aboutsummaryrefslogtreecommitdiff
path: root/net/openvpn
Commit message (Collapse)AuthorAge
* openvpn: update to 2.6.10Ivan Pavlov2024-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a bugfix release containing several security fixes specific to the Windows platform. Bug fixes --------- - Windows: if the win-dco driver is used (default) and the GUI requests use of a proxy server, the connection would fail. Disable DCO in this case. - Compression: minor bugfix in checking option consistency vs. compiled-in algorithm support - systemd unit files: remove obsolete syslog.target Security fixes -------------- - CVE-2024-27459: Windows: fix a possible stack overflow in the interactive service component which might lead to a local privilege escalation. - CVE-2024-24974: Windows: disallow access to the interactive service pipe from remote computers. - CVE-2024-27903: Windows: disallow loading of plugins from untrusted installation paths, which could be used to attack openvpn.exe via a malicious plugin. For details refer to https://github.com/OpenVPN/openvpn/blob/v2.6.10/Changes.rst Signed-off-by: Ivan Pavlov <AuthorReflex@gmail.com>
* openvpn: update to 2.6.9Ivan Pavlov2024-02-22
| | | | | | | | | | | | | | | | | | | | | | | | | | - license change is now complete, and all code has been re-licensed under the new license (still GPLv2, but with new linking exception for Apache2 licensed code). Code that could not be re-licensed has been removed or rewritten. - add support for building with mbedTLS 3.x.x - new option "--force-tls-key-material-export" to only accept clients that can do TLS keying material export to generate session keys (mostly an internal option to better deal with TLS 1.0 PRF failures). - Windows: bump vcpkg-ports/pkcs11-helper to 1.30 - Log incoming SSL alerts in easier to understand form and move logging from "--verb 8" to "--verb 3". - protocol_dump(): add support for printing "--tls-crypt" packets and other fixes For details refer to https://github.com/OpenVPN/openvpn/blob/v2.6.9/Changes.rst Signed-off-by: Ivan Pavlov <AuthorReflex@gmail.com>
* openvpn: fix start_path_instance functionDirk Brenken2024-02-20
| | | | | | | | | | Check the conffile existance (with .conf extension), before calling the function 'start_path_instance'. This fixes errors with non-existing and wrong spelling instances. Signed-off-by: Dirk Brenken <dev@brenken.org> - Update commit description Signed-off-by: Florian Eckert <fe@dev.tdt.de>
* openvpn: add OpenVPN option disable-dcoMartin Schiller2024-02-07
| | | | | | You maybe want to disable the DCO support, so let's add this option. Signed-off-by: Martin Schiller <ms@dev.tdt.de>
* openvpn: add missing script-securityErik Conijn2024-01-29
| | | | | | | | | | | | | | | | | | | Maintainer: @mkrkn @neheb Compile tested: armv7, cortexA15, OpenWRT 23.05 Run tested: Linksys EA8500 Compile tested: armv8, cortexA53, OpenWRT main Run tested: Dynalink DL-WRX36 Description: Script-security is always 2 and cannot be changed from the openvpn config file due to a missing rule in openvpn.init. This is discussed in issue #23014 This patch adds the missing rule in openvpn.init to parse script-security from the openvpn config file. Signed-off-by: Erik Conijn <egc112@msn.com>
* openvpn: remove myself as maintainerMagnus Kroken2024-01-21
| | | | Signed-off-by: Magnus Kroken <mkroken@gmail.com>
* Openvpn: add missing script event optionsErik Conijn2024-01-02
