aboutsummaryrefslogtreecommitdiff
path: root/configure.ac
AgeCommit message (Collapse)Author
2020-05-07build: Remove --disable-server from ./configureDavid Sommerseth
After some discussion among the core community developers [1,2], it was decided to remove the possibility to build openvpn as a pure client. This was alterted on the mailing list [3] that it was scheduled for removal unless anyone had strong arguments why it was needed. The general consensus was that we had not received any strong arguments to keep this possibility after approximately 5 months, so it was fine to remove this ./configure option. By removing this, we remove quite some entangled sections of #ifdef scattered all over the code base, making it more readable. One note: Inside the options_postprocess_mutate_invariant() function, the #ifdef P2MP_SERVER and #ifdef _WIN32 blocks where slightly reworked to make the _WIN32 block more continous and avoiding having an empty if(options->mode == MODE_SERVER) block. Signed-off-by: David Sommerseth <davids@openvpn.net> [1] https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg18830.h tml [2] https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19505.h tml [3] https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg18829.h tml Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20200227205443.27562-1-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19506.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-03-15Fix building with --enable-async-push in FreeBSDLev Stipakov
This option can be used in FreedBSD with devel/libinotify installed. Detect presence of libinotify with pkgconf and use its word to compile and link. Trac: #1256 Signed-off-by: Lev Stipakov <lstipakov@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20200314052906.28095-1-lstipakov@gmail.com> URL: https://www.mail-archive.com/search?l=mid&q=20200314052906.28095-1-lstipakov@gmail.com Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-02-17Add strsep compat functionArne Schwabe
Some operating system do not have the strsep function. Since this API is more "modern" (4.4BSD) than strtok, add it as compat function. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Lev Stipakov <lstipakov@gmail.com> Message-Id: <20200217144339.3273-3-arne@rfc2549.org> URL: https://www.mail-archive.com/search?l=mid&q=20200217144339.3273-3-arne@rfc2549.org Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-02-13configure.ac: simplify AC_CHECK_FUNCS statementsLev Stipakov
AC_CHECK_FUNCS checks availability of each function in argument list and defines HAVE_function macro. AC_CHECK_FUNC takes single function as an argument and doesn't automatically define any macros. When we check for availability of a single function and define own macro, it is enough to use AC_CHECK_FUNC. Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20200121080828.1310-1-lstipakov@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19333.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-01-20Move keying material exporter check from syshead.h to configure.acSteffan Karger
Commit ab27c9f7 added a compile-time check for availablitity of keying-material-export functionality to syshead.h. It turns out that openvpnserv also includes syshead.h, and has ENABLE_CRYPTO_* defined in it's config.h, but doesn't have the necessary CFLAGS / LIBS to actually compile and link against the crypto libraries. That of course breaks openvpnserv builds. To fix this, change the compile-time check in syshead.h into a configure-time check in configure.ac. That's more consistent with how we do other feature checks anyway. Signed-off-by: Steffan Karger <steffan.karger@foxcrypto.com> Acked-by: Lev Stipakov <lstipakov@gmail.com> Message-Id: <E1itVts-0007ZG-NO@sfs-ml-2.v29.lw.sourceforge.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19328.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-11-27Fix ACL_CHECK_ADD_COMPILE_FLAGS to work with clangSelva Nair
Some compilers (e.g., clang) only issue a warning for unsupported options unless an additional flag such as -Werror is used to convert the warning to an error. The behaviour is unchanged when using gcc as it either errors or ignores unknown options whether or not -Werror is present. Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <1574183023-6136-1-git-send-email-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19170.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-11-10add -Wno-stringop-truncation to CFLAGS on linuxAntonio Quartulli
GCC>=8 supports truncation checking, however the logic is somewhat fragile when it comes to evaluating strncpy(). In buffer.h we have implemented a wrapper called strncpynt() which ensures we always do the right hting in the code and reduce the chance of having bugs. This said, it seems that the gcc logic is not able to always understand if we are doing the right thing and throws a false positive. Toa void the noise, disable truncation checking on Linux by default. Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20191110100323.13206-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19085.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-10-10OpenSolaris/OpenIllumos: use /bin/bash if available for test scripts.Gert Doering
