openvpn-devel Mailing List for OpenVPN

ACK. Your patch has been applied to the master branch. commit 51194ffd1983f67b204348686f0ea358f29fe550 Author: Steffan Karger Date: Thu May 29 12:39:07 2014 +0200 Add (default disabled) --enable-werror option to configure Signed-off-by: Steffan Karger <st...@ka...> Acked-by: Gert Doering <ge...@gr...> Message-Id: <140...@ka...> URL: http://article.gmane.org/gmane.network.openvpn.devel/8747 Signed-off-by: Gert Doering <ge...@gr...> -- kind regards, Gert Doering 

ACK. Your patch has been applied to the master branch. commit 55af8e9a4138db0c9de6f6e29dec9839231ec798 Author: Steffan Karger Date: Sun Jun 1 19:58:56 2014 +0200 Remove unused variable 'proxy' from socket_restart_pause() Signed-off-by: Steffan Karger <st...@ka...> Acked-by: Gert Doering <ge...@gr...> Message-Id: <140...@ka...> URL: http://article.gmane.org/gmane.network.openvpn.devel/8750 Signed-off-by: Gert Doering <ge...@gr...> -- kind regards, Gert Doering 

ACK. Your patch has been applied to the master branch. commit 3ba6b9ff1a50800dfea55d33d9be53c77b50d307 Author: Steffan Karger Date: Sun Jun 1 19:58:55 2014 +0200 Remove dependency on manage.h from ssl_verify.h Signed-off-by: Steffan Karger <st...@ka...> Acked-by: Gert Doering <ge...@gr...> Message-Id: <140...@ka...> URL: http://article.gmane.org/gmane.network.openvpn.devel/8754 Signed-off-by: Gert Doering <ge...@gr...> -- kind regards, Gert Doering 

ACK. Your patch has been applied to the master branch. commit 63dc03d068550a6d544ae3b5f489f71c247332eb Author: Steffan Karger Date: Sun Jun 1 19:58:54 2014 +0200 Move #include ssl_verify.h from ssl.h to the source files that need it. Signed-off-by: Steffan Karger <st...@ka...> Acked-by: Gert Doering <ge...@gr...> Message-Id: <140...@ka...> URL: http://article.gmane.org/gmane.network.openvpn.devel/8749 Signed-off-by: Gert Doering <ge...@gr...> -- kind regards, Gert Doering 

ACK. Your patch has been applied to the master branch. commit 67bdede662a90c33502b4f6ed5fac088e90c681a Author: Steffan Karger Date: Sun Jun 1 19:58:53 2014 +0200 Fix ssl.c, ssl_verify_* includes Signed-off-by: Steffan Karger <st...@ka...> Acked-by: Gert Doering <ge...@gr...> Message-Id: <140...@ka...> URL: http://article.gmane.org/gmane.network.openvpn.devel/8753 Signed-off-by: Gert Doering <ge...@gr...> -- kind regards, Gert Doering 

ACK. Your patch has been applied to the master branch. commit a87c0a9624d5fb28930d9d137ba9dbd8a2515caf Author: Steffan Karger Date: Sun Jun 1 19:58:52 2014 +0200 Use generic openvpn_x509_cert_t in ssl_verify_polarssl.c Signed-off-by: Steffan Karger <st...@ka...> Acked-by: Gert Doering <ge...@gr...> Message-Id: <140...@ka...> URL: http://article.gmane.org/gmane.network.openvpn.devel/8752 Signed-off-by: Gert Doering <ge...@gr...> -- kind regards, Gert Doering 

Variable 'proxy' was set but never read, so remove it. Signed-off-by: Steffan Karger <st...@ka...> --- src/openvpn/init.c | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/src/openvpn/init.c b/src/openvpn/init.c index 021b5ca..76b1bbe 100644 --- a/src/openvpn/init.c +++ b/src/openvpn/init.c @@ -1860,18 +1860,8 @@ do_hold (struct context *c) static void socket_restart_pause (struct context *c) { - bool proxy = false; int sec = 2; -#ifdef ENABLE_HTTP_PROXY - if (c->options.ce.http_proxy_options) - proxy = true; -#endif -#ifdef ENABLE_SOCKS - if (c->options.ce.socks_proxy_server) - proxy = true; -#endif - switch (c->options.ce.proto) { case PROTO_TCP_SERVER: -- 1.9.1 

