aboutsummaryrefslogtreecommitdiff
path: root/configure.ac
AgeCommit message (Collapse)Author
2018-10-11Fix mbedtls unit testsSteffan Karger
Commit 674b166 ("Fix build warnings related to get_random()") broke the unit tests for mbedtls, because <mbedtls/cipher.h> was now included via platform.c -> crypto.h -> crypto_backend.h, but the crypto cflags were not included for that unit tests. Since we got rid of --disable-crypto, we can now fix this by simply always including the CRYPTO_CFLAGS in the TEST_CFLAGS (and the CRYPTO_LIBS in the TEST_LDFLAGS). This should not only fix this occurrence, but also prevent similar problems in the future. Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1539153883-15789-1-git-send-email-steffan.karger@fox-it.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg17687.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2018-10-05Add OpenSSL compat definition for RSA_meth_set_signArne Schwabe
Commit 6b495dc4c5cfc118091ddc9c19330b3c9e3e3dff introduced RSA_meth_set_sign, which is OpenSSL 1.1.0 and newer. Add a compatibility definition. Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20181005122330.31431-1-arne@rfc2549.org> URL: https://www.mail-archive.com/search?l=mid&q=20181005122330.31431-1-arne@rfc2549.org Signed-off-by: Gert Doering <gert@greenie.muc.de>
2018-09-26mbedtls: remove dependency on mbedtls pkcs11 moduleSteffan Karger
Instead of using mbedtls's pkcs11 module, reuse the code we already have for management-external-key to also do pkcs11 signatures. As far as mbed is concerned, we simply provide an external signature. This has the following advantages: * We no longer need mbed TLS to be compiled with the pkcs11 modules enabled (which is not enabled by default). This makes it easier to use a system/distribution-provided mbed shared library. * We no longer have a dependency on pkcs11-helper through mbed TLS. So if we want to migrate to some other pkcs11 lib (see e.g. trac #491, #538 and #549 for reason why), this will be easier. While touching this code, switch from M_FATAL to M_WARN and proper error handling. This improves the error reporting, and helps prevent potential future DoS attacks if someone starts using these functions on peer input. Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1536916459-25900-3-git-send-email-steffan.karger@fox-it.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg17463.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2018-06-29openssl: don't use deprecated SSLEAY/SSLeay symbolsSteffan Karger
Compiling our current master against OpenSSL 1.1 with -DOPENSSL_API_COMPAT=0x10100000L screams bloody murder. This patch fixes the errors about the deprecated SSLEAY/SSLeay symbols and defines. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20171126150401.28565-1-steffan@karger.me> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15934.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2018-02-21Get rid of ax_check_compile_flag.m4Steffan Karger
The macro was too new for some of the platforms we still support. In particular, centos/rhel 6 and opensolaris 10. To work around that, we introduce our own simpler and more tailored ACL_CHECK_ADD_COMPILE_FLAGS macro, that not only checks but also sets the flags in CFLAGS if it is accepted. Since this doesn't use new-and-shine autoconf features, it should also work on the legacy platforms. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20180220202508.16201-1-steffan@karger.me> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg16515.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2018-02-20Enable stricter compiler warnings by defaultSteffan Karger
This by default enables the compiler warnings one could previously enable using the --enable-strict configure option. I think it is okay to do so now, because we've taken care of many warnings in the more standard builds. (Most of those were totally harmless, but they prevented us from spotting new more serious mistakes.) The --enable-strict flag now enables two extra warning flags that I think can be useful: -Wsign-compare warns when the compiler promotes a signed type to unsigned before comparing, which can lead to unexpected behaviour. -Wuninitialized adds extra warnings about usage of uninitialized variables or struct elements. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Selva Nair <selva.nair@gmail.com> Message-Id: <20180201154521.7642-1-steffan@karger.me> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg16426.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2018-02-01Update copyright to include 2018 plus company name changeDavid Sommerseth
The autumn of 2017, OpenVPN Technologies, Inc changed name to just OpenVPN Inc. Otherwise, extend the copyright to cover 2018 as well. With the exception of the company name change, all changes have been performed by the dev-tools/update-copyright.sh script. Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20180131140314.11103-1-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg16418.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2018-01-14Bring cryptoapi.c upto speed with openssl 1.1Selva Nair
