth file. Add CONTRIBUTING.rst Updates to Changes.rst Fix termination when windows suspends/sleeps Do not hard-code windows systemroot in env_block Handle ctrl-C and ctrl-break events on Windows Unbreak read username password from management Replace strdup() calls for string_alloc() calls Check return value of ms_error_text() Increase control channel packet size for faster handshakes hardening: add insurance to exit on a failed ASSERT() Fix memory leak in auth-pam plugin Fix (potential) memory leak in init_route_list() Fix unintialized variable in plugin_vlog() Add macro to ensure we exit on fatal errors Fix memory leak in add_option() by simplifying get_ipv6_addr openssl: properly check return value of RAND_bytes() Fix rand_bytes return value checking Add Windows DNS Leak fix using WFP ('block-outside-dns') Fix "White space before end tags can break the config parser" 2015.08.03 -- Version 2.3.8 Report missing endtags of inline files as warnings Fix commit e473b7c if an inline file happens to have a line break exactly at buffer limit Produce a meaningful error message if --daemon gets in the way of asking for passwords. Document --daemon changes and consequences (--askpass, --auth-nocache). Del ipv6 addr on close of linux tun interface Fix --askpass not allowing for password input via stdin write pid file immediately after daemonizing Make __func__ work with Visual Studio too fix regression: query password before becoming daemon Fix using management interface to get passwords. Fix overflow check in openvpn_decrypt() 2015.06.02 -- Version 2.3.7 Default gateway can't be determined on illumos/Solaris platforms Warn that tls-auth with free form files is going to be removed from OpenVPN 2.4 autotools: Fix wrong ./configure help screen default values down-root plugin: Replaced system() calls with execve() down-root: Improve error messages plugin, down-root: Fix compiler warnings sockets: Remove the limitation of --tcp-nodelay to be server-only plugins, down-root: Code style clean-up pkcs11: Load p11-kit-proxy.so module by default Make 'provider' option to --show-pkcs11-ids optional where p11-kit is present Use OPENVPN_ETH_P_* so that is unecessary New approach to handle peer-id related changes to link-mtu (2.3 version) Fix incorrect use of get_ipv6_addr() for iroute options. Print helpful error message on --mktun/--rmtun if not available. explain effect of --topology subnet on --ifconfig Add note about file permissions and --crl-verify to manpage. repair --dev null breakage caused by db950be85d37 assume res_init() is always there. Correct note about DNS randomization in openvpn.8 Disallow usage of --server-poll-timeout in --secret key mode. slightly enhance documentation about --cipher Enforce "serial-tests" behaviour for tests/Makefile Revert "Enforce "serial-tests" behaviour for tests/Makefile" On signal reception, return EAI_SYSTEM from openvpn_getaddrinfo(). Use configure.ac hack to apply serial_test AM option only if supported. Use EAI_AGAIN instead of EAI_SYSTEM for openvpn_getaddrinfo(). Move res_init() call to inner openvpn_getaddrinfo() loop Fix FreeBSD ifconfig for topology subnet tunnels. Fix --redirect-private in --dev tap mode. include ifconfig_ environment variables in --up-restart env set Fix null pointer dereference in options.c Fix mssfix default value in connection_list context Manual page update for Re-enabled TLS version negotiation. Include systemd units in the source tarball (make dist) Updated manpage for --rport and --lport Properly escape dashes on the man-page Improve documentation in --script-security section of the man-page Really fix '--cipher none' regression Update doxygen (a bit) Set tls-version-max to 1.1 if cryptoapicert is used Account for peer-id in frame size calculation Disable SSL compression Fix frame size calculation for non-CBC modes. Allow for CN/username of 64 characters (fixes off-by-one) Remove unneeded parameter 'first_time' from possibly_become_daemon() Re-enable TLS version negotiation by default Remove size limit for files inlined in config Improve --tls-cipher and --show-tls man page