verify_user_pass_enabled() is a function on a tls_session, and belongs in ssl.c. Moving the function removes the dependency on manage.h. Signed-off-by: Steffan Karger <st...@ka...> --- src/openvpn/ssl.c | 21 ++++++++++++++++++++- src/openvpn/ssl_verify.h | 20 -------------------- 2 files changed, 20 insertions(+), 21 deletions(-) diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c index e9e01ad..2d5dde0 100644 --- a/src/openvpn/ssl.c +++ b/src/openvpn/ssl.c @@ -837,6 +837,25 @@ static inline void tls_session_set_self_referential_pointers (struct tls_session session->tls_auth.packet_id = &session->tls_auth_pid; } +/** + * Returns whether or not the server should check for username/password + * + * @param session	The current TLS session + * + * @return	true if username and password verification is enabled, + *	false if not. + */ +static inline bool +tls_session_user_pass_enabled(struct tls_session *session) +{ + return (session->opt->auth_user_pass_verify_script + || plugin_defined (session->opt->plugins, OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY) +#ifdef MANAGEMENT_DEF_AUTH + || management_enable_def_auth (management) +#endif + ); +} + /** @addtogroup control_processor * @{ */ @@ -2069,7 +2088,7 @@ key_method_2_read (struct buffer *buf, struct tls_multi *multi, struct tls_sessi output_peer_info_env (session->opt->es, multi->peer_info); #endif - if (verify_user_pass_enabled(session)) + if (tls_session_user_pass_enabled(session)) { /* Perform username/password authentication */ if (!username_status || !password_status) diff --git a/src/openvpn/ssl_verify.h b/src/openvpn/ssl_verify.h index e0bcba4..601d863 100644 --- a/src/openvpn/ssl_verify.h +++ b/src/openvpn/ssl_verify.h @@ -32,7 +32,6 @@ #include "syshead.h" #include "misc.h" -#include "manage.h" #include "ssl_common.h" /* Include OpenSSL-specific code */ @@ -166,25 +165,6 @@ tls_common_name_hash (const struct tls_multi *multi, const char **cn, uint32_t * #endif /** - * Returns whether or not the server should check for username/password - * - * @param session	The current TLS session - * - * @return	true if username and password verification is enabled, - *	false if not. - * - */ -static inline bool verify_user_pass_enabled(struct tls_session *session) -{ - return (session->opt->auth_user_pass_verify_script - || plugin_defined (session->opt->plugins, OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY) -#ifdef MANAGEMENT_DEF_AUTH - || management_enable_def_auth (management) -#endif - ); -} - -/** * Verify the given username and password, using either an external script, a * plugin, or the management interface. * -- 1.9.1 

Signed-off-by: Steffan Karger <st...@ka...> --- src/openvpn/forward.c | 1 + src/openvpn/init.c | 1 + src/openvpn/multi.c | 1 + src/openvpn/options.c | 1 + src/openvpn/pf.c | 2 +- src/openvpn/push.c | 1 + src/openvpn/ssl.h | 1 - 7 files changed, 6 insertions(+), 2 deletions(-) diff --git a/src/openvpn/forward.c b/src/openvpn/forward.c index 0ec00f3..8d524ce 100644 --- a/src/openvpn/forward.c +++ b/src/openvpn/forward.c @@ -39,6 +39,7 @@ #include "ps.h" #include "dhcp.h" #include "common.h" +#include "ssl_verify.h" #include "memdbg.h" diff --git a/src/openvpn/init.c b/src/openvpn/init.c index 467b98a..021b5ca 100644 --- a/src/openvpn/init.c +++ b/src/openvpn/init.c @@ -43,6 +43,7 @@ #include "lladdr.h" #include "ping.h" #include "mstats.h" +#include "ssl_verify.h" #include "memdbg.h" diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c index 2839b30..e451924 100644 --- a/src/openvpn/multi.c +++ b/src/openvpn/multi.c @@ -38,6 +38,7 @@ #include "otime.h" #include "gremlin.h" #include "mstats.h" +#include "ssl_verify.h" #include "memdbg.h" diff --git a/src/openvpn/options.c b/src/openvpn/options.c index 57f8949..206a091 100644 --- a/src/openvpn/options.c +++ b/src/openvpn/options.c @@ -56,6 +56,7 @@ #include "helper.h" #include "manage.h" #include "forward.h" +#include "ssl_verify.h" #include <ctype.h> #include "memdbg.h" diff --git a/src/openvpn/pf.c b/src/openvpn/pf.c index 461beed..a3208db 100644 --- a/src/openvpn/pf.c +++ b/src/openvpn/pf.c @@ -35,8 +35,8 @@ #if defined(ENABLE_PF) #include "init.h" - #include "memdbg.h" +#include "ssl_verify.h" #include "pf-inline.h" diff --git a/src/openvpn/push.c b/src/openvpn/push.c index 606bb05..1de9f74 100644 --- a/src/openvpn/push.c +++ b/src/openvpn/push.c @@ -33,6 +33,7 @@ #include "push.h" #include "options.h" #include "ssl.h" +#include "ssl_verify.h" #include "manage.h" #include "memdbg.h" diff --git a/src/openvpn/ssl.h b/src/openvpn/ssl.h index cd7cae2..aaecff4 100644 --- a/src/openvpn/ssl.h +++ b/src/openvpn/ssl.h @@ -44,7 +44,6 @@ #include "plugin.h" #include "ssl_common.h" -#include "ssl_verify.h" #include "ssl_backend.h" /* Used in the TLS PRF function */ -- 1.9.1 

