2
2
Copyright (C) 2002-2008 Telethra, Inc. <sales@openvpn.net>
4
$Id: ChangeLog 3149 2008-07-31 22:03:38Z james $
4
$Id: ChangeLog 3330 2008-09-15 01:46:29Z james $
6
2008.09.14 -- Version 2.1_rc11
8
* Fixed a bug that can cause SSL/TLS negotiations in UDP mode
9
to fail if UDP packets are dropped.
11
2008.09.10 -- Version 2.1_rc10
13
* Added "--server-bridge" (without parameters) to enable
14
DHCP proxy mode: Configure server mode for ethernet
15
bridging using a DHCP-proxy, where clients talk to the
16
OpenVPN server-side DHCP server to receive their IP address
17
allocation and DNS server addresses.
19
* Added "--route-gateway dhcp", to enable the extraction
20
of the gateway address from a DHCP negotiation with the
21
OpenVPN server-side LAN.
23
* Fixed minor issue with --redirect-gateway bypass-dhcp or bypass-dns
24
on Windows. If the bypass IP address is 0.0.0.0 or 255.255.255.255,
27
* Warn when ethernet bridging that the IP address of the bridge adapter
28
is probably not the same address that the LAN adapter was set to
31
* When running as a server, warn if the LAN network address is
32
the all-popular 192.168.[0|1].x, since this condition commonly
33
leads to subnet conflicts down the road.
35
* Primarily on the client, check for subnet conflicts between
36
the local LAN and the VPN subnet.
38
* Added a 'netmask' parameter to get_default_gateway, to return
39
the netmask of the adapter containing the default gateway.
40
Only implemented on Windows so far. Other platforms will
41
return 255.255.255.0. Currently the netmask information is
42
only used to warn about subnet conflicts.
44
* Minor fix to cryptoapi.c to not compile itself unless USE_CRYPTO
45
and USE_SSL flags are enabled (Alon Bar-Lev).
47
* Updated openvpn/t_cltsrv.sh (used by "make check") to conform to new
48
--script-security rules. Also adds retrying if the addresses are in
49
use (Matthias Andree).
51
* Fixed build issue with ./configure --disable-socks --disable-http.
53
* Fixed separate compile errors in options.c and ntlm.c that occur
54
on strict C compilers (such as old versions of gcc) that require
55
that C variable declarations occur at the start of a {} block,
58
* Workaround bug in OpenSSL 0.9.6b ASN1_STRING_to_UTF8, which
59
the new implementation of extract_x509_field_ssl depends on.
61
* LZO compression buffer overflow errors will now invalidate
62
the packet rather than trigger a fatal assertion.
64
* Fixed minor compile issue in ntlm.c (mid-block declaration).
66
* Added --allow-pull-fqdn option which allows client to pull DNS names
67
from server (rather than only IP address) for --ifconfig, --route, and
68
--route-gateway. OpenVPN versions 2.1_rc7 and earlier allowed DNS names
69
for these options to be pulled and translated to IP addresses by default.
70
Now --allow-pull-fqdn will be explicitly required on the client to enable
71
DNS-name-to-IP-address translation of pulled options.
73
* 2.1_rc8 and earlier did implicit shell expansion on script
74
arguments since all scripts were called by system().
75
The security hardening changes made to 2.1_rc9 no longer
76
use system(), but rather use the safer execve or CreateProcess
77
system calls. The security hardening also introduced a
78
backward incompatibility with 2.1_rc8 and earlier in that
79
script parameters were no longer shell-expanded, so
82
client-connect "docc CLIENT-CONNECT"
84
would fail to work because execve would try to execute
85
a script called "docc CLIENT-CONNECT" instead of "docc"
86
with "CLIENT-CONNECT" as the first argument.
88
This patch fixes the issue, bringing the script argument
89
semantics back to pre 2.1_rc9 behavior in order to preserve
90
backward compatibility while still using execve or CreateProcess
91
to execute the script/executable.
93
* Modified ip_or_dns_addr_safe, which validates pulled DNS names,
94
to more closely conform to RFC 3696:
96
(1) DNS name length must not exceed 255 characters
98
(2) DNS name characters must be limited to alphanumeric,
99
dash ('-'), and dot ('.')
101
* Fixed bug in intra-session TLS key rollover that was introduced with
102
deferred authentication features in 2.1_rc8.
6
104
2008.07.31 -- Version 2.1_rc9
8
* Security Vulnerability -- affects non-Windows OpenVPN clients running
106
* Security Fix -- affects non-Windows OpenVPN clients running
9
107
OpenVPN 2.1-beta14 through 2.1-rc8 (OpenVPN 2.0.x clients are NOT
10
108
vulnerable nor are any versions of the OpenVPN server vulnerable).
11
109
An OpenVPN client connecting to a malicious or compromised
added
removed
ChangeLog
