2 Copyright (C) 2002-2014 OpenVPN Technologies, Inc. <sales@openvpn.net>
4 2014.10.24 -- Version 2.3.5
6 Fix some typos in the man page.
7 Do not upcase x509-username-field for mixed-case arguments.
10 Fix server routes not working in topology subnet with --server [v3]
13 Improve error reporting on file access to --client-config-dir and --ccd-exclusive
14 Don't let openvpn_popen() keep zombies around
15 Add systemd unit file for OpenVPN
16 systemd: Use systemd functions to consider systemd availability
19 Drop incoming fe80:: packets silently now.
20 Fix t_lpback.sh platform-dependent failures
21 Call init script helpers with explicit path (./)
24 refine assertion to allow other modes than CBC
27 ocsp_check - signature verification and cert staus results are separate
28 ocsp_check - double check if ocsp didn't report any errors in execution
31 Fix socket-flag/TCP_NODELAY on Mac OS X
34 Fixed several instances of declarations after statements.
35 In socket.c, fixed issue where uninitialized value (err) is being passed to to gai_strerror.
36 Explicitly cast the third parameter of setsockopt to const void * to avoid warning.
37 MSVC 2008 doesn't support dimensioning an array with a const var nor using %z as a printf format specifier.
38 Define PATH_SEPARATOR for MSVC builds.
39 Fixed some compile issues with show_library_versions()
42 Remove quadratic complexity from openvpn_base64_decode()
45 Add configure check for the path to systemd-ask-password
47 Philipp Hagemeister (2):
48 Add topology in sample server configuration file
49 Implement on-link route adding for iproute2
52 Ensure that client-connect files are always deleted
55 Remove function without effect (cipher_ok() always returned true).
56 Remove unneeded wrapper functions in crypto_openssl.c
57 Fix bug that incorrectly refuses oid representation eku's in polar builds
58 Update README.polarssl
59 Rename ALLOW_NON_CBC_CIPHERS to ENABLE_OFB_CFB_MODE, and add to configure.
60 Add proper check for crypto modes (CBC or OFB/CFB)
61 Improve --show-ciphers to show if a cipher can be used in static key mode
62 Extend t_lpback tests to test all ciphers reported by --show-ciphers
63 Don't exit daemon if opening or parsing the CRL fails.
64 Fix typo in cipher_kt_mode_{cbc, ofb_cfb}() doxygen.
65 Fix regression with password protected private keys (polarssl)
66 ssl_polarssl.c: fix includes and make casts explicit
67 Remove unused variables from ssl_verify_openssl.c extract_x509_extension()
70 Fix "code=995" bug with windows NDIS6 tap driver.
73 2014.04.30 -- Version 2.3.4
75 Fix man page and OSCP script: tls_serial_{n} is decimal
78 Fix is_ipv6 in case of tap interface.
81 IPv6 address/route delete fix for Win8
82 Add SSL library version reporting.
83 Minor t_client.sh cleanups
84 Repair --multihome on FreeBSD for IPv4 sockets.
85 Rewrite manpage section about --multihome
86 More IPv6-related updates to the openvpn man page.
87 Conditionalize calls to print_default_gateway on !ENABLE_SMALL
90 Use native strtoull() with MSVC 2013.
91 When tls-version-min is unspecified, revert to original versioning approach.
94 Change signedness of hash in x509_get_sha1_hash(), fixes compiler warning.
95 Fix OCSP_check.sh to also use decimal for stdout verification.
96 Fix build system to accept non-system crypto library locations for plugins.
97 Make serial env exporting consistent amongst OpenSSL and PolarSSL builds.
100 Fix SOCKSv5 method selection
103 Fix typo in sample build script to use LDFLAGS
106 2014.04.08 -- Version 2.3.3
108 pkcs11: use generic evp key instead of rsa
111 Add support of utun devices under Mac OS X
112 Add support to ignore specific options.
113 Add a note what setenv opt does for OpenVPN < 2.3.3
114 Add reporting of UI version to basic push-peer-info set.
115 Fix compile error in ssl_openssl introduced by polar external-management patch
116 Fix assertion when SIGUSR1 is received while getaddrinfo is successful
117 Add warning for using connection block variables after connection blocks
118 Introduce safety check for http proxy options
120 David Sommerseth (5):
121 man page: Update man page about the tls_digest_{n} environment variable
122 Remove the --disable-eurephia configure option
123 plugin: Extend the plug-in v3 API to identify the SSL implementation used
125 Fix file checks when --chroot is being used
128 Document authfile for socks server
131 Fix IPv6 examples in t_client.rc-sample
132 Fix slow memory drain on each client renegotiation.
133 t_client.sh: ignore fields from "ip -6 route show" output that distort results.
134 Make code and documentation for --remote-random-hostname consistent.
135 Reduce IV_OPENVPN_GUI_VERSION= to IV_GUI_VER=
136 Document issue with --chroot, /dev/urandom and PolarSSL.
137 Rename 'struct route' to 'struct route_ipv4'
138 Replace copied structure elements with including <net/route.h>
139 Workaround missing SSL_OP_NO_TICKET in earlier OpenSSL versions
141 Heikki Hannikainen (1):
142 Always load intermediate certificates from a PKCS#12 file
145 Support non-ASCII TAP adapter names on Windows
146 Support non-ASCII characters in Windows tmp path
149 TLS version negotiation
150 Added "setenv opt" directive prefix.
151 Set SSL_OP_NO_TICKET flag in SSL context for OpenSSL builds, to disable TLS stateless session resumption.
154 Fix spurious ignoring of pushed config options (trac#349).
156 Joachim Schipper (3):
157 Refactor tls_ctx_use_external_private_key()
158 --management-external-key for PolarSSL
159 external_pkcs1_sign: Support non-RSA_SIG_RAW hash_ids
162 Correct error text when no Windows TAP device is present
163 Require a 1.2.x PolarSSL version
166 tls_ctx_load_ca: Improve certificate error messages
169 Remove duplicate cipher entries from TLS translation table.
172 Fix configure interaction with static OpenSSL libraries
175 Do not pass struct tls_session* as void* in key_state_ssl_init().
176 Require polarssl >= 1.2.10 for polarssl-builds, which fixes CVE-2013-5915.
177 Use RSA_generate_key_ex() instead of deprecated, RSA_generate_key()
178 Also update TLSv1_method() calls in support code to SSLv23_method() calls.
179 Update TLSv1 error messages to SSLv23 to reflect changes from commit 4b67f98
180 If --tls-cipher is supplied, make --show-tls parse the list.
181 Add openssl-specific common cipher list names to ssl.c.
184 Add support for client-cert-not-required for PolarSSL.
187 Fix "." in description of utun.
190 2013.05.31 -- Version 2.3.2
192 Only print script warnings when a script is used. Remove stray mention of script-security system.
193 Move settings of user script into set_user_script function
194 Move checking of script file access into set_user_script
197 Provide more accurate warning message
200 Fix NULL-pointer crash in route_list_add_vpn_gateway().
201 Fix problem with UDP tunneling due to mishandled pktinfo structures.
204 Always push basic set of peer info values to server.
206 Jan Just Keijser (1):
207 make 'explicit-exit-notify' pullable again
210 Fix proto tcp6 for server & non-P2MP modes
211 Fix Windows script execution when called from script hooks
214 Fixed tls-cipher translation bug in openssl-build
215 Fixed usage of stale define USE_SSL to ENABLE_SSL
218 Fix segfault when enabling pf plug-ins
222 2013.03.29 -- Version 2.3.1
224 Remove dead code path and putenv functionality
225 Remove unused function xor
226 Move static prototype definition from header into c file
227 Remove unused function no_tap_ifconfig
230 fix build with automake 1.13(.1)
232 Christian Niessner (1):
233 Fix corner case in NTLM authentication (trac #172)
236 Update README.IPv6 to match what is in 2.3.0
237 Repair "tcp server queue overflow" brokenness, more <stdbool.h> fallout.
238 Permit pool size of /64.../112 for ifconfig-ipv6-pool
239 Add MIN() compatibility macro
240 Fix directly connected routes for "topology subnet" on Solaris.
243 close more file descriptors on exec
244 Ignore UTF-8 byte order mark
245 reintroduce --no-name-remapping option
246 make --tls-remote compatible with pre 2.3 configs
247 add new option for X.509 name verification
249 Jan Just Keijser (1):
250 man page patch for missing options
253 Fix parameter listing in non-debug builds at verb 4
254 (updated) [PATCH] Warn when using verb levels >=7 without debug
257 Enable TCP_NODELAY configuration on FreeBSD.
259 Samuli Seppänen (4):
260 Removed ChangeLog.IPv6
261 Added cross-compilation information INSTALL-win32.txt
263 Cleaned up and updated INSTALL
267 Improve PolarSSL key_state_read_{cipher, plain}text messages
268 Improve verify_callback messages
269 Config compatibility patch. Added translate_cipher_name.
270 Switch to IANA names for TLS ciphers.
271 Fixed autoconf script to properly detect missing pkcs11 with polarssl.
272 Use constant time memcmp when comparing HMACs in openvpn_decrypt.
275 2013.01.07 -- Version 2.3.0
277 Fix parameter type for IP_TOS setsockopt on non-Linux systems.
278 Fix client crash on double PUSH_REPLY.
280 2012.12.17 -- Version 2.3_rc2
282 Fix --show-pkcs11-ids (Bug #239)
285 Error message if max-routes used incorrectly
286 Properly require --key even if defined(MANAGMENT_EXTERNAL_KEY)
287 Remove dnsflags_to_socktype, it is not used anywhere
288 Fix the proto is used inconsistently warning
290 David Sommerseth (3):
291 Fix double-free issue in pf_destroy_context()
292 The get_default_gateway() function uses warn() instead of msg()
293 Avoid recursion in virtual_output_callback_func()
296 Implement --mssfix handling for IPv6 packets.
297 Fix option inconsistency warnings about "proto" and "tun-ipv6"
299 Joachim Schipper (2):
300 doc/management-notes.txt: fix typo
301 Fix typo in ./configure message
303 2012.10.31 -- Version 2.3_rc1
305 Fixed a bug where PolarSSL gave an error when using an inline file tag.
308 Document man agent-external-key
309 Options parsing demands unnecessary configuration if PKCS11 is used
311 David Sommerseth (2):
312 Make git ignore some more files
313 Remove the support for using system() when executing external programs or scripts
316 Fix display of plugin hook types
317 Support UTF-8 --client-config-dir
320 Fix v3 plugins to support returning values back to OpenVPN.
322 2012.09.12 -- Version 2.3_beta1
324 Fixes error: --key fails with EXTERNAL_PRIVATE_KEY: No such file or directory if --management-external-key is used
325 Merge almost identical create_socket_tcp and create_socket_tcp6
326 Document the inlining of files in openvpn and document key-direction
327 Merge getaddr_multi and getaddr6 into one function
328 Document --management-client and --management-signal a bit better
329 Document that keep alive will double the second value in server mode and give a short explanation why the value is chosen.
330 Add checks for external-key-managements
332 David Sommerseth (1):
333 Fix reconnect issues when --push and UDP is used on the server
336 Reduce --version string detail about IPv6 to just "[IPv6]".
337 Put actual OpenVPN command line on top of corresponding log file.
338 Keep pre-existing tun/tap devices around on *BSD
339 make "ipv6 ifconfig" on linux compatible with busybox ifconfig
342 fix regression with --http-proxy[-*] options
343 add x_msg_va() log function
344 add API for plug-ins to write to openvpn log
345 remove stale _openssl_get_subject() prototype
346 remove unused flag SSLF_NO_NAME_REMAPPING
347 Add --compat-names option
349 2012.07.20 -- Version 2.3_alpha3
351 Fix compiling with --disable-management
354 Repair "tap server" mode brokenness caused by <stdbool.h> fallout
357 make non-blocking connect work on Windows
358 don't treat socket related errors special anymore
359 remove unused show_connection_list debug function
360 add option --management-query-proxy
362 2012.06.29 -- Version 2.3_alpha2
363 Adriaan de Jong (11):
364 Fixed off-by-one in serial length calculation
365 Migrated x509_get_subject to use of the garbage collector
366 Migrated x509_get_serial to use the garbage collector
367 Migrated x509_get_sha1_hash to use the garbage collector
368 Ensure sys/un.h autoconf detection includes sys/socket.h
369 Added support for new PolarSSL 1.1 RNG
370 Added a configuration option to enable prediction resistance in the PolarSSL random number generator.
371 Use POLARSSL_CFLAGS instead of POLARSSL_CRYPTO_CFLAGS in configure.ac
372 Removed support for PolarSSL < 1.1
373 Updated README.polarssl with build system changes.
374 Removed stray "Fox-IT hardening" string.
377 build: version should not contain '-'
378 package: rpm: strip should be handled by package management
379 cleanup: options.c: remove redundant include
380 cleanup: remove C++ warnings
381 cleanup: win32.c: wrong printf format
382 cleanup: remove redundant ';'
383 cleanup: crypto_openssl.c: remove support for pre-openssl-0.9.6
384 cleanup: tun.c: fix incorrect option in message (ip-win32)
385 cleanup: memcmp.c: remove unused source
386 fixup: init.c: add missing conditional for ENABLE_CLIENT_CR
387 build: correct place to alter WINVER is at build system
389 build: handle printf style format in mingw
390 build: rename plugin directory to plugins
391 build: plugins: properly use CC, CFLAGS and LDFLAGS
392 build: we need the sample.ovpn in future
396 cleanup: rename tap-windows function from win32 to win
397 build: remove windows specific build system
398 build: split acinclude.m4 into m4/*
399 build: m4/ax_varargs.m4: cleanup
400 build: m4/ax_emptyarray.m4: cleanup
401 build: m4/ax_socklen_t.m4: cleanup
402 build: autotools: first pass of trivial autotools changes
403 build: autoconf: remove OPENVPN_ADD_LIBS useless macro
404 build: remove awk and non-standard autoconf output processing
405 build: standard directory layout
406 build: add libtool + windows resources for executables
407 build: autoconf: commands as environment
409 build: properly detect and use socket libs
410 build: autoconf: minor cleanups
411 build: proper selinux detection and usage
412 build: distribute pkg.m4
413 build: proper pkcs11-helper detection and usage
414 build: properly process lzo-stub
415 build: proper lzo detection and usage
416 build: proper crypto detection and usage
417 build: autoconf: update defaults for options
418 build: win-msvc: msbuild format
419 build: move out config.h include from syshead
420 build: split out compat
421 build: move gettimeofday() emulation to compat
422 build: move daemon() emulation into compat
423 build: move inet_ntop(), inet_pton() emulation into compat
424 cleanup: move console related function into its own module
425 build: move wrappers into platform module
426 build: windows: install version.sh to allow installer read version
427 build: distribute samples in windows
428 build: use tap-windows.h as external dependency
429 build: ax_varargs.m4: fixups
430 build: autoconf: misc sockets fixups
431 build: enable lzo by default
432 build: windows: set vendor to openvpn project + cleanups
433 build: assume dlfcn is available on all supported platforms
434 build: openbsd: detect netinet/ip.h correctly
435 build: tap: search for tap header
436 build: msvc: upgrade to Visual Studio 2010 + fixups
437 Enable pedantic in windows compilation
438 cleanup: flags should not be bool
439 cleanup: avoid using ~0 - generic
440 cleanup: avoid using ~0 - ipv6
441 cleanup: avoid using ~0 - netmask
442 cleanup: avoid using ~0 - windows
444 build: fix some statement left from conversion
445 build: properly detect netinet/ip.h structs
446 build: properly detect TUNSETPERSIST
447 cleanup: plugin: support C++ plugin
448 cleanup: remove C++ comments
449 cleanup: add .gitattributes to control eol style explicitly
450 crash: packet_id_debug_print: sl may be null
451 build: use stdbool.h if available
452 build: fix typo in --enable-save-password
453 build: windows: convert resources to UTF-8
454 build: check minimum polarssl version
455 cleanup: update .gitignore
456 cleanup: spec: make space/tab consistent
457 build: spec: we support openssl >= 0.9.7
458 build: insall README* document using build system
459 build: detect sys/wait.h required for *bsd
460 build: add git revision to --version output if build from git repository
461 build: cleanup: yet another forgotten brackets
462 build: update INSTALL to recent changes
463 build: support platforms that does not need explicit tun headers
464 build: do not support <polarssl-1.1.0
465 build: add --with-special-build to provide special build string
466 cleanup: pkcs11.c: resolve wanings
467 build: integrate plugins build into core build
468 build: plugins: set defaults based on platform
469 cleanup: windows: convert argv (UCS-2 to UTF-8) at earliest
470 build: msvc: chdir with change drive to script location
473 Add the query to the error message.
474 Explain that route-nopull also causes the client to ignore dhcp options.
475 Add the name of the context where option is not allowed to the error message.
476 Only use tmpdir if tmp_dir is really used.
477 Completely remove ancient IANA port warning.
478 Remove ENABLE_INLINE_FILES conditionals
479 Remove ENABLE_CONNECTIONS ifdefs
481 David Sommerseth (5):
482 Clean-up: Presume that Linux is always IPv6 capable at build time
483 Simplify check_cmd_access() function
484 Change version to indicate the master branch is not a version
485 Some filesystems don't like ':', which is a path 'make dist' would use
486 Remove two unused functions
488 Frank de Brabander (1):
489 Fix reported compile issues on OSX 10.6.8
492 repair t_client.sh test after build system revolution
493 t_client.sh iproute2 script fixes
494 t_client.sh - fix for iproute2, print summary line
495 Implement search for "first free" tun/tap device on Solaris
496 cleanup and redefine metric handling for IPv6 routes
497 remove "*option" element in "struct route_ipv6"