* ssl.c: remove three unneeded includes * ssl_verify_polarssl.h: remove two unneeded includes * ssl_verify_openssl.c: add missing ssl_verify_openssl.h and error.h includes, and reorder includes. Signed-off-by: Steffan Karger <st...@ka...> --- src/openvpn/ssl.c | 4 ---- src/openvpn/ssl_verify_openssl.c | 6 +++++- src/openvpn/ssl_verify_polarssl.h | 2 -- 3 files changed, 5 insertions(+), 7 deletions(-) diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c index 9bcb2ac..e9e01ad 100644 --- a/src/openvpn/ssl.c +++ b/src/openvpn/ssl.c @@ -35,7 +35,6 @@ * Both the TLS session and the data channel are multiplexed * over the same TCP/UDP port. */ - #ifdef HAVE_CONFIG_H #include "config.h" #elif defined(_MSC_VER) @@ -48,7 +47,6 @@ #include "error.h" #include "common.h" -#include "integer.h" #include "socket.h" #include "misc.h" #include "fdmisc.h" @@ -57,8 +55,6 @@ #include "status.h" #include "gremlin.h" #include "pkcs11.h" -#include "list.h" -#include "base64.h" #include "route.h" #include "ssl.h" diff --git a/src/openvpn/ssl_verify_openssl.c b/src/openvpn/ssl_verify_openssl.c index 98a888a..2482eaa 100644 --- a/src/openvpn/ssl_verify_openssl.c +++ b/src/openvpn/ssl_verify_openssl.c @@ -37,9 +37,13 @@ #if defined(ENABLE_SSL) && defined(ENABLE_CRYPTO_OPENSSL) +#include "ssl_verify_openssl.h" + +#include "error.h" +#include "ssl_openssl.h" #include "ssl_verify.h" #include "ssl_verify_backend.h" -#include "ssl_openssl.h" + #include <openssl/x509v3.h> #include <openssl/err.h> diff --git a/src/openvpn/ssl_verify_polarssl.h b/src/openvpn/ssl_verify_polarssl.h index b5157ed..2076f2e 100644 --- a/src/openvpn/ssl_verify_polarssl.h +++ b/src/openvpn/ssl_verify_polarssl.h @@ -31,8 +31,6 @@ #define SSL_VERIFY_POLARSSL_H_ #include "syshead.h" -#include "misc.h" -#include "manage.h" #include <polarssl/x509_crt.h> #ifndef __OPENVPN_X509_CERT_T_DECLARED -- 1.9.1 

For symmetry with ssl_verify_openssl.c and release/2.3 branch. Signed-off-by: Steffan Karger <st...@ka...> --- src/openvpn/ssl_verify_polarssl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/openvpn/ssl_verify_polarssl.c b/src/openvpn/ssl_verify_polarssl.c index 1d622cc..71d38a9 100644 --- a/src/openvpn/ssl_verify_polarssl.c +++ b/src/openvpn/ssl_verify_polarssl.c @@ -126,7 +126,7 @@ backend_x509_get_username (char *cn, int cn_len, } char * -backend_x509_get_serial (x509_crt *cert, struct gc_arena *gc) +backend_x509_get_serial (openvpn_x509_cert_t *cert, struct gc_arena *gc) { char *buf = NULL; size_t buflen = 0; @@ -164,7 +164,7 @@ backend_x509_get_serial (x509_crt *cert, struct gc_arena *gc) } char * -backend_x509_get_serial_hex (x509_crt *cert, struct gc_arena *gc) +backend_x509_get_serial_hex (openvpn_x509_cert_t *cert, struct gc_arena *gc) { char *buf = NULL; size_t len = cert->serial.len * 3 + 1; -- 1.9.1 

Hi, The following patches contain some minor clean up of stuff I came along while working on other parts. They do not change behaviour. -Steffan