From 5246174f27866c0e9e22844d998f3c97cac54050 Mon Sep 17 00:00:00 2001 From: Bernhard Schmidt Date: Wed, 30 Sep 2020 21:10:50 +0200 Subject: New upstream version 2.5~rc2 --- ChangeLog | 67 +++ config-msvc.h | 1 + configure | 29 +- configure.ac | 1 + doc/man-sections/advanced-options.rst | 7 +- doc/man-sections/client-options.rst | 60 +- doc/man-sections/generic-options.rst | 7 + doc/man-sections/script-options.rst | 5 +- doc/man-sections/server-options.rst | 36 +- doc/man-sections/vpn-network-options.rst | 4 + doc/openvpn.8 | 133 +++-- doc/openvpn.8.html | 126 +++-- include/openvpn-plugin.h | 2 +- sample/Makefile.am | 3 + sample/Makefile.in | 4 + sample/sample-plugins/Makefile | 584 ++++++++++++++++++++ sample/sample-plugins/Makefile.am | 34 ++ sample/sample-plugins/Makefile.in | 584 ++++++++++++++++++++ sample/sample-plugins/Makefile.plugins | 37 ++ sample/sample-plugins/README | 43 ++ sample/sample-plugins/client-connect/README | 38 ++ .../client-connect/sample-client-connect.c | 612 +++++++++++++++++++++ sample/sample-plugins/defer/README | 16 - sample/sample-plugins/defer/build | 15 - sample/sample-plugins/defer/simple.c | 5 + .../keying-material-exporter-demo/build | 15 - .../keyingmaterialexporter.c | 6 + sample/sample-plugins/log/build | 15 - sample/sample-plugins/log/log.c | 5 + sample/sample-plugins/log/log_v3.c | 5 + sample/sample-plugins/simple/README | 16 - sample/sample-plugins/simple/build | 15 - sample/sample-plugins/simple/simple.c | 5 + src/compat/PropertySheet.props | 2 +- src/openvpn/errlevel.h | 1 + src/openvpn/init.c | 11 + src/openvpn/networking_sitnl.c | 44 +- src/openvpn/openvpn.vcxproj | 4 +- src/openvpn/options.c | 6 +- src/openvpn/otime.h | 1 + src/openvpn/pool.c | 18 + src/openvpn/route.c | 46 +- src/openvpn/socket.c | 13 +- src/openvpn/socks.c | 9 +- src/openvpn/tun.c | 231 +++++--- src/openvpnmsica/dllmain.c | 2 +- src/openvpnmsica/openvpnmsica.c | 16 +- src/openvpnserv/interactive.c | 141 ++++- src/tapctl/main.c | 2 +- src/tapctl/tap.c | 242 +++----- src/tapctl/tap.h | 6 +- tests/t_lpback.sh | 8 +- version.m4 | 4 +- 53 files changed, 2850 insertions(+), 492 deletions(-) create mode 100644 sample/sample-plugins/Makefile create mode 100644 sample/sample-plugins/Makefile.am create mode 100644 sample/sample-plugins/Makefile.in create mode 100644 sample/sample-plugins/Makefile.plugins create mode 100644 sample/sample-plugins/README create mode 100644 sample/sample-plugins/client-connect/README create mode 100644 sample/sample-plugins/client-connect/sample-client-connect.c delete mode 100644 sample/sample-plugins/defer/README delete mode 100755 sample/sample-plugins/defer/build delete mode 100755 sample/sample-plugins/keying-material-exporter-demo/build delete mode 100755 sample/sample-plugins/log/build delete mode 100644 sample/sample-plugins/simple/README delete mode 100755 sample/sample-plugins/simple/build diff --git a/ChangeLog b/ChangeLog index f516b5a..447c374 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,6 +1,73 @@ OpenVPN Change Log Copyright (C) 2002-2020 OpenVPN Inc +2020.09.30 -- Version 2.5_rc2 + +Lev Stipakov (1): + Alias ADAPTER_DOMAIN_SUFFIX to DOMAIN + +Selva Nair (2): + Set DNS Domain using iservice + Improve documentation of --username-as-common-name + +Simon Rozman (4): + netsh: Specify interfaces by index rather than name + netsh: Clear existing IPv6 DNS servers before configuring new ones + netsh: Delete WINS servers on TUN close + openvpnmsica: Simplify find_adapters() to void return + +Vladislav Grishenko (1): + Fix update_time() and openvpn_gettimeofday() coexistence + + +2020.09.21 -- Version 2.5_rc1 + +David Sommerseth (4): + man: Add missing --server-ipv6 + man: Improve --remote entry + sample-plugins: Partially autotoolize the sample-plugins build + build: Fix make distclean/distcheck + +Gert Doering (10): + Fix handling of 'route remote_host' for IPv6 transport case. + Replace 'echo -n' with 'printf' in tests/t_lpback.sh + Fix description of --client-disconnect calling convention in manpage. + Handle NULL returns from calloc() in sample plugins. + Fix --show-gateway for IPv6 on NetBSD/i386. + socks.c: fix alen for DOMAIN type addresses, bump up buffer sizes + Fix netbits setting (in TAP mode) for IPv6 on Windows. + If IPv6 pool specification sets pool start to ::0 address, increment. + Add demo plugin that excercises "CLIENT_CONNECT" and "CLIENT_CONNECT_V2" paths + Fix combination of --dev tap and --topology subnet across multiple platforms. + +Lev Stipakov (1): + msvc: better support for 32bit architecture + +Selva Nair (2): + Add a remark on dropping privileges when --mlock is used + Allow --dhcp-option in config file when windows-driver is wintun + +Vladislav Grishenko (1): + Fix fatal error at switching remotes (#629) + + +2020.09.10 -- Version 2.5_beta4 + +Gert Doering (3): + Document that --push-remove is generally more suitable than --push-reset + Fix error detection / abort in --inetd corner case. + Fix TUNSETGROUP compatibility with very old Linux systems. + +Lev Stipakov (1): + openvpnmsica: make adapter renaming non-fatal + +Selva Nair (1): + In tap.c use DiInstallDevice to install the driver on a new adapter + +Vladislav Grishenko (1): + Fix best gateway selection over netlink + + 2020.08.31 -- Version 2.5_beta3 Arne Schwabe (1): diff --git a/config-msvc.h b/config-msvc.h index 8ef4897..f199bb2 100644 --- a/config-msvc.h +++ b/config-msvc.h @@ -112,6 +112,7 @@ #define HAVE_EC_GROUP_ORDER_BITS 1 #define OPENSSL_NO_EC 1 #define HAVE_EVP_CIPHER_CTX_RESET 1 +#define HAVE_DIINSTALLDEVICE 1 #define PATH_SEPARATOR '\\' #define PATH_SEPARATOR_STR "\\" diff --git a/configure b/configure index 2624890..7de5671 100755 --- a/configure +++ b/configure @@ -1,6 +1,6 @@ #! /bin/sh # Guess values for system-dependent variables and create Makefiles. -# Generated by GNU Autoconf 2.69 for OpenVPN 2.5_beta3. +# Generated by GNU Autoconf 2.69 for OpenVPN 2.5_rc2. # # Report bugs to . # @@ -590,8 +590,8 @@ MAKEFLAGS= # Identity of this package. PACKAGE_NAME='OpenVPN' PACKAGE_TARNAME='openvpn' -PACKAGE_VERSION='2.5_beta3' -PACKAGE_STRING='OpenVPN 2.5_beta3' +PACKAGE_VERSION='2.5_rc2' +PACKAGE_STRING='OpenVPN 2.5_rc2' PACKAGE_BUGREPORT='openvpn-users@lists.sourceforge.net' PACKAGE_URL='' @@ -1466,7 +1466,7 @@ if test "$ac_init_help" = "long"; then # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF -\`configure' configures OpenVPN 2.5_beta3 to adapt to many kinds of systems. +\`configure' configures OpenVPN 2.5_rc2 to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... @@ -1536,7 +1536,7 @@ fi if test -n "$ac_init_help"; then case $ac_init_help in - short | recursive ) echo "Configuration of OpenVPN 2.5_beta3:";; + short | recursive ) echo "Configuration of OpenVPN 2.5_rc2:";; esac cat <<\_ACEOF @@ -1749,7 +1749,7 @@ fi test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF -OpenVPN configure 2.5_beta3 +OpenVPN configure 2.5_rc2 generated by GNU Autoconf 2.69 Copyright (C) 2012 Free Software Foundation, Inc. @@ -2588,7 +2588,7 @@ cat >config.log <<_ACEOF This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. -It was created by OpenVPN $as_me 2.5_beta3, which was +It was created by OpenVPN $as_me 2.5_rc2, which was generated by GNU Autoconf 2.69. Invocation command line was $ $0 $@ @@ -2952,13 +2952,13 @@ if test -z "${htmldir}"; then fi -$as_echo "#define OPENVPN_VERSION_RESOURCE 2,5,0,3" >>confdefs.h +$as_echo "#define