gmane.network.openvpn.devel

[PATCH] build: check minimum polarssl version

Alon Bar-Lev — 2012-05-21T11:04:14

Pre 1.1 is unsupported, API was changed.

Signed-off-by: Alon Bar-Lev <alon.barlev< at >gmail.com>
---
 configure.ac |   21 +++++++++++++++++++++
 1 files changed, 21 insertions(+), 0 deletions(-)

diff --git a/configure.ac b/configure.ac
index 4592727..5ace128 100644
--- a/configure.ac
+++ b/configure.ac
< at >< at > -743,6 +743,27 < at >< at > if test -z "${POLARSSL_LIBS}"; then
 )
 fi
 
+if test "${with_crypto_library}" = "polarssl" ; then
+AC_MSG_CHECKING([polarssl version])
+old_CFLAGS="${CFLAGS}"
+CFLAGS="${POLARSSL_CFLAGS} ${CFLAGS}"
+AC_COMPILE_IFELSE(
+[AC_LANG_PROGRAM(
+[[
+#include <polarssl/version.h>
+]],
+[[
+#if POLARSSL_VERSION_NUMBER <= 0x01010000
+#error invalid version
+#endif
+]]
+)],
+[AC_MSG_RESULT([ok])],
+[AC_MSG_ERROR([invalid polarssl version])]
+)
+CFLAGS="${old_CFLAGS}"
+fi
+
 AC_ARG_VAR([LZO_CFLAGS], [C compiler flags for lzo])
 AC_ARG_VAR([LZO_LIBS], [linker flags for lzo])
 have_lzo="yes"

Pre-2.3-alpha2 Windows installers now available

Samuli Seppänen — 2012-05-16T11:27:49

Hi all,

Here are the first fully-functional Windows installers built (by me)
with Alon's new cross-compilation environment (a.k.a. "generic"
buildsystem):

<http://build.openvpn.net/downloads/snapshots/openvpn-install-2.3_master-I000_master-i686.exe>
<http://build.openvpn.net/downloads/snapshots/openvpn-install-2.3_master-I000_master-x86_64.exe>

The installers and executables and libraries in them have been signed
with a self-signed test certificate. This means that Windows Vista/7
64-bit will refuse to install the (self-signed) TAP-drivers, unless this
CA certificate is in the system keystore:

<http://build.openvpn.net/downloads/openvpntestca-cert.cer>

This certificate can be imported using Microsoft management console
(mmc.exe):

- Add  the "Certificates" snap-in
- Go to "Trusted root certificates"
- Right-click "Certificates"
- Select "All tasks" -> "Import"

After this you can run the OpenVPN installer and it should just work. A
version of OpenVPN signed with paid-for certificate is coming soonish.
T

eurephia plugin

Alon Bar-Lev — 2012-05-16T07:17:11

Hello David,

I guess this is yours:
---
 *  Additions for eurephia plugin done by:
 *         David Sommerseth <dazo< at >users.sourceforge.net> Copyright (C) 2009
---

Looking at the code the eurephia plugin only do the following:
---
#ifdef ENABLE_PLUGIN_EUREPHIA
  /* export X509 cert SHA1 fingerprint */
  {
    unsigned char *sha1_hash = x509_get_sha1_hash(peer_cert, &gc);

    openvpn_snprintf (envname, sizeof(envname), "tls_digest_%d", cert_depth);
    setenv_str (es, envname, format_hex_ex(sha1_hash, SHA_DIGEST_LENGTH, 0, 1,
                                          ":", &gc));
  }
#endif
---

Can you please explain what this plugin is and why just remove the conditional?

Thanks,
Alon.

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malw

[PATCH] cleanup: update .gitignore

Alon Bar-Lev — 2012-05-15T22:21:15

Signed-off-by: Alon Bar-Lev <alon.barlev< at >gmail.com>
---
 .gitignore |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/.gitignore b/.gitignore
index 9f546a3..f762089 100644
--- a/.gitignore
+++ b/.gitignore
< at >< at > -1,4 +1,5 < at >< at >
 *.[oa]
+*.l[oa]
 *.dll
 *.exe
 *.exe.*
< at >< at > -17,6 +18,7 < at >< at > Release
 Debug
 Win32-Output
 .deps
+.libs
 Makefile
 Makefile.in
 aclocal.m4

[PATCH] build: integrate plugins build into corebuild

Alon Bar-Lev — 2012-05-14T22:42:03

As disucssed[1], keep plugins in repository.