498 Remove warning about explicit support for IPv6 support not provided MacOS X
499 Add missing pieces to IPv6 route gateway handling.
500 Update TODO.IPv6 list
501 Remove #include "config.h" from ssl_polarssl.h
504 remove wrapper code for Windows CryptoAPI function
505 fix warnings in event.c when building for win32-64
506 remove the --auto-proxy option from openvpn
509 Remove calls to OpenSSL when building with --disable-ssl
511 Jonathan K. Bullard (2):
512 Fix file access checks on commands
513 Clarified the docs and help screen about what a 'cmd' is
515 Samuli Seppänen (1):
516 Added notes about upgrading from 2.3-alpha1 and earlier to INSTALL-win32.txt
518 2012.02.21 -- Version 2.3-alpha1
519 Adriaan de Jong (127):
520 Added Doxygen doxyfile
521 Changed configure to accept --with-ssl-type=openssl
522 Refactored to rand_bytes for OpenSSL-independency
523 Refactored OpenSSL-specific constants
524 Refactored maximum cipher and hmac length constants
525 Refactored show_available_* functions
526 Refactored SSL_clear_error()
527 Refactored crypto initialisation functions
528 Refactored DES key manipulation functions
529 Refactored NTLM DES key generation
530 Refactored message digest type functions
531 Refactored message digest functions
532 Refactored HMAC functions
533 Refactored cipher key types
534 Refactored cipher functions
536 Refactored: Moved crypto.h inline functions to end of file
537 Removed stale OpenSSL defines from crypto.h
538 Added a check for Openssl or PolarSSL defines
539 Refactored: Added stubs for new files
540 Refactored SSL initialisation functions
541 Refactored TLS_PRF to new hmac and md primitives
542 Refactored tls_show_available_ciphers
543 Refactored get_highest_preference_tls_cipher
544 Refactored root SSL context initialisation
545 Refactored new external key code
546 Refactored DH paramater loading
547 Refactored root TLS option settings
548 Refactored PKCS#12 key loading
549 Refactored PKCS#11 loading
550 Refactored windows cert loading
551 Refactored load certificate functions
552 Refactored private key loading code
553 Refactored external key loading from management
554 Refactored CA and extra certs code
555 Refactored cipher restriction code
556 Refactored tls_options, key_state, and key_source data structures
557 Refactored initalisation of key_states
558 Refactored key_state free code
559 Refactored print_details
560 Refactored key_state read code (including bio_read())
561 Refactored key_state write functions
562 Refactored: Moved BIO debug functions to OpenSSL backend
563 Refactored: removed ks and ks_lame macro for clarity
564 Refactored: moved write_empty_string function back
565 Refactored Doxygen for tls_multi functions
566 Migrated data structures needed by verification functions to ssl_common.h
567 Refactored client_config_dir_exclusive function
568 Refactored certificate hash lock checks
569 Refactored common name locking functions
570 Refactored username and password authentication code
571 Add some extra comments
572 Refactored: split verify_callback into two parts
573 Added function to extract and verify the subject from a certificate
574 Added function to verify and extract the username
575 Refactored: removed global x509_username_field
576 Refactored: separated environment setup during verification
577 Refactored: Netscape certificate type verification
578 Refactored key usage verification code
579 Refactored EKU verification
580 Refactored tls-remote checking
581 Refactored tls-verify-plugin code
582 Refactored tls-verify script code
583 Refactored CRL checks
584 Minor cleanup in verify_cert:
585 Refactored: Moved verify_cert to ssl_verify
587 Refactored: made M_SSL dependent on USE_OPENSSL
588 Refactored: renamed X509 functions from verify_*
589 Separated OpenSSL-specific parts of the PKCS#11 driver
590 Modified base64 code in preparation for PolarSSL merge
591 Final cleanup before PolarSSL addition:
592 Refactored X509 track feature to be contained within the openssl backend
593 Added PolarSSL support:
594 Fixed a missing include in ssl_backend.h
595 Fixed a bug in the hash generation in ssl_verify_openssl.c
596 Added SHA_DIGEST_SIZE definition
597 Changed PolarSSL crypto backend to support v0.99-pre5
598 Updated ssl_polarssl.c to work with 0.99-pre5
599 Fixed a compilation warning for size_t key sizes
600 Added a warning that the PolarSSL library does not support pkcs12 files.
601 Added warning that --capath is not available with PolarSSL
602 Disable CryptoAPI when not using OpenSSL, and document that fact.
603 Removed support for management external keys in PolarSSL
604 Removed stray X509_free from ssl.c
605 Refactored (and disabled for PolarSSL) support for writing external cert files in scripts
606 Added an extra define to allow building without PKCS#11
607 Added SSL library to title string
608 Disabled X.509 track and username selection for PolarSSL
609 Hardening: periodically reset the PRNG's nonce value
610 Fixes for the plugin system:
611 Further improvements to plugin support:
612 Fixed an unintentional change in the options calculated key size.
613 Moved print messages back to generic crypto.c from cipher backends
614 Moved HMAC prints back to main crypto module
615 Added back checks for ks->authenticated in verify_user_pass
616 Moved gc_new and gc_free to begin end of function
617 Fixed a bug in the return value of ssl_verify when pre_verify failed
618 Unified verification function return values:
619 Removed a stray Fox-IT tag
620 Fixed a typo: print the subject instead of the serial for verification errors
621 Made SSL_CIPHER const in print_details, to fix warning
622 Moved to PolarSSL 1.0.0:
623 Added missing #ifdef to allow --disable-managent to work again
624 Fixed disabling crypto and SSL
625 Got rid of a few magic numbers in ntlm.c
626 Removed obsolete des_cblock and des_keyschedule
627 Further removal of des_old.h based calls
628 Fixed missing comma in plugin.h
629 Moved prng_uninit out of crypto_uninit_lib
630 Moved CryptoAPI header include to the ssl_openssl.c
631 Reordered functions to ensure warning-free Windows build
632 Added options to switch between OpenSSL and PolarSSL and PKCS11...
633 Moved from strsep to strtok, for Windows compatibility
634 Minor cleanup to enable warning-free Windows build:
635 Fixed a typo when initialising cryptoapi certs
636 Minor code cleanup: cleaned up error handling in verify_cert.
637 Moved out of memory prototype to error.h, as the definition is in error.c
638 Removed support for calling gc_malloc with a NULL gc_arena struct
640 (The follwing patches from Adriaan was mistakenly merged with
641 the wrong commit author in the git tree)
642 Doxygen: Added data channel crypto docs
643 Added control channel crypto docs
644 Added compression docs
645 Added reliability layer documentation
646 Added memory management documentation
647 Added data channel fragmentation docs
648 Added main/control docs
649 Moved doxygen-specific files to a separate directory
652 autoconf fixes for building on OSX
654 David Sommerseth (50):
655 Provide 'dev_type' environment variable to plug-ins and script hooks
656 Define the new openvpn_plugin_{open,func}_v3() API
657 Implement the core v3 plug-in function calls.
658 Extend the v3 plug-in API to send over X509 certificates
659 Added a simple plug-in demonstrating the v3 plug-in API.
660 Separate the general plug-in version constant and v3 plug-in structs version
661 Use a version-less version identifier on the master branch
662 Fix the --client-cert-not-required feature
663 Change the default --tmp-dir path to a more suitable path
664 Improve the mysprintf() issue in openvpnserv.c
665 Add a simple comment regarding openvpn_snprintf() is duplicated
666 Merge branch 'feat_ipv6_transport'
667 Merge branch 'feat_ipv6_payload'
668 Merge branch 'svn-branch-2.1' into merge
669 Solved hidden merge conflicts between master and svn-branch-2.1
670 Fix const declarations in plug-in v3 structs
671 Merge remote-tracking branch 'cron2/feat_ipv6_payload_2.3'
672 Don't define ENABLE_PUSH_PEER_INFO if SSL is not available
673 Fix compiling issues with pkcs11 when --disable-management is configured
674 Remove support for Linux 2.2 configuration fallback
675 Revert "Add new openssl.cnf to easy-rsa/Windows"
676 Merge remote branch SVN 2.1 into the git tree
677 Merge branch 'svn-merger'
678 Fix Microsoft Visual Studio incompatibility in plugin.c
679 Fixed compile issues on FreeBSD and Solaris
680 Fix PolarSSL and --pkcs12 option issues
681 Fix FreeBSD/OpenBSD/NetBSD compiler warnings in get_default_gateway()
682 Make '--win-sys env' default
683 Do some file/directory tests before really starting openvpn
684 Fix bug after removing Linux 2.2 support
685 Don't look for 'stdin' file when using --auth-user-pass
686 Fix compiling with --disable-crypto and/or --disable-ssl
687 Fix a couple of issues in openvpn_execve()
688 Move away from openvpn_basename() over to platform provided basename()
689 Enable access() when building in Visual Studio
690 New Windows build fixes
691 Fix compilation errors on Linux platforms without SO_MARK
692 autotools ./configure don't like compat.h
693 Fix pool logging when IPv6 is not enabled
694 Don't check for file presence on inline files
695 Add --route-pre-down/OPENVPN_PLUGIN_ROUTE_PREDOWN script/plug-in hook
696 Enhance the error handling in _openssl_get_subject()
697 Fix assert() situations where gc_malloc() is called without a gc_arena object
698 Fix compile issues when plug-ins are disabled.
699 Remove --show-gateway if debug info is not enabled (--disable-debug)
700 Fix compile issues with status.c
701 Connection entry {tun,link}_mtu_defined not set correctly
702 Makefile.am referenced a now non-existing config-win32.h
703 Makefile.am was missing ssl_common.h
704 Revamp check_file_access() checks in stdin scenarios
707 New feauture: Add --stale-routes-check
709 Frank de Brabander (1):
710 Fixed wrong return type of cipher_kt_mode
713 Add support to forward console query to systemd
716 Add more detailed explanation regarding the function of "--rdns-internal"
717 Enable IPv6 Payload in OpenVPN p2mp tun server mode. 20100104-1 release.
718 remove NOTES file from commit - private scribbling
719 NetBSD fixes - on 4.0 and up, use multi-af mode.
720 new feature: "ifconfig-ipv6-push" (from ccd/ config)
721 add some TODOs to TODO.IPv6
722 undo accidential duplication of existing "--iroute" line in the help text
723 basic documentation of IPv6 related options and their syntax
724 Enable IPv6 Payload in OpenVPN p2mp tun server mode.
725 remove NOTES file from commit - private scribbling
726 env_block(): if PATH is not set, add standard PATH setting to env
727 add IPv6 route add / route delete code for windows (using "netsh")
728 - Win32 IPv6 ifconfig support, using "netsh" calls
729 drop "book ipv6" from open_tun() and tuncfg() prototypes
730 document recent changes and open TODOs, adapt --version info, tag release
731 Win32: set next-hop for IPv6 routes according to TUN/TAP mode
732 when deleting a route on win32, also add gateway address
733 WIN32: if IPv6 requested in TUN mode, check if TUN/TAP driver < 9.7
734 revert unconditionally-enabling of setenv_es() logging
735 implement IPv6 ifconfig + route setup/deletion on OpenBSD
736 full "VPN client connect" test framework for OpenVPN t_client.rc-sample
737 renamed t_client.sh to t_client.sh.in
738 2.2-beta3 has a signed TAP driver with the IPv6 code - test for 9.8
739 correct URL for "more information about IPv6 patch is *here*"
740 bugfix for linux/iproute2: IPv6 ifconfig code block was not called for "dev tun"+"topology subnet"
741 bump IPv6 version number (openvpn --version) to 20100922-1
742 Implement "ipv6 ifconfig" for TAP interfaces on Solaris interfaces
743 rebased to 2.2RC2 (beta 2.2 branch)
744 Windows IPv6 cleanup - properly remove IPv6 routes and interface config
745 For all accesses to "struct route_list * rl", check first that rl is non-NULL
746 Replace 32-bit-based add_in6_addr() implementation by an 8-bit based one
747 Platform cleanup for NetBSD
748 Move block for "stale-routes-check" config inside #ifdef P2MP_SERVER block
749 add missing break between "case IPv4" and "case IPv6"
750 bump tap driver version from 9.8 to 9.9
751 log error message and exit for "win32, tun mode, tap driver version 9.8"
752 work around inet_ntop/inet_pton problems for MSVC builds on WinXP
753 Fix build-up of duplicate IPv6 routes on reconnect.
754 Fix list-overrun checks in copy_route_[ipv6_]option_list()
755 add "print test titles" and "use sudo" functionality to t_client.rc
756 Platform cleanup for FreeBSD
757 Implement IPv6 interface config with non-/64 prefix lengths.
758 Fix RUN_SUDO functionality for t_client.sh
759 Document IPv6-related environment variables.
760 Platform cleanup for OpenBSD
763 Avoid re-defining uint32_t when using mingw compiler
765 Gustavo Zacarias (1):
766 Fix compile issues when using --enable-small and --disable-ssl/--disable-crypto
769 add .gitignore to official repository
770 remove function is_proto_tcp()
771 remove legacy code to query IE proxy information
772 lowercase include header name in syshead.h
773 define IN6_ARE_ADDR_EQUAL macro for WIN32
774 add --mark option to set SO_MARK sockopt
775 Windows UTF-8 input/output
776 UTF-8 X.509 distinguished names
777 set Windows environment variables as UCS-2
778 handle Windows unicode paths
779 replace check for TARGET_WIN32 with WIN32
780 do not use mode_t on Windows
781 use the underscore version of stat on Windows
782 make MSVC link against shell32 as well
783 move variable declaration to top of function
784 define access mode flag X_OK as 0 on Windows
787 The code blocks enabled by ENABLE_CLIENT_CR depends on management
790 Added "management-external-key" option.
791 Minor addition of logging info before and after execution of Windows net commands.
793 Added --x509-track option.
794 * added --management-up-down option to allow management interface to be notified of tunnel up/down events.
795 Fixed minor compile issue triggered on builds where MANAGEMENT_DEF_AUTH is not enabled.
796 Implemented get_default_gateway_mac_addr for Mac OS X
798 Properly handle certificate serial numbers > 32 bits.
799 Added "client-nat" option for stateless, one-to-one NAT on the client side.
800 Renamed branch to reflect that it is no longer beta.
801 env_filter_match now includes the serial number of all certs
802 Fixed issue where a client might receive multiple push replies from a server
803 Fixed bug introduced in r7031 that might cause this error message:
804 Extended "client-kill" management interface command (server-side)
805 Client will now try to reconnect if no push reply received within handshake-window seconds.
807 Fixed compiling issues when using --disable-crypto
808 Added "management-external-key" option.
810 win/sign.py now accepts an optional tap-dir argument.
811 Added "auth-token" client directive
812 Added ./configure --enable-osxipconfig option for Mac OS X
813 Added more packet ID debug info at debug level 3 for debugging false positive packet replays.
814 Fixed bug that incorrectly placed stricter TCP packet replay rules on UDP sessions
815 Fixed bug in port-share that could cause port share process to crash
816 For Mac OSX, when DARWIN_USE_IPCONFIG is defined, retry ipconfig command on failure
818 Revert r7092 and r7151, i.e. remove --enable-osxipconfig configure option.
819 Added 'dir' flag to "crl-verify" (see man page for info).
820 Added new "extra-certs" and "verify-hash" options
821 Fixed compile issues on Windows.
822 Added --enable-lzo-stub configure option to build an OpenVPN client without LZO
823 Added optional journal directory argument to "port-share" directive
824 Reduce log verbosity at level 3, with a focus on removing excessive log verbosity generated by port-share activity.
825 env_filter_match now includes the serial number of all certs in chain
826 Added support for static challenge/response protocol.
828 Added redirect-gateway block-local flag, with support for Linux, Mac OS X
829 Extended x509-track to allow SHA1 certificate hash to be extracted
830 Added "management-query-remote" directive (client) to allow the management interface to override the "remote" directive.
832 Fixed MSVC compile error related to r7408.
833 Redact "echo" directive strings from log, since these strings (going forward) could conceivably contain security-sensitive data.
834 Modified sanitize_control_message to remove redacted data from control string rather than blotting it out with "_" chars.
835 Changed CC_PRINT character class to allow UTF-8 chars.
836 Increased the --verb threshold for "PID_ERR replay" messages to 4 from 3.
837 Fixed issue where redirect-gateway block-local code was not correctly calculating...
838 CC_PRINT character class now allows any 8-bit character value >= 32.
839 "status" management interface command (version >= 2) will now include the username for each connected user.
840 Minor fix to CC_PRINT char class
841 Fixed management interface bug where >FATAL notifications were not being output properly
842 Raised D_PID_DEBUG_LOW from level 3 to 4 to reduce replay error verbosity at level 3.
843 Added "memstats" option to maintain real-time operating stats in a memory-mapped file.
844 Fixed client issues with DHCP Router option extraction/deletion when using layer 2 with DHCP proxy:
845 Allow "tap-win32 dynamic <offset>" to be used in topology subnet mode.
846 Added support for "on-link" routes on Linux client
848 Jan Just Keijser (1):
849 Made some options connection-entry specific
852 common_name passing in auth_pam plugin
854 JuanJo Ciarlante (40):
855 * rebased openvpn-2.1_rc1b.jjo.20061206.d.patch
856 * created getaddr6(), use it from resolve_remote()
857 * migrated all getaddrinfo() to getaddr6
858 * socket.c: use USE_PF_INET6 in switch constructs to actually toss them out,
859 * support --disable-ipv6 build properly:
860 * important fix for tcp6 reconnection was incorrectly creating a PF_INET socket
861 * added README.ipv6.txt
862 * fixed win32 non-ipv6 build
863 * ipv6 on win32 "milestone": 1st snapshot that passes all unittests
864 * document ipv6 milestone status
865 * doc update w/unittests results
866 * make possible to x-compile openvpn/win32 in Linux
867 * correctly setup hints.ai_socktype for getaddrinfo(), althought sorta hacky, see TODO.ipv6.
868 * renamed README.ipv6{.txt,}
869 * updated {README,TODO}.ipv6 from feedback at openvpn-devel mlist
870 * init.c: document the ENABLE_MANAGEMENT place to work on
871 * init.c: small in-doc tweaks
872 * fix multi-tcp crash (corrected assertion)
874 * socket.c: better buf logic in print_sockaddr_ex
875 * fixed segfault for undef address family in print_sockaddr_ex (thanks Marcel!)
877 * openbsd: no IFF_MULTICAST, #ifdef around it
878 * no new funcionality, just small cleanups
879 * (prototype) fix for supporting "redirect-gateway" for tunneled ipv4 over ipv6 endpoints
880 * polished redirect-gateway (ipv4 on ipv6 endpoints) support
882 * fix --disable-ipv6 build
884 * rebased to v2.1.1 release
885 * undo mroute.c changes related to ipv6 payload
886 * fix --multihome for ipv4
887 * fix --multihome for ipv6
888 * ipv6-0.4.14: fix xinetd usage
889 * ipv6-0.4.15: add --multihome support to xBSD
890 * ipv6-0.4.15b: rebase over openvpn-testing-master
891 * ipv6-0.4.16: fix mingw32 build
892 * make ipv6_payload compile under windowze
893 USE_PF_INET6 by default for v2.3
894 fix ipv6 compilation under macosx >= 1070 - v3
897 Add extv3 X509 field support to --x509-username-field
899 Matthew L. Creech (1):
900 Fix 2.2.0 build failure when management interface disabled
903 Skip rather than fail test in addressless FreeBSD jails.
906 Update man page with info about --capath
907 Update man page with info about --connect-timeout
908 Added info about --show-proxy-settings
909 Documented --x509-username-field option
910 Documented --errors-to-stderr option
911 Documented --push-peer-info option
912 Update man page with info about --remote-random-hostname
913 Added man page entry for --management-client
915 Samuli Seppänen (19):
916 Add man page entry for --redirect-private
917 Change all CRLF linefeeds to LF linefeeds
918 Fix a bug in devcon source code handling
919 Removed Win2k from supported platforms list in INSTALL and win/openvpn.nsi
920 Fixed copying of tapinstall.exe to dist/bin when using prebuilt TAP-drivers
921 Fixed a bug with GUI icon deletion on upgrade from 2.2-RC or earlier
922 Fix a build-ca issue on Windows
923 Add new openssl.cnf to easy-rsa/Windows
924 Updated "easy-rsa" for OpenSSL 1.0.0
925 Made domake-win builds to use easy-rsa/2.0/openssl-1.0.0.cnf
926 Fixes to easy-rsa/2.0
927 Merged TODO.IPv6 with TODO.ipv6 and README.IPv6 with README.ipv6
928 Fixed a number of fatal build errors on Visual Studio 2008
929 Fix a Visual Studio 2008 build issue in socket.c
930 Additional Visual Studio 2008 build fixes to tun.c
931 Fixed a typo in win32.h that prevented building with Visual Studio
932 Fixed a regression causing VS2008/Python build failure
933 Fix a Visual Studio 2008 build error in tun.c
934 Fix a Visual Studio 2008 build error in options.c
937 Fix issues with some older GCC compilers
939 Stefan Hellermann (2):
940 plugin.h: update prototype of plugin_call dummy in !ENABLE_PLUGIN case
941 Fixed typo in plugin.h
944 Clarify --tmp-dir option
947 Change the netsh.exe command from "add" to "set".
949 2011.12.25 -- Version 2.x-master
951 Added support for "on-link" routes on Linux client -- these are
952 routes where the gateway is specified as an interface rather than
953 an address. This allows redirect-gateway to work on Linux clients
954 whose connection to the internet is via a point-to-point link
957 Note that at the moment, this capability is incompatible with
958 the "redirect-gateway block-local" directive -- this is because
959 the block-local directive blocks all traffic from the local LAN
960 except for the local and gateway addresses. Since a PPP link
961 is essentially a subnet of two addresses, local and remote (i.e.
962 gateway), the set of addresses that would be blocked by block-local
963 is empty. Therefore, the "redirect-gateway block-local" directive
964 will be ignored on PPP links.
966 To view the OpenVPN client's current determination of the default
967 gateway, use this command:
969 ./openvpn --show-gateway
971 2011.03.24 -- Version 2.2-RC2
973 Windows cross-compile cleanup
975 David Sommerseth (2):
976 Open log files as text files on Windows
977 Clarify default value for the --inactive option.
980 Implement IPv6 in TUN mode for Windows TAP driver.
982 Samuli Seppänen (6):
983 Added support for prebuilt TAP-drivers. Automated embedding manifests.
984 Fixes to win/openvpn.nsi
985 Replaced config-win32.h with win/config.h.in
986 Updated INSTALL-win32.txt
988 Clarified --client-config-dir section on the man-page.
991 Fix line continuation in chkconfig init script description.
993 2011.02.28 -- Version 2.2-RC
994 David Sommerseth (3):
995 Make the --x509-username-field feature an opt-in feature
996 Fix compiler warning when compiling against OpenSSL 1.0.0
997 Fix packaging of config-win32.h and service-win32/msvc.mak
1000 Minor addition of logging info before and after execution of Windows net commands.
1002 Matthias Andree (1):
1003 Change variadic macros to C99 style.
1005 Samuli Seppänen (15):
1006 Added ENABLE_PASSWORD_SAVE to config-win32.h
1007 Added a nmake makefile for openvpnserv.exe building
1008 Moved TAP-driver version info to version.m4. Cleaned up win/settings.in.
1009 Added helper functionality to win/wb.py
1010 Added support for viewing config-win32.h paramters to win/show.py
1011 Added comments and made small modifications to win/msvc.mak.in
1012 Added command-line switch to win/build_all.py to skip TAP driver building
1013 Added configure.h and version.m4 variable parsing to win/config.py
1014 Added openvpnserv.exe building to win/build.py
1015 Added comments to win/build_ddk.py
1016 Several modifications to win/make_dist.py to allow building the NSI installer
1017 Copied install-win32/setpath.nsi to win/setpath.nsi
1018 Added first version of NSI installer script to win/openvpn.nsi
1019 Changes to buildsystem patchset
1020 Temporary snprintf-related fix to service-win32/openvpnserv.c
1022 2010.11.25 -- Version 2.2-beta5
1024 Samuli Seppänen (1):
1025 Fixed an issue causing a build failure with MS Visual Studio 2008.
1027 2010.11.18 -- Version 2.2-beta4
1029 David Sommerseth (10):
1030 Clarified --explicit-exit-notify man page entry
1031 Clean-up: Remove pthread and mutex locking code
1032 Clean-up: Remove more dead and inactive code paths
1033 Clean-up: Removing useless code - hash related functions
1034 Use stricter snprintf() formatting in socks_username_password_auth() (v3)
1035 Fix compiler warnings about not used dummy() functions
1036 Fixed potential misinterpretation of boolean logic
1037 Only add some functions when really needed
1038 Removed functions not being used anywhere
1039 Merged add_bypass_address() and add_host_route_if_nonlocal()
1042 Integrate support for TAP mode on Solaris, written by Kazuyoshi Aizawa <admin2@whiteboard.ne.jp>.
1043 Make "topology subnet" work on Solaris
1044 Improved man page entry for script_type
1047 Fixed initialization bug in route_list_add_default_gateway (Gert Doering).
1048 Implement challenge/response authentication support in client mode
1049 Make base64.h have the same conditional compilation expression as base64.c.
1050 Fixed compiling issues when using --disable-crypto
1051 In verify_callback, the subject var should be freed by OPENSSL_free, not free
1054 Remove hardcoded path to resolvconf
1057 Add HTTP/1.1 Host header
1060 Adding support for SOCKS plain text authentication
1062 Samuli Seppänen (2):
1063 Added check for variable CONFIGURE_DEFINES into options.c
1064 Added command-line option parser and an unsigned build option to build_all.py
1066 2010.08.21 -- Version 2.2-beta3
1068 * Attempt to fix issue where domake-win build system was not properly
1069 signing drivers and .exe files.
1071 Added win/tap_span.py for building multiple versions of the TAP driver
1072 and tapinstall binaries using different DDK versions to span from Win2K
1076 David Sommerseth (2):
1077 Test framework improvment - Do not FAIL if t_client.rc is missing
1078 More t_client.sh updates - exit with SKIP when we want to skip
1081 Fix compile problems on NetBSD and OpenBSD
1082 Fix <net/if.h> compile time problems on OpenBSD for good
1083 full "VPN client connect" test framework for OpenVPN
1084 Build t_client.sh by configure at run-time.
1087 Fixes openssl-1.0.0 compilation warning
1089 2010.08.16 -- Version 2.2-beta2
1091 * Windows security issue:
1092 Fixed potential local privilege escalation vulnerability in
1093 Windows service. The Windows service did not properly quote the
1094 executable filename passed to CreateService. A local attacker
1095 with write access to the root directory C:\ could create an
1096 executable that would be run with the same privilege level as
1097 the OpenVPN Windows service. However, since non-Administrative
1098 users normally lack write permission on C:\, this vulnerability
1099 is generally not exploitable except on older versions of Windows
1100 (such as Win2K) where the default permissions on C:\ would allow
1101 any user to create files there.
1102 Credit: Scott Laurie, MWR InfoSecurity
1104 * Added Python-based based alternative build system for Windows using
1105 Visual Studio 2008 (in win directory).
1107 * When aborting in a non-graceful way, try to execute do_close_tun in
1108 init.c prior to daemon exit to ensure that the tun/tap interface is
1109 closed and any added routes are deleted.