t_client.sh relies on "echo -e" and "echo -n" to produce nicely looking output, which fails on Solaris /bin/sh - force SHELL=/bin/bash on recent-enough Solaris variants that have it. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <20191009120043.22692-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg18914.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-08-16openssl: Fix compilation without deprecated OpenSSL 1.1 APIsRosen Penev
EVP_CIPHER_CTX_init and _cleanup were deprecated in 1.1 and both were replaced with _reset. EVP_CIPHER_CTX_free in OpenSSL 1.1 replaces the cleanup/free combo of earlier OpenSSL version. And OpenSSL 1.0.2 already calls cleanup as part of _free. Therefore we can remove the _cleanup calls and use the OpenSSL 1.1. API everywhere. Also removed initialisation with OpenSSL 1.1 as it is no longer needed and causes compilation errors when disabling deprecated APIs. Same with SSL_CTX_set_ecdh_auto as it got removed. Patch V3: Use EVP_CIPHER_CTX_reset instead of init/cleanup Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Rosen Penev <rosenp@gmail.com> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20190724152934.9884-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg18700.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-07-05Remove -no-cpp-precomp flag from Darwin buildsArne Schwabe
GCC 9 no longer accepts this flag and trying to find out what it does do leads to an article "-no-cpp-precomp: the compiler flag that time forgot" that also no longer on the Internet. And most other things are PRs/commits from over ten years ago that remove the flag since it is no longer needed. Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20190705114243.9481-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg18650.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-06-24Remove cmocka submodule, rely on system-wide installation instead.Gert Doering
We used to ship git submodule instructions to build a local copy of cmocka in vendor/cmocka/ and use that (if cmake is installed) to build unit tests. With the network test driver this turns out to be a LD_LIBRARY_PATH vs. SUDO complication which is really outweighing the benefit of a local build today - so, use the system-wide installation if available (querying pgk-config). Do not build unit-tests otherwise. v2: (inspired by patch from David Sommerseth) introduce "configure --disable-unit-test" switch simplify configure.ac logic use CMOCKA_LIBS and CMOCKA_INCLUDE (set by PKG_CHECK) v3: repair conflict with commit 7473f326366fbceb CMOCKA_INCLUDE is not correct, must be CMOCKA_CFLAGS (see config.status) Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <20190623183210.6005-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg18570.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-06-23configure.ac: add lzo CFLAGS/LIBS to the test flagsSteffan Karger
This fixes "make check" builds on systems with lzo on a non-standard location. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <20190602101831.21216-1-steffan@karger.me> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg18482.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-06-16t_net.sh: make bash dep explicit and run only if SITNL is compiledAntonio Quartulli
The t_net script currently has #!/bin/sh but it implicitly assume to be using bash. This is fine on most distros, but some do not have sh pointing to bash by default, thus breaking the script. Explicitly use bash to avoid failures. On the other hand, run this unit-test only if SITNL was enabled at compile time. This test was designed with SITNL in mind and it is not yet ready for other backends. Running only when SITNL is enabled implies running on Linux only therefore we are guaranteed that bash will always work. While at it, also add a comment as of why the t_client.rc file is sourced. Signed-off-by: Antonio Quartulli <antonio@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20190615230213.14888-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg18547.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-06-06unit tests: implement test for sitnlAntonio Quartulli
This patch introduces a new unit test that is not executed by the cmocka framework, but rather used by a new t_net.sh bash script. The idea behind this test is to ensure that invoking sitnl functions or running iproute commands leads to the same networking (interface and routing table) state. To achieve this, the t_net.sh script first runs a binary implemented invoking sitnl functions and then takes a "screenshot" of the state. Subsequently a series of iproute commands, expected to mimic exactly the same behaviour as the sitnl functions invoked before, are executed. The final state is then compared with the screenshot previously taken. If no mismatching is found, the test is passed. The current unit_test, however, does not cover all the sitnl functionalities and it is expected to be extended in the future. Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20181219050118.6568-7-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg18027.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-06-02introduce sitnl: Simplified Interface To NetLinkAntonio Quartulli