| | | | | | | | | | | | | | | | | | | | Maintainer: @mkrkn @neheb Compile tested: aarch64, cortex-a53, OpenWRT Master Run tested: Dynalink DL-WRX36 Description: [A previous commit](https://github.com/openwrt/packages/commit/f8a8b71e26b9bdbf86fbb7d4d1482637af7f3ba4) has added more script event options. However it looked like that commit was not complete as it stops the use of the script events route-up, route-pre-down, and ipchange when those are placed in the openvpn config file. This PR fixes a regression that makes it problematic to specify certain event options in the OpenVPN configuration file. Discussion in [this thread](https://forum.openwrt.org/t/openvpn-custom-route-up-script-in-23-05-rc2/167105/13) and [here](https://forum.openwrt.org/t/openvpn-route-up-and-route-pre-down-broken-in-23-05/176568) Please have a look and consider implementing or make it possible to use all script event options in the openvpn config file in another way. Pull request has been discussed and improved with the help of @AuthorReflex, see: https://github.com/openwrt/packages/pull/21732 Signed-off-by: Erik Conijn <egc112@msn.com>
* openvpn: bump PKG_RELEASEFlorian Eckert2023-12-20
| | | | Signed-off-by: Florian Eckert <fe@dev.tdt.de>
* openvpn: Added option to not start the native OpenVPN configurations on bootFlorian Eckert2023-12-20
| | | | | | | | | | | | | | | | | | | OpenVPN configurations that have a uci entry, the enable/enabled option can be used to control whether the OpenVPN connection should be started at system startup or not. OpenVPN configurations that are located under '/etc/openvpn/' are always started at system boot. To ensure that these connections can also be started later, they must 'not' be started automatically during system boot. This can be prevented with the following entry in the OpenVPN configuration. config globals 'globals' option autostart '0' These OpenVPN configurations can then be started later with the command. '/etc/init.d/openvpn start <name>' Signed-off-by: Florian Eckert <fe@dev.tdt.de>
* openvpn: add possibility to start openvpn_path_instance on requestFlorian Eckert2023-12-20
| | | | | | | | This commit adds the possibility that an OpenVPN instance located under '/etc/openvpn' can also be started with the command. '/etc/init.d/openvpn start <name>' Signed-off-by: Florian Eckert <fe@dev.tdt.de>
* openvpn: add start_path_instance functionFlorian Eckert2023-12-20
| | | | | | This commit moves the part for starting an instance to a sub function. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
* openvpn: move path instances call to sub functionFlorian Eckert2023-12-20
| | | | | | Move the start of the OpenVPN configurations in '/etc/openvpn' in a function. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
* openvpn: rename start_instance to start_uci_instanceFlorian Eckert2023-12-20
| | | | | | Preparation commit to make it clear that this is a uci configuration. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
* openvpn: update to 2.6.8Ivan Pavlov2023-11-19
| | | | | | | | | | | | | | | | | | This is a bugfix release containing security fixes. Security Fixes (included in 2.6.7): CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly use a send buffer after it has been free()d in some circumstances, causing some free()d memory to be sent to the peer. All configurations using TLS (e.g. not using --secret) are affected by this issue. CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly restore --fragment configuration in some circumstances, leading to a division by zero when --fragment is used. On platforms where division by zero is fatal, this will cause an OpenVPN crash. For details refer to https://github.com/OpenVPN/openvpn/blob/v2.6.8/Changes.rst Signed-off-by: Ivan Pavlov <AuthorReflex@gmail.com>
* openvpn: update to 2.6.6Ivan Pavlov2023-08-18
| | | | | | | | | Small bugfix release For details refer to https://github.com/OpenVPN/openvpn/blob/v2.6.6/Changes.rst Also, set depends on DCO kernel module when ENABLE_DCO flag is set. Signed-off-by: Ivan Pavlov <AuthorReflex@gmail.com>