1111 * Fixed an issue where AUTH_FAILED was not being properly delivered
1112 to the client when a bad password is given for mid-session reauth,
1113 causing the connection to fail without an error indication.
1115 * Don't advance to the next connection profile on AUTH_FAILED errors.
1117 * Fixed an issue in the Management Interface that could cause
1118 a process hang with 100% CPU utilization in --management-client
1119 mode if the management interface client disconnected at the
1120 point where credentials are queried.
1122 * Fixed an issue where if reneg-sec was set to 0 on the client,
1123 so that the server-side value would take precedence,
1124 the auth_deferred_expire_window function would incorrectly
1125 return a window period of 0 seconds. In this case, the
1126 correct window period should be the handshake window
1129 * Modified ">PASSWORD:Verification Failed" management interface
1130 notification to include a client reason string:
1132 >PASSWORD:Verification Failed: 'AUTH_TYPE' ['REASON_STRING']
1134 * Enable exponential backoff in reliability layer
1137 * Set socket buffers (SO_SNDBUF and SO_RCVBUF) immediately after
1138 socket is created rather than waiting until after connect/listen.
1140 * Management interface performance optimizations:
1142 1. Added env-filter MI command to perform filtering on env vars
1143 passed through as a part of --management-client-auth
1145 2. man_write will now try to aggregate output into larger blocks
1146 (up to 1024 bytes) for more efficient i/o
1148 * Fixed minor issue in Windows TAP driver DEBUG builds
1149 where non-null-terminated unicode strings were being
1150 printed incorrectly.
1152 * Fixed issue on Windows with MSVC compiler, where TCP_NODELAY support
1153 was not being compiled in.
1155 * Proxy improvements:
1157 Improved the ability of http-auth "auto" flag to dynamically detect
1158 the auth method required by the proxy.
1160 Added http-auth "auto-nct" flag to reject weak proxy auth methods.
1162 Added HTTP proxy digest authentication method.
1164 Removed extraneous openvpn_sleep calls from proxy.c.
1166 * Implemented http-proxy-override and http-proxy-fallback directives to make it
1167 easier for OpenVPN client UIs to start a pre-existing client config file with
1168 proxy options, or to adaptively fall back to a proxy connection if a direct
1171 * Implemented a key/value auth channel from client to server.
1173 * Fixed issue where bad creds provided by the management interface
1174 for HTTP Proxy Basic Authentication would go into an infinite
1175 retry-fail loop instead of requerying the management interface for
1178 * Added support for MSVC debugging of openvpn.exe in settings.in:
1180 # Build debugging version of openvpn.exe
1181 !define PRODUCT_OPENVPN_DEBUG
1183 * Implemented multi-address DNS expansion on the network field of route
1186 When only a single IP address is desired from a multi-address DNS
1187 expansion, use the first address rather than a random selection.
1189 * Added --register-dns option for Windows.
1191 Fixed some issues on Windows with --log, subprocess creation
1192 for command execution, and stdout/stderr redirection.
1194 * Fixed an issue where application payload transmissions on the
1195 TLS control channel (such as AUTH_FAILED) that occur during
1196 or immediately after a TLS renegotiation might be dropped.
1198 * Added warning about tls-remote option in man page.
1200 2009.12.11 -- Version 2.1.1
1202 * Fixed some breakage in openvpn.spec (which is required to build an
1203 RPM distribution) where it was referencing a non-existent
1204 subdirectory in the tarball, causing it to fail (patch from
1207 2009.12.11 -- Version 2.1.0
1209 * Fixed a couple issues in sample plugins auth-pam.c and down-root.c.
1210 (1) Fail gracefully rather than segfault if calloc returns NULL.
1211 (2) The openvpn_plugin_abort_v1 function can potentially be called
1212 with handle == NULL. Add code to detect this case, and if so, avoid
1213 dereferencing pointers derived from handle (Thanks to David
1214 Sommerseth for finding this bug).
1216 * Documented "multihome" option in the man page.
1218 2009.11.20 -- Version 2.1_rc22
1220 * Fixed a client-side bug on Windows that occurred when the
1221 "dhcp-pre-release" or "dhcp-renew" options were combined with
1222 "route-gateway dhcp". The release/renew would not occur
1223 because the Windows DHCP renew function is blocking and
1224 therefore must be called from another process or thread
1225 so as not to stall the tunnel.
1227 * Added a hard failure when peer provides a certificate chain
1228 with depth > 16. Previously, a warning was issued.
1230 2009.11.12 -- Version 2.1_rc21
1232 * Rebuilt OpenVPN Windows installer with OpenSSL 0.9.8l to address
1233 CVE-2009-3555. Note that OpenVPN has never relied on the session
1234 renegotiation capabilities that are built into the SSL/TLS protocol,
1235 therefore the fix in OpenSSL 0.9.8l (disable SSL/TLS renegotiation
1236 completely) will not adversely affect OpenVPN mid-session SSL/TLS
1237 renegotation or any other OpenVPN capabilities.
1239 * Added additional session renegotiation hardening. OpenVPN has always
1240 required that mid-session renegotiations build up a new SSL/TLS
1241 session from scratch. While the client certificate common name is
1242 already locked against changes in mid-session TLS renegotiations, we
1243 now extend this locking to the auth-user-pass username as well as all
1244 certificate content in the full client certificate chain.
1246 2009.10.01 -- Version 2.1_rc20
1248 * Fixed a bug introduced in 2.1_rc17 (svn r4436) where using the
1249 redirect-gateway option by itself, without any extra parameters,
1250 would cause the option to be ignored.
1252 * Fixed build problem when ./configure --disable-server is used.
1254 * Fixed ifconfig command for "topology subnet" on FreeBSD (Stefan Bethke).
1256 * Added --remote-random-hostname option.
1258 * Added "load-stats" management interface command to get global server
1261 * Added new ./configure flags:
1263 --disable-def-auth Disable deferred authentication
1264 --disable-pf Disable internal packet filter
1266 * Added "setcon" directive for interoperability with SELinux (Sebastien
1269 * Optimized PUSH_REQUEST handshake sequence to shave several seconds
1270 off of a typical client connection initiation.
1272 * The maximum number of "route" directives (specified in the config
1273 file or pulled from a server) can now be configured via the new
1274 "max-routes" directive.
1276 * Eliminated the limitation on the number of options that can be pushed
1277 to clients, including routes. Previously, all pushed options needed
1278 to fit within a 1024 byte options string.
1280 * Added --server-poll-timeout option : when polling possible remote
1281 servers to connect to in a round-robin fashion, spend no more than
1282 n seconds waiting for a response before trying the next server.
1284 * Added the ability for the server to provide a custom reason string
1285 when an AUTH_FAILED message is returned to the client. This
1286 string can be set by the server-side managment interface and read
1287 by the client-side management interface.
1289 * client-kill management interface command, when issued on server, will
1290 now send a RESTART message to client.
1291 This feature is intended to make UDP clients respond the same as TCP
1292 clients in the case where the server issues a RESTART message in
1293 order to force the client to reconnect and pull a new options/route
1296 2009.07.16 -- Version 2.1_rc19
1298 * In Windows TAP driver, refactor DHCP/ARP packet injection code to
1299 use a DPC (deferred procedure call) to defer packet injection until
1300 IRQL < DISPATCH_LEVEL, rather than calling NdisMEthIndicateReceive
1301 in the context of AdapterTransmit. This is an attempt to reduce kernel
1302 stack usage, and prevent EXCEPTION_DOUBLE_FAULT BSODs that have been
1303 observed on Vista. Updated TAP driver version number to 9.6.
1305 * In configure.ac, use datadir instead of datarootdir for compatibility
1306 with <autoconf-2.60.
1308 2009.06.07 -- Version 2.1_rc18
1310 * Fixed compile error on ./configure --enable-small
1312 * Fixed issue introduced in r4475 (2.1-rc17) where cryptoapi.c change
1313 does not build on Windows on non-MINGW32.
1315 2009.05.30 -- Version 2.1_rc17
1317 * Reduce the debug level (--verb) at which received management interface
1318 commands are echoed from 7 to 3. Passwords will be filtered.
1320 * Fixed race condition in management interface recv code on
1321 Windows, where sending a set of several commands to the
1322 management interface in quick succession might cause the
1323 latter commands in the set to be ignored.
1325 * Increased management interface input command buffer size
1326 from 256 to 1024 bytes.
1328 * Minor tweaks to Windows build system.
1330 * Added "redirect-private" option which allows private subnets
1331 to be pushed to the client in such a way that they don't accidently
1332 obscure critical local addresses such as the DHCP server address and
1333 DNS server addresses.
1335 * Added new 'autolocal' redirect-gateway flag. When enabled, the OpenVPN
1336 client will examine the routing table and determine whether (a) the
1337 OpenVPN server is reachable via a locally connected interface, or (b)
1338 traffic to the server must be forwarded through the default router.
1339 Only add a special bypass route for the OpenVPN server if (b) is true.
1340 If (a) is true, behave as if the 'local' flag is specified, and do not
1343 The new 'autolocal' flag depends on the non-portable test_local_addr()
1344 function in route.c, which is currently only implemented for Windows.
1345 The 'autolocal' flag will act as a no-op on platforms that have not
1346 yet defined a test_local_addr() function.
1348 * Increased TLS_CHANNEL_BUF_SIZE to 2048 from 1024 (this will allow for
1349 more option content to be pushed from server to client).
1351 * Raised D_MULTI_DROPPED debug level to 4 from 3 to filter out (at debug
1352 levels <=3) a common and usually innocuous warning.
1354 * Fixed issue of symbol conflicts interfering with Windows CryptoAPI
1355 functionality (Alon Bar-Lev).
1357 * Fixed bug where the remote_X environmental variables were not being
1358 set correctly when the 'local' option is specifed.
1360 2009.05.17 -- Version 2.1_rc16
1362 * Windows installer changes:
1364 1. ifdefed out the check Windows version code which is causing
1365 problems on Windows 7
1367 2. don't define SF_SELECTED if it is already defined
1369 3. Use LZMA instead of BZIP2 compression for better compression
1371 4. Upgraded OpenSSL to 0.9.8k
1373 * Added the ability to read the configuration file
1374 from stdin, when "stdin" is given as the config
1377 * Allow "management-client" directive to be used
1378 with unix domain sockets.
1380 * Added errors-to-stderr option. When enabled, fatal errors
1381 that result in the termination of the daemon will be written
1384 * Added optional "nogw" (no gateway) flag to --server-bridge
1385 to inhibit the pushing of the route-gateway parameter to
1388 * Added new management interface command "pid" to show the
1389 process ID of the current OpenVPN process (Angelo Laub).
1391 * Fixed issue where SIGUSR1 restarts would fail if private
1392 key was specified as an inline file.
1394 * Added daemon_start_time and daemon_pid environmental variables.
1396 * In management interface, added new ">CLIENT:ESTABLISHED" notification.
1400 1. Fixed some issues with C++ style comments that leaked into the code.
1402 2. Updated configure.ac to work on MinGW64.
1404 3. Updated common.h types for _WIN64.
1406 4. Fixed issue involving an #ifdef in a macro reference that breaks early gcc
1409 5. In cryptoapi.c, renamed CryptAcquireCertificatePrivateKey to
1410 OpenVPNCryptAcquireCertificatePrivateKey to work around
1411 a symbol conflict in MinGW-5.1.4.
1413 2008.11.19 -- Version 2.1_rc15
1415 * Fixed issue introduced in 2.1_rc14 that may cause a
1416 segfault when a --plugin module is used.
1418 * Added server-side --opt-verify option: clients that connect
1419 with options that are incompatible with those of the server
1420 will be disconnected (without this option, incompatible
1421 clients would trigger a warning message in the server log
1422 but would not be disconnected).
1424 * Added --tcp-nodelay option: Macro that sets TCP_NODELAY socket
1425 flag on the server as well as pushes it to connecting clients.
1427 * Minor options check fix: --no-name-remapping is a
1428 server-only option and should therefore generate an
1429 error when used on the client.
1431 * Added --prng option to control PRNG (pseudo-random
1432 number generator) parameters. In previous OpenVPN
1433 versions, the PRNG was hardcoded to use the SHA1
1434 hash. Now any OpenSSL hash may be used. This is
1435 part of an effort to remove hardcoded references to
1436 a specific cipher or cryptographic hash algorithm.
1438 * Cleaned up man page synopsis.
1440 2008.11.16 -- Version 2.1_rc14
1442 * Added AC_GNU_SOURCE to configure.ac to enable struct ucred,
1443 with the goal of fixing a build issue on Fedora 9 that was
1444 introduced in 2.1_rc13.
1446 * Added additional method parameter to --script-security to preserve
1447 backward compatibility with system() call semantics used in OpenVPN
1448 2.1_rc8 and earlier. To preserve backward compatibility use:
1450 script-security 3 system
1452 * Added additional warning messages about --script-security 2
1453 or higher being required to execute user-defined scripts or
1456 * Windows build system changes:
1458 Modified Windows domake-win build system to write all openvpn.nsi
1459 input files to gen, so that gen can be disconnected from
1460 the rest of the source tree and makensis openvpn.nsi will
1461 still function correctly.
1463 Added additional SAMPCONF_(CA|CRT|KEY) macros to settings.in
1464 (commented out by default).
1466 Added optional files SAMPCONF_CONF2 (second sample configuration
1467 file) and SAMPCONF_DH (Diffie-Helman parameters) to Windows
1468 build system, and may be defined in settings.in.
1470 * Extended Management Interface "bytecount" command
1471 to work when OpenVPN is running as a server.
1472 Documented Management Interface "bytecount" command in
1473 management/management-notes.txt.
1475 * Fixed informational message in ssl.c to properly indicate
1476 deferred authentication.
1478 * Added server-side --auth-user-pass-optional directive, to allow
1479 connections by clients that do not specify a username/password, when a
1480 user-defined authentication script/module is in place (via
1481 --auth-user-pass-verify, --management-client-auth, or a plugin module).
1483 * Changes to easy-rsa/2.0/pkitool and related openssl.cnf:
1485 Calling scripts can set the KEY_NAME environmental variable to set
1486 the "name" X509 subject field in generated certificates.
1488 Modified pkitool to allow flexibility in separating the Common Name
1489 convention from the cert/key filename convention.
1493 KEY_CN="James's Laptop" KEY_NAME="james" ./pkitool james
1495 will create a client certificate/key pair of james.crt/james.key
1496 having a Common Name of "James's Laptop" and a Name of "james".
1498 * Added --no-name-remapping option to allow Common Name, X509 Subject,
1499 and username strings to include any printable character including
1500 space, but excluding control characters such as tab, newline, and
1501 carriage-return (this is important for compatibility with external
1502 authentication systems).
1504 As a related change, added --status-version 3 format (and "status 3"
1505 in the management interface) which uses the version 2 format except
1506 that tabs are used as delimiters instead of commas so that there
1507 is no ambiguity when parsing a Common Name that contains a comma.
1509 Also, save X509 Subject fields to environment, using the naming
1512 X509_{cert_depth}_{name}={value}
1514 This is to avoid ambiguities when parsing out the X509 subject string
1515 since "/" characters could potentially be used in the common name.
1517 * Fixed some ifconfig-pool issues that precluded it from being combined
1518 with --server directive.
1520 Now, for example, we can configure thusly:
1522 server 10.8.0.0 255.255.255.0 nopool
1523 ifconfig-pool 10.8.0.2 10.8.0.99 255.255.255.0
1525 to have ifconfig-pool manage only a subset
1528 * Added config file option "setenv FORWARD_COMPATIBLE 1" to relax
1529 config file syntax checking to allow directives for future OpenVPN
1530 versions to be ignored.
1532 2008.10.07 -- Version 2.1_rc13
1534 * Bundled OpenSSL 0.9.8i with Windows installer.
1536 * Management interface can now listen on a unix
1537 domain socket, for example:
1539 management /tmp/openvpn unix
1541 Also added management-client-user and management-client-group
1542 directives to control which processes are allowed to connect
1545 * Copyright change to OpenVPN Technologies, Inc.
1547 2008.09.23 -- Version 2.1_rc12
1549 * Patched Makefile.am so that the new t_cltsrv-down.sh script becomes
1550 part of the tarball (Matthias Andree).
1552 * Fixed --lladdr bug introduced in 2.1-rc9 where input validation code
1553 was incorrectly expecting the lladdr parameter to be an IP address
1554 when it is actually a MAC address (HoverHell).
1556 2008.09.14 -- Version 2.1_rc11
1558 * Fixed a bug that can cause SSL/TLS negotiations in UDP mode
1559 to fail if UDP packets are dropped.
1561 2008.09.10 -- Version 2.1_rc10
1563 * Added "--server-bridge" (without parameters) to enable
1564 DHCP proxy mode: Configure server mode for ethernet
1565 bridging using a DHCP-proxy, where clients talk to the
1566 OpenVPN server-side DHCP server to receive their IP address
1567 allocation and DNS server addresses.
1569 * Added "--route-gateway dhcp", to enable the extraction
1570 of the gateway address from a DHCP negotiation with the
1571 OpenVPN server-side LAN.
1573 * Fixed minor issue with --redirect-gateway bypass-dhcp or bypass-dns
1574 on Windows. If the bypass IP address is 0.0.0.0 or 255.255.255.255,
1577 * Warn when ethernet bridging that the IP address of the bridge adapter
1578 is probably not the same address that the LAN adapter was set to
1581 * When running as a server, warn if the LAN network address is
1582 the all-popular 192.168.[0|1].x, since this condition commonly
1583 leads to subnet conflicts down the road.
1585 * Primarily on the client, check for subnet conflicts between
1586 the local LAN and the VPN subnet.
1588 * Added a 'netmask' parameter to get_default_gateway, to return
1589 the netmask of the adapter containing the default gateway.
1590 Only implemented on Windows so far. Other platforms will
1591 return 255.255.255.0. Currently the netmask information is
1592 only used to warn about subnet conflicts.
1594 * Minor fix to cryptoapi.c to not compile itself unless USE_CRYPTO
1595 and USE_SSL flags are enabled (Alon Bar-Lev).
1597 * Updated openvpn/t_cltsrv.sh (used by "make check") to conform to new
1598 --script-security rules. Also adds retrying if the addresses are in
1599 use (Matthias Andree).
1601 * Fixed build issue with ./configure --disable-socks --disable-http.
1603 * Fixed separate compile errors in options.c and ntlm.c that occur
1604 on strict C compilers (such as old versions of gcc) that require
1605 that C variable declarations occur at the start of a {} block,
1608 * Workaround bug in OpenSSL 0.9.6b ASN1_STRING_to_UTF8, which
1609 the new implementation of extract_x509_field_ssl depends on.
1611 * LZO compression buffer overflow errors will now invalidate
1612 the packet rather than trigger a fatal assertion.
1614 * Fixed minor compile issue in ntlm.c (mid-block declaration).
1616 * Added --allow-pull-fqdn option which allows client to pull DNS names
1617 from server (rather than only IP address) for --ifconfig, --route, and
1618 --route-gateway. OpenVPN versions 2.1_rc7 and earlier allowed DNS names
1619 for these options to be pulled and translated to IP addresses by default.
1620 Now --allow-pull-fqdn will be explicitly required on the client to enable
1621 DNS-name-to-IP-address translation of pulled options.
1623 * 2.1_rc8 and earlier did implicit shell expansion on script
1624 arguments since all scripts were called by system().
1625 The security hardening changes made to 2.1_rc9 no longer
1626 use system(), but rather use the safer execve or CreateProcess
1627 system calls. The security hardening also introduced a
1628 backward incompatibility with 2.1_rc8 and earlier in that
1629 script parameters were no longer shell-expanded, so
1632 client-connect "docc CLIENT-CONNECT"
1634 would fail to work because execve would try to execute
1635 a script called "docc CLIENT-CONNECT" instead of "docc"
1636 with "CLIENT-CONNECT" as the first argument.
1638 This patch fixes the issue, bringing the script argument
1639 semantics back to pre 2.1_rc9 behavior in order to preserve
1640 backward compatibility while still using execve or CreateProcess
1641 to execute the script/executable.
1643 * Modified ip_or_dns_addr_safe, which validates pulled DNS names,
1644 to more closely conform to RFC 3696:
1646 (1) DNS name length must not exceed 255 characters
1648 (2) DNS name characters must be limited to alphanumeric,
1649 dash ('-'), and dot ('.')
1651 * Fixed bug in intra-session TLS key rollover that was introduced with
1652 deferred authentication features in 2.1_rc8.
1654 2008.07.31 -- Version 2.1_rc9
1656 * Security Fix -- affects non-Windows OpenVPN clients running
1657 OpenVPN 2.1-beta14 through 2.1-rc8 (OpenVPN 2.0.x clients are NOT
1658 vulnerable nor are any versions of the OpenVPN server vulnerable).
1659 An OpenVPN client connecting to a malicious or compromised
1660 server could potentially receive an "lladdr" or "iproute" configuration
1661 directive from the server which could cause arbitrary code execution on
1662 the client. A successful attack requires that (a) the client has agreed
1663 to allow the server to push configuration directives to it by including
1664 "pull" or the macro "client" in its configuration file, (b) the client
1665 successfully authenticates the server, (c) the server is malicious or has
1666 been compromised and is under the control of the attacker, and (d) the
1667 client is running a non-Windows OS. Credit: David Wagner.
1670 * Miscellaneous defensive programming changes to multiple
1671 areas of the code. In particular, use of the system() call
1672 for calling executables such as ifconfig, route, and
1673 user-defined scripts has been completely revamped in favor
1674 of execve() on unix and CreateProcess() on Windows.
1676 * In Windows build, package a statically linked openssl.exe to work around
1677 observed instabilities in the dynamic build since the migration to
1680 2008.06.11 -- Version 2.1_rc8
1682 * Added client authentication and packet filtering capability
1683 to management interface. In addition, allow OpenVPN plugins
1684 to take advantage of deferred authentication and packet
1685 filtering capability.
1687 * Added support for client-side connection profiles.
1689 * Fixed unbounded memory growth bug in environmental variable
1690 code that could have caused long-running OpenVPN sessions
1691 with many TLS renegotiations to incrementally
1692 increase memory usage over time.
1694 * Windows release now packages openssl-0.9.8h.
1696 * Build system changes -- allow building on Windows using
1697 autoconf/automake scripts (Alon Bar-Lev).
