{"push_id":2725135716,"size":23,"distinct_size":23,"ref":"refs/heads/master","head":"d53529038d7be8d6203fb40b07e02353d2c617f2","before":"d56e977bba57e0ea0867e9d5bb2268f8bbd2c753","commits":[{"sha":"1394192b210cb3c6624a7419bcf3ff966742e79b","author":{"name":"Gert Doering","email":"f8cfa20164fd239e4612aaaab1d8b7ff6265f765@greenie.muc.de"},"message":"Fix potential double-free() in Interactive Service (CVE-2018-9336)\n\nMalformed input data on the service pipe towards the OpenVPN interactive\nservice (normally used by the OpenVPN GUI to request openvpn instances\nfrom the service) can result in a double free() in the error handling code.\n\nThis usually only leads to a process crash (DoS by an unprivileged local\naccount) but since it could possibly lead to memory corruption if\nhappening while multiple other threads are active at the same time,\nCVE-2018-9336 has been assigned to acknowledge this risk.\n\nFix by ensuring that sud->directory is set to NULL in GetStartUpData()\nfor all error cases (thus not being free()ed in FreeStartupData()).\n\nRewrite control flow to use explicit error label for error exit.\n\nDiscovered and reported by Jacob Baines <jbaines@tenable.com>.\n\nCVE: 2018-9336\n\nSigned-off-by: Gert Doering <gert@greenie.muc.de>\nAcked-by: Selva Nair <selva.nair@gmail.com>\nMessage-Id: <20180414072617.25075-1-gert@greenie.muc.de>\nURL: https://www.mail-archive.com/search?l=mid&q=20180414072617.25075-1-gert@greenie.muc.de\n\nSigned-off-by: Gert Doering <gert@greenie.muc.de>","distinct":true,"url":"https://api.github.com/repos/Amebis/openvpn/commits/1394192b210cb3c6624a7419bcf3ff966742e79b"},{"sha":"a59fd1475089eda4c89942d345070bb942180223","author":{"name":"Steffan Karger","email":"f89149f9f59d3c1dc8ccdd1c738efc3af884d875@karger.me"},"message":"man: add security considerations to --compress section\n\nAs Ahamed Nafeez reported to the OpenVPN security team, we did not\nsufficiently inform our users about the risks of combining encryption\nand compression.  This patch adds a \"Security Considerations\" paragraph\nto the --compress section of the manpage to point the risks out to our\nusers.\n\nSigned-off-by: Steffan Karger <steffan@karger.me>\nAcked-by: Gert Doering <gert@greenie.muc.de>\nMessage-Id: <1528020718-12721-1-git-send-email-steffan@karger.me>\nURL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg16919.html\nSigned-off-by: Gert Doering <gert@greenie.muc.de>","distinct":true,"url":"https://api.github.com/repos/Amebis/openvpn/commits/a59fd1475089eda4c89942d345070bb942180223"},{"sha":"5d2cd1222e06291021cf5e793f585d5f1485ae9b","author":{"name":"Antonio Quartulli","email":"a08f08bac39aeae6c9580ade7aa8387b5a0e7428@openvpn.net"},"message":"pool: restyle ipv4/ipv6 members to improve readability\n\n(This is only code refactoring)\n\nIPv4 and IPv6 members are all part of the same flat hierarchy\nin the pool data structure, without a proper name convention.\n\nCreate 2 sub-structures to properly separate IPv4 from IPv6\nrelated members. This should make the structure more organized\nand also slightly improve code readability.\n\nSigned-off-by: Antonio Quartulli <antonio@openvpn.net>\nAcked-by: Gert Doering <gert@greenie.muc.de>\nMessage-Id: <20180605090421.9746-3-a@unstable.cc>\nURL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg16944.html\nSigned-off-by: Gert Doering <gert@greenie.muc.de>","distinct":true,"url":"https://api.github.com/repos/Amebis/openvpn/commits/5d2cd1222e06291021cf5e793f585d5f1485ae9b"},{"sha":"3e1606fe86ba1b09d05ba828b5e4e280ceddd30a","author":{"name":"Antonio Quartulli","email":"a08f08bac39aeae6c9580ade7aa8387b5a0e7428@openvpn.net"},"message":"pool: convert pool 'type' to enum\n\nThe pool 'type' member is actually an enumered type, therefore\ndeclare it as 'enum' to improve static code analisys and\nreadability.