- Replace direct access to internals of openssl structs by corresponding methods. v2: Remove the call to EVP_PKEY_id() as its slated for removal from the compat layer (see also review by Stefan) Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1515956662-30572-1-git-send-email-selva.nair@gmail.com> URL: https://www.mail-archive.com/search?l=mid&q=1515956662-30572-1-git-send-email-selva.nair@gmail.com Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-12-04Remove option to disable crypto engineAntonio Quartulli
With this patch we remove the possibility to disable the crypto engine (ENABLE_CRYPTO define) at configuration time. [--disable-crypto has been removed from .travis.yml too] Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20171203124952.15220-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15979.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-11-23Fix build with LibreSSLJeremie Courreges-Anglas
Detect the presence of SSL_CTX_set_security_level(), don't check OPENSSL_VERSION_NUMBER. Signed-off-by: Jeremie Courreges-Anglas <jca@wxcvbn.org> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <8760a6kjwc.fsf@ritchie.wxcvbn.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15902.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-11-08doxygen: add make target and use relative pathsSteffan Karger
Add a make target, such that 'make doxygen' works (both for in-tree and out-of-tree builds). This now generates the doxygen in doc/doxygen/, rather than in doxygen/. While doing so, instead of genering docs with full path names (e.g. /home/steffan/dev/openvpn/src/openvpn/crypto.h), use a relative path wrt the project root (e.g. src/openvpn/crypto.h) in the generated documentation. This makes the generated doxygen easier to read. Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1510143174-15248-1-git-send-email-steffan.karger@fox-it.com> URL: https://www.mail-archive.com/search?l=mid&q=1510143174-15248-1-git-send-email-steffan.karger@fox-it.com Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-11-04autoconf: Fix engine checks for openssl 1.1James Bottomley
In openssl 1.1, ENGINE_cleanup became a #define instead of a function (because it's no longer needed as engines are self cleaning). Update the autoconf.ac script to check for ENGINE_cleanup as a declaration to avoid falsely undefinig HAVE_OPENSSL_ENGINE in openssl 1.1+ Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1509291288.3116.14.camel@HansenPartnership.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15676.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-10-02lz4: Fix broken builds when pkg-config is not present but system library isDavid Sommerseth
In commit f91e4863bc1382 we fixed an issue where LZ4_LIBS could be overwritten in some situations. But on systems where lz4 is installed on the system but is lacking pkg-config information, the linker will not know about the lz4 library when completing the build. This fixes the issue by explicitly setting LZ4_LIBS to contain -llz4 if pkg-config test was run and failed verifying the installed lz4 version number. This also ensures that LZ4_LIBS will not be overwritten if it has been provided on the ./configure command line. Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20171002190732.12531-1-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15549.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-10-02lz4: Fix confused version checkDavid Sommerseth
Older LZ4 library versions used a version number > 100 and not the current x.y.z versioning scheme. This results in version 122 being numberically higher than the check we have liblz4 > 1.7.1. And since that old version (122) does not have the LZ4_compress_default(), the building explodes later on. This patch enhances the version check to also ensure the version number is lower than 100. In addition the function checking we had was not triggered if system library was found via pkg-config, so this have now been reworked to really check if we have at least two of the most important LZ4 functions - as long as a system library have been found or been accepted via the LZ4_{CFLAGS,LIBS} variables. There are more ways to check for functions in autoconf. I opted for AC_CHECK_LIB() instead of AC_CHECK_FUNC{,S}() as the latter ones does not test if a function exists in a specific library. This have the downside of needing to tests instead of AC_CHECK_FUNCS() which could test for more functions in one go. We also do not overwrite the LZ4_LIBS variable on success, as that could change already set library paths (-L) Finally, a stupid typo got fixed as well. Trac: 939 Signed-off-by: David Sommerseth <davids@openvpn.net> Tested-by: Richard Bonhomme <fragmentux@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20171002161812.9376-1-davids@openvpn.net> URL: https://www.mail-archive.com/search?l=mid&q=20171002161812.9376-1-davids@openvpn.net Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-09-22lz4: Move towards a newer LZ4 APIDavid Sommerseth
