openvpn-devel Mailing List for OpenVPN

Yes, currently the CIPE TAP driver has the capability to run on NT 4, 2K, and XP, but this first beta release of OpenVPN has only been tested on XP so far, because that's the only windows development machine I have access to right now. OpenVPN uses a slightly forked version of the CIPE TAP, but I'm in contact with Damion K. Wilson who is the author and maintainer of CIPE on Windows and he has expressed interest in decoupling and modularizing the TAP driver so that it can be used by other projects. It would help if others came forward who have an interest in testing and maintaining OpenVPN on W2K and NT4 -- the binaries really need to be compiled on the version of windows that they are going to be run on, and compiling everything from source is not really an option for the end-user as it is a relatively complex undertaking compared with the ease of ./configure, apt-get, and emerge that we have come to expect on other OSes. While I expect that building OpenVPN for 2K and NT4 will be a relatively straightforward undertaking, the two areas where compatibility breaks down between the NT 4 series and the 2K/XP series are the .inf file (that's a file that tells Windows how to install a particular device driver and how it binds with other device drivers in the system), and the registry layout of network device driver info. OpenVPN needs to do some registry lookups in order to translate the TAP adapter name given in --dev-node into a real filename which can be passed to the Win32 open file function. I would agree with Bishop that as far as running on the 9x/Me series is concerned, I think it's unlikely given the much more limited networking driver model that is available on that series. James bishop <bi...@pl...> said: > My read of it suggested that, yeah, it only does NT or above, due to the > better net stack in the NT family tree. > > Felipe Sanchez wrote: > > > > > > This has to be one of the greatest news I've had this week :-) Count me > > in as a heavy beta-tester! > > > > > > I have one question: If I recall correctly the cipe TAP driver works only > > on NT-class Windows operating systems (NT 4, 2K, XP) and not on 9x-class > > ones (9x/Me). Is this still the case? > > > > > > > > ------------------------------------------------------- > > This SF.Net email sponsored by: Free pre-built ASP.NET sites including > > Data Reports, E-commerce, Portals, and Forums are available now. > > Download today and enter to win an XBOX or Visual Studio .NET. > > http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01 > > _______________________________________________ > > Openvpn-users mailing list > > Ope...@li... > > https://lists.sourceforge.net/lists/listinfo/openvpn-users > > -- >	I tried joining the BATF, but it seems they're actually >	AGAINST all three. Some club they are! > -- 

My read of it suggested that, yeah, it only does NT or above, due to the better net stack in the NT family tree. Felipe Sanchez wrote: > > > This has to be one of the greatest news I've had this week :-) Count me > in as a heavy beta-tester! > > > I have one question: If I recall correctly the cipe TAP driver works only > on NT-class Windows operating systems (NT 4, 2K, XP) and not on 9x-class > ones (9x/Me). Is this still the case? > > > > ------------------------------------------------------- > This SF.Net email sponsored by: Free pre-built ASP.NET sites including > Data Reports, E-commerce, Portals, and Forums are available now. > Download today and enter to win an XBOX or Visual Studio .NET. > http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01 > _______________________________________________ > Openvpn-users mailing list > Ope...@li... > https://lists.sourceforge.net/lists/listinfo/openvpn-users --	I tried joining the BATF, but it seems they're actually	AGAINST all three. Some club they are! 

 This has to be one of the greatest news I've had this week :-) Count me in as a heavy beta-tester! I have one question: If I recall correctly the cipe TAP driver works only on NT-class Windows operating systems (NT 4, 2K, XP) and not on 9x-class ones (9x/Me). Is this still the case? 