This patch introduces a tiny netlink interface, optimized for the openvpn use case. It basically exposes all those operations that are currently handled by directly calling the /sbin/ip command (or even ifconfig/route, if configured). By using netlink, openvpn won't need to spawn new processes when configuring the tun interface or routes. This new approach will also allow openvpn to be granted CAP_NET_ADMIN and be able to properly work even though it dropped the root privileges (currently handled via workarounds). By moving this logic into the sitnl module, tun.c and route.c also benefit from some code simplification Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20181219050118.6568-3-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg18030.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-04-17cmocka: use relative pathsSteffan Karger
Simplifies the build scripts, and fixes my CI, where paths on the test slave can be different from paths on the build slave. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <20181028145449.12676-1-steffan@karger.me> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg17849.html Signed-off-by: David Sommerseth <davids@openvpn.net>
2019-04-11Remove wrong poll.h includeRosen Penev
musl reports: warning redirecting incorrect #include <sys/poll.h> to <poll.h> Signed-off-by: Rosen Penev <rosenp@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20190403225740.8285-1-rosenp@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg18336.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-04-11configure.ac: fix compile-time error in argv_testdriverIlya Shipitsin
allow run tests when lzo is installed to non default directory Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20190411074519.9982-2-chipitsine@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg18357.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-02-28cleanup: Remove RPM openvpn.spec build approachDavid Sommerseth
Linux packaging is quite a comprehensive task these days, with many Linux distributions and each with their own packaging guidelines. In addition OpenVPN is packaged for most important Linux distributions already. The OpenVPN developers is not capable of keeping track of how all the various recommend packaging guidelines evoloves and our RPM build process is no longer consistent with guidelines from Fedora, RHEL or SUSE packaging. We also don't receive any updates improving this situation. Most likely due to packaging being handled fairly well by the Linux distributions directly. In addition comes systemd into play, which more and more Linux distributions embraces - and even our own RPM openvpn.spec file didn't account for that move. This removes all RPM related packaging files and updates the INSTALL file with pointers to several popular Linux distributions with accessible information of the OpenVPN packages they provide. Linux distributions is most likely much better at keeping the packaging up-to-shape much better than we. Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20190220131906.22970-1-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg18222.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-02-06Fix various spelling mistakesJonathan Tooker
New patch, omitted changes to copyrights/licenses & changelog. Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20190123201717.15048-1-jonathan@reliablehosting.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg18177.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-01-17Introduce tapctl.exe utility and openvpnmsica.dll MSI CASimon Rozman
The tapctl.exe utility is a future replacement for the devcon.exe/ tapinstall.exe utility. While this utility does not offer TAP driver installation or upgrading, its purpose is to manipulate TAP virtual network interfaces on Windows. In the long term, its code could be integrated into openvpn.exe with `--mktun` and `--rmtun`. The openvpnmsica.dll provides additional MSI custom actions for TUN/TAP interface creation on install. The interface creation is customizable using the `TAPInterface` MSI table and is fully compliant with MSI's deffered processing, commit and rollback. Detailed instruction and documentation is to be published when MSI packaging completed. Those utilities were placed into openvpn repository to join the established compile-sign-package OpenVPN workflow. Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20181010192337.6984-1-simon@rozman.si> URL: https://www.mail-archive.com/search?l=mid&q=20181010192337.6984-1-simon@rozman.si Signed-off-by: Gert Doering <gert@greenie.muc.de>
2018-10-11Fix mbedtls unit testsSteffan Karger