We are using a deprecated function, LZ4_compress_limitedOutput(), which will be removed with time. The correct function to use is LZ4_compress_default(). Both function takes the same number of arguments and data types, so the change is minimal. This patch will also enforce the system LZ4 library to be at least v1.7.1. If the system library is not found or it is older, it will be build using the bundled LZ4 library. The version number requirement is based on the LZ4 version we ship. The changes in configure.ac for the version check is modelled around the same approach we use for OpenSSL. Plus it does a few minor reformats and improvements to comply with more recommend autoconf coding style. This patch is a result of the discussions in this mail thread: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14135.html Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20170907172004.22534-1-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15396.html Signed-off-by: David Sommerseth <davids@openvpn.net>
2017-09-06fix a couple of typ0s in comments and stringsAntonio Quartulli
Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <20170819075209.28520-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15293.html Signed-off-by: David Sommerseth <davids@openvpn.net>
2017-08-16remove the --disable-multi config switchAntonio Quartulli
This switch is broken and unmaintained. However there wasn't any ticket about it so far, which means that it is practically unused. Get rid of it and simplify P2MP logic. Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20170816132454.13046-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15275.html Signed-off-by: David Sommerseth <davids@openvpn.net>
2017-08-11Print ec bit details, refuse management-external-key if key is not RSAArne Schwabe
V2: Print also curve details, add missing ifdef V3: Goto err instead of using M_FATAL, format fixes, use EC_GROUP_get_curve_name + OBJ_nid2sn instead of ECPKParameters_print, add compat headers for 1.0.2 V4: Formatting changes and change M_ERR to M_WARN Acked-by: Steffan Karger <steffan@karger.me> Message-Id: <1500828336-30314-1-git-send-email-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15124.html Signed-off-by: David Sommerseth <davids@openvpn.net>
2017-07-20Remove strerror_ts()Steffan Karger
This function was only called in string format functions, which already copy the contents, so all this ever did was adding redundant malloc() and free() calls. Also, this wasn't as thread-safe as it claims: another thread could still change the string value between the strerror() and buf_printf() calls. So, instead of a not needed false sense of thread-safeness, just be honest and use strerror() directly. (I think we should find a better place for everything currently in misc.c, and get rid of it all together. In this case, the better place is /dev/null. This patch is part of that effort.) Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1500550740-24773-1-git-send-email-steffan.karger@fox-it.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15105.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-06-29OpenSSL: remove EVP_CIPHER_CTX_free() from the compat layerEmmanuel Deloget
For unknown reason, the writer of the compat layer seemed to think that this function was only present in OpenSSL 1.1. This is not the case at all, since it has been introduced in OpenSSL before version 0.9.8. Thus, there is no need to add this function to the compat layer, and it can be safely removed. Signed-off-by: Emmanuel Deloget <logout@free.fr> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20170629142119.29502-2-logout@free.fr> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14988.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-06-29OpenSSL: remove EVP_CIPHER_CTX_new() from the compat layerEmmanuel Deloget
For unknown reason, the writer of the compat layer seemed to think that this function was only present in OpenSSL 1.1. This is not the case at all, since it has been introduced in OpenSSL before version 0.9.8. Thus, there is no need to add this function to the compat layer, and it can be safely removed. Signed-off-by: Emmanuel Deloget <logout@free.fr> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20170629142119.29502-1-logout@free.fr> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14989.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-06-22OpenSSL: remove pre-1.1 function from the OpenSSL compat interfaceEmmanuel Deloget
