{"push_id":915505439,"size":22,"distinct_size":22,"ref":"refs/heads/master","head":"701269ff997d1f107acbc402d18dfff3236e751f","before":"0e591a2fce325e2b91d429ea18aa6ed383330383","commits":[{"sha":"33cca5853b2bfa58dcb736a1eeb3c2a1e2c7a761","author":{"email":"4b56af5ae892d60698d02db5913af96ca4a4e6d7@lettink.de","name":"Davide Guerri"},"message":"Implement --passtos for tagged ethernet frames\n\nThis patch makes it possible to use the --passtos option with 802.1Q tagged\nethernet frames.\n\nsf.net tracker:\n<https://sourceforge.net/tracker/?func=detail&aid=2829878&group_id=48978&atid=454721>\n\nDiscussed on the IRC meeting March 4, 2010 in #openvpn-discussions.\n<http://thread.gmane.org/gmane.network.openvpn.devel/3242>\n\n* [PATCH] Implement --passtos for tagged ethernet frames\n  - http://thread.gmane.org/gmane.network.openvpn.devel/3165\n  - decided to ask for testing help in the mailinglists\n\nThis patch will need to be tested in it's own feat_passtos branch.  When testing\nhas been acceped by the community, it will be merged into the 'allmerged' branch.\n\nSigned-off-by: David Sommerseth <dazo@users.sourceforge.net>","distinct":true,"url":"https://api.github.com/repos/ikelos/openvpn/commits/33cca5853b2bfa58dcb736a1eeb3c2a1e2c7a761"},{"sha":"a849fbd722defea0e4469212d856c4dea9713748","author":{"email":"4b56af5ae892d60698d02db5913af96ca4a4e6d7@lettink.de","name":"Fabian Knittel"},"message":"is_ipv4(): add packet length check for 802.1Q packets\n\nThis patch adds an additional length check to is_ipv4().\n\nCurrently is_ipv4() only checks whether the frame is large enough for struct\nopenvpn_ethhdr. In case of an 802.1Q packet the function now also checks\nwhether the frame is large enough for struct openvpn_8021qhdr, which is 4 bytes\nlarger than struct openvpn_ethhdr.\n\nSigned-off-by: Fabian Knittel <fabian.knittel@lettink.de>","distinct":true,"url":"https://api.github.com/repos/ikelos/openvpn/commits/a849fbd722defea0e4469212d856c4dea9713748"},{"sha":"f9202ec848dd4cb50a88fd9d7670c84616fbda50","author":{"email":"4b56af5ae892d60698d02db5913af96ca4a4e6d7@lettink.de","name":"Fabian Knittel"},"message":"vlan: add compile-time option ENABLE_VLAN_TAGGING\n\nThe option can be disabled via \"./configure --disable-vlan-tagging\".\n\nSigned-off-by: Fabian Knittel <fabian.knittel@lettink.de>","distinct":true,"url":"https://api.github.com/repos/ikelos/openvpn/commits/f9202ec848dd4cb50a88fd9d7670c84616fbda50"},{"sha":"5c3182675e8d6c4c08a06b158565d3a9e7e48c22","author":{"email":"4b56af5ae892d60698d02db5913af96ca4a4e6d7@lettink.de","name":"Fabian Knittel"},"message":"vlan: Add global --vlan-accept option\n\nThis patch adds the new \"--vlan-accept mode\" option.  The option is valid\nin server mode.  It is set to \"raw\" by default.\n\nIf the option is set to \"raw\", OpenVPN will operate as before. Frames may\nbe tagged or untagged and OpenVPN couldn't care less.\n\nIf the option is set to \"tagged\", OpenVPN will assume the tap device\nto be in tagged mode, i.e. packets coming in on the device are VLAN-tagged.\nPackets going out through the device will be VLAN-tagged likewise. Untagged\npackets coming in on the tap device will be dropped.\n\nIf the option is set to \"untagged\", openvpn will assume the packets to be\nuntagged or priority-tagged. Incoming VLAN-tagged packets will be dropped.\n\nIf the option is set to \"all\", openvpn will accept both VLAN-tagged packets\nand untagged or priority-tagged packets.