1699 * Changes to Windows build system to make it easier to do
1700 partial builds, with a reduced set of prerequisites,
1701 where only a subset of OpenVPN installer
1702 components are built. See ./domake-win comments.
1704 * Cleanup IP address for persistence interfaces for tap and also
1705 using ifconfig, gentoo#209055 (Alon Bar-Lev).
1707 * Fall back to old version of extract_x509_field for OpenSSL 0.9.6.
1709 * Clarified tcp-queue-limit man page entry (Matti Linnanvuori).
1711 * Added new OpenVPN icon and installer graphic.
1713 * Minor pkitool changes.
1715 * Added --pkcs11-id-management option, which will cause OpenVPN to
1716 query the management interface via the new NEED-STR asynchronous
1717 notification query to get additional PKCS#11 options (Alon Bar-Lev).
1719 * Added NEED-STR management interface asynchronous query and
1720 "needstr" management interface command to respond to the query
1723 * Added Dragonfly BSD support (Francis-Gudin).
1725 * Quote device names before passing to up/down script (Josh Cepek).
1727 * Bracketed struct openvpn_pktinfo with #pragma pack(1) to
1728 prevent structure padding from causing an incorrect length
1729 to be returned by sizeof (struct openvpn_pktinfo) on 64-bit
1732 * On systems that support res_init, always call it
1733 before calling gethostbyname to ensure that
1734 resolver configuration state is current.
1736 * Added NTLMv2 proxy support (Miroslav Zajic).
1738 * Fixed an issue in extract_x509_field_ssl where the extraction
1739 would fail on the first field of the subject name, such as
1740 the common name in: /CN=foo/emailAddress=foo@bar.com
1742 * Made "Linux ip addr del failed" error nonfatal.
1744 * Amplified --client-cert-not-required warning.
1746 * Added #pragma pack to proto.h.
1748 2008.01.29 -- Version 2.1_rc7
1750 * Added a few extra files that exist in the svn repo but were
1751 not being copied into the tarball by make dist.
1753 * Fixup null interface on close, don't use ip addr flush (Alon Bar-Lev).
1755 2008.01.24 -- Version 2.1_rc6
1757 * Fixed options checking bug introduced in rc5 where legitimate configuration
1758 files might elicit the error: "Options error: Parameter pkcs11_private_mode
1759 can only be specified in TLS-mode, i.e. where --tls-server or --tls-client
1762 2008.01.23 -- Version 2.1_rc5
1764 * Fixed Win2K TAP driver bug that was introduced by Vista fixes,
1765 incremented driver version to 9.4.
1767 * Windows build system changes:
1769 Incremented included OpenSSL version to openssl-0.9.7m.
1771 Updated openssl.patch for openssl-0.9.7m and added some
1772 brief usage comments to the head of the patch.
1774 Added build-pkcs11-helper.sh for building the pkcs11-helper
1777 Integrated inclusion of pkcs11-helper into Windows build
1780 Upgraded TAP build scripts to use WDK 6001.17121
1781 (Windows 2008 Server pre-RTM).
1783 * Windows installer changes:
1785 Clean up the start menu folder.
1787 Allow for a site-specific sample configuration file and keys
1788 to be included in a custom installer (see SAMPCONF macros
1791 New icon (temporary).
1793 * Added "forget-passwords" command to the management interface
1796 * Added --management-signal option to signal SIGUSR1 when the
1797 management interface disconnects (Alon Bar-Lev).
1799 * Modified command line and config file parser to allow
1800 quoted strings using single quotes ('') (Alon Bar-Lev).
1802 * Use pkcs11-helper as external library, can be downloaded from
1803 https://www.opensc-project.org/pkcs11-helper (Alon Bar-Lev).
1805 * Fixed interim memory growth issue in TCP connect loop where
1806 "TCP: connect to %s failed, will try again in %d seconds: %s"
1809 * Fixed bug in epoll driver in event.c, where the lack of a
1810 handler for EPOLLHUP could cause 99% CPU usage.
1812 * Defined ALLOW_NON_CBC_CIPHERS for people who don't
1813 want to use a CBC cipher for OpenVPN's data channel.
1815 * Added PLUGIN_LIBDIR preprocessor string to prepend a default
1816 plugin directory to the dlopen search list when the user
1817 specifies the basename of the plugin only (Marius Tomaschewski).
1819 * Rewrote extract_x509_field and modified COMMON_NAME_CHAR_CLASS
1820 to allow forward slash characters ("/") in the X509 common name
1823 * Allow OpenVPN to run completely unprivileged under Linux
1824 by allowing openvpn --mktun to be used with --user and --group
1825 to set the UID/GID of the tun device node. Also added --iproute
1826 option to allow an alternative command to be executed in place
1827 of the default iproute2 command (Alon Bar-Lev).
1829 * Fixed --disable-iproute2 in ./configure to actually disable
1830 iproute2 usage (Alon Bar-Lev).
1832 * Added --management-forget-disconnect option -- forget
1833 passwords when management session disconnects (Alon Bar-Lev).
1835 2007.04.25 -- Version 2.1_rc4
1837 * Worked out remaining issues with TAP driver signing
1838 on Vista x64. OpenVPN will now run on Vista x64
1839 with driver signing enforcement enabled.
1841 * Fixed 64-bit portability bug in time_string function
1844 2007.04.22 -- Version 2.1_rc3
1846 * Additional fixes to TAP driver for Windows x64. Driver
1847 now runs successfully on Vista x64 if driver signing
1848 enforcement is disabled.
1850 * The Windows Installer and TAP driver are now signed by
1851 OpenVPN Solutions LLC (in addition to the usual GnuPG
1854 * Added OpenVPN GUI (Mathias Sundman version) as install
1855 option in Windows installer.
1857 * Clean up configure on FreeBSD for recent autotool versions
1858 that require that all .h files have to be compiled.
1859 Also, FreeBSD install does not support GNU long options
1860 which the Makefile in easy-rsa/2.0 uses (not checked the
1861 others as we don't install those on Gentoo) (Roy Marples).
1863 * Added additional scripts to easy-rsa/Windows for working
1864 with password-protected keys; also add -extensions server
1865 option when generating server cert via
1866 build-key-server-pass.bat (Daniel Zauft).
1868 2007.02.27 -- Version 2.1_rc2
1870 * auth-pam change: link with -lpam rather
1871 than dlopen (Roy Marples).
1873 * Prevent SIGUSR1 or SIGHUP from causing program
1874 exit from initial management hold.
1876 * SO_REUSEADDR should not be set on Windows TCP sockets
1877 because it will cause bind to succeed on port conflicts.
1879 * Added time_ascii, time_duration, and time_unix
1880 environmental variables for plugins and callback
1883 * Fixed issue where OpenVPN does not apply the --txqueuelen option
1884 to persistent interfaces made with --mktun (Roy Marples).
1886 * Attempt at rational signal handling when in the
1887 management hold state. During management hold, ignore
1888 SIGUSR1/SIGHUP signals thrown with the "signal" command.
1889 Also, "signal" command will now apply remapping as
1890 specified with the --remap-usr1 option.
1891 When a signal entered using the "signal" command from a management
1892 hold is ignored, output: >HOLD:Waiting for hold release
1894 * Fixed issue where struct env_set methods that
1895 change the value of an existing name=value pair
1896 would delay the freeing of the memory held by
1897 the previous name=value pair until the underlying
1898 client instance object is closed.
1899 This could cause a server that handles long-term
1900 client connections, resulting in many periodic calls
1901 to verify_callback, to needlessly grow the env_set
1902 memory allocation until the underlying client instance
1905 * Renamed TAP-Win32 driver from tap0801.sys to tap0901.sys
1906 to reflect the fact that Vista has blacklisted the tap0801.sys
1907 file name due to previous compatibility issues which have now
1908 been resolved. TAP-Win32 major/minor version number is now 9/1.
1910 * Windows installer will delete a previously installed
1911 tap0801.sys TAP driver before installing tap0901.sys.
1913 * Added code to Windows installer to fail gracefully on 64 bit
1914 installs until 64-bit TAP driver issues can be resolved.
1916 * Added code to Windows installer to fail gracefully on
1917 versions of Windows which are not explicitly supported.
1919 * The Windows version will now use a default route-delay
1920 of 5 seconds to deal with an apparent routing table race
1923 * Worked around an incompatibility in the Windows Vista
1924 version of CreateIpForwardEntry as described in
1925 http://www.nynaeve.net/?p=59
1926 This issue would cause route additions using the
1927 IP Helper API to fail on Vista.
1929 * On Windows, revert to "ip-win32 dynamic" as the default.
1931 2006.10.31 -- Version 2.1_rc1
1933 * Support recovery (return to hold) from signal at
1934 management password prompt.
1936 * Added workaround for OpenSC PKCS#11 bug#108
1939 2006.10.01 -- Version 2.1-beta16
1941 * Windows installer updated with OpenSSL 0.9.7l DLLs to fix
1942 published vulnerabilities.
1944 * Fixed TAP-Win32 bug that caused BSOD on Windows Vista
1947 * Autodetect 32/64 bit Windows in installer and install
1948 appropriate TAP driver (Mathias Sundman, Hypherion).
1950 * Fixed bug in loopback self-test introduced
1951 in 2.1-beta15 where self test as invoked by
1952 "make check" would not properly exit after
1953 2 minutes (Paul Howarth).
1955 2006.09.12 -- Version 2.1-beta15
1957 * Windows installer updated with OpenSSL 0.9.7k DLLs to fix
1958 RSA Signature Forgery (CVE-2006-4339).
1960 * Fixed bug introduced with the --port-share directive
1961 (back in 2.1-beta9 which causes TLS soft resets
1962 (1 per hour by default) in TCP server mode to force
1963 a blockage of tunnel packets and later time-out and
1964 restart the connection.
1966 * easy-rsa update (Alon Bar-Lev)
1967 Makefile (install) is now available so that
1968 distribs will be able to install it safely.
1970 * PKCS#11 changes: (Alon Bar-Lev)
1971 - Modified ssl.c to not FATAL and return to init.c
1972 so auth-retry will work.
1973 - Modifed pkcs11-helper.c to fix some problem with
1975 - Added retry counter to PKCS#11 PIN hook.
1976 - Modified PKCS#11 PIN retry loop to return correct error
1977 code when PIN is incorrect.
1978 - Fix handling (ignoring) zero sized attributes.
1980 - Fix openssl 0.9.6 (first version) issues.
1982 * Minor fixes of lladdr (Alon Bar-Lev)
1983 Updated makefile.w32-vc to include lladdr.*, updated
1985 Modified lladdr.c to be compiled under visual C.
1987 * Added two new management states:
1988 OPENVPN_STATE_RESOLVE -- DNS lookup
1989 OPENVPN_STATE_TCP_CONNECT -- Connecting to TCP server
1991 * Echo management state change to log.
1993 * Minor syshead.h change for NetBSD to allow
1994 TCP_NODELAY flag to work.
1996 * Modified --port-share code to remove the assumption that
1997 CMSG_SPACE always evaluates to a constant, to enable
1998 compilation on NetBSD and possibly other BSDs as well.
2000 * Eliminated gcc 3.3.3 warnings on NetBSD
2001 when ./configure --enable-strict is used.
2003 * Added optional minimum-number-of-bytes parameter
2004 to --inactive directive.
2006 2006.04.13 -- Version 2.1-beta14
2008 * Fixed Windows server bug in time backtrack handling code which
2009 could cause TLS negotiation failures on legitimate clients.
2011 * Rewrote gettimeofday function for Windows to be
2012 simpler and more efficient.
2014 * Merged PKCS#11 extensions to easy-rsa/2.0 (Alon Bar-Lev).
2016 * Added --route-metric option to set a default route metric
2017 for --route (Roy Marples).
2019 * Added --lladdr option to specify the link layer (MAC) address
2020 for the tap interface on non-Windows platforms (Roy Marples).
2022 2006.04.12 -- Version 2.1-beta13
2024 * Code added in 2.1-beta7 and 2.0.6-rc1 to extend byte counters
2025 to 64 bits caused a bug in the Windows version which has now
2026 been fixed. The bug could cause intermittent crashes.
2028 2006.04.05 -- Version 2.1-beta12
2030 * Security Vulnerability -- An OpenVPN client connecting to a
2031 malicious or compromised server could potentially receive
2032 "setenv" configuration directives from the server which could
2033 cause arbitrary code execution on the client via a LD_PRELOAD
2034 attack. A successful attack appears to require that (a) the
2035 client has agreed to allow the server to push configuration
2036 directives to it by including "pull" or the macro "client" in
2037 its configuration file, (b) the client configuration file uses
2038 a scripting directive such as "up" or "down", (c) the client
2039 succesfully authenticates the server, (d) the server is
2040 malicious or has been compromised and is under the control of
2041 the attacker, and (e) the attacker has at least some level of
2042 pre-existing control over files on the client (this might be
2043 accomplished by having the server respond to a client web request
2044 with a specially crafted file). Credit: Hendrik Weimer.
2047 The fix is to disallow "setenv" to be pushed to clients from
2048 the server, and to add a new directive "setenv-safe" which is
2049 pushable from the server, but which appends "OPENVPN_" to the
2050 name of each remotely set environmental variable.
2052 * "topology subnet" fix for FreeBSD (Benoit Bourdin).
2054 * PKCS11 fixes (Alon Bar-Lev). For full description:
2055 svn log -r990 http://svn.openvpn.net/projects/openvpn/branches/BETA21
2057 * When deleting routes under Linux, use the route metric
2058 as a differentiator to ensure that the route teardown
2059 process only deletes the identical route which was originally
2060 added via the "route" directive (Roy Marples).
2062 * Fix the t_cltsrv.sh file in FreeBSD 4 jails
2063 (Matthias Andree, Dirk Meyer, Vasil Dimov).
2065 * Extended tun device configure code to support ethernet
2066 bridging on NetBSD (Emmanuel Kasper).
2068 2006.02.19 -- Version 2.1-beta11
2070 * Fixed --port-share bug that caused premature closing
2071 of proxied sessions.
2073 2006.02.17 -- Version 2.1-beta10
2075 * Fixed --port-share breakage introduced in 2.1-beta9.
2077 2006.02.16 -- Version 2.1-beta9
2079 * Added --port-share option for allowing OpenVPN and HTTPS
2080 server to share the same port number.
2081 * Added --management-client option to connect as a client
2082 to management GUI app rather than be connected to as a
2084 * Added "bytecount" command to management interface.
2085 * --remote-cert-tls fixes (Alon Bar-Lev).
2087 2006.01.03 -- Version 2.1-beta8
2089 * --remap-usr1 will now also remap signals thrown during
2091 * Added --connect-timeout option to control the timeout
2092 on TCP client connection attempts (doesn't work on all
2093 OSes). This patch also makes OpenVPN signalable during
2094 TCP connection attempts.
2095 * Fixed bug in acinclude.m4 where capability of compiler
2096 to handle zero-length arrays in structs is tested
2098 * Fixed typo in manage.c where inline function declaration
2099 was declared without the "static" keyword (David Stipp).
2100 * Patch to support --topology subnet on Mac OS X (Mathias Sundman).
2101 * Added --auto-proxy directive to auto-detect HTTP or SOCKS
2102 proxy settings (currently Windows only).
2103 * Removed redundant base64 code.
2104 * Better sanity checking of --server and --server-bridge
2105 IP pool ranges, so as not to hit the assertion at
2107 * Fixed bug where --daemon and --management-query-passwords
2108 used together would cause OpenVPN to block prior to
2110 * Fixed client/server race condition which could occur
2111 when --auth-retry interact is set and the initially
2112 provided auth-user-pass credentials are incorrect,
2113 forcing a username/password re-query.
2114 * Fixed bug where if --daemon and --management-hold are
2115 used together, --user or --group options would be ignored.
2116 * --ip-win32 adaptive is now the default.
2117 * --ip-win32 netsh (or --ip-win32 adaptive when in netsh
2118 mode) can now set DNS/WINS addresses on the TAP-Win32
2120 * Added new option --route-method adaptive (Win32)
2121 which tries IP helper API first, then falls back to
2123 * Made --route-method adaptive the default.
2125 2005.11.12 -- Version 2.1-beta7
2127 * Allow blank passwords to be passed via the management
2129 * Fixed bug where "make check" inside a FreeBSD "jail"
2130 would never complete (Matthias Andree).
2131 * Fixed bug where --server directive in --dev tap mode
2132 claimed that it would support subnets of /30 or less
2133 but actually would only accept /29 or less.
2134 * Extend byte counters to 64 bits (M. van Cuijk).
2135 * Fixed bug in Linux get_default_gateway function
2136 introduced in 2.0.4, which would cause redirect-gateway
2137 on Linux clients to fail.
2138 * Moved easy-rsa 2.0 scripts to easy-rsa/2.0 to
2139 be compatible with 2.0.x distribution.
2140 * Documented --route-nopull.
2141 * Documented --ip-win32 adaptive.
2142 * Windows build now linked with LZO2.
2143 * Allow ca, cert, key, and dh files to be specified
2144 inline via XML-like syntax without needing to
2145 reference an explicit file.
2150 * Allow plugin and push directives to have multi-line
2151 parameter lists such as:
2157 * Added connect-retry-max option (Alon Bar-Lev).
2158 * Fixed problems where signals thrown during initialization
2159 were not returning to a management-hold state.
2160 * Added a backtrack-hardened system time algorithm.
2161 * Added --remote-cert-ku, --remote-cert-eku, and
2162 --remote-cert-tls options for verifying certificate
2163 attributes (Alon Bar-Lev).
2164 * For Windows, reverted --ip-win32 default back to "dynamic".
2165 To use new adaptive mode, set explicitly.
2167 2005.11.01 -- Version 2.1-beta6
2169 * Security fix (merged from 2.0.4) -- Affects non-Windows
2170 OpenVPN clients of version 2.0 or higher which connect to
2171 a malicious or compromised server. A format string
2172 vulnerability in the foreign_option function in options.c
2173 could potentially allow a malicious or compromised server
2174 to execute arbitrary code on the client. Only
2175 non-Windows clients are affected. The vulnerability
2176 only exists if (a) the client's TLS negotiation with
2177 the server succeeds, (b) the server is malicious or
2178 has been compromised such that it is configured to
2179 push a maliciously crafted options string to the client,
2180 and (c) the client indicates its willingness to accept
2181 pushed options from the server by having "pull" or
2182 "client" in its configuration file (Credit: Vade79).
2184 * Security fix -- (merged from 2.0.4) Potential DoS
2185 vulnerability on the server in TCP mode. If the TCP
2186 server accept() call returns an error status, the resulting
2187 exception handler may attempt to indirect through a NULL
2188 pointer, causing a segfault. Affects all OpenVPN 2.0 versions.
2190 * Fix attempt of assertion at multi.c:1586 (note that
2191 this precise line number will vary across different
2192 versions of OpenVPN).
2193 * Windows reliability changes:
2194 (a) Added code to make sure that the local PATH environmental
2195 variable points to the Windows system32 directory.
2196 (b) Added new --ip-win32 adaptive mode which tries 'dynamic'
2197 and then fails over to 'netsh' if the DHCP negotiation fails.
2198 (c) Made --ip-win32 adaptive the default.
2199 * More PKCS#11 additions/changes (Alon Bar-Lev).
2200 * Added ".PHONY: plugin" to Makefile.am to work around
2202 * Fixed double fork issue that occurs when --management-hold
2204 * Moved TUN/TAP read/write log messages from --verb 8 to 6.
2205 * Warn when multiple clients having the same common name or
2206 username usurp each other when --duplicate-cn is not used.
2207 * Modified Windows and Linux versions of get_default_gateway
2208 to return the route with the smallest metric
2209 if multiple 0.0.0.0/0.0.0.0 entries are present.
2210 * Added ">NEED-OK" alert and "needok" command to management
2211 interface to provide a general interface for sending
2212 alerts to the end-user. Used by the PKCS#11 code
2213 to send Token Insertion Requests to the user.
2214 * Added actual remote address used to the ">STATE" alert
2215 in the management interface (Rolf Fokkens).
2217 2005.10.17 -- Version 2.1-beta4
2219 * Fixed bug introduced in 2.1-beta3 where management
2220 socket bind would fail.
2221 * --capath fix in ssl.c (Zhuang Yuyao).
2222 * Added ".PHONY: plugin" to Makefile.am, reverted
2223 location of "plugin" directory (thanks to
2224 Matthias Andree for figuring this out).
2226 2005.10.16 -- Version 2.1-beta3
2228 * Added PKCS#11 support (Alon Bar-Lev).
2229 * Enable the use of --ca together with --pkcs12. If --ca is
2230 used at the same time as --pkcs12, the CA certificate is loaded
2231 from the file specified by --ca regardless if the pkcs12 file
2232 contains a CA cert or not (Mathias Sundman).
2233 * Merged --capath patch (Thomas Noel).
2234 * Merged --multihome patch.
2235 * Added --bind option for TCP client connections (Ewan Bhamrah
2237 * Moved "plugin" directory to "plugins" to deal with strange
2238 automake problem that ended up being also fixable with
2239 ".PHONY: plugin" in Makefile.am.
2241 2005.10.13 -- Version 2.1-beta2
2243 * Made --sndbuf and --rcvbuf pushable.
2245 2005.10.01 -- Version 2.1-beta1
2247 * Made LZO setting pushable.
2248 * Renamed sample-keys/tmp-ca.crt to ca.crt.
2249 * Fixed bug where remove_iroutes_from_push_route_list
2250 was missing routes if those routes had
2251 an implied netmask (by omission) of 255.255.255.255.
2252 * Merged with 2.0.3-rc1
2253 * easy-rsa/2.0 moved to easy-rsa
2254 * old easy-rsa moved to easy-rsa/1.0
2256 2005.09.23 -- Version 2.0.2-TO4
2258 * Added feature to TAP-Win32 adapter to allow it to be
2259 opened from non-administrator mode. This feature
2260 is enabled by default, and can be enabled/disabled
2261 in the adapter advanced properties dialog.
2262 * Added --allow-nonadmin standalone option for Windows to
2263 set TAP adapter to allow non-admin access. This
2264 is a user-mode version of the code, and duplicates
2265 the same feature as the above entry.
2266 * Added fix that attempts to solve corner case of tunnel not
2267 forwarding packets when system clock is reset to an earlier time.