1, Proper automake/libtool build.

2. Move example plugins to samples/sample-plugins.

3. Plugins are installed at LIBDIR/openvpn/plugins.

[1] http://comments.gmane.org/gmane.network.openvpn.devel/6436

Signed-off-by: Alon Bar-Lev <alon.barlev< at >gmail.com>
---
 configure.ac                            |   63 +++++++
 distro/rpm/openvpn.spec.in              |   47 +-----
 doc/Makefile.am                         |    5 +-
 doc/README.plugins                      |   47 +++++
 sample/Makefile.am                      |    1 +
 sample/sample-plugins/defer/README      |   16 ++
 sample/sample-plugins/defer/build       |   15 ++
 sample/sample-plugins/defer/simple.c    |  305 +++++++++++++++++++++++++++++++
 sample/sample-plugins/defer/simple.def  |    6 +
 sample/sample-plugins/defer/winbuild    |   18 ++
 sample/sample-plugins/log/build         |   15 ++
 sample/sample-plugins/log/log.c         |  184 +++++++++++++++++++
 sample/sample-plugins/log/log_v3.c      |  247 +

[PATCH 1/2] cleanup: spec: make space/tab consistent

Alon Bar-Lev — 2012-05-14T22:29:39

Signed-off-by: Alon Bar-Lev <alon.barlev< at >gmail.com>
---
 distro/rpm/openvpn.spec.in |   34 +++++++++++++++++-----------------
 1 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/distro/rpm/openvpn.spec.in b/distro/rpm/openvpn.spec.in
index a6f31bd..de46f59 100644
--- a/distro/rpm/openvpn.spec.in
+++ b/distro/rpm/openvpn.spec.in
< at >< at > -12,8 +12,8 < at >< at >
 #   rpmbuild -tb [openvpn.x.tar.gz] --define 'with_password_save 1'
 
 Summary:OpenVPN is a robust and highly flexible VPN daemon by James Yonan.
-Name:           < at >PACKAGE< at >
-Version:        < at >VERSION< at >
+Name:< at >PACKAGE< at >
+Version:< at >VERSION< at >
 Release:1
 URL:http://openvpn.net/
 Source0:http://prdownloads.sourceforge.net/openvpn/%{name}-%{version}.tar.gz
< at >< at > -30,27 +30,27 < at >< at > BuildRoot:%{_tmppath}/%{name}-%(id -un)
 
 AutoReq: 0
 
-BuildRequires: openssl-devel >= 0.9.6
-Requires:      openssl       >= 0.9.6
+BuildRequires:openssl-devel >= 0.9.6
+Requires:openssl       >= 0.9.6
 
 %if "%{_vendor}" == "Mandrakesoft"
-%{!?without_lzo:BuildRequires: liblz

Disable tun-ipv6 warning

Arne Schwabe — 2012-05-13T22:12:07

Hey,

Openvpn will show the following warning, if I enable tun-ipv6 in the
local config and not remote or vice versa:

WARNING: 'tun-ipv6' is present in remote config but missing in local
config, remote='tun-ipv6'

ipv4 only. (On android there is no difference at all). Even without
explicitly stating "tun-ipv6" openvpn will happily configure the ipv6
options. Is there anything this message warns about? (I know the obvious
the configs do not match).

If the server does not push any ipv6 related messages running with
tun-ipv6 works fine, and if the server does push ipv6 messages it works
fine too.

Forgive me if I am missing something obvious.

Arne


------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/j

[V2.4 0/4] tun cleanups

Alon Bar-Lev — 2012-05-12T19:31:41

Platform independent interface for tun provider.

Split the long tun.c into platform specific files using
tun_engine interface.

Functionality is the same.

Maintenance will be much easier! new options, like stacking
several interfaces and delegate partial control to plugin.

There is more to be done in order to clean up the code,
however this is a good starting point.

Some more minor cleanups.

Tested on Linux, FreeBSD, Windows.

Branch should be merge after syshead[1].
Most probably patch exceeds list limitation, review is available[2].

This is for 2.4, please review quickly this so won't need to rebase.

Special thanks to Eric Crist for his FreeBSD help.

[1] https://github.com/alonbl/openvpn/compare/build...syshead
[2] https://github.com/alonbl/openvpn/compare/syshead...tun

Alon Bar-Lev (4):
  cleanup: remove check_subnet_conflict
  cleanup: move warn_on_use_of_common_subnets to init.c
  cleanup: remove tun_adjust_frame_parameters
  cleanup: tun: tun_engine interface

 configure.ac

[PATCH 00/16] syshead: cleanups

Alon Bar-Lev — 2012-05-12T19:19:33

Hello,

This series include some minor syshead.h cleanups, most moved to
build system.