HMAC_CTX_init() has been removed from OpenSSL 1.1. Both this function and function HMAC_CTX_cleanup() has been replaced by HMAC_CTX_reset(). Commit aba98e9050eb54d72d921e70bcd422cb892b9c6c introduced support for HMAC_CTX_init() for OpenSSL 1.1+ while other functions were mimicking the OpenSSL 1.1 interface for earlier version. This is clearly not a good idea -- a better approach would be to provide the new interface for pre-1.1 versions in order to have the dependant code use only one interface version. To implement that, we remove HMAC_CTX_init() from our compatibility layer and implement HMAC_CTX_reset() in terms of a cleanup followed by an init (as the regular HMAC_CTX_reset() function does in OpenSSL 1.1. This change has a consequence on HMAC_CTX_free() which now need to cleanup() the HMAC context before freeing it. Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20170619153513.5420-1-logout@free.fr> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14889.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-06-18OpenSSL: don't use direct access to the internal of HMAC_CTXEmmanuel Deloget
OpenSSL 1.1 does not allow us to directly access the internal of any data type, including HMAC_CTX. We have to use the defined functions to do so. Compatibility with OpenSSL 1.0 is kept by defining the corresponding functions when they are not found in the library. Signed-off-by: Emmanuel Deloget <logout@free.fr> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20170612134330.20971-8-logout@free.fr> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14797.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-06-18OpenSSL: don't use direct access to the internal of EVP_CIPHER_CTXEmmanuel Deloget
OpenSSL 1.1 does not allow us to directly access the internal of any data type, including EVP_CIPHER_CTX. We have to use the defined functions to do so. Compatibility with OpenSSL 1.0 is kept by defining the corresponding functions when they are not found in the library. Signed-off-by: Emmanuel Deloget <logout@free.fr> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20170612134330.20971-7-logout@free.fr> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14796.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-06-18OpenSSL: don't use direct access to the internal of EVP_MD_CTXEmmanuel Deloget
OpenSSL 1.1 does not allow us to directly access the internal of any data type, including EVP_MD_CTX. We have to use the defined functions to do so. Compatibility with OpenSSL 1.0 is kept by defining the corresponding functions when they are not found in the library. Signed-off-by: Emmanuel Deloget <logout@free.fr> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20170612134330.20971-6-logout@free.fr> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14793.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-06-18OpenSSL: don't use direct access to the internal of DSAEmmanuel Deloget
OpenSSL 1.1 does not allow us to directly access the internal of any data type, including DSA. We have to use the defined functions to do so. Compatibility with OpenSSL 1.0 is kept by defining the corresponding functions when they are not found in the library. Signed-off-by: Emmanuel Deloget <logout@free.fr> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20170612134330.20971-5-logout@free.fr> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14791.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-06-18OpenSSL: don't use direct access to the internal of RSAEmmanuel Deloget
OpenSSL 1.1 does not allow us to directly access the internal of any data type, including RSA. We have to use the defined functions to do so. Compatibility with OpenSSL 1.0 is kept by defining the corresponding functions when they are not found in the library. Signed-off-by: Emmanuel Deloget <logout@free.fr> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20170612134330.20971-4-logout@free.fr> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14790.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-06-18OpenSSL: don't use direct access to the internal of EVP_PKEYEmmanuel Deloget
OpenSSL 1.1 does not allow us to directly access the internal of any data type, including EVP_PKEY. We have to use the defined functions to do so. Compatibility with OpenSSL 1.0 is kept by defining the corresponding functions when they are not found in the library. Signed-off-by: Emmanuel Deloget <logout@free.fr> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20170612134330.20971-3-logout@free.fr> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14795.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-06-18OpenSSL: don't use direct access to the internal of X509Emmanuel Deloget