2268 * Added --redirect-gateway bypass-dns option. (Developers:
2269 To add bypass-dhcp or bypass-dns support to other OSes,
2270 add a get_bypass_addresses function to route.c for
2272 * Added OPENVPN_PLUGIN_CLIENT_CONNECT_V2 plugin callback, which
2273 allows a client-connect plugin to return configuration text
2274 in memory, rather than via a file.
2275 * Fixed a bug where --mode server --proto tcp-server --cipher none
2276 operation could cause tunnel packet truncation.
2277 * openvpn --version will show [LZO1] or [LZO2], depending on
2278 version that was linked.
2280 2005.09.07 -- Version 2.0.2-TO1
2282 * Added --topology directive. See man page.
2283 * Added --redirect-gateway bypass-dhcp option to add a route
2284 allowing DHCP packets to bypass the tunnel, when the
2285 DHCP server is non-local. Currently only implemented
2287 * Modified OpenVPN Service on Windows to declare the DHCP
2288 client service as a dependency.
2289 * Extended the plugin interface to allow plugins to declare
2290 per-client constructor and destructor functions, to make
2291 it simpler for plugins to maintain per-client state.
2293 2005.09.25 -- Version 2.0.3-rc1
2295 * openvpn_plugin_abort_v1 function wasn't being properly
2296 registered on Windows.
2297 * Fixed a bug where --mode server --proto tcp-server --cipher none
2298 operation could cause tunnel packet truncation.
2300 2005.08.25 -- Version 2.0.2
2302 * No change from 2.0.2-rc1.
2304 2005.08.24 -- Version 2.0.2-rc1
2306 * Fixed regression bug in Win32 installer, introduced in 2.0.1,
2307 which incorrectly set OpenVPN service to autostart.
2308 * Don't package source code zip file in Windows installer
2309 in order to reduce the size of the installer. The source
2310 zip file can always be downloaded separately if needed.
2311 * Fixed bug in route.c in FreeBSD, Darwin, OpenBSD and NetBSD
2312 version of get_default_gateway. Allocated socket for route
2313 manipulation is never freed so number of mbufs continuously
2314 grow and exhaust system resources after a while (Jaroslav Klaus).
2315 * Fixed bug where "--proto tcp-server --mode p2p --management
2316 host port" would cause the management port to not respond until
2317 the OpenVPN peer connects.
2318 * Modified pkitool script to be /bin/sh compatible (Johnny Lam).
2320 2005.08.16 -- Version 2.0.1
2322 * Security Fix -- DoS attack against server when run with "verb 0" and
2323 without "tls-auth". If a client connection to the server fails
2324 certificate verification, the OpenSSL error queue is not properly
2325 flushed, which can result in another unrelated client instance on the
2326 server seeing the error and responding to it, resulting in disconnection
2327 of the unrelated client (CAN-2005-2531).
2328 * Security Fix -- DoS attack against server by authenticated client.
2329 This bug presents a potential DoS attack vector against the server
2330 which can only be initiated by a connected and authenticated client.
2331 If the client sends a packet which fails to decrypt on the server,
2332 the OpenSSL error queue is not properly flushed, which can result in
2333 another unrelated client instance on the server seeing the error and
2334 responding to it, resulting in disconnection of the unrelated client
2335 (CAN-2005-2532). Credit: Mike Ireton.
2336 * Security Fix -- DoS attack against server by authenticated client.
2337 A malicious client in "dev tap" ethernet bridging mode could
2338 theoretically flood the server with packets appearing to come from
2339 hundreds of thousands of different MAC addresses, causing the OpenVPN
2340 process to deplete system virtual memory as it expands its internal
2341 routing table. A --max-routes-per-client directive has been added
2342 (default=256) to limit the maximum number of routes in OpenVPN's
2343 internal routing table which can be associated with a given client
2345 * Security Fix -- DoS attack against server by authenticated client.
2346 If two or more client machines try to connect to the server at the
2347 same time via TCP, using the same client certificate, and when
2348 --duplicate-cn is not enabled on the server, a race condition can
2349 crash the server with "Assertion failed at mtcp.c:411"
2351 * Fixed server bug where under certain circumstances, the client instance
2352 object deletion function would try to delete iroutes which had never been
2353 added in the first place, triggering "Assertion failed at mroute.c:349".
2354 * Added --auth-retry option to prevent auth errors from being fatal
2355 on the client side, and to permit username/password requeries in case
2356 of error. Also controllable via new "auth-retry" management interface
2357 command. See man page for more info.
2358 * Added easy-rsa 2.0 scripts to the tarball in easy-rsa/2.0
2359 * Fixed bug in openvpn.spec where rpmbuild --define 'without_pam 1'
2360 would fail to build.
2361 * Implement "make check" to perform loopback tests (Matthias Andree).
2363 2005.07.21 -- Version 2.0.1-rc7
2365 * Support LZO 2.01 which renamed its library to lzo2 (Matthias Andree).
2366 * Include linux/types.h before checking for linux/errqueue.h (Matthias
2369 2005.07.15 -- Version 2.0.1-rc6
2371 * Commented out "user nobody" and "group nobody" in sample
2372 client/server config files.
2373 * Allow '@' character to be used in --client-config-dir
2376 2005.07.04 -- Version 2.0.1-rc5
2378 * Windows version will log a for-further-info URL when
2379 initialization sequence is completed with errors.
2380 * Added DLOPEN_PAM parameter to plugin/auth-pam/Makefile
2381 to control whether auth-pam plugin links to PAM via
2382 dlopen or -lpam. By default, DLOPEN_PAM=1 so pre-existing
2383 behavior should be preserved. DLOPEN_PAM=0 is the preferred
2384 setting to link via -lpam, but DLOPEN_PAM=1 works around
2385 a bug in SuSE 9.1 (and possibly other distros as well)
2386 where the PAM modules are not linked with -lpam. See
2387 thread on openvpn-devel for more discussion about this
2388 patch (Simon Perreault).
2390 2005.06.15 -- Version 2.0.1-rc4
2392 * Support LZO 2.00, including changes to configure script to
2393 autodetect LZO version.
2395 2005.06.12 -- Version 2.0.1-rc3
2397 * Fixed a bug which caused standard file handles to not be closed
2398 after daemonization when --plugin and --daemon are used together,
2399 and if the plugin initialization function forks (as does auth-pam
2400 and down-root) (Simon Perreault).
2401 * Added client-side up/down scripts in contrib/pull-resolv-conf
2402 for accepting server-pushed "dhcp-option DOMAIN" and "dhcp-option DNS"
2403 on Linux/Unix systems (Jesse Adelman).
2404 * Fixed bug where if client-connect scripts/plugins were cascaded,
2405 and one (but not all) of them returned an error status, there might
2406 be cases where for an individual script/plugin, client-connect was
2407 called but not client-disconnect. The goal of this fix is to
2408 ensure that if client-connect is called on a given client instance,
2409 then client-disconnect will definitely be called. A potential
2410 complication of this fix is that when client-connect functions are
2411 cascaded, it's possible that the client-disconnect function would
2412 be called in cases where the related client-connect function returned
2413 an error status. This fix should not alter OpenVPN behavior when
2414 scripts/plugins are not cascaded.
2415 * Changed the hard-to-reproduce "Assertion failed at fragment.c:312"
2416 fatal error to a warning: "FRAG: outgoing buffer is not empty".
2417 Need more info on how to reproduce this one.
2418 * When --duplicate-cn is used, the --ifconfig-pool allocation
2419 algorithm will now allocate the first available IP address.
2420 * When --daemon and --management-hold are used together,
2421 OpenVPN will daemonize before it enters the management hold state.
2423 2005.05.16 -- Version 2.0.1-rc2
2425 * Modified vendor test in openvpn.spec file to match against
2426 "Mandrakesoft" in addition to "MandrakeSoft".
2427 * Using --iroute in a --client-config-dir file while in --dev tap
2428 mode is not currently supported and will produce a warning
2429 message. Fixed bug where in certain cases, in addition to
2430 generating a warning message, this combination of options
2431 would also produce a fatal assertion in mroute.c.
2432 * Pass --auth-user-pass username to server-side plugin without
2433 performing any string remapping (plugins, unlike scripts,
2434 don't get any security benefit from string remapping).
2435 This is intended to fix an issue with openvpn-auth-pam/pam_winbind
2436 where backslash characters in a username ('\') were being remapped
2437 to underscore ('_').
2438 * Updated OpenSSL DLLs in Windows build to 0.9.7g.
2439 * Documented --explicit-exit-notify in man page.
2440 * --explicit-exit-notify seconds parameter defaults to 1 if
2443 2005.04.30 -- Version 2.0.1-rc1
2445 * Fixed bug where certain kinds of fatal errors after
2446 initialization (such as port in use) would leave plugin
2447 processes (such as openvpn-auth-pam) still running.
2448 * Added optional openvpn_plugin_abort_v1 plugin function for
2449 closing initialized plugin objects in the event of a fatal
2450 error by main OpenVPN process.
2451 * When the --remote list is > 1, and --resolv-retry is not
2452 specified (meaning that it defaults to "infinite"), apply the
2453 infinite timeout to the --remote list as a whole, but try each
2454 list item only once before moving on to the next item.
2455 * Added new --syslog directive which redirects output
2456 to syslog without requiring the use of the --daemon or --inetd
2458 * Added openvpn.spec option to allow RPM to be built with support
2459 for passwords read from a file:
2460 rpmbuild -tb [openvpn.x.tar.gz] --define 'with_password_save 1'
2462 2005.04.17 -- Version 2.0
2464 * Fixed minor options string typo in options.c.
2466 2005.04.10 -- Version 2.0-rc21
2468 * Change license description from "GPL Version 2 or (at your
2469 option) any later version" to just "GPL Version 2".
2471 2005.04.04 -- Version 2.0-rc20
2473 * Dag Wieers has put together an OpenVPN/LZO binary RPM set with
2474 excellent distro/version coverage for RH/EL/Fedora, though
2475 using his own SPEC. I modified openvpn.spec to follow some of
2476 the same conventions such as putting sample scripts and doc
2477 files in %doc rather than /usr/share/openvpn.
2478 * Minor change to init scripts to run the user-defined script
2479 /etc/openvpn/openvpn-startup (if it exists) before any OpenVPN
2480 configs are started, and to run /etc/openvpn/openvpn-shutdown
2481 after all OpenVPN configs have been stopped. The
2482 openvpn-startup script can be used for stuff like
2483 insmod tun.o, setting up firewall rules, or starting
2486 2005.03.29 -- Version 2.0-rc19
2488 * Omit additions of routes where the network and
2489 gateway are equal and the netmask is 255.255.255.255.
2490 This can come up if you are using both
2491 server/ifconfig-pool and client-config-dir with
2492 ifconfig-push static addresses for some subset of clients
2493 which directly reference the server IP address as the
2496 2005.03.28 -- Version 2.0-rc18
2498 * Packaged Windows installer with OpenSSL 0.9.7f.
2499 * Built Windows installer with NSIS 2.06.
2501 2005.03.12 -- Version 2.0-rc17
2503 * "MANAGEMENT: CMD" log file output will now only occur
2504 at --verb 7 or greater.
2505 * Added an optional name/value configuration list to
2506 the openvpn-auth-pam plugin module argument list. See
2507 plugin/auth-pam/README for documentation. This is necessary
2508 in order for openvpn-auth-pam to work with queries generated
2509 by arbitrary PAM modules.
2510 * In both auth-pam and down-root plugins, in the forked process,
2511 a read error on the parent process socket is no longer fatal.
2512 * MandrakeSoft liblzo1 RPM only Provides for a 'liblzo1'.
2513 A conditional test of the vendor has been added to
2514 Require the appropriately named 'lzo' (liblzo1 / lzo).
2515 (Tom Walsh - http://openhardware.net)
2518 2005.02.20 -- Version 2.0-rc16
2520 * Fixed bug introduced in rc13 where Windows service wrapper
2521 would be installed with a startup type of Automatic.
2522 This fix restores the previous behavior of installing
2523 with a startup type of Manual.
2525 2005.02.19 -- Version 2.0-rc15
2527 * Added warning when --keepalive is not used in a server
2529 * Don't include OpenSSL md4.h file if we are not building
2530 NTLM proxy support (Waldemar Brodkorb).
2531 * Added easy-rsa/build-key-pkcs12 and
2532 easy-rsa/Windows/build-key-pkcs12.bat scripts
2535 2005.02.16 -- Version 2.0-rc14
2537 * Fixed small memory leak that occurs when --crl-verify
2539 * Upgraded Windows installer and .nsi script to NSIS 2.05
2541 * Changed #include backslash usage in cryptoapi.c to use
2542 forward slashes instead (Gisle Vanem).
2543 * Created easy-rsa/revoke-full to handle revocations in
2544 a single step: (a) revoke crt, (b) regenerate CRL, and
2545 (c) verify that revocation succeeded.
2546 * Renamed easy-rsa/Windows/revoke-key to revoke-full so
2547 that both *nix and Windows scripts are equivalent.
2549 2005.02.11 -- Version 2.0-rc13
2551 * Improve human-readability of local/remote options
2552 diff, when inconsistencies are present.
2553 * For Windows easy-rsa, distribute vars.bat.sample and
2554 openssl.cnf.sample, then copy them to their normal
2555 filenames (without the .sample) when init-config.bat
2556 is run. This is to prevent OpenVPN upgrades from
2557 wiping out vars.bat and openssl.cnf edits.
2558 * Modified service wrapper (Windows) to use a
2559 case-insensitive search when scanning for .ovpn files
2560 in \Program Files\OpenVPN\config. Prior versions
2561 required an all-lower-case .ovpn file extension.
2562 * Miscellaneous service wrapper code cleanup.
2563 * If --user/--group is used on Windows, treat it
2564 as a no-op with a warning (this makes it easier to
2565 distribute the same client config file to Windows
2567 * Warn if --ifconfig-pool-persist is used with
2570 2005.02.05 -- Version 2.0-rc12
2572 * Removed some debugging code inadvertently included
2573 in rc11 which would print the --auth-user-pass
2574 username/password provided by clients in the server
2576 * Client code for cycling through --remote list will
2577 retry the last address which successfully authenticated
2578 before moving on through the list.
2579 * Windows installer will now install sample configuration
2580 files in \Program Files\OpenVPN\sample-configs as well
2581 as generate a start menu shortcut to this directory.
2582 * Minor type change in buffer.[ch] to work around char-type
2583 ambiguity bug. Caused management interface lock-ups on
2584 ARM when building with armv4b-hardhat-linux-gcc 2.95.3.
2586 2005.02.03 -- Version 2.0-rc11
2588 * Windows installer will now install easy-rsa directory
2589 in \Program Files\OpenVPN
2590 * Allow syslog facility to be controlled at compile time,
2591 e.g. -DLOG_OPENVPN=LOG_LOCAL6 (P Kern).
2592 * Changed certain shell scripts in distribution to use
2593 #!/bin/sh rather than #!/bin/bash for better portability.
2594 * If --ifconfig-pool-persist seconds parameter is 0, treat
2595 persist file as an allocation of fixed IP addresses
2596 (previous versions took IP-to-common-name associations
2597 from this list as hints, not mandatory static allocations).
2598 * Fixed bug on *nix where if --auth-user-pass and --log
2599 were used together, the username prompt would be sent to
2600 the log file rather than /dev/tty.
2601 * Spurious text in openvpn.8 detected by doclifter
2603 * Call closelog later on daemon kill so that process
2604 exit message is written to syslog.
2606 2005.01.27 -- Version 2.0-rc10
2608 * When ./configure is run with plugins enabled (the default),
2609 check whether or not dlopen exists in libc before testing
2610 for libdl. This is to fix an issue on FreeBSD and possibly
2611 other OSes which bundle libdl functions in libc.
2612 * On Windows, filter initial WSAEINVAL warning which occurs
2613 on the initial read attempt of an unbound socket.
2614 * The easy-rsa scripts build-key, build-key-pass, and
2615 build-key-server will now chmod the .key file
2616 to 0600. This is in addition to the fact the generated
2617 keys directory has always been similarly protected
2620 2005.01.23 -- Version 2.0-rc9
2622 * Fixed error "ROUTE: route addition failed using
2623 CreateIpForwardEntry ..." on Windows when --redirect-gateway
2624 is used over a RRAS internet link.
2625 * When using --route-method exe on Windows, include the
2626 gateway parameter on route delete commands (Mathias Sundman).
2627 * Try not to do a hard reset (i.e. SIGHUP) when two
2628 SIGUSR1 signals are received in close succession.
2629 * If the push list tries to grow beyond its buffer capacity,
2630 the resulting error will be non-fatal.
2631 * To increase the push list capacity (must be done on both
2632 client and server), increase TLS_CHANNEL_BUF_SIZE in
2633 common.h (default=1024).
2635 2005.01.15 -- Version 2.0-rc8
2637 * Fixed bug introduced in rc7 where options error
2638 "--auth-user-pass requires --pull" might occur even
2639 if --pull was correctly specified.
2640 * Changed management interface code to bind once
2641 to TCP socket, rather than rebinding after every
2643 * Added "disable" directive for client-config-dir
2645 * Windows binary install is now distributed with
2647 * Query the management interface for --http-proxy
2648 username/password if authfile is set to "stdin".
2649 * Added current OpenVPN version number to "Unrecognized
2650 option or missing parameter" error message.
2651 * Added "-extensions server" to "openssl req" command
2652 in easy-rsa/build-key-server (Nir Yeffet).
2654 2005.01.10 -- Version 2.0-rc7
2656 * Fixed bug in management interface which could cause
2657 100% CPU utilization in --proto tcp-server mode
2658 on all *nix OSes except for Linux 2.6.
2659 * --ifconfig-push now accepts DNS names as well as
2661 * Added sanity check errors when --pull or
2662 --auth-user-pass is used in an incorrect mode.
2663 * Updated man page entries for --client-connect and
2665 * Added "String Types and Remapping" section to man
2666 page to consisely document the way which OpenVPN
2667 may convert certain types of characters in strings
2669 * Modified bridging description in HOWTO to emphasize
2670 the fact that bridging allows Windows file and print
2671 sharing without a WINS server (Charles Duffy).
2673 2004.12.20 -- Version 2.0-rc6
2675 * Improved checking for epoll support in ./configure
2676 to fix false positive on RH9 (Jan Just Keijser).
2677 * Made the "MULTI TCP: I/O wait required blocking in
2678 multi_tcp_action, action=7" error nonfatal and replaced
2679 with "MULTI: Outgoing TUN queue full, dropped packet".
2680 So far the issue only seems to occur on Linux 2.2
2681 in --mode server --proto tcp mode. It occurs when
2682 the TUN/TAP driver locks up and refuses to accept
2683 new packet writes for a second or more.
2684 * Fixed bug where if a --client-config-dir file tried
2685 to include another file using "config", and if that
2686 include failed, OpenVPN would abort with a fatal
2687 error. Now such inclusion failures will be logged
2688 but are no longer fatal.
2689 * Global changes to the way that packet buffer alignment
2690 is handled. Previously we didn't care about alignment
2691 and took care, when handling 16 and 32 bit words
2692 in buffers, to always use alignment-safe transfers.
2693 This approach appears to be inadequate on some
2694 architectures such as alpha. The new approach is
2695 to initialize packet buffers in a way that anticipates
2696 how component structures will be allocated within
2697 them, to maintain correct alignment.
2698 * Added --dhcp-option DISABLE-NBT to disable NetBIOS
2699 over TCP (Jan Just Keijser).
2700 * Added --http-proxy-option directive for controlling
2701 miscellaneous HTTP proxy options.
2702 * Management state will no longer transition to "WAIT"
2703 during TLS renegotiations.
2705 2004.12.16 -- Version 2.0-rc5
2707 * The --client-config-dir option will now try to open
2708 a default file called "DEFAULT" if no file matching
2709 the common name of the incoming client was found.
2710 * The --client-connect script/plugin can now veto client
2711 authentication by returning a failure code.
2712 * The --learn-address script/plugin can now prevent a
2713 client-instance/address association from being learned
2714 by returning a failure code.
2715 * Changed RPM group in .spec file to Applications/Internet.
2717 2004.12.14 -- Version 2.0-rc4
2719 * SuSE only -- Fixed interaction between openvpn.spec and
2720 suse/openvpn.init where the .spec file was writing the
2721 OpenVPN binary to a different location than where the
2722 .init script was referencing it (Stefan Engel).
2723 * Solaris only -- Split Solaris ifconfig command into two
2724 parts (Jan Just Keijser).
2725 * Some cleanup in add_option().
2726 * Better error checking on input dotted quad IP addresses.
2727 * Verify that --push argument is quoted, if there is
2729 * More miscellaneous option sanity checks.
2731 2004.12.13 -- Version 2.0-rc3
2733 * On Windows, when --log or --log-append is used,
2734 save the original stderr for username and password
2736 * Fixed a bug introduced in the late 2.0 betas where
2737 if a "verb" parameter >= 16 was used, it would be
2738 ignored and the actual verb level would remain at 1.
2739 * Fixed a bug mostly seen on OS X where --management-hold
2740 or --management-query-passwords would cause the management
2741 interface to be unresponsive to incoming client connections.
2742 * Trigger an options error if one of the management-modifying
2743 options is used without "management" itself.
2745 2004.12.12 -- Version 2.0-rc2
2747 * Amplified warnings in documentation about possible
2748 man-in-the-middle attack when clients do not properly
2749 verify server certificate. Changes to easy-rsa README,
2750 FAQ, HOWTO, man page, and sample client config file.
2751 * Added a warning message if --tls-client or --client
2752 is used without also specifying one of either
2753 --ns-cert-type, --tls-remote, or --tls-verify.
2754 * status_open() fixes for MSVC builds (Blaine Fleming).
2755 * Fix attempt of "ntlm.c:55: error: `des_cblock' undeclared"
2756 compiler error which has been reported on some platforms.
2757 * The openvpn.spec file for rpmbuild has several
2758 new build-time options. See comments in the file.
2759 * Plugins are now built and packaged in the RPM and
2760 will be saved in /usr/share/openvpn/plugin/lib.
2761 * Added --management-hold directive to start OpenVPN
2762 in a hibernating state until released by the
2763 management interface. Also added "hold" command
2764 to the management interface.
2766 2004.12.07 -- Version 2.0-rc1
2768 * openvpn.spec workaround for SuSE confusion regarding
2769 /etc/init.d vs. /etc/rc.d/init.d (Stefan Engel).
2771 2004.12.05 -- Version 2.0-beta20
2773 * The ability to read --askpass and --auth-user-pass
2774 passwords from a file has been disabled by default.