\n\nThe option has no immediate effect yet, but will be used by later patches.\n\nSigned-off-by: Fabian Knittel <fabian.knittel@lettink.de>","distinct":true,"url":"https://api.github.com/repos/ikelos/openvpn/commits/5c3182675e8d6c4c08a06b158565d3a9e7e48c22"},{"sha":"1151c8c208b162d3f09aea1aa6494681da699cb3","author":{"email":"4b56af5ae892d60698d02db5913af96ca4a4e6d7@lettink.de","name":"Fabian Knittel"},"message":"vlan: Add per-client --vlan-pvid option\n\nThis patch adds the new \"--vlan-pvid\" integer option.  The option is valid\nin server mode and can be set in a client context (e.g. from the client-connect\nhook).  It defaults to 1.\n\nThe value indicates which VID (VLAN identifier) to associate with a client\nor (in global context) with the tap device.\nIt also serves as the Port VLAN Identifier, i.e. the VID to use for incoming\nand outgoing untagged or priority-tagged frames.\n\nThe client will only receive packets which belong to the same VLAN.\n\nThe option has no immediate effect yet, but will be used by later patches.\n\nSigned-off-by: Fabian Knittel <fabian.knittel@lettink.de>","distinct":true,"url":"https://api.github.com/repos/ikelos/openvpn/commits/1151c8c208b162d3f09aea1aa6494681da699cb3"},{"sha":"7b3bf2aa2cbde3a0e7cb06d4c515696e32d45385","author":{"email":"4b56af5ae892d60698d02db5913af96ca4a4e6d7@lettink.de","name":"Fabian Knittel"},"message":"vlan: Prepend and remove VLAN identifiers on outgoing and incoming frames\n\nThis patch adds parsing of the IEEE 802.1Q headers for incoming and outgoing\nethernet frames.\n\nFor frames coming in from the tap device, the 802.1Q header is parsed and\ntranslated into a regular Ethernet II header.\n\nFor frames where the Priority Code Point (PCP) is non-zero, the 802.1Q tagging\nisn't removed. Instead, the VID is zeroed out, turning the frame into a\npriority frame.\n\nFor frames going out over the tap interface, the Ethernet II header is\nreplaced with a 802.1Q-based header.  PCP and CFI are permanently set to 0,\nunless the frame was a priority frame, in which case the values are copied\nover.  The VID is set according to the instance's vlan_pvid value (also see\npatch adding the \"--vlan-pvid\" option).\n\nIn \"--vlan-accept untagged\" mode, VLAN-tagged frames coming in from the tap\ndevice are dropped.  Untagged or priority tagged frames are assigned the VID of\nthe global \"--vlan-pvid\" setting.  Outgoing frames are sent untagged or\npriority-tagged. Outgoing frames are dropped if the VID does not match the\nglobal \"--vlan-pvid\" setting.\n\nIn \"--vlan-accept all\" mode, VLAN-tagged frames coming in from the tap device\nare handled the same way as in the \"tagged\" mode. Untagged or priority\ntagged frames are handled the same was as in \"untagged\" mode. Outgoing frames\nare tagged if they don't match the global tag_pvid value. Otherwise they go\nout untagged.\n\nThe patch also introduces the log level D_VLAN_DEBUG for debug messages\nregarding tagging/untagging.\n\nSigned-off-by: Fabian Knittel <fabian.knittel@lettink.de>","distinct":true,"url":"https://api.github.com/repos/ikelos/openvpn/commits/7b3bf2aa2cbde3a0e7cb06d4c515696e32d45385"},{"sha":"9c4d6ab69b6f9073e31eb5102f01502576e505d7","author":{"email":"4b56af5ae892d60698d02db5913af96ca4a4e6d7@lettink.de","name":"Fabian Knittel"},"message":"vlan: Add VLAN identifier to mroute_addr for ethernet addresses\n\nThis patch appends the VID to the ethernet address in mroute_addr.