Commit 674b166 ("Fix build warnings related to get_random()") broke the unit tests for mbedtls, because <mbedtls/cipher.h> was now included via platform.c -> crypto.h -> crypto_backend.h, but the crypto cflags were not included for that unit tests. Since we got rid of --disable-crypto, we can now fix this by simply always including the CRYPTO_CFLAGS in the TEST_CFLAGS (and the CRYPTO_LIBS in the TEST_LDFLAGS). This should not only fix this occurrence, but also prevent similar problems in the future. Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1539153883-15789-1-git-send-email-steffan.karger@fox-it.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg17687.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2018-10-05Add OpenSSL compat definition for RSA_meth_set_signArne Schwabe
Commit 6b495dc4c5cfc118091ddc9c19330b3c9e3e3dff introduced RSA_meth_set_sign, which is OpenSSL 1.1.0 and newer. Add a compatibility definition. Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20181005122330.31431-1-arne@rfc2549.org> URL: https://www.mail-archive.com/search?l=mid&q=20181005122330.31431-1-arne@rfc2549.org Signed-off-by: Gert Doering <gert@greenie.muc.de>
2018-09-26mbedtls: remove dependency on mbedtls pkcs11 moduleSteffan Karger
Instead of using mbedtls's pkcs11 module, reuse the code we already have for management-external-key to also do pkcs11 signatures. As far as mbed is concerned, we simply provide an external signature. This has the following advantages: * We no longer need mbed TLS to be compiled with the pkcs11 modules enabled (which is not enabled by default). This makes it easier to use a system/distribution-provided mbed shared library. * We no longer have a dependency on pkcs11-helper through mbed TLS. So if we want to migrate to some other pkcs11 lib (see e.g. trac #491, #538 and #549 for reason why), this will be easier. While touching this code, switch from M_FATAL to M_WARN and proper error handling. This improves the error reporting, and helps prevent potential future DoS attacks if someone starts using these functions on peer input. Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1536916459-25900-3-git-send-email-steffan.karger@fox-it.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg17463.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2018-06-29openssl: don't use deprecated SSLEAY/SSLeay symbolsSteffan Karger
Compiling our current master against OpenSSL 1.1 with -DOPENSSL_API_COMPAT=0x10100000L screams bloody murder. This patch fixes the errors about the deprecated SSLEAY/SSLeay symbols and defines. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20171126150401.28565-1-steffan@karger.me> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15934.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2018-02-21Get rid of ax_check_compile_flag.m4Steffan Karger
The macro was too new for some of the platforms we still support. In particular, centos/rhel 6 and opensolaris 10. To work around that, we introduce our own simpler and more tailored ACL_CHECK_ADD_COMPILE_FLAGS macro, that not only checks but also sets the flags in CFLAGS if it is accepted. Since this doesn't use new-and-shine autoconf features, it should also work on the legacy platforms. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20180220202508.16201-1-steffan@karger.me> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg16515.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2018-02-20Enable stricter compiler warnings by defaultSteffan Karger
This by default enables the compiler warnings one could previously enable using the --enable-strict configure option. I think it is okay to do so now, because we've taken care of many warnings in the more standard builds. (Most of those were totally harmless, but they prevented us from spotting new more serious mistakes.) The --enable-strict flag now enables two extra warning flags that I think can be useful: -Wsign-compare warns when the compiler promotes a signed type to unsigned before comparing, which can lead to unexpected behaviour. -Wuninitialized adds extra warnings about usage of uninitialized variables or struct elements. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Selva Nair <selva.nair@gmail.com> Message-Id: <20180201154521.7642-1-steffan@karger.me> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg16426.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2018-02-01Update copyright to include 2018 plus company name changeDavid Sommerseth
The autumn of 2017, OpenVPN Technologies, Inc changed name to just OpenVPN Inc. Otherwise, extend the copyright to cover 2018 as well. With the exception of the company name change, all changes have been performed by the dev-tools/update-copyright.sh script. Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20180131140314.11103-1-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg16418.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2018-01-14Bring cryptoapi.c upto speed with openssl 1.1Selva Nair
- Replace direct access to internals of openssl structs by corresponding methods. v2: Remove the call to EVP_PKEY_id() as its slated for removal from the compat layer (see also review by Stefan) Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1515956662-30572-1-git-send-email-selva.nair@gmail.com> URL: https://www.mail-archive.com/search?l=mid&q=1515956662-30572-1-git-send-email-selva.nair@gmail.com Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-12-04Remove option to disable crypto engineAntonio Quartulli