\n\nSigned-off-by: Antonio Quartulli <antonio@openvpn.net>\nAcked-by: Gert Doering <gert@greenie.muc.de>\nMessage-Id: <20180608052017.6696-4-a@unstable.cc>\nURL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg17000.html\nSigned-off-by: Gert Doering <gert@greenie.muc.de>","distinct":true,"url":"https://api.github.com/repos/Amebis/openvpn/commits/3e1606fe86ba1b09d05ba828b5e4e280ceddd30a"},{"sha":"68441882e55b8e6c3c55a4078fbfdd76c7ada6bc","author":{"name":"Selva Nair","email":"2eb99a48d378528a84f7dde9096c19ce2b849493@gmail.com"},"message":"Replace M_DEBUG with D_LOW as the former is too verbose\n\nM_DEBUG only indicates the type of the message and will print even\nat verb 0.  Use D_LOW which is M_DEBUG combined with verb = 4 and\na mute level.\n\nAcked-by: Gert Doering <gert@greenie.muc.de>\nMessage-Id: <1528229170-6175-1-git-send-email-selva.nair@gmail.com>\nURL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg16964.html\nSigned-off-by: Gert Doering <gert@greenie.muc.de>","distinct":true,"url":"https://api.github.com/repos/Amebis/openvpn/commits/68441882e55b8e6c3c55a4078fbfdd76c7ada6bc"},{"sha":"62b1cc161c53d900b6fe56f6924ef2ec1c1b8a00","author":{"name":"Simon Rozman","email":"088e16a1019277b15d58faf0541e11910eb756f6@rozman.si"},"message":"Add Interactive Service developer documentation\n\nThe OpenVPN Interactive Service documentation from\nhttps://community.openvpn.net/openvpn/wiki/OpenVPNInteractiveService was\nupgraded with a description of the client-service communication flow,\nservice registry configuration, and non-default instance installation.\n\nAcked-by: Selva Nair <selva.nair@gmail.com>\nMessage-Id: <20180419112313.1013-1-simon@rozman.si>\nURL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg16794.html\n\nSigned-off-by: Gert Doering <gert@greenie.muc.de>","distinct":true,"url":"https://api.github.com/repos/Amebis/openvpn/commits/62b1cc161c53d900b6fe56f6924ef2ec1c1b8a00"},{"sha":"18225f0fd5c45164308d4d66db055a1ad3960887","author":{"name":"Antonio Quartulli","email":"a08f08bac39aeae6c9580ade7aa8387b5a0e7428@openvpn.net"},"message":"tun: ensure gc and argv are properly handled\n\nEverytime a argv object is initialized with argv_new(), it has\nto be released with argv_reset() once not needed anymore.\n\nEnsure this kind of objects are always properly released to avoid\nmemory leaks.\n\nAt the same time, remove those gc_arena objects that are initialized\nbut never used/released.\n\nSigned-off-by: Antonio Quartulli <antonio@openvpn.net>\n\nAcked-by: Gert Doering <gert@greenie.muc.de>\nMessage-Id: <20180613122824.4207-2-a@unstable.cc>\nURL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg17044.html\nSigned-off-by: Gert Doering <gert@greenie.muc.de>","distinct":true,"url":"https://api.github.com/repos/Amebis/openvpn/commits/18225f0fd5c45164308d4d66db055a1ad3960887"},{"sha":"0bea472c98dca8b3470ef863fd90a63b6c79fa68","author":{"name":"Antonio Quartulli","email":"a08f08bac39aeae6c9580ade7aa8387b5a0e7428@openvpn.net"},"message":"tun: always pass a valid tt pointer\n\nThis patch is a small \"logic restyle\" which basically moves the\ncheck for \"tt != NULL\" outside of the various close_tun()\nimplementations and replaces it with an ASSERT.\n\nThis way the check is done only once and the function can rely\non the assumption that \"tt\" is always valid.\n\nThis change is mainly to improve the code style inside close_tun()\nimplementations by removing one level of indentation.\n\nNo functional change is present.\n\nSigned-off-by: Antonio Quartulli <antonio@openvpn.net>\n\nAcked-by: Gert Doering <gert@greenie.muc.de>\nMessage-Id: <20180613122824.4207-3-a@unstable.cc>\nURL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg17045.html\nSigned-off-by: Gert Doering <gert@greenie.muc.de>","distinct":true,"url":"https://api.github.com/repos/Amebis/openvpn/commits/0bea472c98dca8b3470ef863fd90a63b6c79fa68"},{"sha":"78c58cfb02c5ca543cc7e0962337003601483e39","author":{"name":"Antonio Quartulli","email":"a08f08bac39aeae6c9580ade7aa8387b5a0e7428@openvpn.net"},"message":"tun: get rid of tt->did_ifconfig member\n\ntt->did_ifconfig is currently only read by the Linux platform, but\nit is currently uselessly set also by every other system.