* openvpn: update to 2.6.5 and add DCO supportMartin Schiller2023-07-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit updates openvpn to version 2.6.5 and add DCO support. There are several changes: - Starting with version 2.6.0, the sources are only provided as .tar.gz file. - removed OPENVPN_<variant>_ENABLE_MULTIHOME: multihome support is always included and cannot be disabled anymore with 2.6.x. - removed OPENVPN_<variant>_ENABLE_DEF_AUTH: deferred auth support is always included and cannot be disabled anymore with 2.6.x. - removed OPENVPN_<variant>_ENABLE_PF: PF (packet filtering) support was removed in 2.6.x. - The internal lz4 library was removed in 2.6.x; we now use the liblz4 package if needed - To increase reproducibility, _DATE_ is only used for development builds and not in release builds in 2.6.x. - wolfSSL support was integrated into upstream openvpn - DES support was removed from openvpn The first two wolfSSL patches were created following these 2 commits: https://github.com/OpenVPN/openvpn/commit/4cf01c8e4381403998341aa32f79f4bf24c7ccb1 https://github.com/OpenVPN/openvpn/commit/028b501734b4a57dc53edb8b11a4b370f5b99e38 Signed-off-by: Martin Schiller <ms@dev.tdt.de>
* openvpn: fix ipchange hotplug eventIvan Pavlov2023-06-09
| | | | | | | | | | In f8a8b71e26b9bdbf86fbb7d4d1482637af7f3ba4 openvpn introduced new hotplug events. For server config, ipchange hotplug event produces an error. So, make ipchange hotplug event for client only Fixes https://github.com/openwrt/packages/issues/21200 Signed-off-by: Ivan Pavlov <AuthorReflex@gmail.com>
* openvpn: Add more hotplug eventsMichal Hrusecky2023-05-20
| | | | | | | | | | | OpenVPN supports more hooks than just 'up' and 'down'. Especially reacting to 'route-up' and 'route-pre-down' events could be important. When routing table changes, it can make sense to adapt firewall, run some tests or change even more routes. This change passes those events to hotplug, so it is easy to react to them without changing configuration files provided by VPN provider. Signed-off-by: Michal Hrusecky <michal.hrusecky@turris.com>
* treewide: refactor to use PKG_BUILD_FLAGS:=gc-sectionsAndre Heider2023-04-08
| | | | | | | | | | | | See commit da370098 "treewide: add support for "gc-sections" in PKG_BUILD_FLAGS" on the main repository. Note: This only touches packages which use all three parts (-ffunction-sections, -fdata-sections and -Wl,--gc-sections) enabled by this build flag. Some packages only use a subset, and these are left unchanged for now. Signed-off-by: Andre Heider <a.heider@gmail.com>
* openvpn: update to 2.5.8Ivan Pavlov2022-11-11
| | | | | | | Mostly bugfix release For details refer to https://github.com/OpenVPN/openvpn/blob/v2.5.8/Changes.rst Signed-off-by: Ivan Pavlov <AuthorReflex@gmail.com>
* openvpn: add possibility to set param "compress" without algorithmMartin Schiller2022-10-31
| | | | | | | | | | | | | In some situations you need to set the compress param without an algorithm. Compression will be turned off, but the packet framing for compression will still be enabled, allowing a different setting to be pushed later. As it is not possible to have options with optional values at the moment, I've introduced a pseudo value "frames_only" which will be removed in the init script. Signed-off-by: Martin Schiller <ms@dev.tdt.de>
* treewide: fix security issues by bumping all packages using libwolfsslPetr Štetiar2022-10-04
| | | | | | | | | | | | | | | | | | | | As wolfSSL is having hard time maintaining ABI compatibility between releases, we need to manually force rebuild of packages depending on libwolfssl and thus force their upgrade. Otherwise due to the ABI handling we would endup with possibly two libwolfssl libraries in the system, including the patched libwolfssl-5.5.1, but still have vulnerable services running using the vulnerable libwolfssl-5.4.0. So in order to propagate update of libwolfssl to latest stable release done in commit ec8fb542ec3e4 ("wolfssl: fix TLSv1.3 RCE in uhttpd by using 5.5.1-stable (CVE-2022-39173)") which fixes several remotely exploitable vulnerabilities, we need to bump PKG_RELEASE of all packages using wolfSSL library. Same bump has been done in buildroot in commit f1b7e1434f66 ("treewide: fix security issues by bumping all packages using libwolfssl"). Signed-off-by: Petr Štetiar <ynezz@true.cz>