Well some good news on the development front... (1) OpenVPN has finally been ported to Windows. (2) TCP protocol support has been added. The Windows port was made possible by a number of emerging developments, most importantly the stabilizing of the TAP driver component of the Cipe-Win32 project, thanks to the work of Damion K. Wilson and the other Cipe-Win32 developers. My work on this effort involved decoupling the nascent Win32 TAP virtual device driver from the Cipe-Win32 project, and making OpenVPN comfortable with the Win32 API and the MinGW development environment. This is a native port, and does not require the presence of a Posix compatibility layer such as Cygwin. Performance appears to be comparable with Linux running on similar hardware. Some Notes: * The port has been developed and tested on XP only at this point. * With a few exceptions, most of the core functionality available under Posix implementations of OpenVPN also works under Windows, including SSL/TLS, LZO compression, the ability to call scripts (i.e. --up & --tls-auth), and support for UDP or TCP tunnels. Features that are missing from the current Windows beta include --daemon, --shaper, pthread support, TUN devices, and options such as --mlock or --user which don't have Posix-equivalent Win32 system calls. Another limitation is that installation must be done manually, i.e. there is no Windows installer support yet. * The --ifconfig option is not implemented on Windows OpenVPN, due to the lack of an ifconfig executable to call. Basically what happens when you install the TAP-Win32 driver is that you get a new TAP network adapter that shows up in your network control panel. You right click on the TAP adapter and set the TCP/IP properties, i.e. IP address and netmask. Then you rename the TAP adapter icon to something like "my-tap" and reference it using the --dev-node option in OpenVPN. So essentially the function of --ifconfig is accomplished manually using the GUI and the network control panel. * While OpenVPN on Windows supports multiple TAP adapters, I have not yet found an easy way to create and delete TAP adapters using the Network Control Panel. Damion tells me that this can be done in the .inf file that is used to install the driver, but I am still a beginner at understanding .inf files. * The TAP-Win32 device driver is fairly stable at this point and did not crash my system despite repeated editing, compiling, installing, and reinstalling the driver. * The other new feature is TCP support, for situations where using UDP is not possible. TCP support is enabled through the the new --proto option. You can select the protocol with --proto p, where p = udp | tcp-server | tcp-client. TCP support also works on Windows. Since TCP is connection oriented, OpenVPN needs to handle Connection Reset events. Basically, on connection reset, a TCP client or server will simulate a SIGUSR1 signal. The server will go back into a mode where it listens for a new connection, and the TCP client will simulate a SIGUSR1 signal which will normally cause it to try to reestablish the connection with the server. Known Issues in the beta: * TCP mode combined with --daemon doesn't work correctly yet -- this will be fixed before 1.5 final. * For some reason if a Solaris TCP client is connected to a TCP server, and that TCP server resets the connection, the Solaris client will try to reconnect, and will apparently succeeed, but then after reading a handful of bytes from the remote, the client suddenly thinks that the connection was reset again, and it will restart. This client restart will also cause the server to restart, and the whole process repeats again. I have tested this same scenario using both Windows and Linux TCP clients, but only Solaris TCP clients show this problem. The Solaris system I am using is: SunOS [name] 5.9 Generic_112233-06 sun4u sparc SUNW,Ultra-1 Downloads --------- The beta version of the Windows distribution can be downloaded from here (with source + pre-compiled binaries): http://openvpn.sourceforge.net/beta/openvpn-1.4.99.3.zip See the file INSTALL.w32 for Windows installation instructions. The usual Posix distribution beta is here: http://openvpn.sourceforge.net/beta/openvpn-1.4.99.3.tar.gz The version numbering scheme is an attempt to denote a pre-1.5 beta in a way that works with RPM spec files. The only differences between the distributions are compressed file formats (.tar.gz for posix, .zip for windows) and the presence of a win32-binaries directory on the .zip distribution which contains a pre-built openvpn exe, OpenSSL DLLs, and the TAP-Win32 device driver. James 

1.4.2 has been released. Details here: http://openvpn.sourceforge.net/relnotes.html James 

On Sun, 13 Jul 2003, James Yonan wrote: > These look like the kind of warnings you get with the gcc -Wconversion flag -- > though Sun Workshop must be using a different warning algorithm because gcc > -Wconversion generates pages of warnings about similar things -- basically > function prototypes causing an implicit type conversion. Most of these are > pretty harmless. > > Anyway, I've fixed them. Thanks. -- Matthias Andree 

Matthias Andree <ma+...@dt...> said: > On Thu, 10 Jul 2003, James Yonan wrote: > > > > > This is a maintenance release which (a) fixes the previously discussed ISO C99 > > vararg efficiency bug, and (b) further stabilizes the experimental > > --mtu-dynamic option which causes OpenVPN to perform internal datagram > > fragmentation in cases where native IP fragmentation is broken. > > > > Testing will be helpful at this point, especially for non-x86-linux platforms. > > I am only compile testing, not testing runtime; these are Sun Workshop > warnings: > > "crypto.c", line 838: warning: argument #3 is incompatible with prototype: > prototype: pointer to unsigned int : "/usr/local/ssl/include//openssl/evp.h", line 551 > argument : pointer to int > "ssl.c", line 310: warning: argument #2 is incompatible with prototype: > prototype: pointer to unsigned char : "buffer.h", line 80 > argument : pointer to char > "ssl.c", line 1523: warning: argument #1 is incompatible with prototype: > prototype: pointer to const char : "options.h", line 191 > argument : pointer to unsigned char These look like the kind of warnings you get with the gcc -Wconversion flag -- though Sun Workshop must be using a different warning algorithm because gcc -Wconversion generates pages of warnings about similar things -- basically function prototypes causing an implicit type conversion. Most of these are pretty harmless. Anyway, I've fixed them. James James 