\n\nThe Linux platform does not actually even need this member and can\ndirectly rely on tt->did_ifconfig_setup.\n\nFor the reasons above, remove the tt->did_ifconfig at all and use\ntt->did_ifconfig_setup where needed (close_tun() on Linux).\n\nSigned-off-by: Antonio Quartulli <antonio@openvpn.net>\n\nAcked-by: Gert Doering <gert@greenie.muc.de>\nMessage-Id: <20180613122824.4207-4-a@unstable.cc>\nURL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg17046.html\nSigned-off-by: Gert Doering <gert@greenie.muc.de>","distinct":true,"url":"https://api.github.com/repos/Amebis/openvpn/commits/78c58cfb02c5ca543cc7e0962337003601483e39"},{"sha":"611fcbc487292054306767a76e727aea4e593725","author":{"name":"Antonio Quartulli","email":"a08f08bac39aeae6c9580ade7aa8387b5a0e7428@openvpn.net"},"message":"tun: ensure interface can be configured with IPv6 only\n\nThis change ensures that an interface is properly brought\nup and down even when only IPv6 settings are configured/pushed.\n\nAt the same time, some code restyling took place to ensure the new\ngeneric logic is easier to read. Both do_ifconfig() and close_tun()\n(Linux only) functions have been rearranged by splitting the logic\ninto a v4 and a v6 specific part. Each part has then been moved\ninto an idependent helper that can be invoked as\nneeded.\n\nThis makes the code easier to read and more \"symmetric\" with\nrespect to the two address families.\n\nTrac: #208\nSigned-off-by: Antonio Quartulli <antonio@openvpn.net>\n\nAcked-by: Gert Doering <gert@greenie.muc.de>\nMessage-Id: <20180618074733.19773-1-a@unstable.cc>\nURL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg17064.html\nSigned-off-by: Gert Doering <gert@greenie.muc.de>","distinct":true,"url":"https://api.github.com/repos/Amebis/openvpn/commits/611fcbc487292054306767a76e727aea4e593725"},{"sha":"c5108260b3699ab01638452ef3c9bef5193e265a","author":{"name":"Ilya Shipitsin","email":"037251da31699544c0c8b46c8c3f5d282e10978e@gmail.com"},"message":"travis-ci: cleanup, refactor, upgrade ssl libraries\n\nBoth \"compiler\" and \"exclude\" are redundant, so remove them.\nAdd openssl-1.0.1u to build matrix. Enable explicit apt update\n(it was disabled by default in travis-ci).\n\nSigned-off-by: Ilya Shipitsin <chipitsine@gmail.com>\n\n--\nv2: Add openssl-1.0.1u to build matrix (thanks to Steffan Karger),\nAdd explicit apt-get update (it was disabled by default in travis-ci)\nAcked-by: Steffan Karger <steffan.karger@fox-it.com>\nMessage-Id: <20180527190057.3488-1-chipitsine@gmail.com>\nURL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg16898.html\n\nSigned-off-by: Gert Doering <gert@greenie.muc.de>","distinct":true,"url":"https://api.github.com/repos/Amebis/openvpn/commits/c5108260b3699ab01638452ef3c9bef5193e265a"},{"sha":"e38d3a004195f33c5c04fe7c04db5d66c53241bc","author":{"name":"Antonio Quartulli","email":"86f7e437faa5a7fce15d1ddcb9eaeaea377667b8@unstable.cc"},"message":"add support for %lu in argv_printf and prevent ASSERT\n\n%lu is not supported by our tiny argv_printf implementation, therefore\nit will trigger an ASSERT() when parsing it at route.c:1638.\n\nAdd support for '%lu' in argv_print() and prevent the ASSERT from being\ntriggered.