\n\nBy including the VID in mroute_addr, the routing space is divided by VLAN.\nThis means:\n - duplicate MAC addresses on different VLANs no longer conflict and\n - all unicast-traffic is constrained to whatever VLAN the traffic came\n   from (i.e. cross-VLAN unicast routing is no longer possible).\n\n(This patch doesn't take care of broadcast traffic.  Broadcast traffic across\nVLANs is still be possible at this point.)\n\nSigned-off-by: Fabian Knittel <fabian.knittel@lettink.de>","distinct":true,"url":"https://api.github.com/repos/ikelos/openvpn/commits/9c4d6ab69b6f9073e31eb5102f01502576e505d7"},{"sha":"0580fe78d0f0f4a14faeefd24fc85c60b7d4734b","author":{"email":"4b56af5ae892d60698d02db5913af96ca4a4e6d7@lettink.de","name":"Fabian Knittel"},"message":"vlan: Restrict broadcasts to the sender's VLAN.\n\nThis patch enhances openvpn's internal packet routing to restrict broadcast\npackets to destinations with a matching VID.\n\nI.e. broadcasts from client to client or from tap interface to clients are now\nfiltered based on whether the client belongs to the correct VLAN id.\n\nSigned-off-by: Fabian Knittel <fabian.knittel@lettink.de>","distinct":true,"url":"https://api.github.com/repos/ikelos/openvpn/commits/0580fe78d0f0f4a14faeefd24fc85c60b7d4734b"},{"sha":"9ff44e334df287774600b5b9e71c2a51917b59e4","author":{"email":"4b56af5ae892d60698d02db5913af96ca4a4e6d7@lettink.de","name":"Fabian Knittel"},"message":"vlan: Slightly enhance PF's protocol inspection of 802.1Q packets\n\nTo allow openvpn's PF code to inspect IP packets contained within 802.1Q\npackets, this patch enhances mroute_extract_addr_ether() to properly\nskip over the 802.1Q header.\n\nSigned-off-by: Fabian Knittel <fabian.knittel@lettink.de>","distinct":true,"url":"https://api.github.com/repos/ikelos/openvpn/commits/9ff44e334df287774600b5b9e71c2a51917b59e4"},{"sha":"81af10fefa30d247f0d7bf2d671cfb81fe2b089d","author":{"email":"4b56af5ae892d60698d02db5913af96ca4a4e6d7@lettink.de","name":"Fabian Knittel"},"message":"vlan: document --vlan-accept and --vlan-pvid in openvpn.8 man page\n\nSigned-off-by: Fabian Knittel <fabian.knittel@lettink.de>","distinct":true,"url":"https://api.github.com/repos/ikelos/openvpn/commits/81af10fefa30d247f0d7bf2d671cfb81fe2b089d"},{"sha":"1c0e0b331e412825f98a62d813bad001ec4f7be7","author":{"email":"4b56af5ae892d60698d02db5913af96ca4a4e6d7@lettink.de","name":"Fabian Knittel"},"message":"vlan: split out '--vlan-accept raw' to '--vlan-tagging' boolean switch\n\nAs '--vlan-accept raw' is a global behavioural modifier, it makes more sense\nto break it out into a global '--vlan-tagging' boolean switch. (Which\nmatches the approach chosen in the initial patch-set.)\n\n'--vlan-accept tagged|untagged|all' now only specifies the behaviour of the\ntap device, while '--vlan-tagging' specifies whether OpenVPN should take a\ncloser look at the tagging of packets.\n\nThe patch is only a configuration option change.  The behaviour should\nremain the same.