OpenSSL 1.1 does not allow us to directly access the internal of any data type, including X509. We have to use the defined functions to do so. In x509_verify_ns_cert_type() in particular, this means that we cannot directly check for the extended flags to find whether the certificate should be used as a client or as a server certificate. We need to leverage the X509_check_purpose() API yet this API is far stricter than the currently implemented check. So far, I have not been able to find a situation where this stricter test fails (although I must admit that I haven't tested that very well). We double-check the certificate purpose using "direct access" to the internal of the certificate object (of course, this is not a real direct access, but we still fetch ASN1 strings within the X509 object and we check the internal value of these strings). This allow us to warn the user if there is a discrepancy between the X509_check_purpose() return value and our internal, less strict check. We use these changes to make peer_cert a non-const parameter to x509_verify_ns_cert_type(). The underlying library waits for a non-const pointer, and forcing it to be a const pointer does not make much sense (please note that this has an effect on the mbedtls part too). Compatibility with OpenSSL 1.0 is kept by defining the corresponding functions when they are not found in the library. Signed-off-by: Emmanuel Deloget <logout@free.fr> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20170612134330.20971-2-logout@free.fr> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14792.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-06-16copyright: Update GPLv2 license textsDavid Sommerseth
The COPYRIGHT.GPL file was slightly out-of-sync with the last GPLv2 license from Free Software Foundation, Inc. The changes are primarily a new address, which required touching almost all the project files. Except of that, it is just minor adjustments to formatting, removal of form-feed characters and referencing "GNU Lesser General Public License" instead of "GNU Library General Public License". Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20170329093648.10156-1-davids@openvpn.net> URL: https://www.mail-archive.com/search?l=mid&q=20170329093648.10156-1-davids@openvpn.net Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-04-24Fix broken ./configure on systems without openssl.pcDavid Sommerseth
Commit 039a89c331e9b799 changed the OpenSSL check slightly, but that broke ./configure on systems which do not install the openssl.pc pkg-config support file. This is typically an issue on most of the BSD platforms, where the OpenSSL package from the base repository does not provide that file. We should anyway in this case have a better check of OpenSSL version available. So in the case pkg-config fails, it will run an additional test looking for the OpenSSL version number in the opensslv.h header file and check against that version number. I did consider to rip out the pkg-config test all together, but decided to let it stay. If pkg-config works, it provides much more details to the ./configure script than just the version number check - such as include and library paths if those are outside the default system paths. If the user adds OPENSSL_CFLAGS or OPENSSL_LIBS to the ./configure script, the pkg-config will not be run. But this patch ensures that the OpenSSL version is also checked in this situation. This patch have been tested on Scientic Linux 7.3 (RHEL clone) and FreeBSD 10.3-RELEASE-p11. v5 - Remove the right OPENSSL_LIBS and preserve the old one - In PKG_CHECK_MODULES(), check for openssl instead of libssl + libcrypto - Fix tab/space issues once again v4 - Move the CFLAGS/LDFLAGS declarations before the manual version test; otherwise we're still testing the system install version v3 - Remove not needed and duplicated OPENSSL_LIBS assignment - Fix tab/space issues in modified lines v2 - Don't use try to simplify the version matching, use the full OPENSSL_VERSION_NUMBER - Fixed typo (OpneSSL -> OpenSSL) - Improve a few comments Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20170424143910.20118-1-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14503.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-04-11Require minimum OpenSSL 1.0.1David Sommerseth
As RHEL 5 has reached EOL, we no longer need to support OpenSSL v0.9.8. This also makes it possible to remove a few workaronds which was needed earlier, as well as some left overs from v0.9.6. This also makes ./configure really stop running unless a new enough OpenSSL library is found. Compile tested on RHEL7.3 and RHEL6.7 (mock chroot build), both shipping openssl-1.0.1e. Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20170411173133.18060-1-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14441.html Signed-off-by: David Sommerseth <davids@openvpn.net>
2017-03-05OpenSSL: don't use direct access to the internal of RSA_METHODEmmanuel Deloget
