changelog

OpenVPN is a robust and highly flexible tunneling application that uses all of the encryption, authe

OpenVPN
Copyright (C) 2002-2004 James Yonan <[e-mail]>

$Id: ChangeLog,v 1.89.2.34 2004/06/24 03:48:27 jimyonan Exp $

2004.06.29 -- Version 2.0-beta7

* Fixed bug in link_socket_verify_incoming_addr() which
  under certain circumstances could have caused --float
  behavior even if --float was not specified.
* --tls-auth option now works with --mode server.
  All clients and the server should use the same
  --tls-auth key when operating in client/server mode.
* Added --engine option to make use of OpenSSL-supported
  crypto acceleration hardware.
* Fixed some high verbosity print format size issues
  in event.c for 64 bit platforms (Janne Johansson).
* Made failure to open --log or --log-append file
  a non-fatal error.

2004.06.23 -- Version 2.0-beta6

* Fixed Windows installer to intelligently put
  up a reboot dialog only if tapinstall tells
  us that it's really necessary.
* Fixed "Assertion failed at fragment.c:309"
  bug when --mode server and --fragment are used
  together.
* Ignore HUP, USR1, and USR2 signals during
  initialization.  Prior versions would abort.
* Fixed bug on OS X: "Assertion failed at event.c:406".
* Added --service option to Windows version, for use
  when OpenVPN is being programmatically instantiated
  by another process (see man page for info).
* --log and --log-append options now work on Windows.
* Update OpenBSD INSTALL notes (Janne Johansson).
* Enable multicast on tun interface when running on
  OpenBSD (Pavlin Radoslavov).
* Fixed recent --test-crypto breakage, where options
  such as --cipher were not being parsed correctly.
* Modified options compatibility string by removing
  ifconfig substring if it is empty.  Incremented
  options compatibility string version number to 4.
* Fixed typo in --tls-timeout option parsing
  (Mikael Lonnroth).

2004.06.13 -- Version 2.0-beta5

* Fixed rare --mode server crash that could occur
  if data was being routed to a client at
  high bandwidth at the precise moment that the
  client instance object on the server was being
  deleted.
* Fixed issue on machines which have epoll.h and
  the epoll_create glibc call defined, but which
  don't actually implement epoll in the kernel.
  OpenVPN will now gracefully fall back to the
  poll API in this case.
* Fixed Windows bug which would cause the following
  error in a --mode server --dev tap configuration:
  "resource limit WSA_MAXIMUM_WAIT_EVENTS has been
  exceeded".
* Added CRL (certificate revocation list) management
  scripts to easy-rsa directory (Jon Bendtsen).
* Do a better job of getting the ifconfig component
  of the options consistency check to work correctly
  when --up-delay is used.
* De-inlined some functions which were too complex
  to be inlined anyway with gcc.
* If a --dhcp-option option is pushed to a non-windows
  client, the option will be saved in the client's
  environment before the --up script is called, under
  the name "foreign_option_{n}".
* Added --learn-address script (see man page) which
  allows for firewall access through the VPN to be
  controlled based on the client common name.
* In mode --server mode, when a client connects to
  the server, the server will disconnect any
  still-active clients which use the same common
  name.  Use --duplicate-cn flag to revert to
  previous behavior of allowing multiple clients
  to concurrently connect with the same common name.

2004.06.08 -- Version 2.0-beta4

* Fixed issue with beta3 where Win32 service wrapper
  was keying off of old TAP HWID as a dependency.  To
  ensure that the new service wrapper is correctly
  installed, the Windows install script will uninstall
  the old wrapper before installing the new one,
  causing a reset of service properties.
* Fixed permissions issue on --status output file,
  with default access permissions of owner read/write
  only (default permissions can be changed of course with
  chmod).

2004.06.05 -- Version 2.0-beta3

* More changes to TAP-Win32 driver's INF file which
  affects the placement of the driver in the Windows
  device namespace.  This is done to work around an
  apparent bug in Windows when short HWIDs are used,
  and will also ease the upgrade from 1.x to 2.0 by
  reducing the chances that a reboot will be needed
  on upgrade.  Like beta2, this upgrade will
  delete existing TAP-Win32 interfaces, and reinstall
  a single new interface with default properties.
* Major rewrite of I/O event wait layer in the style
  of libevent.  This is a precursor to TCP support
  in --mode server.
* New feature: --status.  Outputs a SIGUSR2-like
  status summary to a given file, updated once
  per n seconds.  The status file is comma delimited
  for easy machine parsing.
* --ifconfig-pool now remembers common names and
  will try to assign a consistent IP to a given
  common name.  Still to do: persist --ifconfig-pool
  memory across restarts by saving state in file.
* Fixed bug in event timer queue which could cause
  recurring timer events such as --ping to not
  correctly schedule again after firing.  This in
  turn would cause spurrious ping restarts and possible
  connection outages.  Thanks to Denis Vlasenko for
  tracking this down.
* Possible fix to reported bug where --daemon argument
  was not printing to syslog correctly after restart.
* Fixed bug where pulling --route or --dhcp-option
  directives from a server would problematically
  interact with --persist-tun on the client.
* Updated contrib/multilevel-init.patch (Farkas Levente).
* Added RPM build option to .spec and .spec.in files
  to optionally disable LZO inclusion (Ian Pilcher).
* The latest MingW runtime and headers define
  'ssize_t', so a patch is needed (Gisle Vanem).

