[Openvpn-devel] combined ndis5 + ndis6 installer ?

Hello, as we finished x86 + x64 installer, we can do something else now. @mattock, which installer are you going to build ? it used to be (ndis5, ndis6) x (x86, x64) matrix, what will be future matrix ? (and, yes, I'm going to build multi-language installer, probably right after 2.4 release) Ch

[Openvpn-devel] [PATCH 2.4 and 2.3] When parsing "--setenv opt xx .." make sure a third parameter is present

When no parameters are present, set it to "setenv opt" to trigger a descriptive error message. And, thus get rid of the pesky NULL pointer dereferencing. Resolves Trac 779 Signed-off-by: Selva Nair --- src/openvpn/options.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/openvpn/optio

[Openvpn-devel] [PATCH v2.3] Map restart signals from event loop to SIGTERM during exit-notification wait

Commit 63b3e000c9.. fixed SIGTERM getting lost during exit notification by ignoring any restart signals triggered during this interval. However, as reported in Trac 777, this could result in repeated triggering of restart signals when the event loop cannot continue without restart due to IO errors

Re: [Openvpn-devel] [PATCH 1/1] Use systemd service manager notification

On 29/11/16 16:27, Christian Hesse wrote: > From: Christian Hesse > > Notify systemd service manager when our initialization sequence > completed. This helps ordering services as dependencies can rely on vpn > being available. Funny detail is that I have a somewhat similar patch in a local git t

Re: [Openvpn-devel] [PATCH] reload CRL only if file was modified

On Tue, Nov 29, 2016 at 05:43:33PM +0100, Steffan Karger wrote: [CUT..] > > > > +void > > +tls_ctx_reload_crl(struct tls_root_ctx *ssl_ctx, const char *crl_file, > > + const char *crl_file_inline, bool reload) > > This is only used within ssl.c, so should be static and have a func

[Openvpn-devel] [PATCH] Force 'def1' method when --redirect-gateway is done through service

The service deletes all added routes when the client process (openvpn) exits, causing the re-instated default route to disappear. Fix by rewriting "--redirect-gateway" to "--redirect-gateway def1" when routes are set using interactive service. Only the behaviour on Windows with intereactive servic

Re: [Openvpn-devel] [PATCH applied] Re: Map restart signals from event loop to SIGTERM during exit-notification wait

Hi, On Tue, Nov 29, 2016 at 04:01:34PM -0500, Selva Nair wrote: > Just to be sure, I think the second ctrl-C or SIGTERM during exit-notify > wait should cause a prompt exit without waiting for exit-notify to > complete. That was the original behaviour and is supposed to be unchanged... It does :-

[Openvpn-devel] [PATCH applied] Re: Introduce and use secure_memzero() to erase secrets

Another ACK from me. (David agreed on IRC that even while he is not happy with CLEAR(), it's ok to go forward with this one as it's a somewhat independent issue) Your patch has been applied to the master branch. commit 009521ac8ae613084b23b9e3e5dc4ebeccd4c6c8 Author: Steffan Karger Date: Mon N

Re: [Openvpn-devel] [PATCH applied] Re: Map restart signals from event loop to SIGTERM during exit-notification wait

On Tue, Nov 29, 2016 at 3:04 AM, Gert Doering wrote: > .. which fixes the issue for good. > > "Real signals" are still ignored (kill -USR1 from another window): > > Tue Nov 29 08:58:19 2016 event_wait : Interrupted system call (code=4) > Tue Nov 29 08:58:19 2016 Ignoring SIGUSR1 received during e

Re: [Openvpn-devel] [PATCH] reload CRL only if file was modified

On 29-11-16 17:43, Steffan Karger wrote: > Will test more thoroughly tonight (hopefully on Windows too), but have a > lot of faith that those will succeed. Just did this, on linux and windows, and code works as expected. So once you've taken care of the (minor) remarks in my previous mails, I th

Re: [Openvpn-devel] [PATCH] reload CRL only if file was modified

Hi, One more thing. On 29-11-16 07:38, Antonio Quartulli wrote: > + if (!crl_file_inline) > +platform_stat(crl_file, &crl_stat); If platform_stat() fails, we now silently ignore the error and continue using the old CRL. I think using the old CRL is fine, but we should print a warning to te

Re: [Openvpn-devel] [PATCH] reload CRL only if file was modified

Christian Hesse on Tue, 2016/11/29 20:16: > Oops, missed that in my logs (and did not find the code)... You are right, > cache is cleared. > > Either of both is just fine and it works as-is. So ignore my patch. Oops again... Looks like I answered a wrong mail. Please ignore... (The mail, not any

Re: [Openvpn-devel] [PATCH] reload CRL only if file was modified

Steffan Karger on Tue, 2016/11/29 17:43: > Hi, > > Thanks for following up. I did some stare-at-code and trivial tests. > Will test more thoroughly tonight (hopefully on Windows too), but have a > lot of faith that those will succeed. I have some comments from staring > at the code though, see