\n\nSigned-off-by: Antonio Quartulli <a@unstable.cc>\nAcked-by: Gert Doering <gert@greenie.muc.de>\nMessage-Id: <20180623021147.22792-1-a@unstable.cc>\nURL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg17115.html\nSigned-off-by: Gert Doering <gert@greenie.muc.de>","distinct":true,"url":"https://api.github.com/repos/Amebis/openvpn/commits/e38d3a004195f33c5c04fe7c04db5d66c53241bc"},{"sha":"125e9df9539a0d3aa7894f959ef966464754f1da","author":{"name":"Antonio Quartulli","email":"a08f08bac39aeae6c9580ade7aa8387b5a0e7428@openvpn.net"},"message":"windows: properly configure TAP driver when no IPv4 is configured\n\nThis patch ensures that the TAP driver on a windows host is still\nconfigured, even though no IPv4 has been provided.\n\nIn this case the TAP driver ioctl will be invoked with a fake\n0.0.0.0/0.0.0.0 IPv4 which will simply start the interface and\nget it to a working state.\n\nTrac: #208\nSigned-off-by: Antonio Quartulli <antonio@openvpn.net>\nAcked-by: Gert Doering <gert@greenie.muc.de>\nMessage-Id: <20180623183108.18684-1-a@unstable.cc>\nURL: https://www.mail-archive.com/search?l=mid&q=20180623183108.18684-1-a@unstable.cc\nSigned-off-by: Gert Doering <gert@greenie.muc.de>","distinct":true,"url":"https://api.github.com/repos/Amebis/openvpn/commits/125e9df9539a0d3aa7894f959ef966464754f1da"},{"sha":"4376805d8fd2a5d4a3a7c5e4f60948a3ef76ff3b","author":{"name":"Gert Doering","email":"f8cfa20164fd239e4612aaaab1d8b7ff6265f765@greenie.muc.de"},"message":"Add %d, %u and %lu tests to test_argv unit tests.\n\nSome basic integer tests to verify signed, unsigned and\nlong unsigned (1L) printing.\n\nSigned-off-by: Gert Doering <gert@greenie.muc.de>\n\nAcked-by: Selva Nair <selva.nair@gmail.com>\nMessage-Id: <20180623191538.29317-1-gert@greenie.muc.de>\nURL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg17131.html\nSigned-off-by: Gert Doering <gert@greenie.muc.de>","distinct":true,"url":"https://api.github.com/repos/Amebis/openvpn/commits/4376805d8fd2a5d4a3a7c5e4f60948a3ef76ff3b"},{"sha":"17a476fd5c8cc49f1d103a50199e87ede76b1b67","author":{"name":"Steffan Karger","email":"f89149f9f59d3c1dc8ccdd1c738efc3af884d875@karger.me"},"message":"openssl: don't use deprecated SSLEAY/SSLeay symbols\n\nCompiling our current master against OpenSSL 1.1 with\n-DOPENSSL_API_COMPAT=0x10100000L screams bloody murder.  This patch fixes\nthe errors about the deprecated SSLEAY/SSLeay symbols and defines.\n\nSigned-off-by: Steffan Karger <steffan@karger.me>\nAcked-by: Gert Doering <gert@greenie.muc.de>\nMessage-Id: <20171126150401.28565-1-steffan@karger.me>\nURL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15934.html\nSigned-off-by: Gert Doering <gert@greenie.muc.de>","distinct":true,"url":"https://api.github.com/repos/Amebis/openvpn/commits/17a476fd5c8cc49f1d103a50199e87ede76b1b67"},{"sha":"1987498271abadf042d8bb3feee1fe0d877a9d55","author":{"name":"Steffan Karger","email":"f89149f9f59d3c1dc8ccdd1c738efc3af884d875@karger.me"},"message":"openssl: add missing #include statements\n\nCompiling our current master against OpenSSL 1.1 with\n-DOPENSSL_API_COMPAT=0x10100000L screams bloody murder.  This patch fixes\nthe errors caused by missing includes.  Previous openssl versions would\nusually include 'the rest of the world', but they're fixing that.  So we\nshould no longer rely on it.\n\n(And sneaking in alphabetic ordering of the includes while touching them.)\n\nSigned-off-by: Steffan Karger <steffan@karger.me>\nAcked-by: Gert Doering <gert@greenie.muc.de>\nMessage-Id: <20171126154912.13283-1-steffan@karger.me>\nURL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15936.html\nSigned-off-by: Gert Doering <gert@greenie.muc.de>","distinct":true,"url":"https://api.github.com/repos/Amebis/openvpn/commits/1987498271abadf042d8bb3feee1fe0d877a9d55"},{"sha":"6ae2f19d891e8cedccffdb1760b9774b9feff140","author":{"name":"Gert Doering","email":"f8cfa20164fd239e4612aaaab1d8b7ff6265f765@greenie.muc.de"},"message":"Extend push-remove to also handle 'ifconfig'.\n\nPush-remove (introduced in commit 970312f1850) did not handle \"ifconfig\"\nyet, as both \"ifconfig\" and \"ifconfig-ipv6\" are handled differently from\nall other pushed options.  