OpenVPN
Find a file
Heiko Hund 1dfe8729f6 dns: support running up/down command with privsep
With --user privileges are dropped after init. Unfortunately this
affects --dns-updown when undoing previous modifications.

To keep the privileges for just that, the concept of a dns updown runner
in introduced. It's basically a fork of openvpn at the time the
modifications to DNS are made. Its only capability is running the
--dns-updown command when asked to. The parent openvpn process signals
this by writing to a pipe the runner is waiting on.

Commands need to be ready to receive variables from a file instead of the
process environment. A shameless and effective workaround to keep the
protocol between the two processes simple.

Change-Id: I6b67e3a00dd84bf348b6af28115ee11138c3a111
Signed-off-by: Heiko Hund <heiko@ist.eigentlich.net>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20250517083833.28728-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg31668.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>
2025-05-17 11:09:51 +02:00
.github GHA: Use CMake 4.0 and apply required fixes 2025-04-09 16:26:59 +02:00
contrib Doxygen: Fix obsolete links to OpenSSL documentation 2025-04-09 16:04:06 +02:00
debug build: standard directory layout 2012-03-22 22:07:08 +01:00
dev-tools Update Copyright statements to 2024 2024-03-18 18:46:26 +01:00
distro dns: support running up/down command with privsep 2025-05-17 11:09:51 +02:00
doc dns: apply settings via script on unixoid systems 2025-05-14 18:17:51 +02:00
include win: remove Wintun support 2025-05-13 17:32:00 +02:00
m4 configure: update old copy of pkg.m4 2024-05-06 18:24:23 +02:00
sample Manually reformat some long trailing comments 2025-05-05 13:01:29 +02:00
src dns: support running up/down command with privsep 2025-05-17 11:09:51 +02:00
tests CMake: Sync list of compiler flags with configure.ac 2025-05-09 12:16:27 +02:00
.git-blame-ignore-revs uncrustify: add sp_after_comma=add 2022-05-22 13:10:22 +02:00
.gitattributes cleanup: add .gitattributes to control eol style explicitly 2012-04-26 20:54:26 +02:00
.gitignore dns: apply settings via script on unixoid systems 2025-05-14 18:17:51 +02:00
.mailmap Update .mailmap to unify and clean up odd names and e-mail addresses 2016-10-18 13:46:04 +02:00
.svncommitters Added mapping files from SVN commit ID to more descriptive commit IDs. 2010-10-21 11:31:26 +02:00
AUTHORS This is the start of the BETA21 branch. 2005-09-26 05:28:27 +00:00
ChangeLog Update Copyright statements to 2024 2024-03-18 18:46:26 +01:00
Changes.rst Implement override-username 2025-03-11 18:58:19 +01:00
CMakeLists.txt dns: apply settings via script on unixoid systems 2025-05-14 18:17:51 +02:00
CMakePresets.json Add building/testing with msbuild and the clang compiler 2024-12-27 12:30:55 +01:00
compat.m4 Remove checks for uint* types that are part of C99 2021-04-07 08:30:34 +02:00
config.h.cmake.in dns: apply settings via script on unixoid systems 2025-05-14 18:17:51 +02:00
configure.ac dns: apply settings via script on unixoid systems 2025-05-14 18:17:51 +02:00
CONTRIBUTING.rst Add git pre-commit hook script to uncrustify 2022-04-22 09:25:55 +02:00
COPYING Update Copyright statements to 2024 2024-03-18 18:46:26 +01:00
COPYRIGHT.GPL copyright: Update GPLv2 license texts 2017-06-16 10:38:03 +02:00
forked-test-driver forked-test-driver: Show test output always 2024-04-02 17:20:48 +02:00
INSTALL Haiku: Introduce basic platform / tun support 2024-11-28 12:19:38 +01:00
ltrc.inc cmake: symlink whole build dir not just .json file 2024-01-17 15:01:54 +01:00
Makefile.am configure: Allow to detect git checkout if .git is not a directory 2024-09-06 22:07:18 +02:00
NEWS This is the start of the BETA21 branch. 2005-09-26 05:28:27 +00:00
PORTS Update Copyright statements to 2024 2024-03-18 18:46:26 +01:00
README README.cmake.md: Add new documentation for CMake buildsystem 2023-07-07 19:07:10 +02:00
README.awslc Add compatibility to build OpenVPN with AWS-LC. 2025-01-29 17:11:19 +01:00
README.cmake.md README.cmake.md: Document minimum required CMake version for --preset 2024-02-01 20:26:45 +01:00
README.dco.md README.cmake.md: Add new documentation for CMake buildsystem 2023-07-07 19:07:10 +02:00
README.ec Implement tls-groups option to specify eliptic curves/groups 2020-07-21 22:33:58 +02:00
README.mbedtls Remove license warning from README.mbedtls 2024-03-15 09:16:54 +01:00
README.wolfssl README.wolfssl Update 2021-03-19 15:19:31 +01:00
renovate.json GHA: Configure Renovate 2024-09-08 13:57:11 +02:00
version.m4 Change version.m4 to 2.7_git 2022-12-01 16:33:25 +01:00

OpenVPN -- A Secure tunneling daemon

Copyright (C) 2002-2022 OpenVPN Inc. This program is free software;
you can redistribute it and/or modify
it under the terms of the GNU General Public License version 2
as published by the Free Software Foundation.

*************************************************************************

To get the latest release of OpenVPN, go to:

	https://openvpn.net/community-downloads/

To Build and Install,

	tar -zxf openvpn-<version>.tar.gz
	cd openvpn-<version>
	./configure
	make
	make install

or see the file INSTALL for more info.

For information on how to build OpenVPN on/for Windows with MinGW
or MSVC see README.cmake.md.

*************************************************************************

For detailed information on OpenVPN, including examples, see the man page
  http://openvpn.net/man.html

For a sample VPN configuration, see
  http://openvpn.net/howto.html

To report an issue, see
  https://github.com/OpenVPN/openvpn/issues/new
  (Note: We recently switched to GitHub for reporting new issues,
   old issues can be found at:
   https://community.openvpn.net/openvpn/report)

For a description of OpenVPN's underlying protocol,
  see the file ssl.h included in the source distribution.

*************************************************************************

Other Files & Directories:

* configure.ac -- script to rebuild our configure
  script and makefile.

* sample/sample-scripts/verify-cn

  A sample perl script which can be used with OpenVPN's
  --tls-verify option to provide a customized authentication
  test on embedded X509 certificate fields.

* sample/sample-keys/

  Sample RSA keys and certificates.  DON'T USE THESE FILES
  FOR ANYTHING OTHER THAN TESTING BECAUSE THEY ARE TOTALLY INSECURE.

* sample/sample-config-files/

  A collection of OpenVPN config files and scripts from
  the HOWTO at http://openvpn.net/howto.html

*************************************************************************

Note that easy-rsa and tap-windows are now maintained in their own subprojects.
Their source code is available here:

  https://github.com/OpenVPN/easy-rsa
  https://github.com/OpenVPN/tap-windows6

Community-provided Windows installers (MSI) and Debian packages are built from

  https://github.com/OpenVPN/openvpn-build

See the INSTALL file for usage information.