With this patch we remove the possibility to disable the crypto engine (ENABLE_CRYPTO define) at configuration time. [--disable-crypto has been removed from .travis.yml too] Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20171203124952.15220-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15979.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-11-23Fix build with LibreSSLJeremie Courreges-Anglas
Detect the presence of SSL_CTX_set_security_level(), don't check OPENSSL_VERSION_NUMBER. Signed-off-by: Jeremie Courreges-Anglas <jca@wxcvbn.org> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <8760a6kjwc.fsf@ritchie.wxcvbn.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15902.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-11-08doxygen: add make target and use relative pathsSteffan Karger
Add a make target, such that 'make doxygen' works (both for in-tree and out-of-tree builds). This now generates the doxygen in doc/doxygen/, rather than in doxygen/. While doing so, instead of genering docs with full path names (e.g. /home/steffan/dev/openvpn/src/openvpn/crypto.h), use a relative path wrt the project root (e.g. src/openvpn/crypto.h) in the generated documentation. This makes the generated doxygen easier to read. Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1510143174-15248-1-git-send-email-steffan.karger@fox-it.com> URL: https://www.mail-archive.com/search?l=mid&q=1510143174-15248-1-git-send-email-steffan.karger@fox-it.com Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-11-04autoconf: Fix engine checks for openssl 1.1James Bottomley
In openssl 1.1, ENGINE_cleanup became a #define instead of a function (because it's no longer needed as engines are self cleaning). Update the autoconf.ac script to check for ENGINE_cleanup as a declaration to avoid falsely undefinig HAVE_OPENSSL_ENGINE in openssl 1.1+ Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1509291288.3116.14.camel@HansenPartnership.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15676.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-10-02lz4: Fix broken builds when pkg-config is not present but system library isDavid Sommerseth
In commit f91e4863bc1382 we fixed an issue where LZ4_LIBS could be overwritten in some situations. But on systems where lz4 is installed on the system but is lacking pkg-config information, the linker will not know about the lz4 library when completing the build. This fixes the issue by explicitly setting LZ4_LIBS to contain -llz4 if pkg-config test was run and failed verifying the installed lz4 version number. This also ensures that LZ4_LIBS will not be overwritten if it has been provided on the ./configure command line. Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20171002190732.12531-1-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15549.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-10-02lz4: Fix confused version checkDavid Sommerseth
Older LZ4 library versions used a version number > 100 and not the current x.y.z versioning scheme. This results in version 122 being numberically higher than the check we have liblz4 > 1.7.1. And since that old version (122) does not have the LZ4_compress_default(), the building explodes later on. This patch enhances the version check to also ensure the version number is lower than 100. In addition the function checking we had was not triggered if system library was found via pkg-config, so this have now been reworked to really check if we have at least two of the most important LZ4 functions - as long as a system library have been found or been accepted via the LZ4_{CFLAGS,LIBS} variables. There are more ways to check for functions in autoconf. I opted for AC_CHECK_LIB() instead of AC_CHECK_FUNC{,S}() as the latter ones does not test if a function exists in a specific library. This have the downside of needing to tests instead of AC_CHECK_FUNCS() which could test for more functions in one go. We also do not overwrite the LZ4_LIBS variable on success, as that could change already set library paths (-L) Finally, a stupid typo got fixed as well. Trac: 939 Signed-off-by: David Sommerseth <davids@openvpn.net> Tested-by: Richard Bonhomme <fragmentux@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20171002161812.9376-1-davids@openvpn.net> URL: https://www.mail-archive.com/search?l=mid&q=20171002161812.9376-1-davids@openvpn.net Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-09-22lz4: Move towards a newer LZ4 APIDavid Sommerseth
We are using a deprecated function, LZ4_compress_limitedOutput(), which will be removed with time. The correct function to use is LZ4_compress_default(). Both function takes the same number of arguments and data types, so the change is minimal. This patch will also enforce the system LZ4 library to be at least v1.7.1. If the system library is not found or it is older, it will be build using the bundled LZ4 library. The version number requirement is based on the LZ4 version we ship. The changes in configure.ac for the version check is modelled around the same approach we use for OpenSSL. Plus it does a few minor reformats and improvements to comply with more recommend autoconf coding style. This patch is a result of the discussions in this mail thread: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14135.html Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20170907172004.22534-1-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15396.html Signed-off-by: David Sommerseth <davids@openvpn.net>