OPENVPN_VERSION_RESOURCE 2,5,0,6" >>confdefs.h OPENVPN_VERSION_MAJOR=2 OPENVPN_VERSION_MINOR=5 -OPENVPN_VERSION_PATCH=_beta3 +OPENVPN_VERSION_PATCH=_rc2 $as_echo "#define OPENVPN_VERSION_MAJOR 2" >>confdefs.h @@ -2967,7 +2967,7 @@ $as_echo "#define OPENVPN_VERSION_MAJOR 2" >>confdefs.h $as_echo "#define OPENVPN_VERSION_MINOR 5" >>confdefs.h -$as_echo "#define OPENVPN_VERSION_PATCH \"_beta3\"" >>confdefs.h +$as_echo "#define OPENVPN_VERSION_PATCH \"_rc2\"" >>confdefs.h ac_aux_dir= @@ -3493,7 +3493,7 @@ fi # Define the identity of the package. PACKAGE='openvpn' - VERSION='2.5_beta3' + VERSION='2.5_rc2' cat >>confdefs.h <<_ACEOF @@ -18360,7 +18360,7 @@ TEST_CFLAGS="${TEST_CFLAGS} -I\$(top_srcdir)/include ${CMOCKA_CFLAGS}" -ac_config_files="$ac_config_files version.sh Makefile build/Makefile build/msvc/Makefile build/msvc/msvc-generate/Makefile distro/Makefile distro/systemd/Makefile doc/Makefile doc/doxygen/Makefile doc/doxygen/openvpn.doxyfile include/Makefile src/Makefile src/compat/Makefile src/openvpn/Makefile src/openvpnmsica/Makefile src/openvpnserv/Makefile src/plugins/Makefile src/plugins/auth-pam/Makefile src/plugins/down-root/Makefile src/tapctl/Makefile tests/Makefile tests/unit_tests/Makefile tests/unit_tests/example_test/Makefile tests/unit_tests/openvpn/Makefile tests/unit_tests/plugins/Makefile tests/unit_tests/plugins/auth-pam/Makefile tests/unit_tests/engine-key/Makefile sample/Makefile" +ac_config_files="$ac_config_files version.sh Makefile build/Makefile build/msvc/Makefile build/msvc/msvc-generate/Makefile distro/Makefile distro/systemd/Makefile doc/Makefile doc/doxygen/Makefile doc/doxygen/openvpn.doxyfile include/Makefile sample/sample-plugins/Makefile src/Makefile src/compat/Makefile src/openvpn/Makefile src/openvpnmsica/Makefile src/openvpnserv/Makefile src/plugins/Makefile src/plugins/auth-pam/Makefile src/plugins/down-root/Makefile src/tapctl/Makefile tests/Makefile tests/unit_tests/Makefile tests/unit_tests/example_test/Makefile tests/unit_tests/openvpn/Makefile tests/unit_tests/plugins/Makefile tests/unit_tests/plugins/auth-pam/Makefile tests/unit_tests/engine-key/Makefile sample/Makefile" ac_config_files="$ac_config_files tests/t_client.sh" @@ -18946,7 +18946,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" -This file was extended by OpenVPN $as_me 2.5_beta3, which was +This file was extended by OpenVPN $as_me 2.5_rc2, which was generated by GNU Autoconf 2.69. Invocation command line was CONFIG_FILES = $CONFIG_FILES @@ -19012,7 +19012,7 @@ _ACEOF cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`" ac_cs_version="\\ -OpenVPN config.status 2.5_beta3 +OpenVPN config.status 2.5_rc2 configured by $0, generated by GNU Autoconf 2.69, with options \\"\$ac_cs_config\\" @@ -19515,6 +19515,7 @@ do "doc/doxygen/Makefile") CONFIG_FILES="$CONFIG_FILES doc/doxygen/Makefile" ;; "doc/doxygen/openvpn.doxyfile") CONFIG_FILES="$CONFIG_FILES doc/doxygen/openvpn.doxyfile" ;; "include/Makefile") CONFIG_FILES="$CONFIG_FILES include/Makefile" ;; + "sample/sample-plugins/Makefile") CONFIG_FILES="$CONFIG_FILES sample/sample-plugins/Makefile" ;; "src/Makefile") CONFIG_FILES="$CONFIG_FILES src/Makefile" ;; "src/compat/Makefile") CONFIG_FILES="$CONFIG_FILES src/compat/Makefile" ;; "src/openvpn/Makefile") CONFIG_FILES="$CONFIG_FILES src/openvpn/Makefile" ;; diff --git a/configure.ac b/configure.ac index f827992..ebb3220 100644 --- a/configure.ac +++ b/configure.ac @@ -1433,6 +1433,7 @@ AC_CONFIG_FILES([ doc/doxygen/Makefile doc/doxygen/openvpn.doxyfile include/Makefile + sample/sample-plugins/Makefile src/Makefile src/compat/Makefile src/openvpn/Makefile diff --git a/doc/man-sections/advanced-options.rst b/doc/man-sections/advanced-options.rst index 