OpenSSL 1.1 does not allow us to directly access the internal of any data type, including RSA_METHOD. We have to use the defined functions to do so. Compatibility with OpenSSL 1.0 is kept by defining the corresponding functions when they are not found in the library. Signed-off-by: Emmanuel Deloget <logout@free.fr> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <79d89580db6fd92c059dabc4f5f4d83b72bb9d3d.1487859361.git.logout@free.fr> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14175.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-02-23OpenSSL: 1.1 fallout - fix configure on old autoconfSteffan Karger
Older versions of autoconf generate an empty "else fi" block for empty fields in an AC_CHECK_FUNCS() macro. This breaks on e.g. RHEL6. Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1487846138-22231-1-git-send-email-steffan.karger@fox-it.com> URL: http://www.mail-archive.com/search?l=mid&q=1487846138-22231-1-git-send-email-steffan.karger@fox-it.com Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-02-22OpenSSL: don't use direct access to the internal of X509_OBJECTEmmanuel Deloget
OpenSSL 1.1 does not allow us to directly access the internal of any data type, including X509_OBJECT. We have to use the defined functions to do so. Compatibility with OpenSSL 1.0 is kept by defining the corresponding functions when they are not found in the library. Signed-off-by: Emmanuel Deloget <logout@free.fr> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <c849c9778d2b2faa4eb4d31367b37d993da5eb85.1487368114.git.logout@free.fr> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14080.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-02-22OpenSSL: don't use direct access to the internal of X509_STOREEmmanuel Deloget
OpenSSL 1.1 does not allow us to directly access the internal of any data type, including X509_STORE. We have to use the defined functions to do so. Compatibility with OpenSSL 1.0 is kept by defining the corresponding functions when they are not found in the library. Signed-off-by: Emmanuel Deloget <logout@free.fr> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <8e6d66e3a9a40abb3d7c99c48ba59bad1037d0ef.1487368114.git.logout@free.fr> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14076.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-02-22OpenSSL: don't use direct access to the internal of SSL_CTXEmmanuel Deloget
OpenSSL 1.1 does not allow us to directly access the internal of any data type, including SSL_CTX. We have to use the defined functions to do so. Compatibility with OpenSSL 1.0 is kept by defining the corresponding functions when they are not found in the library. Signed-off-by: Emmanuel Deloget <logout@free.fr> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <a77187a66affdba318ef70e0e218b69cdad509d1.1487368114.git.logout@free.fr> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14088.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-01-27plugin: Remove GNUism in openvpn-plugin.h generationChristian Hesse
The plugin path handling cleanup (4590c383) introduced GNUism and broke builds on system not using GNU Make (like *BSD). Revert back to let configure generate the header file. Instead let make add an extra CFLAG that defines PLUGIN_LIBDIR. Signed-off-by: Christian Hesse <mail@eworm.de> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20170127084927.21040-1-list@eworm.de> URL: http://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg13966.html Signed-off-by: David Sommerseth <davids@openvpn.net>
2017-01-25Clean up plugin path handlingChristian Hesse
Drop --with-plugindir, instead use an environment variable PLUGINDIR to specify the plugin directory. This puts a define into include/openvpn-plugin.h.in which has the plugin directory. The configure script does not know about the final plugin path. Thus we have to make Make generate the final header file for us. As the path is always available remove the compile time condition (and dead code) from src/openvpn/plugin.c. v2: The configure script can not evaluate the final $libdir path. So use make to create a header file on the containing the final path. v3: Fix whitespace errors and gitignore location. v4: No extra header file, generate src/openvpn/plugin.h on the fly. Remove condition and dead code. v5: Move the define to include/openvpn-plugin.h.in and let make generate the final header file. Signed-off-by: Christian Hesse <mail@eworm.de> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <20170125201947.17197-1-list@eworm.de> URL: http://www.mail-archive.com/search?l=mid&q=20170125201947.17197-1-list@eworm.de Signed-off-by: David Sommerseth <davids@openvpn.net>
2017-01-25systemd: Do not race on RuntimeDirectoryChristian Hesse
