CVS commit: pkgsrc/net/openvpn

[Stephen Borrill <sborrill%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   sborrill
Date:           Thu Oct  9 10:57:23 UTC 2008

Modified Files:
        pkgsrc/net/openvpn: Makefile PLIST distinfo
        pkgsrc/net/openvpn/patches: patch-ac patch-ae patch-af

Log Message:
Update to 2.1rc13. Changes include:

2008.10.07 -- Version 2.1_rc13

* Bundled OpenSSL 0.9.8i with Windows installer.

* Management interface can now listen on a unix
  domain socket, for example:

    management /tmp/openvpn unix

  Also added management-client-user and management-client-group
  directives to control which processes are allowed to connect
  to the socket.

* Copyright change to OpenVPN Technologies, Inc.

2008.09.23 -- Version 2.1_rc12

* Patched Makefile.am so that the new t_cltsrv-down.sh script becomes
  part of the tarball (Matthias Andree).

* Fixed --lladdr bug introduced in 2.1-rc9 where input validation code
  was incorrectly expecting the lladdr parameter to be an IP address
  when it is actually a MAC address (HoverHell).

2008.09.14 -- Version 2.1_rc11

* Fixed a bug that can cause SSL/TLS negotiations in UDP mode
  to fail if UDP packets are dropped.

2008.09.10 -- Version 2.1_rc10

* Added "--server-bridge" (without parameters) to enable
  DHCP proxy mode:  Configure server mode for ethernet
  bridging using a DHCP-proxy, where clients talk to the
  OpenVPN server-side DHCP server to receive their IP address
  allocation and DNS server addresses.

* Added "--route-gateway dhcp", to enable the extraction
  of the gateway address from a DHCP negotiation with the
  OpenVPN server-side LAN.

* Fixed minor issue with --redirect-gateway bypass-dhcp or bypass-dns
  on Windows.  If the bypass IP address is 0.0.0.0 or 255.255.255.255,
  ignore it.

* Warn when ethernet bridging that the IP address of the bridge adapter
  is probably not the same address that the LAN adapter was set to
  previously.

* When running as a server, warn if the LAN network address is
  the all-popular 192.168.[0|1].x, since this condition commonly
  leads to subnet conflicts down the road.

* Primarily on the client, check for subnet conflicts between
  the local LAN and the VPN subnet.

* Added a 'netmask' parameter to get_default_gateway, to return
  the netmask of the adapter containing the default gateway.
  Only implemented on Windows so far.  Other platforms will
  return 255.255.255.0.  Currently the netmask information is
  only used to warn about subnet conflicts.

* Minor fix to cryptoapi.c to not compile itself unless USE_CRYPTO
  and USE_SSL flags are enabled (Alon Bar-Lev).

* Updated openvpn/t_cltsrv.sh (used by "make check") to conform to new
  --script-security rules.  Also adds retrying if the addresses are in
  use (Matthias Andree).

* Fixed build issue with ./configure --disable-socks --disable-http.

* Fixed separate compile errors in options.c and ntlm.c that occur
  on strict C compilers (such as old versions of gcc) that require
  that C variable declarations occur at the start of a {} block,
  not in the middle.

* Workaround bug in OpenSSL 0.9.6b ASN1_STRING_to_UTF8, which
  the new implementation of extract_x509_field_ssl depends on.

* LZO compression buffer overflow errors will now invalidate
  the packet rather than trigger a fatal assertion.

* Fixed minor compile issue in ntlm.c (mid-block declaration).

* Added --allow-pull-fqdn option which allows client to pull DNS names
  from server (rather than only IP address) for --ifconfig, --route, and
  --route-gateway.  OpenVPN versions 2.1_rc7 and earlier allowed DNS names
  for these options to be pulled and translated to IP addresses by default.
  Now --allow-pull-fqdn will be explicitly required on the client to enable
  DNS-name-to-IP-address translation of pulled options.

* 2.1_rc8 and earlier did implicit shell expansion on script
  arguments since all scripts were called by system().
  The security hardening changes made to 2.1_rc9 no longer
  use system(), but rather use the safer execve or CreateProcess
  system calls.  The security hardening also introduced a
  backward incompatibility with 2.1_rc8 and earlier in that
  script parameters were no longer shell-expanded, so
  for example:

    client-connect "docc CLIENT-CONNECT"

  would fail to work because execve would try to execute
  a script called "docc CLIENT-CONNECT" instead of "docc"
  with "CLIENT-CONNECT" as the first argument.

  This patch fixes the issue, bringing the script argument
  semantics back to pre 2.1_rc9 behavior in order to preserve
  backward compatibility while still using execve or CreateProcess
  to execute the script/executable.