9b96e40..bedc884 100644 --- a/doc/man-sections/advanced-options.rst +++ b/doc/man-sections/advanced-options.rst @@ -11,8 +11,11 @@ Standalone Debug Options --show-gateway --show-gateway IPv6-target - If an IPv6 target address is passed as argument, the IPv6 route for this - host is reported. + For IPv6 this queries the route towards ::/128, or the specified IPv6 + target address if passed as argument. + For IPv4 on Linux, Windows, MacOS and BSD it looks for a 0.0.0.0/0 route. + If there are more specific routes, the result will not always be matching + the route of the IPv4 packets to the VPN gateway. Advanced Expert Options diff --git a/doc/man-sections/client-options.rst b/doc/man-sections/client-options.rst index ec1e3b1..af21fbc 100644 --- a/doc/man-sections/client-options.rst +++ b/doc/man-sections/client-options.rst @@ -244,43 +244,51 @@ configuration. use :code:`ignore`. --remote args - Remote host name or IP address. It supports two additional optional - arguments: ``port`` and ``proto``. On the client, multiple ``--remote`` - options may be specified for redundancy, each referring to a different - OpenVPN server. Specifying multiple ``--remote`` options for this - purpose is a special case of the more general connection-profile - feature. See the ```` documentation below. + Remote host name or IP address, port and protocol. - The OpenVPN client will try to connect to a server at ``host:port`` in - the order specified by the list of ``--remote`` options. - - Examples: + Valid syntaxes: :: - remote server.example.net - remote server.example.net 1194 - remote server.example.net tcp + remote host + remote host port + remote host port proto - ``proto`` indicates the protocol to use when connecting with the remote, - and may be :code:`tcp` or :code:`udp`. + The ``port`` and ``proto`` arguments are optional. The OpenVPN client + will try to connect to a server at ``host:port``. The ``proto`` argument + indicates the protocol to use when connecting with the remote, and may be + :code:`tcp` or :code:`udp`. To enforce IPv4 or IPv6 connections add a + :code:`4` or :code:`6` suffix; like :code:`udp4` / :code:`udp6` + / :code:`tcp4` / :code:`tcp6`. - For forcing IPv4 or IPv6 connection suffix tcp or udp with 4/6 like - udp4/udp6/tcp4/tcp6. + On the client, multiple ``--remote`` options may be specified for + redundancy, each referring to a different OpenVPN server, in the order + specified by the list of ``--remote`` options. Specifying multiple + ``--remote`` options for this purpose is a special case of the more + general connection-profile feature. See the ```` + documentation below. The client will move on to the next host in the list, in the event of connection failure. Note that at any given time, the OpenVPN client will at most be connected to one server. - Note that since UDP is connectionless, connection failure is defined by - the ``--ping`` and ``--ping-restart`` options. + Examples: + :: - Note the following corner case: If you use multiple ``--remote`` - options, AND you are dropping root privileges on the client with - ``--user`` and/or ``--group`` AND the client is running a non-Windows - OS, if the client needs to switch to a different server, and that server - pushes back different TUN/TAP or route settings, the client may lack the - necessary privileges to close and reopen the TUN/TAP interface. This - could cause the client to exit with a fatal error. + remote server1.example.net + remote server1.example.net 1194 + remote server2.example.net 1194 tcp + + *Note:* + Since UDP is connectionless, connection failure is defined by + the ``--ping`` and ``--ping-restart`` options. + + Also, if you use multiple ``--remote`` options, AND you are dropping + root privileges on the client with ``--user`` and/or ``--group`` AND + the client is running a non-Windows OS, if the client needs to switch + to a different server, and that server pushes back different TUN/TAP + or route settings, the client may lack the necessary privileges to + close and reopen the TUN/TAP interface. This could cause the client + to exit with a fatal error. If ``--remote`` is unspecified, OpenVPN will listen for packets from any IP address, but will not act on those packets unless they pass all diff --git a/doc/man-sections/generic-options.rst b/doc/man-sections/generic-options.rst index a07fe7e..d5f0883 100644 --- a/doc/man-sections/generic-options.rst +++ b/doc/man-sections/generic-options.rst @@ -230,6 +230,13 @@ which mode OpenVPN is configured as. The downside of using ``--mlock`` is that it will reduce the amount of physical memory available to other applications. + The limit on how much memory can be locked and how that limit + is enforced are OS-dependent. On Linux the default limit that an + unprivileged process may lock (RLIMIT_MEMLOCK) is low, and if + privileges are dropped later, future memory allocations will very + likely fail. The limit can be increased using ulimit or systemd + directives depending on how OpenVPN is started. + --nice n Change process priority after initialization (``n`` greater than 0 is lower priority, ``n`` less than zero is higher priority). diff --git a/doc/man-sections/script-options.rst b/doc/man-sections/script-options.rst index b4bbf52..a4df673 100644 --- a/doc/man-sections/script-options.rst +++ b/doc/man-sections/script-options.rst @@ -157,9 +157,8 @@ SCRIPT HOOKS where some of the related client-connect functions returned an error status. - The ``--client-disconnect`` command is passed the same pathname as the - corresponding ``--client-connect`` command as its last argument (after - any arguments specified in ``cmd``). + The ``--client-disconnect`` command is not passed any extra arguments + (only those arguments specified in cmd, if any). --down cmd Run command ``cmd`` after TUN/TAP device close (post ``--user`` UID diff --git a/doc/man-sections/server-options.rst b/doc/man-sections/server-options.rst index f1f0667..5a68945 100644 --- a/doc/man-sections/server-options.rst +++ b/doc/man-sections/server-options.rst @@ -204,7 +204,8 @@ fast hardware. SSL/TLS authentication must be used in this mode. ifconfig-ipv6-pool ipv6addr/bits The pool starts at ``ipv6addr`` and matches the offset determined from - the start of the IPv4 pool. + the start of the IPv4 pool. If the host part of the given IPv6 + address is ``0``, the pool starts at ``ipv6addr`` +1. --ifconfig-pool-persist args Persist/unpersist ifconfig-pool data to ``file``, at ``seconds`` @@ -530,6 +531,14 @@ fast hardware. SSL/TLS authentication must be used in this mode. ``--client-config-dir`` configuration file. This option will ignore ``--push`` options at the global config file level. + *NOTE*: ``--push-reset`` is very thorough: it will remove almost + all options from the list of to-be-pushed options. In many cases, + some of these options will need to be re-configured afterwards - + specifically, ``--topology subnet`` and ``--route-gateway`` will get + lost and this will break client configs in many cases. Thus, for most + purposes, ``--push-remove`` is better suited to selectively remove + push options for individual clients. + --server args A helper directive designed to simplify the configuration of OpenVPN's server mode. This directive will set up an OpenVPN server which will @@ -631,6 +640,19 @@ fast hardware. SSL/TLS authentication must be used in this mode. mode server tls-server +--server-ipv6 args + Convenience-function to enable a number of IPv6 related options at once, + namely ``--ifconfig-ipv6``, ``--ifconfig-ipv6-pool`` and + ``--push tun-ipv6``. + + Valid syntax: + :: + + server-ipv6 ipv6addr/bits + + Pushing of the ``--tun-ipv6`` directive is done for older clients which + require an explicit ``--tun-ipv6`` in their configuration. + --stale-routes-check args Remove routes which haven't had activity for ``n`` seconds (i.e. the ageing time). This check is run every ``t`` seconds (i.e. check interval). @@ -646,9 +668,15 @@ fast hardware. SSL/TLS authentication must be used in this mode. ``--max-routes-per-client`` --username-as-common-name - For ``--auth-user-pass-verify`` authentication, use the authenticated - username as the common name, rather than the common name from the client - cert. + Use the authenticated username as the common-name, rather than the + common-name from the client certificate. Requires that some form of + ``--auth-user-pass`` verification is in effect. As the replacement happens + after ``--auth-user-pass`` verification, the verification script or + plugin will still receive the common-name from the certificate. + + The common_name environment variable passed to scripts and plugins invoked + after authentication (e.g, client-connect script) and file names parsed in + client-config directory will match the username. --verify-client-cert mode Specify whether the client is required to supply a valid certificate. diff --git a/doc/man-sections/vpn-network-options.rst b/doc/man-sections/vpn-network-options.rst index 825dd1c..2668278 100644 --- a/doc/man-sections/vpn-network-options.rst +++ b/doc/man-sections/vpn-network-options.rst @@ -114,6 +114,10 @@ routing. :code:`DOMAIN` ``name`` Set Connection-specific DNS Suffix to :code:`name`. + :code:`ADAPTER_DOMAIN_SUFFIX` ``name`` + Alias to :code:`DOMAIN`. This is a compatibility option, it + should not be used in new deployments. + :code:`DOMAIN-SEARCH` ``name`` Add :code:`name` to the domain search list. Repeat this option to add more entries. Up to diff --git a/doc/openvpn.8 b/doc/openvpn.8 index b914f32..5056e03 100644 --- a/doc/openvpn.8 +++ b/doc/openvpn.8 @@ -343,6 +343,13 @@ below), then are discarded. .sp The downside of using \fB\-\-mlock\fP is that it will reduce the amount of physical memory available to other applications. +.sp +The limit on how much memory can be locked and how that limit +is enforced are OS\-dependent. On Linux the default limit that an +unprivileged process may lock (RLIMIT_MEMLOCK) is low, and if +privileges are dropped later, future memory allocations will very +likely fail. The limit can be increased using ulimit or systemd +directives depending on how OpenVPN is started. .TP .BI \-\-nice \ n Change process priority after initialization (\fBn\fP greater than 0 is @@ -1268,50 +1275,67 @@ next remote succeeds. To silently ignore an option pushed by the server, use \fBignore\fP\&. .TP .BI \-\-remote \ args -Remote host name or IP address. It supports two additional optional -arguments: \fBport\fP and \fBproto\fP\&. On the client, multiple \fB\-\-remote\fP -options may be specified for redundancy, each referring to a different -OpenVPN server. Specifying multiple \fB\-\-remote\fP options for this -purpose is a special case of the more general connection\-profile -feature. See the \fB\fP documentation below. -.sp -The OpenVPN client will try to connect to a server at \fBhost:port\fP in -the order specified by the list of \fB\-\-remote\fP options. +Remote host name or IP address, port and protocol. .sp -Examples: +Valid syntaxes: .INDENT 7.0 .INDENT 3.5 .sp .nf .ft C -remote server.example.net -remote server.example.net 1194 -remote server.example.net tcp +remote host +remote host port +remote host port proto .ft P .fi .UNINDENT .UNINDENT .sp -\fBproto\fP indicates the protocol to use when connecting with the remote, -and may be \fBtcp\fP or \fBudp\fP\&. +The \fBport\fP and \fBproto\fP arguments are optional. The OpenVPN client +will try to connect to a server at \fBhost:port\fP\&. The \fBproto\fP argument +indicates the protocol to use when connecting with the remote, and may be +\fBtcp\fP or \fBudp\fP\&. To enforce IPv4 or IPv6 connections add a +\fB4\fP or \fB6\fP suffix; like \fBudp4\fP / \fBudp6\fP +/ \fBtcp4\fP / \fBtcp6\fP\&. .sp -For forcing IPv4 or IPv6 connection suffix tcp or udp with 4/6 like -udp4/udp6/tcp4/tcp6. +On the client, multiple \fB\-\-remote\fP options may be specified for +redundancy, each referring to a different OpenVPN server, in the order +specified by the list of \fB\-\-remote\fP options. Specifying multiple +\fB\-\-remote\fP options for this purpose is a special case of the more +general connection\-profile feature. See the \fB\fP +documentation below. .sp The client will move on to the next host in the list, in the event of connection failure. Note that at any given time, the OpenVPN client will at most be connected to one server. .sp -Note that since UDP is connectionless, connection failure is defined by +Examples: +.INDENT 7.0 +.INDENT 3.5 +.sp +.nf +.ft C +remote server1.example.net +remote server1.example.net 1194 +remote server2.example.net 1194 tcp +.ft P +.fi +.UNINDENT +.UNINDENT +.INDENT 7.0 +.TP +.B \fINote:\fP +Since UDP is connectionless, connection failure is defined by the \fB\-\-ping\fP and \fB\-\-ping\-restart\fP options. .sp -Note the following corner case: If you use multiple \fB\-\-remote\fP -options, AND you are dropping root privileges on the client with -\fB\-\-user\fP and/or \fB\-\-group\fP AND the client is running a non\-Windows -OS, if the client needs to switch to a different server, and that server -pushes back different TUN/TAP or route settings, the client may lack the -necessary privileges to close and reopen the TUN/TAP interface. This -could cause the client to exit with a fatal error. +Also, if you use multiple \fB\-\-remote\fP options, AND you are dropping +root privileges on the client with \fB\-\-user\fP and/or \fB\-\-group\fP AND +the client is running a non\-Windows OS, if the client needs to switch +to a different server, and that server pushes back different TUN/TAP +or route settings, the client may lack the necessary privileges to +close and reopen the TUN/TAP interface. This could cause the client +to exit with a fatal error. +.UNINDENT .sp If \fB\-\-remote\fP is unspecified, OpenVPN will listen for packets from any IP address, but will not act on those packets unless they pass all @@ -1709,7 +1733,8 @@ ifconfig\-ipv6\-pool ipv6addr/bits .UNINDENT .sp The pool starts at \fBipv6addr\fP and matches the offset determined from -the start of the IPv4 pool. +the start of the IPv4 pool. If the host part of the given IPv6 +address is \fB0\fP, the pool starts at \fBipv6addr\fP +1. .TP .BI \-\-ifconfig\-pool\-persist \ args Persist/unpersist ifconfig\-pool data to \fBfile\fP, at \fBseconds\fP @@ -2098,6 +2123,14 @@ Don\(aqt inherit the global push list for a specific client instance. Specify this option in a client\-specific context such as with a \fB\-\-client\-config\-dir\fP configuration file. This option will ignore \fB\-\-push\fP options at the global config file level. +.sp +\fINOTE\fP: \fB\-\-push\-reset\fP is very thorough: it will remove almost +all options from the list of to\-be\-pushed options. In many cases, +some of these options will need to be re\-configured afterwards \- +specifically, \fB\-\-topology subnet\fP and \fB\-\-route\-gateway\fP will get +lost and this will break client configs in many cases. Thus, for most +purposes, \fB\-\-push\-remove\fP is better suited to selectively remove +push options for individual clients. .TP .BI \-\-server \ args A helper directive designed to simplify the configuration of OpenVPN\(aqs @@ -2242,6 +2275,26 @@ tls\-server .UNINDENT .UNINDENT .TP +.BI \-\-server\-ipv6 \ args +Convenience\-function to enable a number of IPv6 related options at once, +namely \fB\-\-ifconfig\-ipv6\fP, \fB\-\-ifconfig\-ipv6\-pool\fP and +\fB\-\-push tun\-ipv6\fP\&. +.sp +Valid syntax: +.INDENT 7.0 +.INDENT 3.5 +.sp +.nf +.ft C +server\-ipv6 ipv6addr/bits +.ft P +.fi +.UNINDENT +.UNINDENT +.sp +Pushing of the \fB\-\-tun\-ipv6\fP directive is done for older clients which +require an explicit \fB\-\-tun\-ipv6\fP in their configuration. +.TP .BI \-\-stale\-routes\-check \ args Remove routes which haven\(aqt had activity for \fBn\fP seconds (i.e. the ageing time). This check is run every \fBt\fP seconds (i.e. check interval). @@ -2264,9 +2317,15 @@ This option helps to keep the dynamic routing table small. See also \fB\-\-max\-routes\-per\-client\fP .TP .B \-\-username\-as\-common\-name -For \fB\-\-auth\-user\-pass\-verify\fP authentication, use the authenticated -username as the common name, rather than the common name from the client -cert. +Use the authenticated username as the common\-name, rather than the +common\-name from the client certificate. Requires that some form of +\fB\-\-auth\-user\-pass\fP verification is in effect. As the replacement happens +after \fB\-\-auth\-user\-pass\fP verification, the verification script or +plugin will still receive the common\-name from the certificate. +.sp +The common_name environment variable passed to scripts and plugins invoked +after authentication (e.g, client\-connect script) and file names parsed in +client\-config directory will match the username. .TP .BI \-\-verify\-client\-cert \ mode Specify whether the client is required to supply a valid certificate. @@ -4271,6 +4330,10 @@ dhcp\-options type [parm] .B \fBDOMAIN\fP \fBname\fP Set Connection\-specific DNS Suffix to \fBname\fP\&. .TP +.B \fBADAPTER_DOMAIN_SUFFIX\fP \fBname\fP +Alias to \fBDOMAIN\fP\&. This is a compatibility option, it +should not be used in new deployments. +.TP .B \fBDOMAIN\-SEARCH\fP \fBname\fP Add \fBname\fP to the domain search list. Repeat this option to add more entries. Up to @@ -5020,9 +5083,8 @@ plugins will be called on client instance object deletion, even in cases where some of the related client\-connect functions returned an error status. .sp -The \fB\-\-client\-disconnect\fP command is passed the same pathname as the -corresponding \fB\-\-client\-connect\fP command as its last argument (after -any arguments specified in \fBcmd\fP). +The \fB\-\-client\-disconnect\fP command is not passed any extra arguments +(only those arguments specified in cmd, if any). .TP .BI \-\-down \ cmd Run command \fBcmd\fP after TUN/TAP device close (post \fB\-\-user\fP UID @@ -6283,8 +6345,11 @@ Valid syntax: .UNINDENT .UNINDENT .sp -If an IPv6 target address is passed as argument, the IPv6 route for this -host is reported. +For IPv6 this queries the route towards ::/128, or the specified IPv6 +target address if passed as argument. +For IPv4 on Linux, Windows, MacOS and BSD it looks for a 0.0.0.0/0 route. +If there are more specific routes, the result will not always be matching +the route of the IPv4 packets to the VPN gateway. .UNINDENT .SS Advanced Expert Options .sp diff --git a/doc/openvpn.8.html b/doc/openvpn.8.html index d6b2719..f5d6f26 100644 --- a/doc/openvpn.8.html +++ b/doc/openvpn.8.html @@ -3,7 +3,7 @@ - + openvpn