2004.05.14 -- Version 2.0-beta2

* Fixed signal handling bug in --mode server, where
  SIGHUP and SIGUSR1 were treated as SIGTERM.
* Changed the TAP-Win32 HWID from "TAP" to "TAPDEV".
  Apparently the larger string may work around
  a problem where the TAP adapter is sometimes missing
  from the network connections panel, especially under
  XP SP2. Also note that installing this upgrade will
  uninstall any pre-existing TAP-Win32 adapters, and then
  install a single new adapter, meaning that old adapter
  properties will be lost.  Thanks to Md5Chap for solving
  this one.
* For --mode server --dev tap, the options --ifconfig and
  --ifconfig-pool are now optional.  This allows address
  assignment via DHCP or use of a TAP VPN without
  IP support, as has always been possible with 1.x.
* Fixed bug where --ifconfig may not work correctly on
  Linux 2.2.
* Added 'local' flag to --redirect-gateway for use on
  networks where both OpenVPN daemons are connected
  to a shared subnet, such as wireless.

2004.05.09 -- Version 2.0-beta1

* Unchanged from test29 except for version number
  upgrade.

2004.05.08 -- Version 2.0-test29

* Modified --dev-node on Windows to accept a TAP-Win32
  GUID name.  In addition, --show-adapters will now
  display the high-level name and GUID of each adapter.
  This is an attempt to work around an issue in Windows
  where sometimes the TAP-Win32 adapter installs correctly
  but has no icon in the network connections control
  panel.  In such cases, being able to specify
  --dev-node {TAP-GUID} can work around the missing icon.

2004.05.07 -- Version 2.0-test28

* Fixed bug which could cause segfault on program
  shutdown if --route and --persist-tun are used
  together.

2004.05.06 -- Version 2.0-test27

* Fixed bug in close_instance() which might cause
  memory to be accessed after it had already been freed.
* Fixed bug in verify_callback() that might have
  caused uninitialized data to be referenced.
* --iroute now allows full CIDR subnet routing.
* In "--mode server --dev tun" usage, source addresses
  on VPN packets coming from a particular client must
  be associated with that client in the OpenVPN internal
  routing table.
	
2004.04.28 -- Version 2.0-test26

* Optimized broadcast path in multi-client mode.
* Added socket buffer size options --rcvbuf & --sndbuf.
* Configure Linux tun/tap driver to use a more sensible
  txqueuelen default.  Also allow explicit setting
  via --txqueuelen option (Harald Roelle).
* The --remote option now allows the port number
  to be specified as the second parameter.  If
  unspecified, the port number defaults to the
  --rport value.
* Multiple --remote options on the client can now be
  specified for load balancing and failover.  The
  --remote-random flag can be used to initially randomize
  the --remote list for basic load balancing.
* If a remote DNS name resolves to multiple DNS addresses,
  one will be chosen by random as a kind of basic
  load-balancing feature if --remote-random is used.
* Added --connect-freq option to control maximum
  new connection frequency in multi-client mode.
* In multi-client mode, all syslog messages associated
  with a specific client now include a client-ID prefix.
* For Windows, use a gettimeofday() function based
  on QueryPerformanceCounter (Derek Burdick).
* Fixed bug in interaction between --key-method 2
  and DES ciphers, where dynamic keys would be generated
  with bad parity and then be rejected.

2004.04.17 -- Version 2.0-test24

* Reworked multi-client broadcast handling.

2004.04.13 -- Version 2.0-test23
	
* Fixed bug in --dev tun --client-to-client routing.
* Fixed a potential deadlock in --pull.
* Fixed a problem with select() usage which could
  cause a repeating sequence of "select : Invalid
  argument (code=22)"

2004.04.11 -- Version 2.0-test22

* Fixed bug where --mode server + --daemon was
  prematurely closing syslog connection.
* Added support for --redirect-gateway on Mac OS X
  (Jeremy Apple).
* Minor changes to TAP-Win32 driver based on feedback
  from the NDISTest tool.
	
2004.04.11 -- Version 2.0-test21

* Optimizations in multi-client server event loop.

2004.04.10 -- Version 2.0-test20

* --mode server capability now works with either tun
  or tap interfaces.  When used with tap interfaces,
  OpenVPN will internally bridge all client tap
  interfaces with the server tap interface.
* Connecting clients can now have a client-specific
  configuration on the server, based on the client
  common name embedded in the client certificate.
  See --client-config-dir and --client-connect.
  These options can be used to configure client-specific
  routes.
* Added an option --client-to-client that enables
  internal client-to-client routing or bridging.
  Otherwise, clients will only "see" the server,
  not other connected clients.
* Fixed bug in route scheduling which would have caused
  --mode server to not work on Windows in test18
  and test19 with the sample config file.
* Man page is up to date with all new options.
* OpenVPN 2.0 release notes on web site updated
  with tap-style tunnel examples.

2004.04.02 -- Version 2.0-test19

* Fixed bug where routes pushed from server were
  not working correctly on Windows clients.
* Added Mac OS X route patch (Jeremy Apple).

2004.03.30 -- Version 2.0-test18

* Minor fixes + Windows self-install modified
  to use OpenSSL 0.9.7d.

2004.03.29 -- Version 2.0-test17

* Fixed some bugs related to instance timeout and deletion.
* Extended --push/--pull option to support additional
  option classes.

2004.03.28 -- Version 2.0-test16

* Successful test of --mode udp-server, --push,
  --pull, and --ifconfig-pool with server on
  Linux 2.4 and clients on Linux and Windows.

2004.03.25 -- Version 2.0-test15
	
* Implemented hash-table lookup of client instances
  based either on remote UDP address/port or remote
  ifconfig endpoint.
* Implemented a randomized binary tree based
  scheduler for scalably scheduling a large number
  of client instance events.  Uses the treap
  data structure and node rotation algorithm
  to keep the tree balanced.
* Initial implementation of ifconfig-pool.

2004.03.20 -- Version 2.0-test14

* Implemented --push and --pull.

2004.03.20 -- Version 2.0-test13

* Reduced struct tls_multi and --single-session