2775 To re-enable, use ./configure --enable-password-save.
2776 * Added additional pre-connected states to management
2777 interface. See management/management-notes.txt
2779 * State history is now recorded by the management
2780 interface, and the "state" command now works like
2781 the log or echo commands.
2782 * State history and real-time state change notifications
2783 are now prepended with an integer unix timestamp.
2784 * Added --http-proxy-timeout option, previously
2785 the timeout was hardcoded to 5 seconds.
2787 2004.12.02 -- Version 2.0-beta19
2789 * Fixed bug in management interface line termination
2790 where output lines incorrectly contained a \00 char
2791 after the customary \0d \0a.
2792 * Fixed bug introduced in beta18 where Windows version
2793 would segfault on options errors.
2794 * Fixed bug in management interface where an empty
2795 quoted string ("") entered as a parameter would cause
2797 * Fixed bug where --resolv-retry was not working
2798 properly with multiple --remote hosts.
2799 * Added additional ./configure options to reduce
2800 executable size for embedded applications.
2801 See ./configure --help.
2803 2004.11.28 -- Version 2.0-beta18
2805 * Added management interface. See new --management-*
2806 options or the full management interface documentation
2807 in management/management-notes.txt in the tarball.
2808 Management interface inclusion can be disabled by
2809 ./configure --disable-management.
2810 * Added two new plugin modules: auth-pam and down-root.
2811 Auth-pam supports pam-based authentication using a
2812 split privilege execution model, while down-root enables
2813 a down script to be executed with root privileges, even
2814 when --user/--group is used to drop root privileges.
2815 See the plugin directory in the tarball for READMEs,
2816 source code, and Makefiles.
2817 * Plugin developers should note that some changes were
2818 made to the plugin interface since beta17. See
2819 openvpn-plugin.h for details.
2820 Plugin interface inclusion can be disabled with
2821 ./configure --disable-plugins
2822 * Added easy-rsa/build-key-server script which will
2823 build a certificate with with nsCertType=server.
2824 * Added --ns-cert-type option for verification
2825 of nsCertType field in peer certificate.
2826 * If --fragment n is specified and --mssfix is specified
2827 without a parameter, default --mssfix to n. This restores
2828 the 1.6 behavior when using --mssfix without a parameter.
2829 * Fixed SSL context initialization bug introduced in beta14
2830 where this error might occur on restarts: "Cannot load
2831 certificate chain ... PEM_read_bio:no start line".
2833 2004.11.11 -- Version 2.0-beta17
2835 * Changed default port number to 1194 per IANA official
2836 port number assignment.
2837 * Added --plugin directive which allows compiled
2838 modules to intercept script callbacks. See
2839 plugin folder in tarball for more info.
2840 * Fixed bug introduced in beta12 where --key-method 1
2841 authentications which should have succeeded would fail.
2842 * Ignore SIGUSR1 during DNS resolution.
2843 * Added SuSE support to openvpn.spec (Umberto Nicoletti).
2844 * Fixed --cryptoapicert SUBJ: parsing bug (Peter 'Luna'
2847 2004.11.07 -- Version 2.0-beta16
2849 * Modified sample-scripts/auth-pam.pl to get username
2850 and password from OpenVPN via a file rather than
2851 via environmental variables.
2852 * Added bytes_sent and bytes_received environmental
2853 variables to be set prior to client-disconnect script.
2854 * Changed client virtual IP derivation precedence:
2855 (1) use --ifconfig-push directive from --client-connect
2856 script, (2) use --ifconfig-push directive from
2857 --client-config-dir, and (3) use --ifconfig-pool
2859 * If a --client-config-dir file specifies --ifconfig-push,
2860 it will be visible to the --client-connect-script in
2861 the ifconfig_pool_remote_ip environmental variable.
2862 * For tun-style tunnels, the ifconfig_pool_local_ip
2863 environmental variable will be set, while for
2864 tap-style tunnels, the ifconfig_pool_netmask variable
2866 * Added intelligence to autoconf script to test
2867 compiler for the accepted form of zero-length arrays.
2868 * Fixed a bug introduced in beta12 where --ip-win32
2869 netsh would fail if --dev-node was not explicitly
2871 * --ip-win32 netsh will now work on hidden adapters.
2872 * Fix attempt of "Assertion failed at crypto.c:149".
2873 This assertion has also been reported on 1.x with a
2874 slightly different line number. The fix is twofold:
2875 (1) In previous releases, --mtu-test may trigger this
2876 assertion -- this bug has been fixed. (2) If something
2877 else causes the assertion to be thrown, don't panic,
2878 just output a nonfatal warning to the log and drop
2879 the packet which generated the error.
2880 * Support TAP interfaces on Mac OS X (Waldemar Brodkorb).
2881 * Added --echo directive.
2882 * Added --auth-nocache directive.
2884 2004.10.28 -- Version 2.0-beta15
2886 * Changed environmental variable character classes
2887 so that names must consist of alphanumeric or
2888 underbar chars and values must consist of printable
2889 characters. Illegal chars will be deleted.
2890 Versions prior to 2.0-beta12 were more restrictive
2891 and would map spaces to '.'.
2892 * On Windows, when the TAP adapter fails to
2893 initialize with the correct IP address, output
2894 "Initialization Sequence Completed with Errors"
2895 to the console or log file.
2896 * Added a warning when user/group/chroot is used
2897 without persist-tun and persist-key.
2898 * Added cryptoapi.[ch] to tarball and source zip.
2899 * --tls-remote option now works with common name
2900 prefixes as well as with the full X509 subject
2901 string. This is a useful alternative to using
2902 a CRL on the client.
2903 * common names associated with a static
2904 --ifconfig-push setting will no longer leave
2905 any state in the --ifconfig-pool-persist file.
2906 * Hard TLS errors (TLS handshake failed) will now
2907 trigger either a SIGUSR1 signal by default
2908 or SIGTERM (if --tls-exit is specified). In TCP
2909 mode, all TLS errors are considered to be hard.
2910 In server mode, the signal will be local to the
2912 * Added method parameter to --auth-user-pass-verify
2913 directive to select whether username/password
2914 is passed to script via environment or a temporary
2916 * Added --status-version option to control format
2917 of --status file. The --mode server
2918 --status-version 2 format now includes a line
2919 type token, the virtual IP address is shown
2920 in the client list (even in --dev tap mode),
2921 and the integer time_t value is shown anywhere
2922 an ascii-formatted time/date is also shown.
2923 * Added --remap-usr1 directive which can be used
2924 to control whether internally or externally
2925 generated SIGUSR1 signals are remapped to
2926 SIGHUP (restart without persisting state) or
2928 * When running as a Windows service (using
2929 --service option), check the exit event before
2930 and after reading one line of input from
2931 stdin, when reading username/password info.
2932 * For developers: Extended the --gremlin function
2933 to better stress-test the new 2.0 features,
2934 added Valgrind support on Linux and Dmalloc
2937 2004.10.19 -- Version 2.0-beta14
2939 * Fixed a bug introduced in Beta12 that would occur
2940 if you use a --client-connect script without also
2942 * Fixed a bug introduced in Beta12 where a learn-address
2943 script might segfault on the delete method.
2944 * Added Crypto API support in Windows version via
2945 the --cryptoapicert option (Peter 'Luna' Runestig).
2947 2004.10.18 -- Version 2.0-beta13
2949 * Fixed an issue introduced in Beta12 where the private
2950 key password would not be prompted for unless --askpass
2951 was explicitly specified in the config.
2953 2004.10.17 -- Version 2.0-beta12
2955 * Added support for username/password-based authentication.
2956 Clients can now authentication themselves with the server
2957 using either a certificate, a username/password, or both.
2958 New directives: --auth-user-pass, --auth-user-pass-verify,
2959 --client-cert-not-required, and --username-as-common-name.
2960 * Added NTLM proxy patch (William Preston).
2961 * Added --ifconfig-pool-linear server flag to allocate
2962 individual tun addresses for clients rather than /30
2963 subnets (won't work with Windows clients).
2964 * Modified --http-proxy code to cache username/password
2966 * Modified --http-proxy code to read username/password
2967 from the console when the auth file is given as "stdin".
2968 * Modified --askpass to take an optional filename argument.
2969 * --persist-tun and --persist-key now work in client mode
2970 and can be pushed to clients as well.
2971 * Added --ifconfig-pool-persist directive, to maintain
2972 ifconfig-pool info in a file which is persistent across
2973 daemon instantiations.
2974 * --user and --group privilege downgrades as well as
2975 --chroot now also work in client mode (the
2976 dowgrade/chroot will be delayed until the initialization
2977 sequence is completed).
2978 * Added --show-engines standalone directive to show
2979 available OpenSSL crypto accelerator engine support.
2980 * --engine directive now accepts an optional engine-ID
2981 parameter to control which engine is used.
2982 * "Connection reset, restarting" log message now shows
2983 which client is being reset.
2984 * Added --dhcp-pre-release directive in Windows version.
2985 * Second parm to --ip-win32 can be "default", e.g.
2986 --ip-win32 dynamic default 60.
2987 * Fixed documentation bug regarding environmental
2988 variable settings for --ifconfig-pool IP addresses.
2989 The correct environmental variable names are:
2990 ifconfig_pool_local_ip and ifconfig_pool_remote_ip.
2991 * ifconfig_pool_local_ip and ifconfig_pool_remote_ip
2992 environmental variables are now passed to the
2993 client-disconnect script.
2994 * In server mode, environmental variables are now scoped
2995 according to the client they are associated with,
2996 to solve the problem of "crosstalk" between different
2997 client's environmental variable sets.
2998 * Added --down-pre flag to cause --down script to be
2999 called before TUN/TAP close (rather than after).
3000 * Added --tls-exit flag which will cause OpenVPN
3001 to exit on any TLS errors.
3002 * Don't push a route to a client if it exactly
3003 matches an iroute (this lets you push routes to
3004 all clients, and OpenVPN will automatically remove
3005 the route from the route push list only for that client
3006 which the route actually belongs to).
3007 * Made '--resolv-retry infinite' the default.
3008 --resolv-retry can be disabled by using a parameter of 0.
3009 * For clients which plan to pull config info from server,
3010 set an initial default ping-restart of 60 seconds.
3011 * Optimized mute code to lessen the load on the processor
3012 when messages are being muted at a higher frequency.
3013 * Made route log messages non-mutable.
3014 * Silence the Linux "No buffer space available" message.
3015 * Added miscellaneous additional option sanity checks.
3016 * Added Windows version of easy-rsa scripts in
3017 easy-rsa/Windows directory (Andrew J. Richardson).
3018 * Added NetBSD route patch (Ed Ravin).
3019 * Added OpenBSD patch for TAP + --redirect-gateway
3020 (Waldemar Brodkorb).
3021 * Directives which prompt for a username and/or password
3022 will now work with --daemon (OpenVPN will prompt
3024 * Warn if CRL is from a different issuer than the
3025 issuer of the peer certificate (Bernhard Weisshuhn).
3026 * Changed init script chkconfig parameters to start
3027 OpenVPN daemon(s) before NFS.
3028 * Bug fix attempt of "too many I/O wait events" which occurs
3029 on OSes which prefer select() over poll() such as Mac OS X.
3030 * Added --ccd-exclusive flag. This flag will require, as a
3031 condition of authentication, that a connecting client has
3032 a --client-config-dir file.
3033 * TAP-Win32 open code will attempt to open a free adapter
3034 if --dev-node is not specified (Mathias Sundman).
3035 * Resequenced --nice and --chroot ordering so that --nice
3037 * Added --suppress-timestamps flag (Charles Duffy).
3038 * Source code changes to allow compilation by MSVC
3039 (Peter 'Luna' Runestig).
3040 * Added experimental --fast-io flag which optimizes
3041 TUN/TAP/UDP writes on non-Windows systems.
3043 2004.08.18 -- Version 2.0-beta11
3045 * Added --server, --server-bridge, --client, and
3046 --keepalive helper directives. See client.conf
3047 and server.conf in sample-config-files for sample
3048 configurations which use the new directives.
3049 * On Windows, added --route-method to control
3050 whether IP Helper API or route.exe is used
3051 to add/delete routes.
3052 * On Windows, added a second parameter to
3053 --route-delay to control the maximum time period
3054 to wait for the TAP-Win32 adapter to come up
3055 before adding routes.
3056 * Fixed bug in Windows version where configurations
3057 which omit --ifconfig might fail to recognize when
3058 the TAP adapter is up.
3059 * Proxy connection failures will now retry according
3060 to the --connect-retry parameter.
3061 * Fixed --dev null handling on Windows so that TLS
3062 loopback test described in INSTALL file works
3063 correctly on Windows.
3064 * Added "Initialization Sequence Completed" message
3065 after all initialization steps have been completed
3066 and the VPN can be considered "up".
3067 * Better sanity-checking on --ifconfig-pool parameters.
3068 * Added --tcp-queue-limit option to control
3069 TUN/TAP -> TCP socket overflow.
3070 * --ifconfig-nowarn flag will now silence general
3071 warnings about possible --ifconfig address
3072 conflicts, including the warning about --ifconfig
3073 and --remote addresses being in same /24 subnet.
3074 * Fixed case where server mode did not correctly
3075 identify certain types of ethernet multicast packets
3077 * Added --explicit-exit-notify option (experimental).
3079 2004.08.02 -- Version 2.0-beta10
3081 * Fixed possible reference after free of option strings
3082 after a restart, bug was introduced in beta8.
3083 * Fixed segfault at route.c:919 in the beta9
3084 Windows version that was being caused by indirection
3085 through a NULL pointer.
3086 * Mistakenly built debug version of TAP-Win32 driver
3087 for beta9. Beta10 has correct release build.
3089 2004.07.30 -- Version 2.0-beta9
3091 * Fixed --route issue on Windows that was introduced with
3092 the new beta8 route implementation based on the
3095 2004.07.27 -- Version 2.0-beta8
3097 * Added TCP support in server mode.
3098 * Added PKCS #12 support (Mathias Sundman).
3099 * Added patch to make revoke-crt and make-crl work
3100 seamlessly within the easy-rsa environment (Jan Kiszka).
3101 * Modified --mode server ethernet bridge code to forward
3102 special IEEE 802.1d MAC Groups, i.e. 01:80:C2:XX:XX:XX.
3103 * Added --dhcp-renew and --dhcp-release flags to Windows
3104 version. Normally DHCP renewal and release on the TAP
3105 adapter occurs automatically under Windows, however
3106 if you set the TAP-Win32 adapter Media Status property
3107 to "Always Connected", you may need these flags.
3108 * Added --show-net standalone flag to Windows version to
3109 show OpenVPN's view of the system adapter and routing
3111 * Added --show-net-up flag to Windows version to output
3112 the system routing table and network adapter list to
3113 the log file after the TAP-Win32 adapter has been brought
3114 up and any routes have been added.
3115 * Modified Windows version to add routes using the IP Helper
3116 API rather than by calling route.exe.
3117 * Fixed bug where --route-up script was not being called
3118 if no --route options were specified.
3119 * Added --mute-replay-warnings to suppress packet replay
3120 warnings. This is a common false alarm on WiFi nets.
3121 * Added "def1" flag to --redirect-gateway option to override
3122 the default gateway by using 0.0.0.0/1 and 128.0.0.0/1
3123 rather than 0.0.0.0/0. This has the benefit of overriding
3124 but not wiping out the original default gateway.
3125 (Thanks to Jim Carter for pointing out this idea).
3126 * You can now run OpenVPN with a single config file argument.
3127 For example, you can now say "openvpn config.conf"
3128 rather than "openvpn --config config.conf".
3129 * On Windows, made --route and --route-delay more adaptive
3130 with respect to waiting for interfaces referenced by the
3131 route destination to come up. Routes added by --route
3132 should now be added as soon as the interface comes up,
3133 rather than after an obligatory 10 second delay. The
3134 way this works internally is that --route-delay now
3135 defaults to 0 on Windows. Previous versions would
3136 wait for --route-delay seconds then add the routes.
3137 This version will wait --route-delay seconds and then
3138 test the routing table at one second intervals for the
3139 next 30 seconds and will not add the routes until they
3140 can be added without errors.
3141 * On Windows, don't setsockopt SO_SNDBUF or SO_RCVBUF by
3142 default on TCP/UDP socket in light of reports that this
3143 action can have undesirable global side effects on the
3144 MTU settings of other adapters. These parameters can
3145 still be set, but you need to explicitly specify
3146 --sndbuf and/or --rcvbuf.
3147 * Added --max-clients option to limit the maximum number
3148 of simultaneously connected clients in server mode.
3149 * Added error message to illuminate shell escape gotcha when
3150 single backslashes are used in Windows path names.
3151 * Added optional netmask parm to --ifconfig-pool.
3152 * Fixed bug where http-proxy connect retry attempts were
3153 incorrectly going to the remote OpenVPN server,
3154 not to the HTTP proxy server.
3156 2004.06.29 -- Version 2.0-beta7
3158 * Fixed bug in link_socket_verify_incoming_addr() which
3159 under certain circumstances could have caused --float
3160 behavior even if --float was not specified.
3161 * --tls-auth option now works with --mode server.
3162 All clients and the server should use the same
3163 --tls-auth key when operating in client/server mode.
3164 * Added --engine option to make use of OpenSSL-supported
3165 crypto acceleration hardware.
3166 * Fixed some high verbosity print format size issues
3167 in event.c for 64 bit platforms (Janne Johansson).
3168 * Made failure to open --log or --log-append file
3171 2004.06.23 -- Version 2.0-beta6
3173 * Fixed Windows installer to intelligently put
3174 up a reboot dialog only if tapinstall tells
3175 us that it's really necessary.
3176 * Fixed "Assertion failed at fragment.c:309"
3177 bug when --mode server and --fragment are used
3179 * Ignore HUP, USR1, and USR2 signals during
3180 initialization. Prior versions would abort.
3181 * Fixed bug on OS X: "Assertion failed at event.c:406".
3182 * Added --service option to Windows version, for use
3183 when OpenVPN is being programmatically instantiated
3184 by another process (see man page for info).
3185 * --log and --log-append options now work on Windows.
3186 * Update OpenBSD INSTALL notes (Janne Johansson).
3187 * Enable multicast on tun interface when running on
3188 OpenBSD (Pavlin Radoslavov).
3189 * Fixed recent --test-crypto breakage, where options
3190 such as --cipher were not being parsed correctly.
3191 * Modified options compatibility string by removing
3192 ifconfig substring if it is empty. Incremented
3193 options compatibility string version number to 4.
3194 * Fixed typo in --tls-timeout option parsing
3197 2004.06.13 -- Version 2.0-beta5
3199 * Fixed rare --mode server crash that could occur
3200 if data was being routed to a client at
3201 high bandwidth at the precise moment that the
3202 client instance object on the server was being
3204 * Fixed issue on machines which have epoll.h and
3205 the epoll_create glibc call defined, but which
3206 don't actually implement epoll in the kernel.
3207 OpenVPN will now gracefully fall back to the
3208 poll API in this case.
3209 * Fixed Windows bug which would cause the following
3210 error in a --mode server --dev tap configuration:
3211 "resource limit WSA_MAXIMUM_WAIT_EVENTS has been
3213 * Added CRL (certificate revocation list) management
3214 scripts to easy-rsa directory (Jon Bendtsen).
3215 * Do a better job of getting the ifconfig component
3216 of the options consistency check to work correctly
3217 when --up-delay is used.
3218 * De-inlined some functions which were too complex
3219 to be inlined anyway with gcc.
3220 * If a --dhcp-option option is pushed to a non-windows
3221 client, the option will be saved in the client's
3222 environment before the --up script is called, under
3223 the name "foreign_option_{n}".
3224 * Added --learn-address script (see man page) which
3225 allows for firewall access through the VPN to be
3226 controlled based on the client common name.
3227 * In mode --server mode, when a client connects to
3228 the server, the server will disconnect any
3229 still-active clients which use the same common
3230 name. Use --duplicate-cn flag to revert to
3231 previous behavior of allowing multiple clients
3232 to concurrently connect with the same common name.
3234 2004.06.08 -- Version 2.0-beta4
3236 * Fixed issue with beta3 where Win32 service wrapper
3237 was keying off of old TAP HWID as a dependency. To
3238 ensure that the new service wrapper is correctly
3239 installed, the Windows install script will uninstall
3240 the old wrapper before installing the new one,
3241 causing a reset of service properties.
3242 * Fixed permissions issue on --status output file,
3243 with default access permissions of owner read/write
3244 only (default permissions can be changed of course with
3247 2004.06.05 -- Version 2.0-beta3
3249 * More changes to TAP-Win32 driver's INF file which
3250 affects the placement of the driver in the Windows
3251 device namespace. This is done to work around an
3252 apparent bug in Windows when short HWIDs are used,
3253 and will also ease the upgrade from 1.x to 2.0 by
3254 reducing the chances that a reboot will be needed
3255 on upgrade. Like beta2, this upgrade will
3256 delete existing TAP-Win32 interfaces, and reinstall
3257 a single new interface with default properties.
3258 * Major rewrite of I/O event wait layer in the style
3259 of libevent. This is a precursor to TCP support
3261 * New feature: --status. Outputs a SIGUSR2-like
3262 status summary to a given file, updated once
3263 per n seconds. The status file is comma delimited
3264 for easy machine parsing.
3265 * --ifconfig-pool now remembers common names and
3266 will try to assign a consistent IP to a given
3267 common name. Still to do: persist --ifconfig-pool
3268 memory across restarts by saving state in file.
3269 * Fixed bug in event timer queue which could cause
3270 recurring timer events such as --ping to not
3271 correctly schedule again after firing. This in
3272 turn would cause spurrious ping restarts and possible
3273 connection outages. Thanks to Denis Vlasenko for
3275 * Possible fix to reported bug where --daemon argument
3276 was not printing to syslog correctly after restart.
3277 * Fixed bug where pulling --route or --dhcp-option
3278 directives from a server would problematically
3279 interact with --persist-tun on the client.
3280 * Updated contrib/multilevel-init.patch (Farkas Levente).
3281 * Added RPM build option to .spec and .spec.in files
3282 to optionally disable LZO inclusion (Ian Pilcher).
3283 * The latest MingW runtime and headers define
3284 'ssize_t', so a patch is needed (Gisle Vanem).
3286 2004.05.14 -- Version 2.0-beta2
3288 * Fixed signal handling bug in --mode server, where
3289 SIGHUP and SIGUSR1 were treated as SIGTERM.
3290 * Changed the TAP-Win32 HWID from "TAP" to "TAPDEV".