* openvpn: explicitly disable engine parameter for openssl variantIvan Pavlov2022-08-31
| | | | | | | | Engine support is deprecated in OpenSSL 3.0 and for OpenSSL 3.0 the default is to disable engine support as engine support is deprecated. For ath79 architecture build with autodetection engine support fails, so explicitly set off for now. Signed-off-by: Ivan Pavlov <AuthorReflex@gmail.com>
* openvpn: update to 2.5.7Ivan Pavlov2022-06-09
| | | | | | | Added limited support for OpenSSL 3.0 Fixed some bugs Signed-off-by: Ivan Pavlov <AuthorReflex@gmail.com>
* openvpn: update to 2.5.6Ivan Pavlov2022-03-18
| | | | | | | | | | | | | Maintainer: me / @mkrkn Compile tested: ramips/mt7620 TP-Link Archer C50 v1, ramips/mt7621 Xiaomi Mi router 3 Pro, ath79/generic TP-Link WDR-3500 Run tested: ramips/mt7620 TP-Link Archer C50 v1, ramips/mt7621 Xiaomi Mi router 3 Pro, ath79/generic TP-Link WDR-3500 bugfix release including one security fix ("Disallow multiple deferred authentication plug-ins.", CVE: 2022-0547) several build fixes, refer to https://github.com/OpenVPN/openvpn/blob/release/2.5/Changes.rst Signed-off-by: Ivan Pavlov <AuthorReflex@gmail.com>
* openvpn: update to 2.5.5Ivan Pavlov2021-12-18
| | | | | | | | | | | | | | Maintainer: me / @mkrkn Compile tested: ramips/mt7620 TP-Link Archer C50 v1, ramips/mt7621 Xiaomi Mi router 3 Pro, ath79/generic TP-Link WDR-3500 Run tested: ramips/mt7620 TP-Link Archer C50 v1, ramips/mt7621 Xiaomi Mi router 3 Pro, ath79/generic TP-Link WDR-3500 openvpn: update to 2.5.5 use of CFG Spectre-mitigations in MSVC builds bring back OpenSSL config loading to Windows builds several build fixes, refer to https://github.com/OpenVPN/openvpn/blob/release/2.5/Changes.rst Signed-off-by: Ivan Pavlov <AuthorReflex@gmail.com>
* openvpn: update to 2.5.4Ivan Pavlov2021-10-13
| | | | | | | Include a number of small improvements and bug fixes. Improve compatibility on Windows systems Signed-off-by: Ivan Pavlov <AuthorReflex@gmail.com>
* openvpn: add OpenVPN option push-peer-infoNguyen Quang Minh2021-09-01
| | | | | | | | | This will allow the server to know more info about the client like HWADDR, very useful for managing IoT devices. See: https://www.mankier.com/8/openvpn#--push-peer-info Signed-off-by: Nguyen Quang Minh <minhnq31@fpt.com.vn>
* openvpn: enable LZO support by default for OpenSSL variantEtienne Champetier2021-07-12
| | | | | | | | User that don't control both OpenVPN client and server might still need LZO support, so keep it enable by default for at least OpenSSL variant. Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
* openvpn: update to 2.5.3Ivan Pavlov2021-06-18
| | | | | | | | | Fix a possible security issue with OpenSSL config autoloading on Windows (CVE-2021-3606). Include a number of small improvements and bug fixes. remove upstreamed: 115-fix-mbedtls-without-renegotiation.patch Signed-off-by: Ivan Pavlov <AuthorReflex@gmail.com>
* openvpn: enable using wolfSSL cryptographic API engineIvan Pavlov2021-06-13
| | | | | | | | | | Support for wolfSSL has been upstreamed to the master OpenVPN branch in f6dca235ae560597a0763f0c98fcc9130b80ccf4 so we can use wolfSSL directly in OpenVPN. So no more needed differnt SSL engine for OpenVPN in systems based on wolfSSL library Compiled && tested on ramips/mt7620, ramips/mt7621 Signed-off-by: Ivan Pavlov <AuthorReflex@gmail.com>
* openvpn: update to 2.5.2Magnus Kroken2021-04-22