\n\n  New                                       Old\n  ------------------------------------------------------------------\n\n  not specifying anything is equivalent to not specifying anything\n\n  not specifying anything is equivalent to '--vlan-accept raw'\n\n  '--vlan-tagging' +\n  '--vlan-accept tagged'  is equivalent to '--vlan-accept tagged'\n\n  '--vlan-tagging' +\n  '--vlan-accept untagged' is equivalent to '--vlan-accept untagged'\n\n  '--vlan-tagging'        is equivalent to '--vlan-accept all'\n\n  '--vlan-tagging' +\n  '--vlan-accept all'     is equivalent to '--vlan-accept all'\n\nSigned-off-by: Fabian Knittel <fabian.knittel@lettink.de>","distinct":true,"url":"https://api.github.com/repos/ikelos/openvpn/commits/1c0e0b331e412825f98a62d813bad001ec4f7be7"},{"sha":"f96e2fc60ebbae73a6b57413c61d1467434cd3cd","author":{"email":"4b56af5ae892d60698d02db5913af96ca4a4e6d7@lettink.de","name":"Fabian Knittel"},"message":"vlan: Mention 802.1Q in configuration descriptions\n\nTo clarify that the tagging/untagging is based on the 802.1Q standard, this\npatch adds \"802.1Q-based\" to a few descriptive strings.\n\nThe improvement was suggested by Peter Stuge.\n\nSigned-off-by: Fabian Knittel <fabian.knittel@lettink.de>","distinct":true,"url":"https://api.github.com/repos/ikelos/openvpn/commits/f96e2fc60ebbae73a6b57413c61d1467434cd3cd"},{"sha":"e3c2ce55e8f7553a0ff8923f746f57663dbac2a7","author":{"email":"4b56af5ae892d60698d02db5913af96ca4a4e6d7@lettink.de","name":"Fabian Knittel"},"message":"vlan: use uint16_t for storage of the VID where possible\n\nThis patch switches from signed to unsigned short integers for storage of\nthe VID.  The change attempts to clarify, that the VID can't ever be negative.\n\nThe only place where the patch doesn't use unsigned int is for the return value\nof remove_vlan_tag(): The function indicates errors by returning -1.\n\nThe patch should not cause any changes in behaviour.\n\nThe improvement was suggested by Peter Stuge.\n\nSigned-off-by: Fabian Knittel <fabian.knittel@lettink.de>","distinct":true,"url":"https://api.github.com/repos/ikelos/openvpn/commits/e3c2ce55e8f7553a0ff8923f746f57663dbac2a7"},{"sha":"acc2a6daab7ff1b0dc5979690eef22b6d389ff1a","author":{"email":"4b56af5ae892d60698d02db5913af96ca4a4e6d7@lettink.de","name":"Fabian Knittel"},"message":"vlan: slightly clean-up buf_filter_incoming_vlan_tags()\n\nThis patch changes buf_filter_incoming_vlan_tags() to use a less nested\ncode-style.  It also improves documentation of the function.\n\nIn addition, the function is made static, as it is only used locally.\n\nCode based on a snippet by Peter Stuge.\n\nSigned-off-by: Fabian Knittel <fabian.knittel@lettink.de>","distinct":true,"url":"https://api.github.com/repos/ikelos/openvpn/commits/acc2a6daab7ff1b0dc5979690eef22b6d389ff1a"},{"sha":"a956b5ded98f2e505000bab7193b48a4fe342dff","author":{"email":"4b56af5ae892d60698d02db5913af96ca4a4e6d7@lettink.de","name":"Fabian Knittel"},"message":"vlan: Improve documentation of remove_vlan_tag()\n\nThis patch improves the comments that document the remove_vlan_tag() function.\nIt clarifies what is meant by \"priority-tagged frames\" and documents the\nparameters and return value.\n\nSigned-off-by: Fabian Knittel <fabian.knittel@lettink.de>","distinct":true,"url":"https://api.github.com/repos/ikelos/openvpn/commits/a956b5ded98f2e505000bab7193b48a4fe342dff"},{"sha":"b865c88c8a8b728240516a6df3fd3f45109d9173","author":{"email":"4b56af5ae892d60698d02db5913af96ca4a4e6d7@lettink.de","name":"Fabian Knittel"},"message":"vlan: is_ipv4: fix position of variable definition\n\nTo avoid difficulties on older / stricter C compilers, this patch moves the\nvariable definition to the beginning of the block in is_ipv4().\n\nFound by Peter Stuge.