Since there was no valid use-case to not-push\n\"ifconfig\" (no support on the client side for running IPv6-only) this\nwas not an issue so far - but with the recent commits to enable ipv6-only\noperation it can be a desirable feature.\n\nThe implementation is similar to \"push-remove ifconfig-ipv6\" - namely,\nflagging via a new context option (c->options.push_ifconfig_ipv4_blocked)\nand then not creating the push statement in \"send_push_reply()\".\n\nWhile not truly elegant, it's much less invasive than the alternatives\n(storing the list of \"push-remove\" statements somewhere and then checking\nin push_option_ex())\n\nTrac: #1072\n\nSigned-off-by: Gert Doering <gert@greenie.muc.de>\n\nAcked-by: Antonio Quartulli <antonio@openvpn.net>\nMessage-Id: <20180701195938.2541-1-gert@greenie.muc.de>\nURL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg17169.html\nSigned-off-by: Gert Doering <gert@greenie.muc.de>","distinct":true,"url":"https://api.github.com/repos/Amebis/openvpn/commits/6ae2f19d891e8cedccffdb1760b9774b9feff140"},{"sha":"e050bdfe9489ae9d0a15cb000360b73c7c748b59","author":{"name":"Arne Schwabe","email":"dab03e449f14e75765945578a2efe6f319276af7@rfc2549.org"},"message":"Add MTU to Android IFCONFIG6 control command\n\nSince OpenVPN nows supports IPv6 only connections, OpenVPN for Android\ncannot longer rely on IFCONFIG to send the MTU. Add sending the MTU to\nIFCONFIG6 too.\nAcked-by: Gert Doering <gert@greenie.muc.de>\nMessage-Id: <20180703161751.7680-1-arne@rfc2549.org>\nURL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg17186.html\n\nSigned-off-by: Gert Doering <gert@greenie.muc.de>","distinct":true,"url":"https://api.github.com/repos/Amebis/openvpn/commits/e050bdfe9489ae9d0a15cb000360b73c7c748b59"},{"sha":"b7bea782f3356dbd82613dc8f38fd4ef0bc714ca","author":{"name":"Steffan Karger","email":"80facfc4657f5ce127b055e847f97345ac717798@fox-it.com"},"message":"Move file-related functions from misc.c to platform.c\n\nTo avoid having to include misc.c - which is a dependency mess - in the\ntls-crypt unit tests, move file-handing related functions to platform.c\n(which is where other file-related functions already reside).\n\nNote that platform_create_temp_file() needs random.  To avoid including\nmisc.c in other tests that use platform.c, add a mock get_random().\n\n(Almost every test includes platform.c, because buffer.c depends on it.\nThat smells like it needs cleanup too, but not in this patch set.)\n\nSigned-off-by: Steffan Karger <steffan.karger@fox-it.com>\nAcked-by: Gert Doering <gert@greenie.muc.de>\nMessage-Id: <20180704175404.22371-1-steffan@karger.me>\nURL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg17208.html\nSigned-off-by: Gert Doering <gert@greenie.muc.de>","distinct":true,"url":"https://api.github.com/repos/Amebis/openvpn/commits/b7bea782f3356dbd82613dc8f38fd4ef0bc714ca"},{"sha":"bf97c00f7dba441b504881f38e40afcbb610a39f","author":{"name":"Steffan Karger","email":"f89149f9f59d3c1dc8ccdd1c738efc3af884d875@karger.me"},"message":"Move execve/run_script helper functions to run_command.c\n\nTo avoid having to include misc.c - which is a dependency mess - in the\ntls-crypt unit tests, move the command execution helper functions to a new\nrun_command.c module.\n\nWhile at it, abstract away the script_security global variable.\n\nSigned-off-by: Steffan Karger <steffan.karger@fox-it.com>\nAcked-by: Antonio Quartulli <antonio@openvpn.net>\nMessage-Id: <20180704175404.22371-2-steffan@karger.me>\nURL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg17212.html\nSigned-off-by: Gert Doering <gert@greenie.muc.de>","distinct":true,"url":"https://api.github.com/repos/Amebis/openvpn/commits/bf97c00f7dba441b504881f38e40afcbb610a39f"}]}
{"actor":{"display_login":"rozmansi"}}