2017-09-06fix a couple of typ0s in comments and stringsAntonio Quartulli
Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <20170819075209.28520-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15293.html Signed-off-by: David Sommerseth <davids@openvpn.net>
2017-08-16remove the --disable-multi config switchAntonio Quartulli
This switch is broken and unmaintained. However there wasn't any ticket about it so far, which means that it is practically unused. Get rid of it and simplify P2MP logic. Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20170816132454.13046-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15275.html Signed-off-by: David Sommerseth <davids@openvpn.net>
2017-08-11Print ec bit details, refuse management-external-key if key is not RSAArne Schwabe
V2: Print also curve details, add missing ifdef V3: Goto err instead of using M_FATAL, format fixes, use EC_GROUP_get_curve_name + OBJ_nid2sn instead of ECPKParameters_print, add compat headers for 1.0.2 V4: Formatting changes and change M_ERR to M_WARN Acked-by: Steffan Karger <steffan@karger.me> Message-Id: <1500828336-30314-1-git-send-email-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15124.html Signed-off-by: David Sommerseth <davids@openvpn.net>
2017-07-20Remove strerror_ts()Steffan Karger
This function was only called in string format functions, which already copy the contents, so all this ever did was adding redundant malloc() and free() calls. Also, this wasn't as thread-safe as it claims: another thread could still change the string value between the strerror() and buf_printf() calls. So, instead of a not needed false sense of thread-safeness, just be honest and use strerror() directly. (I think we should find a better place for everything currently in misc.c, and get rid of it all together. In this case, the better place is /dev/null. This patch is part of that effort.) Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1500550740-24773-1-git-send-email-steffan.karger@fox-it.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15105.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-06-29OpenSSL: remove EVP_CIPHER_CTX_free() from the compat layerEmmanuel Deloget
For unknown reason, the writer of the compat layer seemed to think that this function was only present in OpenSSL 1.1. This is not the case at all, since it has been introduced in OpenSSL before version 0.9.8. Thus, there is no need to add this function to the compat layer, and it can be safely removed. Signed-off-by: Emmanuel Deloget <logout@free.fr> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20170629142119.29502-2-logout@free.fr> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14988.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-06-29OpenSSL: remove EVP_CIPHER_CTX_new() from the compat layerEmmanuel Deloget
For unknown reason, the writer of the compat layer seemed to think that this function was only present in OpenSSL 1.1. This is not the case at all, since it has been introduced in OpenSSL before version 0.9.8. Thus, there is no need to add this function to the compat layer, and it can be safely removed. Signed-off-by: Emmanuel Deloget <logout@free.fr> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20170629142119.29502-1-logout@free.fr> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14989.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-06-22OpenSSL: remove pre-1.1 function from the OpenSSL compat interfaceEmmanuel Deloget
HMAC_CTX_init() has been removed from OpenSSL 1.1. Both this function and function HMAC_CTX_cleanup() has been replaced by HMAC_CTX_reset(). Commit aba98e9050eb54d72d921e70bcd422cb892b9c6c introduced support for HMAC_CTX_init() for OpenSSL 1.1+ while other functions were mimicking the OpenSSL 1.1 interface for earlier version. This is clearly not a good idea -- a better approach would be to provide the new interface for pre-1.1 versions in order to have the dependant code use only one interface version. To implement that, we remove HMAC_CTX_init() from our compatibility layer and implement HMAC_CTX_reset() in terms of a cleanup followed by an init (as the regular HMAC_CTX_reset() function does in OpenSSL 1.1. This change has a consequence on HMAC_CTX_free() which now need to cleanup() the HMAC context before freeing it. Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20170619153513.5420-1-logout@free.fr> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14889.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-06-18OpenSSL: don't use direct access to the internal of HMAC_CTXEmmanuel Deloget