description Re-read auth-user-pass file on (re)connect if required Clarify --capath option in manpage Call daemon() before initializing crypto library @ text @d1 1 a1 1 $NetBSD: patch-ae,v 1.7 2013/07/31 06:53:21 adam Exp $ @ 1.7 log @Changes 2.3.2: Only print script warnings when a script is used. Remove stray mention of script-security system. Move settings of user script into set_user_script function Move checking of script file access into set_user_script Provide more accurate warning message Fix NULL-pointer crash in route_list_add_vpn_gateway(). Fix problem with UDP tunneling due to mishandled pktinfo structures. Always push basic set of peer info values to server. make 'explicit-exit-notify' pullable again Fix proto tcp6 for server & non-P2MP modes Fix Windows script execution when called from script hooks Fixed tls-cipher translation bug in openssl-build Fixed usage of stale define USE_SSL to ENABLE_SSL Fix segfault when enabling pf plug-ins @ text @d1 3 a3 1 $NetBSD$ @ 1.6 log @Upgrade OpenVPN to 2.3.0 Bump openvpn-acct-wtmpx to add its licence and to take into account the new location of plugin directory Significant changes since 2.2.x: * Full IPv6 support * SSL layer modularised, enabling easier implementation for other SSL libraries * PolarSSL support as a drop-in replacement for OpenSSL * New plug-in API providing direct certificate access, improved logging API and easier to extend in the future * Added 'dev_type' environment variable to scripts and plug-ins - which is set to 'TUN' or 'TAP' * New feature: --management-external-key - to provide access to the encryption keys via the management interface * New feature: --x509-track option, more fine grained access to X.509 fields in scripts and plug-ins * New feature: --client-nat support * New feature: --mark which can mark encrypted packets from the tunnel, suitable for more advanced routing and firewalling * New feature: --management-query-proxy - manage proxy settings via the management interface (supercedes --http-proxy-fallback) * New feature: --stale-routes-check, which cleans up the internal routing table * New feature: --x509-username-field, where other X.509v3 fields can be used for the authentication instead of Common Name * Improved client-kill management interface command * Improved UTF-8 support - and added --compat-names to provide backwards compatibility with older scripts/plug-ins * Improved auth-pam with COMMONNAME support, passing the certificate's common name in the PAM conversation * More options can now be used inside blocks * Completely new build system, enabling easier cross-compilation and Windows builds * Much of the code has been better documented * Many documentation updates * Plenty of bug fixes and other code clean-ups @ text @d1 1 a1 1 $NetBSD: patch-ae,v 1.5 2011/04/28 07:27:25 adam Exp $ d3 3 a5 4 --- configure.ac.orig 2012-11-29 20:47:57.000000000 +0000 +++ configure.ac 2013-01-28 09:26:04.000000000 +0000 @@@@ -418,8 +418,9 @@@@ sys/time.h sys/ioctl.h sys/stat.h \ d13 1 a13 3 @@@@ -432,8 +433,11 @@@@ #endif d23 13 a35 1 #ifdef HAVE_WINDOWS_H @ 1.5 log @Changes 2.2.0: * Several man-page updates * Several buildsystem fixes * Fixed a bug with GUI icon deletion on upgrade from 2.2-RC or earlier * Change the default --tmp-dir path to a more suitable path * Improve the mysprintf() issue in openvpnserv.c * Fixed bug in port-share that could cause port share process to crash * Fix the --client-cert-not-required feature @ text @d1 1 a1 1 $NetBSD$ d3 24 a26 20 --- configure.ac.orig 2011-04-14 21:30:08.000000000 +0000 +++ configure.ac @@@@ -375,6 +375,7 @@@@ if test "${WIN32}" != "yes"; then sys/mman.h fcntl.h sys/file.h stdlib.h stdint.h dnl stdarg.h unistd.h signal.h stdio.h string.h dnl strings.h ctype.h errno.h syslog.h pwd.h grp.h dnl + net/if_tap.h net/if_tun.h net/tun/if_tun.h stropts.h sys/sockio.h dnl netinet/in.h netinet/in_systm.h dnl netinet/tcp.h arpa/inet.h dnl @@@@ -407,6 +408,9 @@@@ if test "${WIN32}" != "yes"; then #ifdef HAVE_SYS_SOCKET_H # include #endif + #ifdef HAVE_NET_IF_H + # include + #endif #ifdef HAVE_NETINET_IN_H # include #endif @ 1.4 log @Changes 2.1.4: * Fix problem with special case route targets ('remote_host') The init_route() function will leave &netlist untouched for get_special_addr() routes ("remote_host" being one of them). netlist is on stack, contains random garbage, and netlist.len will not be 0 - thus, random stack data is copied from netlist.data[] until the route_list is full. @ text @d3 1 a3 1 --- configure.ac.orig 2010-11-04 19:29:02.000000000 +0000 d5 1 a5 1 @@@@ -362,14 +362,17 @@@@ if test "${WIN32}" != "yes"; then d9 2 a10 2 - net/if_tun.h net/tun/if_tun.h stropts.h sys/sockio.h dnl + net/if_tap.h net/if_tun.h net/tun/if_tun.h stropts.h sys/sockio.h dnl d13 1 a13 13 netdb.h sys/uio.h linux/if_tun.h linux/sockios.h dnl linux/types.h sys/poll.h sys/epoll.h err.h dnl ) AC_CHECK_HEADERS(net/if.h,,, - [#ifdef HAVE_SYS_SOCKET_H + [#ifdef HAVE_SYS_TYPES_H + # include + #endif + #ifdef HAVE_SYS_SOCKET_H # include #endif ]) @@@@ -391,6 +394,9 @@@@ if test "${WIN32}" != "yes"; then @ 1.3 log @Update to 2.1rc13. Changes include: 2008.10.07 -- Version 2.1_rc13 * Bundled OpenSSL 0.9.8i with Windows installer. * Management interface can now listen on a unix domain socket, for example: management /tmp/openvpn unix Also added management-client-user and management-client-group directives to control which processes are allowed to connect to the socket. * Copyright change to OpenVPN Technologies, Inc. 2008.09.23 -- Version 2.1_rc12 * Patched Makefile.am so that the new t_cltsrv-down.sh script becomes part of the tarball (Matthias Andree). * Fixed --lladdr bug introduced in 2.1-rc9 where input validation code was incorrectly expecting the lladdr parameter to be an IP address when it is actually a MAC address (HoverHell). 2008.09.14 -- Version 2.1_rc11 * Fixed a bug that can cause SSL/TLS negotiations in UDP mode to fail if UDP packets are dropped. 2008.09.10 -- Version 2.1_rc10 * Added "--server-bridge" (without parameters) to enable DHCP proxy mode: Configure server mode for ethernet bridging using a DHCP-proxy, where clients talk to the OpenVPN server-side DHCP server to receive their IP address allocation and DNS server addresses. * Added "--route-gateway dhcp", to enable the extraction of the gateway address from a DHCP negotiation with the OpenVPN server-side LAN. * Fixed minor issue with --redirect-gateway bypass-dhcp or bypass-dns on Windows. If the bypass IP address is 0.0.0.0 or 255.255.255.255, ignore it. * Warn when ethernet bridging that the IP address of the bridge adapter is probably not the same address that the LAN adapter was set to previously. * When running as a server, warn if the LAN network address is the all-popular 192.168.[0|1].x, since this condition commonly leads to subnet conflicts down the road. * Primarily on the client, check for subnet conflicts between the local LAN and the VPN subnet. * Added a 'netmask' parameter to get_default_gateway, to return the netmask of the adapter containing the default gateway. Only implemented on Windows so far. Other platforms will return 255.255.255.0. Currently the netmask information is only used to warn about subnet conflicts. * Minor fix to cryptoapi.c to not compile itself unless USE_CRYPTO and USE_SSL flags are enabled (Alon Bar-Lev). * Updated openvpn/t_cltsrv.sh (used by "make check") to conform to new --script-security rules. Also adds retrying if the addresses are in use (Matthias Andree). * Fixed build issue with ./configure --disable-socks --disable-http. * Fixed separate compile errors in options.c and ntlm.c that occur on strict C compilers (such as old versions of gcc) that require that C variable declarations occur at the start of a {} block, not in the middle. * Workaround bug in OpenSSL 0.9.6b ASN1_STRING_to_UTF8, which the new implementation of extract_x509_field_ssl depends on. * LZO compression buffer overflow errors will now invalidate the packet rather than trigger a fatal assertion. * Fixed minor compile issue in ntlm.c (mid-block declaration). * Added --allow-pull-fqdn option which allows client to pull DNS names from server (rather than only IP address) for --ifconfig, --route, and --route-gateway. OpenVPN versions 2.1_rc7 and earlier allowed DNS names for these options to be pulled and translated to IP addresses by default. Now --allow-pull-fqdn will be explicitly required on the client to enable DNS-name-to-IP-address translation of pulled options. * 2.1_rc8 and earlier did implicit shell expansion on script arguments since all scripts were called by system(). The security hardening changes made to 2.1_rc9 no longer use system(), but rather use the safer execve or CreateProcess system calls. The security hardening also introduced a backward incompatibility with 2.1_rc8 and earlier in that script parameters were no longer shell-expanded, so for example: client-connect "docc CLIENT-CONNECT" would fail to work because execve would try to execute a script called "docc CLIENT-CONNECT" instead of "docc" with "CLIENT-CONNECT" as the first argument. This patch fixes the issue, bringing the script argument semantics back to pre 2.1_rc9 behavior in order to preserve backward compatibility while still using execve or CreateProcess to execute the script/executable. * Modified ip_or_dns_addr_safe, which validates pulled DNS names, to more closely conform to RFC 3696: (1) DNS name length must not exceed 255 characters (2) DNS name characters must be limited to alphanumeric, dash ('-'), and dot ('.') * Fixed bug in intra-session TLS key rollover that was introduced with deferred authentication features in 2.1_rc8. 008.07.31 -- Version 2.1_rc9 * Security Fix -- affects non-Windows OpenVPN clients running OpenVPN 2.1-beta14 through 2.1-rc8 (OpenVPN 2.0.x clients are NOT vulnerable nor are any versions of the OpenVPN server vulnerable). An OpenVPN client connecting to a malicious or compromised server could potentially receive an "lladdr" or "iproute" configuration directive from the server which could cause arbitrary code execution on the client. A successful attack requires that (a) the client has agreed to allow the server to push configuration directives to it by including "pull" or the macro "client" in its configuration file, (b) the client succesfully authenticates the server, (c) the server is malicious or has been compromised and is under the control of the attacker, and (d) the client is running a non-Windows OS. Credit: David Wagner. * Miscellaneous defensive programming changes to multiple areas of the code. In particular, use of the system() call for calling executables such as ifconfig, route, and user-defined scripts has been completely revamped in favor of execve() on unix and CreateProcess() on Windows. * In Windows build, package a statically linked openssl.exe to work around observed instabilities in the dynamic build since the migration to OpenSSL 0.9.8h. 2008.06.11 -- Version 2.1_rc8 * Added client authentication and packet filtering capability to management interface. In addition, allow OpenVPN plugins to take advantage of deferred authentication and packet filtering capability. * Added support for client-side connection profiles. * Fixed unbounded memory growth bug in environmental variable code that could have caused long-running OpenVPN sessions with many TLS renegotiations to incrementally increase memory usage over time. * Windows release now packages openssl-0.9.8h. * Build system changes -- allow building on Windows using autoconf/automake scripts (Alon Bar-Lev). * Changes to Windows build system to make it easier to do partial builds, with a reduced set of prerequisites, where only a subset of OpenVPN installer components are built. See ./domake-win comments. * Cleanup IP address for persistence interfaces for tap and also using ifconfig, gentoo#209055 (Alon Bar-Lev). * Fall back to old version of extract_x509_field for OpenSSL 0.9.6. * Clarified tcp-queue-limit man page entry (Matti Linnanvuori). * Added new OpenVPN icon and installer graphic. * Minor pkitool changes. * Added --pkcs11-id-management option, which will cause OpenVPN to query the management interface via the new NEED-STR asynchronous notification query to get additional PKCS#11 options (Alon Bar-Lev). * Added