3291 Apparently the larger string may work around
3292 a problem where the TAP adapter is sometimes missing
3293 from the network connections panel, especially under
3294 XP SP2. Also note that installing this upgrade will
3295 uninstall any pre-existing TAP-Win32 adapters, and then
3296 install a single new adapter, meaning that old adapter
3297 properties will be lost. Thanks to Md5Chap for solving
3299 * For --mode server --dev tap, the options --ifconfig and
3300 --ifconfig-pool are now optional. This allows address
3301 assignment via DHCP or use of a TAP VPN without
3302 IP support, as has always been possible with 1.x.
3303 * Fixed bug where --ifconfig may not work correctly on
3305 * Added 'local' flag to --redirect-gateway for use on
3306 networks where both OpenVPN daemons are connected
3307 to a shared subnet, such as wireless.
3309 2004.05.09 -- Version 2.0-beta1
3311 * Unchanged from test29 except for version number
3314 2004.05.08 -- Version 2.0-test29
3316 * Modified --dev-node on Windows to accept a TAP-Win32
3317 GUID name. In addition, --show-adapters will now
3318 display the high-level name and GUID of each adapter.
3319 This is an attempt to work around an issue in Windows
3320 where sometimes the TAP-Win32 adapter installs correctly
3321 but has no icon in the network connections control
3322 panel. In such cases, being able to specify
3323 --dev-node {TAP-GUID} can work around the missing icon.
3325 2004.05.07 -- Version 2.0-test28
3327 * Fixed bug which could cause segfault on program
3328 shutdown if --route and --persist-tun are used
3331 2004.05.06 -- Version 2.0-test27
3333 * Fixed bug in close_instance() which might cause
3334 memory to be accessed after it had already been freed.
3335 * Fixed bug in verify_callback() that might have
3336 caused uninitialized data to be referenced.
3337 * --iroute now allows full CIDR subnet routing.
3338 * In "--mode server --dev tun" usage, source addresses
3339 on VPN packets coming from a particular client must
3340 be associated with that client in the OpenVPN internal
3343 2004.04.28 -- Version 2.0-test26
3345 * Optimized broadcast path in multi-client mode.
3346 * Added socket buffer size options --rcvbuf & --sndbuf.
3347 * Configure Linux tun/tap driver to use a more sensible
3348 txqueuelen default. Also allow explicit setting
3349 via --txqueuelen option (Harald Roelle).
3350 * The --remote option now allows the port number
3351 to be specified as the second parameter. If
3352 unspecified, the port number defaults to the
3354 * Multiple --remote options on the client can now be
3355 specified for load balancing and failover. The
3356 --remote-random flag can be used to initially randomize
3357 the --remote list for basic load balancing.
3358 * If a remote DNS name resolves to multiple DNS addresses,
3359 one will be chosen by random as a kind of basic
3360 load-balancing feature if --remote-random is used.
3361 * Added --connect-freq option to control maximum
3362 new connection frequency in multi-client mode.
3363 * In multi-client mode, all syslog messages associated
3364 with a specific client now include a client-ID prefix.
3365 * For Windows, use a gettimeofday() function based
3366 on QueryPerformanceCounter (Derek Burdick).
3367 * Fixed bug in interaction between --key-method 2
3368 and DES ciphers, where dynamic keys would be generated
3369 with bad parity and then be rejected.
3371 2004.04.17 -- Version 2.0-test24
3373 * Reworked multi-client broadcast handling.
3375 2004.04.13 -- Version 2.0-test23
3377 * Fixed bug in --dev tun --client-to-client routing.
3378 * Fixed a potential deadlock in --pull.
3379 * Fixed a problem with select() usage which could
3380 cause a repeating sequence of "select : Invalid
3383 2004.04.11 -- Version 2.0-test22
3385 * Fixed bug where --mode server + --daemon was
3386 prematurely closing syslog connection.
3387 * Added support for --redirect-gateway on Mac OS X
3389 * Minor changes to TAP-Win32 driver based on feedback
3390 from the NDISTest tool.
3392 2004.04.11 -- Version 2.0-test21
3394 * Optimizations in multi-client server event loop.
3396 2004.04.10 -- Version 2.0-test20
3398 * --mode server capability now works with either tun
3399 or tap interfaces. When used with tap interfaces,
3400 OpenVPN will internally bridge all client tap
3401 interfaces with the server tap interface.
3402 * Connecting clients can now have a client-specific
3403 configuration on the server, based on the client
3404 common name embedded in the client certificate.
3405 See --client-config-dir and --client-connect.
3406 These options can be used to configure client-specific
3408 * Added an option --client-to-client that enables
3409 internal client-to-client routing or bridging.
3410 Otherwise, clients will only "see" the server,
3411 not other connected clients.
3412 * Fixed bug in route scheduling which would have caused
3413 --mode server to not work on Windows in test18
3414 and test19 with the sample config file.
3415 * Man page is up to date with all new options.
3416 * OpenVPN 2.0 release notes on web site updated
3417 with tap-style tunnel examples.
3419 2004.04.02 -- Version 2.0-test19
3421 * Fixed bug where routes pushed from server were
3422 not working correctly on Windows clients.
3423 * Added Mac OS X route patch (Jeremy Apple).
3425 2004.03.30 -- Version 2.0-test18
3427 * Minor fixes + Windows self-install modified
3428 to use OpenSSL 0.9.7d.
3430 2004.03.29 -- Version 2.0-test17
3432 * Fixed some bugs related to instance timeout and deletion.
3433 * Extended --push/--pull option to support additional
3436 2004.03.28 -- Version 2.0-test16
3438 * Successful test of --mode udp-server, --push,
3439 --pull, and --ifconfig-pool with server on
3440 Linux 2.4 and clients on Linux and Windows.
3442 2004.03.25 -- Version 2.0-test15
3444 * Implemented hash-table lookup of client instances
3445 based either on remote UDP address/port or remote
3447 * Implemented a randomized binary tree based
3448 scheduler for scalably scheduling a large number
3449 of client instance events. Uses the treap
3450 data structure and node rotation algorithm
3451 to keep the tree balanced.
3452 * Initial implementation of ifconfig-pool.
3453 * Made --key-method 2 the default.
3455 2004.03.20 -- Version 2.0-test14
3457 * Implemented --push and --pull.
3459 2004.03.20 -- Version 2.0-test13
3461 * Reduced struct tls_multi and --single-session
3463 * Modified --single-session flag to be used
3464 in multi-client UDP server client instances.
3466 2004.03.19 -- Version 2.0-test12
3468 * Added the key multi-client UDP server options,
3469 --mode, --push, --pull, and --ifconfig-pool.
3470 * Revamped GC (garbage collection) code to not rely
3472 * Modifications to thread.[ch] to allow a more
3473 flexible thread model.
3475 2004.03.16 -- Version 2.0-test11
3477 * Moved all timer code to interval.h, added new file
3479 * Fixed missing include.
3481 2004.03.16 -- Version 2.0-test10
3483 * More TAP-Win32 fixes.
3484 * Initial debugging and testing of multi.[ch].
3486 2004.03.14 -- Version 2.0-test9
3488 * Branch merge with 1.6-rc3
3489 * More point-to-multipoint work in multi.[ch].
3490 * Major TAP-Win32 driver restructuring to use
3491 NdisMRegisterDevice instead of
3492 IoCreateDevice/IoCreateSymbolicLink.
3493 * Changed TAP-Win32 symbolic links to use \DosDevices\Global\
3495 * In the majority of cases, TAP-Win32 should now be
3496 able to install and uninstall on Win2K without requiring
3498 * TAP-Win32 MAC address can now be explicitly set in the
3499 adapter advanced properties page.
3501 2004.03.04 -- Version 2.0-test8
3503 * Branch merge with 1.6-rc2.
3505 2004.03.03 -- Version 2.0-test7
3507 * Branch merge with 1.6-rc1.2.
3509 2004.03.02 -- Version 2.0-test6
3511 * Branch merge with 1.6-rc1.
3513 2004.03.02 -- Version 2.0-test5
3515 * Move Socks5 UDP header append/remove to socks.c, and is
3516 called from forward.c.
3517 * Moved verify statics from ssl.c into struct tls_session.
3518 * Wrote multi.[ch] to handle top level of point-to-multipoint
3520 * Wrote some code to allow a struct link_socket in a child context
3521 to be slaved to the parent context.
3522 * Broke up packet read and process functions in forward.c
3523 (from socket or tuntap) into separate functions for read
3524 and process, so that point-to-point and point-to-multipoint can
3525 share the same code.
3526 * Expand TLS control channel to allow the passing of configuration
3528 * Wrote mroute.[ch] to handle internal packet routing for
3529 point-to-multipoint mode.
3531 2004.02.22 -- Version 2.0-test3
3533 * Initial work on UDP multi-client server.
3534 * Branch merge of 1.6-beta7
3536 2004.02.14 -- Version 2.0-test2
3538 * Refactorization of openvpn.c into openvpn.[ch]
3539 init.[ch] forward.[ch] forward-inline.h
3540 occ.[ch] occ-inline.h ping.[ch] ping-inline.h
3541 sig.[ch]. Created a master per-tunnel
3542 struct context in openvpn.h.
3543 * Branch merge of 1.6-beta6.2
3545 2003.11.06 -- Version 2.0-test1
3547 * Initial testbed for 2.0.
3549 2004.05.09 -- Version 1.6.0
3551 * Unchanged from 1.6-rc4 except for version number
3554 2004.04.01 -- Version 1.6-rc4
3556 * Made minor customizations to devcon and
3557 renamed as tapinstall.exe for Windows version.
3558 * Fixed "storage size of `iv' isn't known" build
3560 * OpenSSL 0.9.7d bundled with Windows self-install.
3562 2004.03.13 -- Version 1.6-rc3
3564 * Minor Windows fixes for --ip-win32 dynamic, relating to
3565 the way the TAP-Win32 driver responds to a DHCP request
3566 from the Windows DHCP client.
3567 * The net_gateway environmental variable wasn't being
3568 set correctly for called scripts (Paul Zuber).
3569 * Added code to determine the default gateway on FreeBSD,
3570 allowing the --redirect-gateway option to work
3571 (Juan Rodriguez Hervella).
3573 2004.03.04 -- Version 1.6-rc2
3575 * Fixed bug in Windows version where the NetBIOS node-type
3576 DHCP option might have been passed even if it was not
3578 * Fixed bug in Windows version introduced in 1.6-rc1, where
3579 DHCP timeout would be set to 0 seconds if --ifconfig option
3580 was used and --ip-win32 option was not explicitly specified.
3581 * Added some new --dhcp-option types for Windows version.
3583 2004.03.02 -- Version 1.6-rc1
3585 * For Windows, make "--ip-win32 dynamic" the default.
3586 * For Windows, make "--route-delay 10" the default
3587 unless --ip-win32 dynamic is not used or --route-delay
3588 is explicitly specified.
3589 * L_TLS mutex could have been left in a locked state
3590 for certain kinds of TLS errors.
3592 2004.02.22 -- Version 1.6-beta7
3594 * Allow scheduling priority increase (--nice) together
3595 with UID/GID downgrade (--user/--group).
3596 * Code that causes SIGUSR1 restart on TLS errors in TCP
3597 mode was not activated in pthread builds.
3598 * Save the certificate serial number in an environmental
3599 variable called tls_serial_{n} prior to calling the
3600 --tls-verify script. n is the current cert chain level.
3601 * Added NetBSD IPv6 tunnel capability (also requires
3602 a kernel patch) (Horst Laschinsky).
3603 * Fixed bug in checking the return value of the nice()
3604 function (Ian Pilcher).
3605 * Bug fix in new FreeBSD IPv6 over TUN code which was
3606 originally added in 1.6-beta5 (Nathanael Rensen).
3607 * More Socks5 fixes -- extended the struct frame
3608 infrastructure to accomodate proxy-based encapsulation
3610 * Added --dhcp-option to Windows version for setting
3611 adapter properties such as WINS & DNS servers.
3612 * Use a default route-delay of 5 seconds when
3613 --ip-win32 dynamic is specified (only applicable when
3614 --route-delay is not explicitly specified).
3615 * Added "log_append" registry variable to control
3616 whether the OpenVPN service wrapper on Windows
3617 opens log files in append (log_append="1") or
3618 truncate (log_append="0") mode. The default
3621 2004.02.05 -- Version 1.6-beta6
3623 * UDP over Socks5 fix to accomodate Socks5 encapsulation
3624 overhead (Christof Meerwald).
3625 * Minor --ip-win32 dynamic tweaks (use long lease time,
3626 invalidate existing lease with DHCPNAK).
3628 2004.02.01 -- Version 1.6-beta5
3630 * Added Socks5 proxy support (Christof Meerwald).
3631 * IPv6 tun support for FreeBSD (Thomas Glanzmann).
3632 * Special TAP-Win32 debug mode for Windows self-install that was
3633 enabled in beta4 is now turned off.
3634 * Added some new Solaris notes to INSTALL (Koen Maris).
3635 * More work on --ip-win32 dynamic.
3637 2004.01.27 -- Version 1.6-beta4
3639 * For this beta, the Windows self-install is a debug version
3640 and will run slower -- use only for testing.
3641 * Reverted the --ip-win32 default back to 'ipapi'
3643 * Added the offset parameter to '--ip-win32 dynamic' which
3644 can be used to control the address of the masqueraded
3645 DHCP server which replies to Windows DHCP requests.
3646 * Added a wait/nowait option to --inetd (nowait can only
3647 be used with TCP sockets, TLS authentication, and over
3648 a bridged configuration -- see FAQ for more info)
3649 (Stefan `Sec` Zehl).
3650 * Added a build-time capability where TAP-Win32 driver
3651 debug messages can be output by OpenVPN at --verb 6
3654 2004.01.20 -- Version 1.6-beta2
3656 * Added ./configure --enable-iproute2 flag which
3657 uses iproute2 instead of route + ifconfig --
3658 this is necessary for the LEAF Linux distro
3660 * Added renewal-time and rebind-time to set of
3661 DHCP options returned by the TAP-Win32 driver when
3662 "--ip-win32 dynamic" is used.
3664 2004.01.14 -- Version 1.6-beta1
3666 * Fixed --proxy bug that sometimes caused plaintext
3667 control info generated by the proxy prior to http
3668 CONNECT method establishment to be incorrectly
3669 parsed as OpenVPN data.
3670 * For Windows version, implemented the
3671 "--ip-win32 dynamic" method and made it the default.
3672 This method sets the TAP-Win32 adapter IP address
3673 and netmask by replying to the kernel's DHCP queries.
3674 See the man page for more detailed info.
3675 * Added --connect-retry parameter which controls
3676 the time interval (in seconds) between connect()
3677 retries when --proto tcp-client is used. Previously,
3678 this value was hardcoded to 5 seconds, and still
3680 * --resolv-retry can now be used with a parameter
3681 of "infinite" to retry indefinitely.
3682 * Added SSL_CTX_use_certificate_chain_file() to ssl.c
3683 for support of multi-level certificate chains
3685 * Fixed --tls-auth incompatibility with 1.4.x and earlier
3686 versions of OpenVPN when the passphrase file is an
3687 OpenVPN static key file (as generated by --genkey).
3688 * Added shell-escape support in config files using
3689 the backslash character ("\") so that (for example)
3690 double quotes can be passed to the shell.
3691 * Added "contrib" subdirectory on tarball, source zip,
3692 and CVS containing user-submitted contributions.
3693 * Added an optional patch to the Redhat init script to
3694 allow the configuration file directory to be a
3695 multi-level directory hierarchy (Farkas Levente).
3696 See contrib/multilevel-init.patch
3697 * Added some scripts and documentation on using
3698 Linux "fwmark" iptables rules to enable
3699 fine-grained routing control over the VPN
3700 (Sean Reifschneider, <jafo@tummy.com>).
3701 See contrib/openvpn-fwmarkroute-1.00
3703 2003.11.20 -- Version 1.5.0
3705 * Minor documentation changes.
3707 2003.11.04 -- Version 1.5-beta14
3709 * Fixed build problem with ./configure --disable-ssl
3710 that was reported on Debian woody.
3711 * Fixed bug where --redirect-gateway could not be used
3712 together with --resolv-retry.
3714 2003.11.03 -- Version 1.5-beta13
3716 * Added CRL (certificate revocation list) capability using
3717 --crl-verify option (Stefano Bracalenti).
3718 * Added --replay-window option for variable replay-protection
3720 * Fixed --fragment bug which might have caused certain large
3721 packets to be sent unfragmented.
3722 * Modified --secret and --tls-auth to permit different cipher and
3723 HMAC keys to be used for each data flow direction. Also
3724 increased static key file size generated by --genkey from
3725 1024 to 2048 bits, where 512 bits each are reserved for
3726 send-HMAC, encrypt, receive-HMAC, and decrypt. Key file forward
3727 and backward compatibility is maintained. See --secret option
3728 documentation on the man page for more info.
3729 * Added --tls-remote option (Teemu Kiviniemi).
3730 * Fixed --tls-cipher documention regarding correct delimiter
3731 usage (Teemu Kiviniemi).
3732 * Added --key-method option for selecting alternative data
3733 channel key negotiation methods. Method 1 is the default.
3734 Method 2 has been added (see man page for more info).
3735 * Added French translation of HOWTO to web site
3736 (Guillaume Lehmann).
3737 * Fixed problem caused by late resolver library load on
3738 certain platforms when --resolv-retry and --chroot are
3739 used together (Teemu Kiviniemi).
3740 * In TCP mode, all decryption or TLS errors will abort the current
3741 connection (this is not done in UDP mode because UDP is
3743 * Fixed a TCP client reconnect bug that only occurs on the
3744 BSDs, where connect() fails with an invalid argument. This
3745 bug was partially (but not completely) fixed in beta7.
3746 * Added "route_net_gateway" environmental variable which contains
3747 the pre-existing default gateway address from the routing table
3748 (there's no standard API for getting the default gateway, so
3749 right now this feature only works on Windows or Linux).
3750 * Renamed the "route_default_gateway" enviromental variable to
3751 "route_vpn_gateway" -- this is the remote VPN endpoint.
3752 * The special keywords vpn_gateway, net_gateway, and remote_host
3753 can now be used for the network or gateway components of the
3754 --route option. See the man page for more info.
3755 * Added the --redirect-gateway option to configure the VPN
3756 as the default gateway (implemented on Linux and Windows only).
3757 * Added the --http-proxy option with basic authentication
3758 support for use in TCP client mode. Successfully tested
3759 using Squid as the HTTP proxy, with and without authentication.
3761 2003.10.12 -- Version 1.5-beta12
3763 * Fixed Linux-only bug in --mktun and --rmtun which was
3764 introduced around beta8 or so, which would cause
3765 an error such as "I don't recognize device tun0 as a
3766 tun or tap device1".
3767 * Added --ifconfig-nowarn option to disable options
3768 consistency warnings about --ifconfig parameters.
3769 * Don't allow any kind of sequence number backtracking or
3770 message reordering when in TCP mode.
3771 * Changed beta naming convention to use '_' (underscore)
3772 rather than '-' (dash) to pacify rpmbuild.
3774 2003.10.08 -- Version 1.5-beta11
3776 * Modified code in the Windows version which sets the IP address
3777 and netmask of the TAP-Win32 adapter using the IP Helper API.
3778 Most of the changes involve better error recovery when
3779 the IP Helper API returns an error status. See the
3780 manual page entry on --ip-win32 for more info.
3782 2003.10.08 -- Version 1.5-beta10
3784 * Added getpass() function for Windows version so that --askpass
3785 option works correctly (Stefano Bracalenti).
3786 * Added reboot advisory to end of Win32 install script.
3787 * Changed crypto code to use pseudo-random IVs rather than
3788 carrying forward the IV state from the previous packet.
3789 This is in response to item 2 in the following document:
3790 http://www.openssl.org/~bodo/tls-cbc.txt which points
3791 out weaknesses in TLS's use of the same IV carryforward
3792 approach. This change does not break protocol compatibility
3793 with previous versions of OpenVPN.
3794 * Made a change to the crypto replay protection code to also
3795 protect against certain kinds of packet reordering attacks.
3796 This change does not break protocol compatibility with
3797 previous versions of OpenVPN.
3798 * Added --ip-win32 option to provide several choices for
3799 setting the IP address on the TAP-Win32 adapter.
3800 * #ifdefed out non-CBC crypto modes by default.
3801 * Added --up-delay option to delay TUN/TAP open and --up script
3802 execution until after connection establishment. This option
3803 replaces the earlier windows-only option --tap-delay.
3805 2003.10.01 -- Version 1.5-beta9
3807 * Fixed --route-noexec bug where option was not parsed correctly.
3808 * Complain if --dev tun is specified without --ifconfig on Windows.
3809 * Fixed bug where TCP connections on windows would sometimes cause
3810 an assertion failure.
3811 * Added a new flag to TAP-Win32 advanced properties that allows one
3812 to set the adapter to be always "connected" even when an OpenVPN
3813 process doesn't have it open. The default behavior is to report
3814 a media status of connected only when an OpenVPN process has the
3816 * Rebuilt the Windows self-install distribution with OpenSSL 0.9.7c
3817 DLLs in response to an OpenSSL security advisory.
3819 2003.09.30 -- Version 1.5-beta8
3821 * Extended the --ifconfig option to work on tap devices as well
3823 * Implemented the --ifconfig option for Windows, by calling the
3825 * By default, do an "arp -d *" on Windows after TAP-Win32 open to
3826 refresh the MAC cache. This behaviour can be disabled with
3828 * On Windows, allow the --dev-node parameter (which specifies
3829 the name of the TAP-Win32 adapter) to be omitted in cases where
3830 there is a single TAP-Win32 adapter on the system which can be
3831 assumed to be the default.
3832 * Modified the diagnostic --verb 5 debugging level to print 'R'
3833 for TCP/UDP read, 'W' for TCP/UDP write, 'r' for TUN/TAP read,
3834 and 'w' for TUN/TAP write.
3835 * Conditionalize OpenBSD read_tun and write_tun based on tun or tap
3837 * Added IPv6 tun support to OpenBSD (Thomas Glanzmann).
3838 * Make the --enable-mtu-dynamic ./configure option enabled by
3840 * Deprecated the --mtu-dynamic run-time option, in favor of
3842 * DNS names can now be used as --ifconfig parameters.
3843 * Significant work on TAP-Win32 driver to bring up to SMP standards.