OpenSSL 1.1 does not allow us to directly access the internal of any data type, including HMAC_CTX. We have to use the defined functions to do so. Compatibility with OpenSSL 1.0 is kept by defining the corresponding functions when they are not found in the library. Signed-off-by: Emmanuel Deloget <logout@free.fr> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20170612134330.20971-8-logout@free.fr> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14797.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-06-18OpenSSL: don't use direct access to the internal of EVP_CIPHER_CTXEmmanuel Deloget
OpenSSL 1.1 does not allow us to directly access the internal of any data type, including EVP_CIPHER_CTX. We have to use the defined functions to do so. Compatibility with OpenSSL 1.0 is kept by defining the corresponding functions when they are not found in the library. Signed-off-by: Emmanuel Deloget <logout@free.fr> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20170612134330.20971-7-logout@free.fr> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14796.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-06-18OpenSSL: don't use direct access to the internal of EVP_MD_CTXEmmanuel Deloget
OpenSSL 1.1 does not allow us to directly access the internal of any data type, including EVP_MD_CTX. We have to use the defined functions to do so. Compatibility with OpenSSL 1.0 is kept by defining the corresponding functions when they are not found in the library. Signed-off-by: Emmanuel Deloget <logout@free.fr> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20170612134330.20971-6-logout@free.fr> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14793.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-06-18OpenSSL: don't use direct access to the internal of DSAEmmanuel Deloget
OpenSSL 1.1 does not allow us to directly access the internal of any data type, including DSA. We have to use the defined functions to do so. Compatibility with OpenSSL 1.0 is kept by defining the corresponding functions when they are not found in the library. Signed-off-by: Emmanuel Deloget <logout@free.fr> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20170612134330.20971-5-logout@free.fr> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14791.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-06-18OpenSSL: don't use direct access to the internal of RSAEmmanuel Deloget
OpenSSL 1.1 does not allow us to directly access the internal of any data type, including RSA. We have to use the defined functions to do so. Compatibility with OpenSSL 1.0 is kept by defining the corresponding functions when they are not found in the library. Signed-off-by: Emmanuel Deloget <logout@free.fr> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20170612134330.20971-4-logout@free.fr> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14790.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-06-18OpenSSL: don't use direct access to the internal of EVP_PKEYEmmanuel Deloget
OpenSSL 1.1 does not allow us to directly access the internal of any data type, including EVP_PKEY. We have to use the defined functions to do so. Compatibility with OpenSSL 1.0 is kept by defining the corresponding functions when they are not found in the library. Signed-off-by: Emmanuel Deloget <logout@free.fr> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20170612134330.20971-3-logout@free.fr> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14795.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-06-18OpenSSL: don't use direct access to the internal of X509Emmanuel Deloget
OpenSSL 1.1 does not allow us to directly access the internal of any data type, including X509. We have to use the defined functions to do so. In x509_verify_ns_cert_type() in particular, this means that we cannot directly check for the extended flags to find whether the certificate should be used as a client or as a server certificate. We need to leverage the X509_check_purpose() API yet this API is far stricter than the currently implemented check. So far, I have not been able to find a situation where this stricter test fails (although I must admit that I haven't tested that very well). We double-check the certificate purpose using "direct access" to the internal of the certificate object (of course, this is not a real direct access, but we still fetch ASN1 strings within the X509 object and we check the internal value of these strings). This allow us to warn the user if there is a discrepancy between the X509_check_purpose() return value and our internal, less strict check. We use these changes to make peer_cert a non-const parameter to x509_verify_ns_cert_type(). The underlying library waits for a non-const pointer, and forcing it to be a const pointer does not make much sense (please note that this has an effect on the mbedtls part too). Compatibility with OpenSSL 1.0 is kept by defining the corresponding functions when they are not found in the library. Signed-off-by: Emmanuel Deloget <logout@free.fr> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20170612134330.20971-2-logout@free.fr> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14792.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
generated by cgit v1.1 at 2024-10-07 14:32:24 +0000