* Modified ip_or_dns_addr_safe, which validates pulled DNS names,
  to more closely conform to RFC 3696:

  (1) DNS name length must not exceed 255 characters

  (2) DNS name characters must be limited to alphanumeric,
      dash ('-'), and dot ('.')

* Fixed bug in intra-session TLS key rollover that was introduced with
  deferred authentication features in 2.1_rc8.

008.07.31 -- Version 2.1_rc9

* Security Fix -- affects non-Windows OpenVPN clients running
  OpenVPN 2.1-beta14 through 2.1-rc8 (OpenVPN 2.0.x clients are NOT
  vulnerable nor are any versions of the OpenVPN server vulnerable).
  An OpenVPN client connecting to a malicious or compromised
  server could potentially receive an "lladdr" or "iproute" configuration
  directive from the server which could cause arbitrary code execution on
  the client. A successful attack requires that (a) the client has agreed
  to allow the server to push configuration directives to it by including
  "pull" or the macro "client" in its configuration file, (b) the client
  succesfully authenticates the server, (c) the server is malicious or has
  been compromised and is under the control of the attacker, and (d) the
  client is running a non-Windows OS.  Credit: David Wagner.

* Miscellaneous defensive programming changes to multiple
  areas of the code.  In particular, use of the system() call
  for calling executables such as ifconfig, route, and
  user-defined scripts has been completely revamped in favor
  of execve() on unix and CreateProcess() on Windows.

* In Windows build, package a statically linked openssl.exe to work around
  observed instabilities in the dynamic build since the migration to
  OpenSSL 0.9.8h.

2008.06.11 -- Version 2.1_rc8

* Added client authentication and packet filtering capability
  to management interface.  In addition, allow OpenVPN plugins
  to take advantage of deferred authentication and packet
  filtering capability.

* Added support for client-side connection profiles.

* Fixed unbounded memory growth bug in environmental variable
  code that could have caused long-running OpenVPN sessions
  with many TLS renegotiations to incrementally
  increase memory usage over time.

* Windows release now packages openssl-0.9.8h.

* Build system changes -- allow building on Windows using
  autoconf/automake scripts (Alon Bar-Lev).

* Changes to Windows build system to make it easier to do
  partial builds, with a reduced set of prerequisites,
  where only a subset of OpenVPN installer
  components are built.  See ./domake-win comments.

* Cleanup IP address for persistence interfaces for tap and also
  using ifconfig, gentoo#209055 (Alon Bar-Lev).

* Fall back to old version of extract_x509_field for OpenSSL 0.9.6.

* Clarified tcp-queue-limit man page entry (Matti Linnanvuori).

* Added new OpenVPN icon and installer graphic.

* Minor pkitool changes.

* Added --pkcs11-id-management option, which will cause OpenVPN to
  query the management interface via the new NEED-STR asynchronous
  notification query to get additional PKCS#11 options (Alon Bar-Lev).

* Added NEED-STR management interface asynchronous query and
  "needstr" management interface command to respond to the query
  (Alon Bar-Lev).

* Added Dragonfly BSD support (Francis-Gudin).

* Quote device names before passing to up/down script (Josh Cepek).

* Bracketed struct openvpn_pktinfo with #pragma pack(1) to
  prevent structure padding from causing an incorrect length
  to be returned by sizeof (struct openvpn_pktinfo) on 64-bit
  platforms.

* On systems that support res_init, always call it
  before calling gethostbyname to ensure that
  resolver configuration state is current.

* Added NTLMv2 proxy support (Miroslav Zajic).

* Fixed an issue in extract_x509_field_ssl where the extraction
  would fail on the first field of the subject name, such as
  the common name in:  /CN=foo/emailAddress=
 foo%bar.comThis@localhost e-mail address is being protected from spambots. You 
need
JavaScript enabled to view it

* Made "Linux ip addr del failed" error nonfatal.

* Amplified --client-cert-not-required warning.

* Added #pragma pack to proto.h.


To generate a diff of this commit:
cvs rdiff -r1.25 -r1.26 pkgsrc/net/openvpn/Makefile
cvs rdiff -r1.5 -r1.6 pkgsrc/net/openvpn/PLIST
cvs rdiff -r1.14 -r1.15 pkgsrc/net/openvpn/distinfo
cvs rdiff -r1.6 -r1.7 pkgsrc/net/openvpn/patches/patch-ac
cvs rdiff -r1.2 -r1.3 pkgsrc/net/openvpn/patches/patch-ae
cvs rdiff -r1.3 -r1.4 pkgsrc/net/openvpn/patches/patch-af

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.