3844 * On Windows, fixed dangling IRP problem if TAP-Win32 driver is
3845 unloaded or disabled, while a user-space process has it open.
3846 * On Windows, if --tun-mtu is not specified, it will be read from
3847 the TAP-Win32 driver via ioctl.
3848 * On Windows, added TAP-Win32 driver status info to "F2" keyboard
3849 signal (only when run from a console window).
3850 * Added --mssfix option to control TCP MSS size (YANO Hirokuni).
3851 * Renamed --mtu-dynamic option to --fragment to more accurately
3852 reflect its function. Fragment accepts a single parameter which
3853 is the upper limit on acceptable UDP packet size.
3854 * Changed default --tun-mtu-extra parameter to 32 from 64.
3855 * Eliminated reference to malloc.o in configure.ac.
3856 * Added tun device emulation to the TAP-Win32 driver.
3857 * Added --route and related options.
3858 * Added init script for SuSE Linux (Frank Plohmann).
3859 * Extended option consistency check between peers to function
3860 in all crypto modes, including static-key and cleartext modes.
3861 Previously only TLS mode was supported. Disable with
3863 * Overall, increased the amount of configuration option sanity
3864 checking, especially of networking parameters.
3865 * Added --mtu-test option for empirical MTU measurement.
3866 * Added Windows-only option --tap-delay to not set the TAP-Win32
3867 adapter media state to 'connected' until TCP/UDP connection
3868 establishment with peer.
3869 * Slightly modified --route/--route-delay semantics so that when
3870 --route is given without --route-delay, routes are added
3871 immediately after tun/tap device open. When --route-delay is
3872 specified, routes will be added n seconds after connection
3873 initiation, where n is the --route-delay parameter (which
3875 * Made TCP framing error into a non-fatal error that triggers a
3878 2003.08.28 -- Version 1.5-beta7
3880 * Fixed bug that caused OpenVPN not to respond to exit/restart
3881 signals when --resolv-retry is used and a local or remote DNS
3882 name cannot be resolved.
3883 * Exported a series of environmental variables with useful
3884 info for scripts. See man page for more info. Based
3885 on a suggestion by Anthony Ciaravalo.
3886 * Moved TCP/UDP socket bind to a point in the initialization
3887 before the --up script gets called. This is desirable
3888 because (a) a socket bind failure will happen before
3889 daemonization, allowing an error status code to be returned
3890 to the shell and (b) the possibility is eliminated of a
3891 socket bind failure causing the --up script to be run
3892 but not the --down script. This change has a side effect
3893 that --resolv-retry will no longer work with --local.
3894 * Fixed bug where if an OpenVPN TCP server went down and back
3895 up again, Solaris or FreeBSD clients would fail to reconnect
3897 * Fixed bug that prevented OpenVPN from being run by
3898 inetd/xinetd in TCP mode.
3899 * Added --log and --log-append options for logging messages to
3901 * On Windows, check that the current user is a member of the
3902 Administrator group before attempting install or uninstall.
3904 2003.08.16 -- Version 1.5-beta6
3906 * Fixed TAP-Win32 driver to properly increment the Rx/Tx count.
3908 2003.08.14 -- Version 1.5-beta5
3910 * Added user-configurability of the TAP-Win32 adapter MTU
3911 through the adapter advanced properties page.
3912 * Added Windows Service support.
3913 * On Windows, added file association and right-clickability
3914 for .ovpn files (OpenVPN config files).
3916 2003.08.05 -- Version 1.5-beta4
3918 * Extra refinements and error checking added to Windows
3919 NSIS install script.
3921 2003.08.05 -- Version 1.5-beta3
3923 * Added md5.h include to crypto.c to fix build problem on
3925 * Created a Win32 installer using NSIS.
3926 * Removed DelService command from TAP-Win32 INF file. It appears
3927 to be not necessary and it interfered with the ability to
3928 uninstall and reinstall the driver without needing to reboot.
3929 * On Windows version, added "addtap" and "deltapall" batch
3930 files to add and delete TAP-Win32 adapter instances.
3932 2003.07.31 -- Version 1.5-beta2
3934 * Renamed INSTALL.w32 to INSTALL-win32.txt and reformatted
3935 in Windows ASCII so it's easier to click and view.
3936 * Added postscript and PDF versions of the HOWTO to the web
3938 * Merged Michael Clarke's stability patch into TAP-Win32
3939 driver which appears to fix the suspend/resume driver bug
3940 and significantly improve driver stability.
3941 * Added Christof Meerwald's Media Status patch to the
3942 TAP-Win32 driver which shows the TAP adapter to be
3943 disconnected when OpenVPN is not running.
3944 * Moved socket connect and TCP server listen code to a later
3945 point in openvpn() function so that the TCP server listen
3946 state is entered after daemonization.
3947 * Added keyboard shortcuts to simulate signals in the Windows
3948 version, see the window title bar for descriptions.
3950 2003.07.24 -- Version 1.5-beta1
3952 * Added TCP support via the new --proto option.
3953 * Renamed udp-centric options such as --udp-mtu to
3954 --link-mtu (old option names preserved for compatibility).
3955 * Ported to Windows 2000 + XP using mingw and a TAP driver
3956 derived from the Cipe-Win32 project by Damion K. Wilson.
3957 * Added --show-adapters flag for windows version.
3958 * Reworked the SSL/TLS packet acknowledge code to better
3959 handle certain corner cases.
3960 * Turned off the default enabling of IP forwarding in the
3961 sample-scripts/openvpn.init script for Redhat.
3962 Forwarding can be enabled by users in their --up scripts
3964 * Added --up-restart option based on suggestion from Sean
3966 * If --dev tap or --dev-type tap is specified, --tun-mtu
3967 defaults to 1500 and --tun-mtu-extra defaults to 64.
3968 * Enabled --verb 5 debugging mode that prints 'R' and 'W'
3969 for each packet read or write on the TCP/UDP socket.
3971 2003.08.04 -- Version 1.4.3
3973 * Added md5.h include to crypto.c
3974 to fix build problem on OpenBSD.
3976 2003.07.15 -- Version 1.4.2
3978 * Removed adaptive bandwidth from
3979 --mtu-dynamic -- its absence appears
3980 to work better than its existence (1.4.1.2).
3981 * Minor changes to --shaper to fix long
3982 retransmit timeouts at low bandwidth
3984 * Added LOG_RW flag to openvpn.h for
3985 debugging (1.4.1.2).
3986 * Silenced spurious configure warnings (1.4.1.2).
3987 * Backed out --dev-name patch, modified --dev
3988 to offer equivalent functionality (1.4.1.4).
3989 * Added an optional parameter to --daemon and
3990 --inetd to support the passing of a custom
3991 program name to the system logger (1.4.1.5).
3992 * Add compiled-in options to the program title
3994 * Coded the beginnings of a WIN32 port (1.4.1.5).
3995 * Succeeded in porting to Win32 Mingw environment
3996 and running loopback tests (1.4.1.6). Still
3997 need a kernel driver for full Win32
3999 * Fixed a bug in error.h where
4000 HAVE_CPP_VARARG_MACRO_GCC was misspelled.
4001 This would have caused a significant slowdown
4002 of OpenVPN when built by compilers that
4003 lack ISO C99 vararg macros (1.4.1.6).
4004 * Created an init script for Gentoo Linux
4005 in ./gentoo directory (1.4.1.6).
4007 2003.05.15 -- Version 1.4.1
4009 * Modified the Linux 2.4 TUN/TAP open code to
4010 fall back to the 2.2 TUN/TAP interface if the
4011 open or ioctl fails.
4012 * Fixed bug when --verb is set to 0 and non-fatal
4013 socket errors occur, causing 100% CPU utilization.
4014 Occurs on platorms where
4015 EXTENDED_SOCKET_ERROR_CAPABILITY is defined,
4017 * Fixed typo in tun.c that was preventing
4019 * Added --enable-mtu-dynamic configure option
4020 to enable --mtu-dynamic experimental option.
4022 2003.05.07 -- Version 1.4.0
4024 * Added --replay-persist feature to allow replay
4025 protection across sessions.
4026 * Fixed bug where --ifconfig could not be used
4028 * Added --tun-mtu-extra parameter to deal with
4029 the situation where a read on a TUN/TAP device
4030 returns more data than the device's MTU size.
4031 * Fixed bug where some IPv6 support code for
4032 Linux was not being properly ifdefed out for
4033 Linux 2.2, causing compile errors.
4034 * Added OPENVPN_EXIT_STATUS_x codes to
4035 openvpn.h to control which status value
4036 openvpn returns to its caller (such as
4037 a shell or inetd/xinetd) for various conditions.
4038 * Added OPENVPN_DEBUG_COMMAND_LINE flag to
4039 openvpn.h to allow debugging in situations
4040 where stdout, stderr, and syslog cannot be used
4041 for message output, such as when OpenVPN is
4042 instantiated by inetd/xinetd.
4043 * Removed owner-execute permission from file
4044 created by static key generator (Herbert Xu
4045 and Alberto Gonzalez Iniesta).
4046 * Added --passtos option to allow IPv4 TOS bits
4047 to be passed from TUN/TAP input packets to
4048 the outgoing UDP socket (Craig Knox).
4049 * Added code to prevent open socket file descriptors
4050 from being accessible to called scripts.
4051 * Added --dev-name option (Christian Lademann).
4052 * Added --mtu-disc option for manual control
4054 * Show OS MTU value on UDP socket write failures
4056 * Numerous build system and portability
4057 fixes (Matthias Andree).
4058 * Added better sensing of compiler support for
4059 variable argument macros, including (a) gcc
4060 style, (b) ISO C 1999 style, and (c) no support.
4061 * Removed generated files from CVS. Note INSTALL
4062 file for new CVS build commands.
4063 * Changed certain internal symbol names
4064 for C standards compliance.
4065 * Added TUN/TAP open code to cycle dynamically
4066 through unit numbers until it finds a free
4067 unit (based on code from Thomas Gielfeldt
4069 * Added dynamic MTU and fragmenting infrastructure
4070 (Experimental). Rebuild with FRAGMENT_ENABLE
4072 * Minor changes to SSL/TLS negotiation, use
4073 exponential backoff on retransmits, and use
4074 a smaller MTU size (note that no protocol
4075 changes have been made which would break
4076 compatibility with 1.3.x).
4077 * Added --enable-strict-options flag
4078 to ./configure. This option will cause
4079 a more strict check for options compatibility
4080 between peers when SSL/TLS negotiation is used,
4081 but should only be used when both OpenVPN peers
4082 are of the same version.
4083 * Reorganization of debugging levels.
4084 * Added a workaround in configure.ac for
4085 default SSL header location on Linux
4086 to fix RH9 build problem.
4087 * Fixed potential deadlock when pthread support
4088 is used on OSes that allocate a small socketpair()
4090 * Fixed openvpn.init to be sh compliant
4092 * Changed --daemon to wait until all
4093 initialization is finished before becoming a
4094 daemon, for the benefit of initialization
4095 scripts that want a useful return status from
4096 the openvpn command.
4097 * Made openvpn.init script more robust, including
4098 positive indication of initialization errors
4099 in the openvpn daemon and better sanity checks.
4100 * Changed --chroot to wait until initialization
4101 is finished before calling chroot(), and allow
4102 the use of --user and --group with --chroot.
4103 * When syslog logging is enabled (--daemon or
4104 --inetd), set stdin/stdout/stderr to point
4106 * For inetd instantiations, dup socket descriptor
4108 * Fixed bug in verify-cn script, where test would
4109 incorrectly fail if CN=x was the last component
4110 of the X509 composite string (Anonymous).
4111 * Added Markus F.X.J. Oberhumer's special
4112 license exception to COPYING.
4114 2002.10.23 -- Version 1.3.2
4116 * Added SSL_CTX_set_client_CA_list call
4117 to follow the canonical form for TLS initialization
4118 recommended by the OpenSSL docs. This change allows
4119 better support for intermediate CAs and has no impact
4121 * Added build-inter script to easy-rsa package, to
4122 facilitate the generation of intermediate CAs.
4123 * Ported to NetBSD (Dimitri Goldin).
4124 * Fixed minor bug in easy-rsa/sign-req. It refers to
4125 openssl.cnf file, instead of $KEY_CONFIG, like all
4126 other scripts (Ernesto Baschny).
4127 * Added --days 3650 to the root CA generation command
4128 in the HOWTO to override the woefully small 30 day
4129 default (Dominik 'Aeneas' Schnitzer).
4130 * Fixed bug where --ping-restart would sometimes
4131 not re-resolve remote DNS hostname.
4132 * Added --tun-ipv6 option and related infrastructure
4133 support for IPv6 over tun.
4134 * Added IPv6 over tun support for Linux (Aaron Sethman).
4135 * Added FreeBSD 4.1.1+ TUN/TAP driver notes to
4136 INSTALL (Matthias Andree).
4137 * Added inetd/xinetd support (--inetd) including
4138 documentation in the HOWTO.
4139 * Added "Important Note on the use of commercial certificate
4140 authorities (CAs) with OpenVPN" to HOWTO based on
4141 issues raised on the openvpn-users list.
4143 2002.07.10 -- Version 1.3.1
4145 * Fixed bug in openvpn.spec and openvpn.init
4146 which caused RPM upgrade to fail.
4148 2002.07.10 -- Version 1.3.0
4150 * Added --dev-node option to allow explicit selection of
4151 tun/tap device node.
4152 * Removed mlockall call from child thread, as it doesn't
4153 appear to be necessary (child thread inherits mlockall
4155 * Added --ping-timer-rem which causes timer for --ping-exit
4156 and --ping-restart not to run unless we have a remote IP
4158 * Added condrestart to openvpn.init and openvpn.spec
4160 * Added --ifconfig case for FreeBSD (Matthias Andree).
4161 * Call openlog with facility=LOG_DAEMON (Matthias Andree).
4162 * Changed LOG_INFO messages to LOG_NOTICE.
4163 * Added warning when key files are group/others accessible.
4164 * Added --single-session flag for TLS mode.
4165 * Fixed bug where --writepid would segfault if used with
4166 an invalid filename.
4167 * Fixed bug where --ipchange status message was formatted
4169 * Print more concise error message when system() call
4171 * Added --disable-occ option.
4172 * Added --local, --remote, and --ifconfig options sanity
4174 * Changed default UDP MTU to 1300 and TUN/TAP MTU to
4176 * Successfully tested with OpenSSL 0.9.7 Beta 2.
4177 * Broke out debug level definitions to errlevel.h
4178 * Minor documentation and web site changes.
4179 * All changes maintain protocol compatibility
4180 with OpenVPN versions since 1.1.0, however default
4181 MTU changes will require setting the MTU explicitly
4182 by command line option, if you want 1.3.0 to
4183 communicate with previous versions.
4185 2002.06.12 -- Version 1.2.1
4187 * Added --ping-restart option to restart
4188 connection on ping timeout using SIGUSR1
4189 logic (Matthias Andree).
4190 * Added --persist-tun, --persist-key,
4191 --persist-local-ip, and --persist-remote-ip
4192 options for finer-grained control over SIGUSR1
4193 and --ping-restart restarts. To
4194 replicate previous SIGUSR1 functionality,
4195 use --persist-remote-ip.
4196 * Changed residual IV fetching code to take
4197 IV from tail of ciphertext.
4198 * Added check to make sure that CFB or OFB
4199 cipher modes are only used with SSL/TLS
4200 authentication mode, and added a caveat
4202 * Changed signal handling during initialization
4203 (including re-initialization during restarts)
4204 to exit on SIGTERM or SIGINT and ignore other
4205 signals which would ordinarily be caught.
4206 * Added --resolv-retry option to allow
4207 retries on hostname resolution.
4208 * Expanded the --float option to also
4209 allow dynamic changes in source port number
4210 on incoming datagrams.
4211 * Added --mute option to limit repetitive
4212 logging of similar message types.
4213 * Added --group option to downgrade GID
4214 after initialization.
4215 * Try to set ifconfig path automatically
4217 * Added --ifconfig code for Mac OS X
4218 (Christoph Pfisterer).
4219 * Moved "Peer Connection Initiated" message
4221 * Successfully tested with
4222 OpenSSL 0.9.7 Beta 1 and AES cipher.
4223 * Added RPM notes to INSTALL.
4224 * Added ACX_PTHREAD (from the autoconf
4225 macro archive) to configure.ac
4226 to figure out the right pthread
4227 options for a given platform.
4228 * Broke out macro definitions from
4229 configure.ac to acinclude.m4.
4230 * Minor changes to docs and HOWTO.
4231 * All changes maintain protocol compatibility
4232 with OpenVPN versions since 1.1.0.
4234 2002.05.22 -- Version 1.2.0
4236 * Added configuration file support via
4237 the --config option.
4238 * Added pthread support to improve latency.
4239 With pthread support, OpenVPN
4240 will offload CPU-intensive tasks such as RSA
4241 key number crunching to a background thread
4242 to improve tunnel packet forwarding
4243 latency. pthread support can be enabled
4244 with the --enable-pthread configure option.
4245 Pthread support is currently available
4246 only for Linux and Solaris.
4247 * Added --dev-type option so that tun/tap
4248 device names don't need to begin with
4250 * Added --writepid option to write main
4251 process ID to a file.
4252 * Numerous portability fixes to ease
4253 porting to other OSes including changing
4254 all network types to uint8_t and uint32_t,
4255 and not assuming that time_t is 32 bits.
4256 * Backported to OpenSSL 0.9.5.
4257 * Ported to Solaris.
4258 * Finished OpenBSD port except for
4260 * Added initialization script:
4261 sample-scripts/openvpn.init
4263 * Ported to Mac OS X (Christoph Pfisterer).
4264 * Improved resilience to DoS attacks when
4265 TLS mode is used without --remote or
4266 --tls-auth, or when --float is used
4267 with --remote. Note however that the best
4268 defense against DoS attacks in TLS mode
4269 is to use --tls-auth.
4270 * Eliminated automake/autoconf dependency
4272 * Ported configure.in to configure.ac
4274 * SIGHUP signal now causes OpenVPN to restart
4275 and re-read command line and or config file,
4276 in conformance with canonical daemon behaviour.
4277 * SIGUSR1 now does what SIGHUP did in
4278 version 1.1.1 and earlier -- close and reopen
4279 the UDP socket for use when DHCP changes
4280 host's IP address and preserve most recently
4281 authenticated peer address without rereading
4283 * SIGUSR2 added -- outputs current statistics,
4284 including compression statistics.
4285 * All changes maintain protocol compatibility
4286 with 1.1.1 and 1.1.0.
4288 2002.04.22 -- Version 1.1.1
4290 * Added --ifconfig option to automatically configure
4292 * Added inactivity disconnect (--inactive
4293 and --ping-exit options).
4294 * Added --ping option to keep stateful firewalls
4296 * Added sanity check to command line parser to
4297 err if any TLS options are used in non-TLS mode.
4298 * Fixed build problem with compiler environments that
4299 define printf as a macro.
4300 * Fixed build problem on linux systems that have
4301 an integrated TUN/TAP driver but lack the persistent
4302 tunnel feature (TUNSETPERSIST). Some linux kernels
4303 >= 2.4.0 and < 2.4.7 fall into this category.
4304 * Changed all calls to EVP_CipherInit to use explicit
4305 encrypt/decrypt mode in order to fix problem with
4306 IDEA-CBC and AES-256-CBC ciphers.
4307 * Minor changes to control channel transmit limiter
4308 algorithm to fix problem where TLS control channel
4309 might not renegotiate within the default 60 second window.
4310 * Simplified man page examples by taking advantage
4311 of the new --ifconfig option.
4312 * Minor changes to configure.in to check more
4313 rigourously for OpenSSL 0.9.6 or greater.
4314 * Put back openvpn.spec, eliminated
4316 * Modified openvpn.spec to reflect new automake-based
4317 build environment (Bishop Clark).
4318 * Other documentation changes.
4319 * Added --test-crypto option for debugging.
4320 * Added "missing" and "mkinstalldirs" automake
4324 2002.04.09 -- Version 1.1.0
4326 * Strengthened replay protection and IV handling,
4327 extending it fully to both static key and
4328 TLS dynamic key exchange modes.
4329 * Added --mlock option to disable paging and ensure that key
4330 material and tunnel data is never paged to disk.
4331 * Added optional traffic shaping feature to cap the maximum
4332 data rate of the tunnel.
4333 * Converted to automake (The Platypus Brothers 2002-04-01).
4334 * Ported to OpenBSD by Janne Johansson.
4335 * Added --tun-af-inet option to work around an incompatibility
4336 between Linux and BSD tun drivers.
4337 * Sequence number-based replay protection using the
4338 IPSec sliding window model is now the default,
4339 disable with --no-replay.
4340 * Explicit IV is now the default, disable with --no-iv.
4341 * Disabled all cipher modes except CBC, CFB, and OFB.
4342 * In CBC mode, use explicit IV and carry forward residuals,
4344 * In CFB/OFB mode, IV is timestamp, sequence number.
4345 * Eliminated --packet-id, --timestamp, and max-delta parameter to
4346 the --tls-auth option as they are now supplanted by improved
4347 replay code which is enabled by default.
4348 * Eliminated --rand-iv as it is now obsolete with improved
4350 * Eliminated --reneg-err option as it increases vulnerability
4352 * Added weak key check for DES ciphers.
4353 * --tls-freq option is no longer specified on the command line,
4354 instead it now inherits its parameter from the
4355 --tls-timeout option.
4356 * Fixed bug that would try to free memory on exit that was
4357 never malloced if --comp-lzo was not specified.
4358 * Errata fixed in the man page examples: "test-ca" should be
4360 * Updated manual page.
4361 * Preliminary work in porting to OpenSSL 0.9.7.
4362 * Changed license to allowing linking with OpenSSL.
4364 2002.03.29 -- Version 1.0.3
4366 * Fixed a problem in configure with library ordering on the
4369 2002.03.28 -- Version 1.0.2
4371 * Improved the efficiency of the inner event loop.
4372 * Fixed a minor bug with timeout handling.
4373 * Improved the build system to build on RH 6.2 through 7.2.
4374 * Added an openvpn.spec file for RPM builders (Bishop Clark).
4376 2002.03.23 -- Version 1.0
4378 * Added TLS-based authentication and key exchange.
4379 * Added gremlin mode to stress test.
4382 2001.12.26 -- Version 0.91
4384 * Added any choice of cipher or HMAC digest.
4386 2001.5.13 -- Version 0.90
4389 * IP tunnel over UDP, with blowfish cipher and SHA1 HMAC signature.