\n\nSigned-off-by: Fabian Knittel <fabian.knittel@lettink.de>","distinct":true,"url":"https://api.github.com/repos/ikelos/openvpn/commits/b865c88c8a8b728240516a6df3fd3f45109d9173"},{"sha":"ddb17977552e87808d834f86a42852b285ac8584","author":{"email":"4b56af5ae892d60698d02db5913af96ca4a4e6d7@lettink.de","name":"Fabian Knittel"},"message":"vlan: move htons / ntohs into vlanhdr_get/_set functions\n\nThe vlanhdr_set_*() family of methods expected the passed values to be in\nnetwork byte order.  Therefore all invocations used htons() on the parameter.\n\nThe vlanhdr_get_*() family of methods returned the values in network byte\norder.  Therefore all invocations used ntohs() on the return value.\n\nThe patch moves all htons() and ntohs() conversions into the vlan_hdr_*\nfunctions to avoid the needless repetition.  The vlan_hdr_* functions now\nexpect and return the values in host byte order.  The callee doesn't need\nto perform any kind of conversion.\n\nSigned-off-by: Fabian Knittel <fabian.knittel@lettink.de>","distinct":true,"url":"https://api.github.com/repos/ikelos/openvpn/commits/ddb17977552e87808d834f86a42852b285ac8584"},{"sha":"5f2dd8bdacb1ab54a9f6e37a77ede86337afefe4","author":{"email":"4b56af5ae892d60698d02db5913af96ca4a4e6d7@lettink.de","name":"Fabian Knittel"},"message":"vlan: Slightly clarify comments and code in multi.h / multi.c\n\nThis patch improves the comments in the VLAN tagging / untagging code.  Among\nother things, it attempts to clarify the wording, so that \"untagged\",\n\"VLAN-tagged\", \"priority-tagged\" and \"tagged\" are used in the right contexts.\n\n untagged:        no 802.1Q tagging\n tagged:          802.1Q tagging (VID and PCP unspecfied)\n VLAN-tagged:     802.1Q tagging with VID != 0 and PCP unspecified\n priority-tagged: 802.1Q tagging with VID == 0 and PCP != 0\n\nThe patch contains no functional changes.\n\nSigned-off-by: Fabian Knittel <fabian.knittel@lettink.de>","distinct":true,"url":"https://api.github.com/repos/ikelos/openvpn/commits/5f2dd8bdacb1ab54a9f6e37a77ede86337afefe4"},{"sha":"43858b559c11c3642ab61231a569673f2619cbeb","author":{"email":"4b56af5ae892d60698d02db5913af96ca4a4e6d7@lettink.de","name":"Fabian Knittel"},"message":"vlan: improve naming of vlan tagging / untagging functions\n\nThis patch includes \"8021q\" in all method names that handle 802.1Q tagged\nframes.\n\nSigned-off-by: Fabian Knittel <fabian.knittel@lettink.de>","distinct":true,"url":"https://api.github.com/repos/ikelos/openvpn/commits/43858b559c11c3642ab61231a569673f2619cbeb"},{"sha":"8a46e6a21cb60a8c9dbbb9b1aee547087d999550","author":{"email":"4b56af5ae892d60698d02db5913af96ca4a4e6d7@lettink.de","name":"Fabian Knittel"},"message":"vlan: don't create priority-tagged frames\n\nThis patch changes the behaviour of tagged frames that contain both VLAN and\npriority (PCP) information.  Previously, when stripping the VLAN tagging, the\npriority information would be kept, causing priority-tagged frames to be sent\nto clients with no tagging support.  The new behaviour is to completely drop\nthe tagging.\n\nPreviously some tagging-aware appliances that set both the VID and PCP fields\nwould cause OpenVPN to forward prio-tagged frames to clients, which wouldn't\nunderstand and therefore drop them.\n\nThe only case where the tagging is kept is when the frame isn't vlan-tagged and\nonly prio-tagged.  In that case the sender clearly wanted to send a tagged\nframe on an otherwise untagged network and we honour that decision by not\nfiddling with it.\n\nSigned-off-by: Fabian Knittel <fabian.knittel@lettink.de>","distinct":true,"url":"https://api.github.com/repos/ikelos/openvpn/commits/8a46e6a21cb60a8c9dbbb9b1aee547087d999550"}]}