Re: [Openvpn-devel] [PATCH] reload CRL only if file was modified

Hi, Thanks for following up. I did some stare-at-code and trivial tests. Will test more thoroughly tonight (hopefully on Windows too), but have a lot of faith that those will succeed. I have some comments from staring at the code though, see below. On 29-11-16 07:38, Antonio Quartulli wrote: >

Re: [Openvpn-devel] [PATCH v2] Introduce and use secure_memzero() to erase secrets

Hi, On Mon, Nov 28, 2016 at 5:14 PM, Steffan Karger wrote: > As described in trac #751, and shortly after reported by Zhaomo Yang, of > the University of California, San Diego, we use memset() (often through > the CLEAR() macro) to erase secrets after use. In some cases however, the > compiler

[Openvpn-devel] [PATCH 1/1] Use systemd service manager notification

From: Christian Hesse Notify systemd service manager when our initialization sequence completed. This helps ordering services as dependencies can rely on vpn being available. Signed-off-by: Christian Hesse --- distro/systemd/openvpn-client@.service | 1 + distro/systemd/openvpn-server@.service

Re: [Openvpn-devel] [PATCH 1/1] Clean up plugin path handling

Christian Hesse on Tue, 2016/11/29 12:07: > From: Christian Hesse > > Drop --with-plugindir, instead use an environment variable PLUGINDIR > to specify the plugin directory. > > This always defines PLUGIN_LIBDIR and enables plugin search path. > > Signed-off-by: Christian Hesse > --- > confi

Re: [Openvpn-devel] [PATCH v2] Introduce and use secure_memzero() to erase secrets

On 29-11-16 11:28, Arne Schwabe wrote: > > > Am 29.11.16 um 11:18 schrieb Gert Doering: >> Hi, >> >> On Tue, Nov 29, 2016 at 11:07:12AM +0100, Arne Schwabe wrote: >>> I think we should prefer memset_s if available since it is a C11 standard. >> Since we're currently compiling against C99, we can'

[Openvpn-devel] [PATCH 1/1] Clean up plugin path handling

From: Christian Hesse Drop --with-plugindir, instead use an environment variable PLUGINDIR to specify the plugin directory. This always defines PLUGIN_LIBDIR and enables plugin search path. Signed-off-by: Christian Hesse --- configure.ac| 14 ++ src/openvpn/Makefile.am

Re: [Openvpn-devel] [PATCH 2/2] allow to enable plugin lookup with configure argument

David Sommerseth on Tue, 2016/11/29 00:47: > On 28/11/16 17:16, Christian Hesse wrote: > > From: Christian Hesse > > > > For plugin lookup (give relative path to plugin directory in > > configuration) we had to configure with something like this: > > > > CFLAGS="$CFLAGS > > -DPLUGIN_LIBDIR=\\\"

Re: [Openvpn-devel] [PATCH v2] Introduce and use secure_memzero() to erase secrets

Am 29.11.16 um 11:18 schrieb Gert Doering: > Hi, > > On Tue, Nov 29, 2016 at 11:07:12AM +0100, Arne Schwabe wrote: >> I think we should prefer memset_s if available since it is a C11 standard. > Since we're currently compiling against C99, we can't rely on it being > there (in my OS Zoo, only Mac

Re: [Openvpn-devel] [PATCH v2] Introduce and use secure_memzero() to erase secrets

Hi, On Tue, Nov 29, 2016 at 11:07:12AM +0100, Arne Schwabe wrote: > I think we should prefer memset_s if available since it is a C11 standard. Since we're currently compiling against C99, we can't rely on it being there (in my OS Zoo, only MacOS seems to have it, at least "have a manpage for it"

Re: [Openvpn-devel] [PATCH v2] Introduce and use secure_memzero() to erase secrets

Am 29.11.16 um 09:20 schrieb Steffan Karger: > Hi, > > On 29-11-16 00:00, Zhaomo Yang wrote: >> Just wanted to let you know that we have a new implementation of >> secure_memzero.h, which is available at >> https://compsec.sysnet.ucsd.edu/secure_memzero.h >>

Re: [Openvpn-devel] [PATCH v2] Introduce and use secure_memzero() to erase secrets

Hi, On 29-11-16 00:00, Zhaomo Yang wrote: > Just wanted to let you know that we have a new implementation of > secure_memzero.h, which is available at > https://compsec.sysnet.ucsd.edu/secure_memzero.h > . > > The version I sent to you guys has a

[Openvpn-devel] [PATCH applied] Re: Map restart signals from event loop to SIGTERM during exit-notification wait

ACK, thanks a lot. I could reproduce the effect as well -- set "--explicit-exit-notify 5", try to connect to a non-responsive server (unused IP address, ...), and ~2 seconds before the 60 second timeout, press ctrl-c. Flooding of SIGUSR1 messages, no way to stop it (except "kill -9"), quite an a