Different unit instances create and destroy the same RuntimeDirectory. This leads to running instances where the status file (and possibly more runtime data) is no longer accessible. So do not handle this in unit files but provide a tmpfiles.d configuration and let systemd-tmpfiles do the work. Nobody will (unintentionally) delete the directories and its content. As /run is volatile we do not have to care about cleanup. Signed-off-by: Christian Hesse <mail@eworm.de> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <20170124143947.27385-2-list@eworm.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg13939.html Signed-off-by: David Sommerseth <davids@openvpn.net>
2017-01-25systemd: Use automake tools to install unit filesChristian Hesse
If systemd is enabled we install unit files to $libdir/systemd/system (or the path specified by SYSTEMD_UNIT_DIR). The unit files are generated on the fly with matching $sbindir. Signed-off-by: Christian Hesse <mail@eworm.de> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <20170124143947.27385-1-list@eworm.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg13940.html Signed-off-by: David Sommerseth <davids@openvpn.net>
2017-01-20Add a check for -Wl, --wrap support in linkerSelva Nair
- Also make tests that require --wrap option to be conditional on this support [ DS: Removed AC_DEFINE([HAVE_LD_WRAP_SUPPORT],...) at commit time as we now see no real use for such a #define in config.h ] Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <1484772172-19758-1-git-send-email-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg13897.html Signed-off-by: David Sommerseth <davids@openvpn.net>
2016-12-21Update copyrightsDavid Sommerseth
Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Steffan Karger <steffan@karger.me> Message-Id: <1482350454-27280-2-git-send-email-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg13653.html
2016-12-14Further enhance async-push feature descriptionDavid Sommerseth
Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <1481718210-15673-1-git-send-email-davids@openvpn.net> URL: http://www.mail-archive.com/search?l=mid&q=1481718210-15673-1-git-send-email-davids@openvpn.net
2016-12-06Fix wrong configure.ac parsing of --enable-async-pushDavid Sommerseth
AC_ARG_ENABLE() was used wrong, which led enable_async_push to always be set, regardless if --enable-async-push or --disable-async-push was used. Also spotted the exact same patch when writing this commit message as GitHub PR#70. Trac: #786 Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Lev Stipakov <lstipakov@gmail.com> Message-Id: <1481062251-18349-1-git-send-email-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg13411.html
2016-11-20Remove remaining traces of compat-stdbool.hGert Doering
commit 35be7e0d5 removed most references to compat-stdbool.h but overlooked configure and "make dist" Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Selva Nair <selva.nair@gmail.com> Message-Id: <1479628060-32673-1-git-send-email-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg13135.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2016-11-14Make argv unit tests obey {MBEDTLS, OPENSSL}_{LIBS, CFLAGS}Steffan Karger
Fixes builds that use MBEDTLS_CFLAGS and friends to tell the build where the header files and libraries are. Also alphabetically orders some of the listed files in relates Makefile.am files. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1479152603-5103-1-git-send-email-steffan@karger.me> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg13050.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2016-11-14put argv_* functions into own file, add unit testsHeiko Hund
misc.c is too crowded with different things to perform any sane unit testing due to its dependencies. So, in order to re-write the #ifdef'ed tests for the argv_* family of functions into unit tests I moved them into a dedicated file. Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Acked-by: David Sommerseth <davids@redhat.com> Message-Id: <1477672963-5724-2-git-send-email-heiko.hund@sophos.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg12811.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2016-11-13Fix builds on compilers without anonymous union supportSteffan Karger
The "Don't dereference type-punned pointers" patch introduced an anonymous union, which older compilers do not support (or refuse to support when -std=c99 is defined). Add a configure check, and some wrapper defines to repair builds on those compilers. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1479060203-4472-1-git-send-email-steffan@karger.me> URL: http://www.mail-archive.com/search?l=mid&q=1479060203-4472-1-git-send-email-steffan@karger.me Signed-off-by: Gert Doering <gert@greenie.muc.de>
2016-11-13Add in_port_t check to configure.acGert Doering
commit 8cac9b98d58b97 introduced using in_port_t which is not available on (all?) mingw build environments. Add configure check, falling back to uint16_t. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20161113155535.68355-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg13021.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
generated by cgit v1.1 at 2024-10-07 14:21:44 +0000