| | | | | | | | | | | | | | | | Fixes two related security vulnerabilities (CVE-2020-15078) which under very specific circumstances allow tricking a server using delayed authentication (plugin or management) into returning a PUSH_REPLY before the AUTH_FAILED message, which can possibly be used to gather information about a VPN setup. In combination with "--auth-gen-token" or a user-specific token auth solution it can be possible to get access to a VPN with an otherwise-invalid account. OpenVPN 2.5.2 also includes other bug fixes and improvements. Add CI build test script. Signed-off-by: Magnus Kroken <mkroken@gmail.com>
* openvpn: fix invoking user up & down commands from hotplug wrapperJo-Philipp Wich2021-04-01
| | | | | | | | | | | | | | | | | | | | | | | | This commit adds a number of fixes to the OpenVPN up/down hotplug command wrapper which currently fails to actually invoke user defined up and down commands for uci configurations not using external native configurations. - Use the `--setenv` to pass the user configured `up` and `down` commands as `user_up` and `user_down` environment variables respectively - Instead of attempting to scrape the `up` and `down` settings from the (possibly generated) native OpenVPN configuration in `/etc/hotplug.d/openvpn/01-user`, read them from the respective environment variables instead - Fix parsing of native configuration values in `get_openvpn_option()`; first try to parse a given setting as single quoted value, then as double quoted and finally as non-quoted, potentially white-space escaped one. This ensures that `up '/bin/foo'` is interpreted as `/bin/foo` and not `'/bin/foo'` Ref: https://forum.openwrt.org/t/openvpn-up-down-configuration-ignored/91126 Supersedes: #15121, #15284 Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* openvpn: add OpenVPN option server-poll-timeoutAlexander Egorenkov2021-03-22
| | | | | | See https://www.mankier.com/8/openvpn#--server-poll-timeout Signed-off-by: Alexander Egorenkov <egorenar-dev@posteo.net>
* openvpn: update to 2.5.1Magnus Kroken2021-02-24
| | | | | | Set myself as maintainer. Signed-off-by: Magnus Kroken <mkroken@gmail.com>
* openvpn: Support username and password optionsMichal Hrusecky2020-12-11
| | | | | | | | | Some VPN providers require username and password for client to connect. This commit adds an option to specify username, password and cert_password directly in uci config which then gets expanded during start of openpvn client. Signed-off-by: Michal Hrusecky <michal.hrusecky@turris.com>
* openvpn: disable LZO support by defaultMagnus Kroken2020-12-01
| | | | | | | | | | | OpenVPN recommends disabling compression, as it may weaken the security of the connection. For users who need compression, we build with LZ4 support by default. LZO in OpenVPN pulls in liblzo at approx. 32 kB. OpenWrt users will no longer be able to connect to OpenVPN peers that require LZO compression, unless they build the OpenVPN package themselves. Signed-off-by: Magnus Kroken <mkroken@gmail.com>
* openvpn: update to 2.5.0Magnus Kroken2020-12-01
| | | | | | | | | | | | | | | | | | | | New features: * Per client tls-crypt keys * ChaCha20-Poly1305 can be used to encrypt the data channel * Routes are added/removed via Netlink instead of ifconfig/route (unless iproute2 support is enabled). * VLAN support when using a TAP device Significant changes: * Server support can no longer be disabled. * Crypto support can no longer be disabled, remove nossl variant. * Blowfish (BF-CBC) is no longer implicitly the default cipher. OpenVPN peers prior to 2.4, or peers with data cipher negotiation disabled, will not be able to connect to a 2.5 peer unless option data_fallback_ciphers is set on the 2.5 peer and it contains a cipher supported by the client. Signed-off-by: Magnus Kroken <mkroken@gmail.com>
* openvpn: import from baseRosen Penev2020-12-01
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Powered by cgit, Themed by Ted Yin.