I think these are simple enough to go into 2.3, the risk is minimal
but I don't care if we truly freeze 2.3 and switch master to 2.4
and apply this for 2.4.

This series is on top of my build branch[1], about to merge it too.

[1] https://github.com/alonbl/openvpn/compare/build

Alon Bar-Lev (16):
  cleanup: syshead: remove OS_SPECIFIC_DIRSEP in favor of autoconf
    PATH_SEPARATOR
  cleanup: syshead: move O_BINARY detection to autoconf
  cleanup: syshead: remove useless WIN32_0_1
  cleanup: syshead: remove useless constant USE_64_BIT_COUNTERS
  cleanup: syshead: move apple specific CPPFLAGS out of syshead
  clenaup: syshead: remove wait macros wrappers
  cleanup: syshead: move likely,unlikely to basic.h
  cleanup: syshead: move sleep,random,syshead.h emulation to compat
  cleanup: syshead: rename S_ERROR->S_ERRORS to avoid conflict with
    stropts.h
  cleanup: syshead: split pedantic into pedantic, lint
  cleanup: syshe

[PATCH] build: insall README* document using buildsystem

Alon Bar-Lev — 2012-05-12T19:03:53

Purpose: make distro packager task simpler, more flexible to provide
more documentation without changing the packaging script.

Remove installation related documents from rpm as package already
installed when viewed.

+Workaround rpm bug[1].

[1] http://rpm.org/ticket/836

Signed-off-by: Alon Bar-Lev <alon.barlev< at >gmail.com>
---
 Makefile.am                |    3 +++
 distro/rpm/openvpn.spec.in |   11 +++++++----
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/Makefile.am b/Makefile.am
index 33dfcd6..c580579 100644
--- a/Makefile.am
+++ b/Makefile.am
< at >< at > -57,6 +57,9 < at >< at > endif
 SUBDIRS = build distro include src sample doc tests
 
 dist_doc_DATA = \
+README \
+README.IPv6 \
+README.polarssl \
 COPYRIGHT.GPL \
 COPYING
 
diff --git a/distro/rpm/openvpn.spec.in b/distro/rpm/openvpn.spec.in
index d9158c1..a6f31bd 100644
--- a/distro/rpm/openvpn.spec.in
+++ b/distro/rpm/openvpn.spec.in
< at >< at > -164,6 +164,10 < at >< at > done
 
 %__mv -f src/plugins/README src/plugins/README.plugins
 
+# Install extra %doc st

[PATCH] Properly detect OpenSSL version stringswith numbers only

Simon Deziel — 2012-05-12T15:54:41

whichopensslcnf failed to return the right cnf for:

$ openssl version
OpenSSL 1.0.1 14 Mar 2012

Signed-off-by: Simon Deziel <simon.deziel< at >gmail.com>
---
 easy-rsa/2.0/whichopensslcnf |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/easy-rsa/2.0/whichopensslcnf b/easy-rsa/2.0/whichopensslcnf
index 2226a8e..ccdaf50 100755
--- a/easy-rsa/2.0/whichopensslcnf
+++ b/easy-rsa/2.0/whichopensslcnf
< at >< at > -3,11 +3,11 < at >< at >
 cnf="$1/openssl.cnf"

 if [ "$OPENSSL" ]; then
-       if $OPENSSL version | grep -E "0\.9\.6[[:alnum:]]" > /dev/null; then
+       if $OPENSSL version | grep -E "0\.9\.6[[:alnum:]]?" > /dev/null;
then
                cnf="$1/openssl-0.9.6.cnf"
-       elif $OPENSSL version | grep -E "0\.9\.8[[:alnum:]]" >
/dev/null; then
+       elif $OPENSSL version | grep -E "0\.9\.8[[:alnum:]]?" >
/dev/null; then
                cnf="$1/openssl-0.9.8.cnf"
-       elif $OPENSSL version | grep -E "1\.0\.([[:digit:]][[:alnum:]])"
+       elif $OPENSSL version | grep -E "1\.0\.[[:digit:]][[:

[PATCH] build: detect sys/wait.h required for *bsd

Alon Bar-Lev — 2012-05-12T09:02:18

Signed-off-by: Alon Bar-Lev <alon.barlev< at >gmail.com>
---
 configure.ac |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/configure.ac b/configure.ac
index 901a916..4592727 100644
--- a/configure.ac
+++ b/configure.ac
< at >< at > -374,7 +374,7 < at >< at > AC_CHECK_HEADERS([ \
 ])
 AC_CHECK_HEADERS([ \
 sys/time.h sys/ioctl.h sys/stat.h \
-sys/mman.h sys/file.h \
+sys/mman.h sys/file.h sys/wait.h \
 unistd.h signal.h libgen.h stropts.h \
 syslog.h pwd.h grp.h \
 sys/sockio.h sys/uio.h linux/sockios.h \

Some openvpn-build issues

Samuli Seppänen — 2012-05-11T15:37:20

Hi (Alon),

Just a quick overview of the build issues I ran into while building with

$ cd openvpn-build/windows-nsis
$ ./build-snapshot <signing options>

First, the build_openvpn_gui() fails with

i686-w64-mingw32-gcc -std=gnu99 -municode -pedantic -Wall -Wextra
-mwindows -o openvpn-gui.exe main.o openvpn.o localization.o tray.o
viewlog.o service.o options.o passphrase.o proxy.o registry.o scripts.o
manage.o openvpn_config.o res/openvpn-gui-res.o
-L/home/samuli/opt/openvpn-build/windows-nsis/tmp/image-i686/openvpn/lib
-lcrypto -lws2_32 -lcomctl32
/usr/lib/gcc/i686-w64-mingw32/4.6.1/../../../../i686-w64-mingw32/lib/../lib/libmingwex.a(lib32_libmingwex_a-_wctime32.o):
In function `_wctime32':
/build/buildd/mingw-w64-1.0+20110523/mingw-w64-crt/misc/_wctime32.c:15:
undefined reference to `__imp__wctime'
collect2: ld returned 1
make[1]: *** [openvpn-gui.exe] Error 1
make[1]: leaving directory
"/home/samuli/opt/openvpn-build/windows-nsis/tmp/build-i686/openvpn-gui-1.0.3"
make: *** [install-strip] Error 2
FATAL:

First partially-working snapshot build for Windowsnow available

Samuli Seppänen — 2012-05-11T15:26:04

Hi all,

I finally managed to generate fairly crude OpenVPN Windows installers
using Alon's new openvpn-build buildsystem. Due to a build issue
"openvpn-gui" is not included, and the tap-driver is seems to be
unsigned. Regardless, here are the results nevertheless:

<http://build.openvpn.net/downloads/snapshots/openvpn-install-2.3_master-I000_master-i686.exe>
<http://build.openvpn.net/downloads/snapshots/openvpn-install-2.3_master-I000_master-x86_64.exe>

All of the libraries and executables have been signed with a self-signed
test key. This includes openssl libraries and such. If you want Windows
to trust these executables, you need to download this certificate:

<http://build.openvpn.net/downloads/openvpntestca-cert.cer>

Then you need to import it to your "Trusted CA" key store, e.g. with


After this Windows should not complain about an unknown publisher. I'll
try to come up with really usable installer next week.

Some issues with openvpn-build/windows-nsis

Samuli Seppänen — 2012-05-10T12:11:15

Hi,

I tried to generate a Windows installer on Ubuntu 11.10 amd64, but ran
into some issues:

$ cd openvpn-build/windows-nsis
$ ./build-snapshot
--- snip ---

make[3]: Leaving directory
`/home/samuli/opt/openvpn-build/windows-nsis/tmp/build-i686/pkcs11-helper-1.10'
make[2]: Leaving directory
`/home/samuli/opt/openvpn-build/windows-nsis/tmp/build-i686/pkcs11-helper-1.10'
make[1]: Leaving directory
`/home/samuli/opt/openvpn-build/windows-nsis/tmp/build-i686/pkcs11-helper-1.10'
tap-windows
Fixup libtool files
Restore libtool files
ls: cannot access tmp/image-i686/openvpn-i686-*-bin.*: No such file or
directory

The error message seems clear enough, but I'm wondering why the binaries
are not where it looks for them:

$ ls tmp/image-i686
openvpn
$ ls tmp/image-i686/openvpn
bin  etc  include  lib  share

openvpn question

Raj Kumar — 2012-05-10T08:43:03


Hi all,

I am new to openvpn. I am using openvpn on my  linux machine.


I have a basic question about openvpn.  


How openvpn process the incoming packets ?