NEED-STR management interface asynchronous query and "needstr" management interface command to respond to the query (Alon Bar-Lev). * Added Dragonfly BSD support (Francis-Gudin). * Quote device names before passing to up/down script (Josh Cepek). * Bracketed struct openvpn_pktinfo with #pragma pack(1) to prevent structure padding from causing an incorrect length to be returned by sizeof (struct openvpn_pktinfo) on 64-bit platforms. * On systems that support res_init, always call it before calling gethostbyname to ensure that resolver configuration state is current. * Added NTLMv2 proxy support (Miroslav Zajic). * Fixed an issue in extract_x509_field_ssl where the extraction would fail on the first field of the subject name, such as the common name in: /CN=foo/emailAddress= foo@@bar.comThis e-mail address is being protected from spambots. You need JavaScript enabled to view it * Made "Linux ip addr del failed" error nonfatal. * Amplified --client-cert-not-required warning. * Added #pragma pack to proto.h. @ text @d2 4 a5 3 --- configure.ac.orig 2008-10-06 08:22:21.000000000 +0100 +++ configure.ac 2008-10-09 10:03:55.000000000 +0100 @@@@ -343,14 +343,17 @@@@ d25 1 a25 1 @@@@ -372,6 +375,9 @@@@ @ 1.2 log @Update net/openvpn to 2.1rc4. Changes from version 2.1rc2 include: * Fixed 64-bit portability bug in time_string function (Thomas Habets). * Clean up configure on FreeBSD for recent autotool versions that require that all .h files have to be compiled. Also, FreeBSD install does not support GNU long options which the Makefile in easy-rsa/2.0 uses (not checked the others as we don't install those on Gentoo) (Roy Marples). @ text @d2 3 a4 4 --- configure.ac.orig 2007-04-25 17:38:46.000000000 -0400 +++ configure.ac @@@@ -285,14 +285,17 @@@@ AC_CHECK_HEADERS(sys/time.h sys/socket.h d8 2 a9 2 - net/if_tun.h stropts.h sys/sockio.h dnl + net/if_tap.h net/if_tun.h stropts.h sys/sockio.h dnl d14 2 a15 2 ) AC_CHECK_HEADERS(net/if.h,,, d24 1 a24 1 @@@@ -314,6 +317,9 @@@@ AC_CHECK_HEADERS(netinet/if_ether.h,,, @ 1.1 log @Add support for NetBSD's cloning tap device to support "device tap" configurations. Changes supplied in PR pkg/32929 by Alan Barrett. Bump PKGREVISION to 1. @ text @d3 1 a3 1 --- configure.ac.orig 2006-04-05 04:02:59.000000000 -0400 d5 1 a5 1 @@@@ -266,7 +266,7 @@@@ AC_CHECK_HEADERS(sys/time.h sys/socket.h d9 4 a12 4 - net/if_tun.h net/if.h stropts.h sys/sockio.h dnl + net/if_tap.h net/if_tun.h net/if.h stropts.h sys/sockio.h dnl netinet/in.h netinet/in_systm.h netinet/ip.h dnl netinet/if_ether.h netinet/tcp.h resolv.h arpa/inet.h dnl d14 21 @ 1.1.2.1 log @file patch-ae was added on branch pkgsrc-2006Q1 on 2006-04-11 20:09:52 +0000 @ text @d1 13 @ 1.1.2.2 log @Pullup ticket 1364 - requested by jlam NetBSD tap(4) support for openvpn Revisions pulled up: - pkgsrc/net/openvpn/Makefile 1.17 - pkgsrc/net/openvpn/distinfo 1.8 - pkgsrc/net/openvpn/patches/patch-ab 1.4 - pkgsrc/net/openvpn/patches/patch-ac 1.3 - pkgsrc/net/openvpn/patches/patch-ad 1.1 - pkgsrc/net/openvpn/patches/patch-ae 1.1 - pkgsrc/net/openvpn/patches/patch-af 1.1 Module Name: pkgsrc Committed By: jlam Date: Tue Apr 11 20:09:52 UTC 2006 Modified Files: pkgsrc/net/openvpn: Makefile distinfo Added Files: pkgsrc/net/openvpn/patches: patch-ab patch-ac patch-ad patch-ae patch-af Log Message: Add support for NetBSD's cloning tap device to support "device tap" configurations. Changes supplied in PR pkg/32929 by Alan Barrett. Bump PKGREVISION to 1. @ text @a0 13 $NetBSD: patch-ae,v 1.1.2.1 2006/04/13 16:08:25 salo Exp $ --- configure.ac.orig 2006-04-05 04:02:59.000000000 -0400 +++ configure.ac @@@@ -266,7 +266,7 @@@@ AC_CHECK_HEADERS(sys/time.h sys/socket.h sys/mman.h fcntl.h sys/file.h stdlib.h stdint.h dnl stdarg.h unistd.h signal.h stdio.h string.h dnl strings.h ctype.h errno.h syslog.h pwd.h grp.h dnl - net/if_tun.h net/if.h stropts.h sys/sockio.h dnl + net/if_tap.h net/if_tun.h net/if.h stropts.h sys/sockio.h dnl netinet/in.h netinet/in_systm.h netinet/ip.h dnl netinet/if_ether.h netinet/tcp.h resolv.h arpa/inet.h dnl netdb.h sys/uio.h linux/if_tun.h linux/sockios.h dnl @