On Thu, 10 Jul 2003, James Yonan wrote: > > This is a maintenance release which (a) fixes the previously discussed ISO C99 > vararg efficiency bug, and (b) further stabilizes the experimental > --mtu-dynamic option which causes OpenVPN to perform internal datagram > fragmentation in cases where native IP fragmentation is broken. > > Testing will be helpful at this point, especially for non-x86-linux platforms. I am only compile testing, not testing runtime; these are Sun Workshop warnings: "crypto.c", line 838: warning: argument #3 is incompatible with prototype: prototype: pointer to unsigned int : "/usr/local/ssl/include//openssl/evp.h", line 551 argument : pointer to int "ssl.c", line 310: warning: argument #2 is incompatible with prototype: prototype: pointer to unsigned char : "buffer.h", line 80 argument : pointer to char "ssl.c", line 1523: warning: argument #1 is incompatible with prototype: prototype: pointer to const char : "options.h", line 191 argument : pointer to unsigned char 

This is a maintenance release which (a) fixes the previously discussed ISO C99 vararg efficiency bug, and (b) further stabilizes the experimental --mtu-dynamic option which causes OpenVPN to perform internal datagram fragmentation in cases where native IP fragmentation is broken. Testing will be helpful at this point, especially for non-x86-linux platforms. Download: http://openvpn.sourceforge.net/beta/openvpn-1.4.1.9.tar.gz (or CVS) Change Log: * Removed adaptive bandwidth from --mtu-dynamic -- its absence appears to work better than its existence (1.4.1.2). * Minor changes to --shaper to fix long retransmit timeouts at low bandwidth (1.4.1.2). * Added LOG_RW flag to openvpn.h for debugging (1.4.1.2). * Silenced spurious configure warnings (1.4.1.2). * Backed out --dev-name patch, modified --dev to offer equivalent functionality (1.4.1.4). * Added an optional parameter to --daemon and --inetd to support the passing of a custom program name to the system logger (1.4.1.5). * Add compiled-in options to the program title (1.4.1.5). * Coded the beginnings of a WIN32 port (1.4.1.5). * Succeeded in porting to Win32 Mingw environment and running loopback tests (1.4.1.6). Still need a kernel driver for full Win32 functionality. * Fixed a bug in error.h where HAVE_CPP_VARARG_MACRO_GCC was misspelled. This would have caused a significant slowdown of OpenVPN when built by compilers that lack ISO C99 vararg macros (1.4.1.6). * Created an init script for Gentoo Linux in ./gentoo directory (1.4.1.6). James 

1.4.0 and 1.4.1 have a fairly serious efficiency bug when built by compilers which do not support ISO C99 vararg macros. If you run ./configure with 1.4.0 or 1.4.1 and you see this line: checking for ISO C 1999 vararg macro support... no you will be experiencing a significant slowdown due to this bug. A minimal patch is available against 1.4.0 and 1.4.1: http://openvpn.sourceforge.net/patch/isoc99fix.patch Alternatively, you are encouraged to test the first 1.4.2 release candidate which also contains a fix for the ISO C99 vararg bug, as well as: * Removed adaptive bandwidth from --mtu-dynamic -- its absence appears to work better than its existence (1.4.1.2). * Minor changes to --shaper to fix long retransmit timeouts at low bandwidth (1.4.1.2). * Added LOG_RW flag to openvpn.h for debugging (1.4.1.2). * Silenced spurious configure warnings (1.4.1.2). * Backed out --dev-name patch, modified --dev to offer equivalent functionality (1.4.1.4). * Added an optional parameter to --daemon and --inetd to support the passing of a custom program name to the system logger (1.4.1.5). * Add compiled-in options to the program title (1.4.1.5). * Coded the beginnings of a WIN32 port (1.4.1.5). * Succeeded in porting to Win32 Mingw environment and running loopback tests (1.4.1.6). Still need a kernel driver for full Win32 functionality. * Fixed a bug in error.h where HAVE_CPP_VARARG_MACRO_GCC was misspelled. This would have caused a significant slowdown of OpenVPN when built by compilers that lack ISO C99 vararg macros (1.4.1.6). * Created an init script for Gentoo Linux in ./gentoo directory (1.4.1.6). Download the release candidate: http://openvpn.sourceforge.net/beta/openvpn-1.4.1.8.tar.gz Release candidate is also available on CVS (note that sourceforge anonymous CVS is now 24 hour delayed). James