Is it processing incoming packets one by one, means receive one packet from the kernel, decrypt it and send it back to the kernel then next packet ?

or 

whenever a packet comes, openvpn receives  and queues it while doing decryption of already received packet ?


 
Regards
Raj Kumar
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/_______________________________________________
Openvpn-devel mailing list
Openvpn-devel< at >lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

[PATCH] Openvpn for Android 4.0 Changeset

Arne Schwabe — 2012-05-09T21:24:49

Hello,

I have developed the port of openvpn for Android 4.0:
https://play.google.com/store/apps/details?id=de.blinkt.openvpn and
http://code.google.com/p/ics-openvpn/

The API of Android 4.0 requires that openvpn runs as completely
unprivileged process. There all opening of tun, adding of routes,
ifconfig etc. has to be done by another process.

This patch implements an API to allow pushing routes, dns, tun over the
management interface (unix socket). Also on Android 4.0 the connection
for the control has to be protect via an API call from the Java GUI.

Basically I am using the needok feature of the management protocol to
push all relevant information to the GUI or to request information. I
have not split the patch into multiple small patches because it should
be first discussed if this is right architectural way.


Arne
From: Arne Schwabe <arne< at >rfc2549.org>
Date: Tue, 1 May 2012 14:04:22 +0200
Subject: [PATCH] rebase on head

---
 src/openvpn/error.c   |   86 +++++++++++++++++++++++++++++-----------------

[PATCH] Don't require DAF_INITIAL_AUTH to sendADDRESS/DISCONNECT messages

Adrien Bustany — 2012-05-08T07:30:02

From: Adrien Bustany <adrien.bustany< at >nokia.com>

As discussed in [1], here is a cleaned up version of my patch to fix
the sending of CLIENT:ADDRESS/CLIENT:DISCONNECT message on the
management interface when using password-less TLS certificate
authentication. It seems that DAF_INITIAL_AUTH is now unused, should I
send another patch that removes it altogether?


Adrien Bustany (1):
  management: Don't require DAF_INITIAL_AUTH to send ADDRESS/DISCONNECT
    messages

 src/openvpn/manage.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

OpenVPN in the Hypervisor

Tom Kent — 2012-05-08T01:03:17

I had an idea I wanted to run by people and see if its feasible....here
goes.

I've been hearing a lot about "virtualized" networking for VMs and that got
me thinking. It seems like OpenVPN would be a good tool that could join a
group of VMs into their own private LAN, basically segregating them from
the internet even though they're just machines hosted by amazon, rackspace,
or in my own server room. This could all be done now by setting all the VMs
up with the openvpn client and getting them to connect, etc. The down side
is that this is a lot of configuration, and the machines would still be
exposed to the larger network.

The idea I had, and wanted to run by, was if it would be possible to
integrate an openvpn client into the hypervisor's virtual network card.
This would make it so that from the moment the VM boots up, it is only
connected to the private LAN served by the OpenVPN server. The VM would see
just another NIC, but instead of routing the data directly to the
Hypervisor's NIC (tap) or NATing it

A few questions related to the management interface

Adrien Bustany — 2012-05-07T11:58:37

Hi,

I was toying with the management interface of openvpn (on server side),
to monitor the connections/disconnections of my clients. The clients
are authenticated with TLS certificates, without a password. I needed 
to
patch two things in order to get things working as I wanted, but since
I'm new to the code base, I'm not sure at all that those patches make
sense, especially the second one. I still attach them to this email,
in the hope that people here will point where I'm wrong :)

Cheers

Adrien
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/_______________________________________________
Openvpn-devel mailing list
Openvpn-devel< at >lists.sourceforge.net
https://list

[RFC] Split plugins into their own repositories

Alon Bar-Lev — 2012-05-06T16:55:06

Hello,

Now, I also have the courage to ask one more question regarding build....

We currently have:
- auth-pam
- defer
- down-root
- examples

Distribution wise it will be best to allow admin to install plugins as
own package which requires openvpn, allowing select specific plugins,
while each has own release cycle and versioning.

I already made the openvpn-plugin.h available in /usr/include, so
there is no real reason to keep the plugins in openvpn tree, as they
can be complied using their own separate build system.

for example, if we take RHEL, we can install the following to use the
auth-pam plugin:

openvpn
openvpn-plugin-auth-pam

To build plugin we need openvpn-devel.

What do you say?

BTW: next will be probably to split out the contrib... :)

Alon

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions