Re: [Openvpn-devel] Summary of the IRC meeting / sprint (8th Sep 2011)

[Heiko Hund <heiko.hund@so...>]

On Friday 09 September 2011 10:21:03 Samuli Seppänen wrote:
> Discussed the "Better --auto-proxy support for Windows" patchset:
> 
> <http://thread.gmane.org/gmane.network.openvpn.devel/4927>;
> 
> Suggested the following modifications:
> 
> Patch [1/3]: Add MinGW WinHTTP compatibility layer
> 
> - Make use of import libraries:
> <http://www.mingw.org/wiki/CreateImportLibraries>;

See my patch from yesterday.
 
> Patch [2/3]: Do automatic proxy detection on Windows right...
> Patch [3/3]: Query auto-proxy information when connecting...
> 
> - Verify that these patches play well with existing functionality:
>   - PROXY queries from the management interface
>   - http-proxy-fallback option
>   - http-proxy-override option

Have done the tests now:

--http-proxy-override works. The server configured here overrides the one from 
--auto-proxy.

--http-proxy-fallback works as long as no proxy is configured via 
--http-proxy or --auto-proxy. In that case ">PROXY:NEED_NOW" can be answered 
with "http-proxy-fallback <host> <port>" via management interface and the 
fallback proxy entered is used.

So, as expected, we're still fine regarding compatibiliy with these options.

Heiko
-- 
Heiko Hund | Software Engineer | Phone +49-721-25516-237 | Fax -200
Astaro a Sophos Company | Amalienbadstr. 41 Bau 52 | 76227 Karlsruhe | Germany
Commercial Register: Mannheim HRA 702710 | Headquarter Location: Karlsruhe
 
Represented by the General Partner Astaro Verwaltungs GmbH
Amalienbadstraße 41 Bau 52 | 76227 Karlsruhe | Germany 
Commercial Register: Mannheim HRB 708248 | Executive Board: Gert Hansen,
Markus Hennig, Jan Hichert, Günter Junk, Dr. Frank Nellissen

Re: [Openvpn-devel] Info on internal routes aging and MULTI_ROUTE_AGEABLE

[Davide Guerri <d.guerri@ca...>]

Hi all,
please find attached the patch Matteo is referring to.

Since we're not expert of the openvpn source code, we think it should be considered as a starting point for a discussion.

Basically this patch adds a stale-routes-check option that takes 2 parameters: a ageing time (in seconds) and a check interval (in seconds). The latter defaults to the former if it's not present.
Internally, a new "check" is added in multi_process_per_second_timers_dowork(). This check deletes stale routes and it is inspired to the function multi_reap_range().

We're running a very large connectivity infrastructure based on openVPN (more than 4000 different clients connected per day per server), so we can throughly check this patch (or, of course, any variant of it).

Regards,
  Matteo and Davide.

[Openvpn-devel] Info on internal routes aging and MULTI_ROUTE_AGEABLE

[Matteo Latini <m.latini@ca...>]

Hi,
we (openwisp.it) are an open source wireless ISP using openvpn's tap devices 
to bridge access points with our main servers.

We recently ran into a problem with openvpn's internal routing table getting filled up by "old and stale" routes.
Some routes are kept for months (till the vpn gets restarted). This and the --max-routes-per-client option makes
the internal routing table fill up and never let newer clients add new internal routes.

Since we were unable to find a way to clean stale routes by reading the manpages, we began exploring openvpn's
code to create a patch that would clean old and inactive routes. The patch is working but, by looking through code,
we found some reference to MULTI_ROUTE_AGEABLE and ageable_ttl_secs in the multi_route_defined method (multi.h).

Are those in any way meant to clean, in any way (maybe yet to implement), aged routes?
We tried using multi_route_defined to keep track of such routes without success.

Should we keep trying with MULTI_ROUTE_AGEABLE or find other ways (we implemented the patch by using a dedicated
timer that triggers a function that does something similar to what happens on teardown)?

We are currently patching OpenVPN 2.1.0


Regards,
Matteo Latini

Re: [Openvpn-devel] hello

[David Sommerseth <openvpn.list@to...>]

On 14/09/11 11:47, luiji tin tac wrote:
> please can you get me open vpn i want to hide my ip from scammers
> 

For any one tempted to answer such requests like this.  Don't do it.  It's
not that hard to find http://www.openvpn.net/ and download things.  This
request is more likely just an attempt of harvesting our mailing list for
mail addresses, used by spam.  If you look at the senders mail address, you
should get more sceptical.


kind regards,

David Sommerseth

[Openvpn-devel] hello

[luiji tin tac <sellerscvv2@gm...>]

please can you get me open vpn i want to hide my ip from scammers

[Openvpn-devel] [PATCH] add MinGW WinHTTP compatibility import library

[Heiko Hund <heiko.hund@so...>]

MinGW is missing support for winhttp.dll which will be used for automatic
proxy server detection in Windows. Until it becomes available the workaround
performed is to define the used constants and function prototypes in openvpn
and build a WINHTTP.dll import library in the build process.

Signed-off-by: Heiko Hund <heiko.hund@...>
---
 Makefile.am   |   15 +++++++++++++
 configure.ac  |   53 ++++++++++++++++++++++++++++++++++++++++++++++
 win32.c       |    2 +
 win32.h       |   65 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 winhttp32.def |    8 +++++++
 winhttp64.def |    8 +++++++
 6 files changed, 151 insertions(+), 0 deletions(-)
 create mode 100644 winhttp32.def
 create mode 100644 winhttp64.def

diff --git a/Makefile.am b/Makefile.am
index 266a5af..b1c0a1b 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -74,6 +74,8 @@ dist_noinst_DATA = \
 	openvpn.spec \
 	COPYRIGHT.GPL \
 	PORTS \
+	winhttp32.def \
+	winhttp64.def \
 	INSTALL-win32.txt \
 	service-win32/msvc.mak
 
@@ -163,3 +165,16 @@ openvpn.8.html: $(srcdir)/openvpn.8
 else
 dist_man_MANS = openvpn.8
 endif
+
+if BUILD_WINHTTP_IMPLIB
+openvpn_LDADD = libwinhttp.a
+
+if WIN64
+libwinhttp.a: winhttp64.def
+	$(DLLTOOL) -k -d winhttp64.def -l libwinhttp.a
+else
+libwinhttp.a: winhttp32.def
+	$(DLLTOOL) -k -d winhttp32.def -l libwinhttp.a
+endif
+
+endif
diff --git a/configure.ac b/configure.ac
index a3789d9..7516d68 100644
--- a/configure.ac
+++ b/configure.ac
@@ -62,6 +62,22 @@ case "${host}" in
 	;;
 esac
 
+dnl Check for 64 bit Windows
+WIN64="no"
+if test "${WIN32}" = "yes"; then
+  AC_MSG_CHECKING([if building for 64 bit Windows])
+  case "${host}" in
+    *64-*-*)
+      AC_MSG_RESULT([yes])
+      WIN64="yes"
+      ;;
+    *)
+      AC_MSG_RESULT([no])
+      ;;
+  esac
+fi
+
+
 AC_ARG_ENABLE(lzo,
    [  --disable-lzo           Disable LZO compression support],
    [LZO="$enableval"],
@@ -665,6 +681,42 @@ if test "${WIN32}" = "yes"; then
 fi
 
 dnl
+dnl Check if MinGW knows about WinHTTP API
+dnl
+if test "${WIN32}" = "yes"; then
+   AC_MSG_CHECKING([if MinGW knows about WinHTTP])
+   AC_TRY_LINK([
+       #include <windows.h>
+       #include <winhttp.h>
+     ], [
+       LPWSTR *url;
+       HINTERNET session;
+       WINHTTP_PROXY_INFO proxy_info;
+       WINHTTP_AUTOPROXY_OPTIONS proxy_options;
+       WINHTTP_CURRENT_USER_IE_PROXY_CONFIG ie_proxy_info;
+
+       WinHttpGetDefaultProxyConfiguration (&proxy_info);
+       WinHttpGetIEProxyConfigForCurrentUser (&ie_proxy_info);
+       WinHttpDetectAutoProxyConfigUrl (WINHTTP_AUTO_DETECT_TYPE_DHCP | WINHTTP_AUTO_DETECT_TYPE_DNS_A, url);
+       session = WinHttpOpen (NULL, WINHTTP_ACCESS_TYPE_NO_PROXY, WINHTTP_NO_PROXY_NAME, WINHTTP_NO_PROXY_BYPASS, 0);
+       WinHttpGetProxyForUrl (session, L"http://openvpn.net";, &proxy_options, &proxy_info);
+       WinHttpCloseHandle (session);
+     ], [
+       AC_MSG_RESULT([yes])
+       OPENVPN_ADD_LIBS(-lwinhttp)
+       AC_DEFINE([HAVE_WINHTTP], [1], [WinHTTP is available in MinGW])
+     ], [
+       AC_MSG_RESULT([no])
+       AM_CONDITIONAL([BUILD_WINHTTP_IMPLIB], [true])
+       AC_MSG_NOTICE([Compiling own WinHTTP import library.])
+       AC_CHECK_TOOL([DLLTOOL], [dlltool])
+       if test -z "$DLLTOOL"; then
+         AC_MSG_ERROR([Could not find dlltool. Make sure you have binutils for Windows.])
+       fi
+     ])
+fi
+
+dnl
 dnl check for LZO library
 dnl
 
@@ -920,6 +972,7 @@ AC_SUBST(TAP_WIN32_MIN_MINOR)
 win32datadir="\${datadir}/${PACKAGE}-win32"
 AC_SUBST(win32datadir)
 AM_CONDITIONAL(WIN32, test "${WIN32}" = "yes")
+AM_CONDITIONAL(WIN64, test "${WIN64}" = "yes")
 
 # workaround for <autoconf-2.60
 if test -z "${docdir}"; then
diff --git a/win32.c b/win32.c
index cf6cc2d..9f150e9 100644
--- a/win32.c
+++ b/win32.c
@@ -1128,4 +1128,6 @@ win_get_tempdir()
   }
   return tmpdir;
 }
+
+
 #endif
diff --git a/win32.h b/win32.h
index 87d8ecc..f1cc78e 100644
--- a/win32.h
+++ b/win32.h
@@ -288,5 +288,70 @@ int inet_pton(int af, const char *src, void *st);
 /* Find temporary directory */
 const char *win_get_tempdir();
 
+/*
+ * If MinGW does not know about the WinHTTP C API functions and
+ * constants that are used for automatic proxy server detection
+ * they are declared here. For detailed information see:
+ * http://msdn.microsoft.com/en-us/library/aa384252%28v=VS.85%29.aspx
+ */
+#ifdef HAVE_WINHTTP
+
+#include <winhttp.h>
+
+#else /* HAVE_WINHTTP */
+
+#include <windows.h>
+#include <wininet.h>
+
+/* WINHTTP_PROXY_INFO dwAccessType constants */
+/* and WinHttpOpen() access_type             */
+#define WINHTTP_ACCESS_TYPE_NO_PROXY     1
+#define WINHTTP_ACCESS_TYPE_NAMED_PROXY  3
+
+/* WinHttpDetectAutoProxyConfigUrl() flags */
+#define WINHTTP_AUTO_DETECT_TYPE_DHCP   1
+#define WINHTTP_AUTO_DETECT_TYPE_DNS_A  2
+
+/* WINHTTP_AUTOPROXY_OPTIONS dwFlags */
+#define WINHTTP_AUTOPROXY_CONFIG_URL   2
+
+/* WinHttpOpen() proxy and bypass values */
+#define WINHTTP_NO_PROXY_NAME    0
+#define WINHTTP_NO_PROXY_BYPASS  0
+
+typedef struct {
+  DWORD  dwAccessType;
+  LPWSTR lpszProxy;
+  LPWSTR lpszProxyBypass;
+} WINHTTP_PROXY_INFO;
+
+typedef struct {
+  BOOL   fAutoDetect;
+  LPWSTR lpszAutoConfigUrl;
+  LPWSTR lpszProxy;
+  LPWSTR lpszProxyBypass;
+} WINHTTP_CURRENT_USER_IE_PROXY_CONFIG;
+
+typedef struct {
+  DWORD   dwFlags;
+  DWORD   dwAutoDetectFlags;
+  LPCWSTR lpszAutoConfigUrl;
+  LPVOID  lpvReserved;
+  DWORD   dwReserved;
+  BOOL    fAutoLogonIfChallenged;
+} WINHTTP_AUTOPROXY_OPTIONS;
+
+HINTERNET WINAPI WinHttpOpen (LPCWSTR user_agent, DWORD access_type,
+		       LPCWSTR proxy, LPCWSTR bypass, DWORD flags);
+BOOL WINAPI WinHttpCloseHandle (HINTERNET session);
+BOOL WINAPI WinHttpGetDefaultProxyConfiguration (WINHTTP_PROXY_INFO *proxy_info);
+BOOL WINAPI WinHttpGetIEProxyConfigForCurrentUser (WINHTTP_CURRENT_USER_IE_PROXY_CONFIG *proxy_config);
+BOOL WINAPI WinHttpDetectAutoProxyConfigUrl (DWORD flags, LPWSTR *url);
+BOOL WINAPI WinHttpGetProxyForUrl (HINTERNET session, LPCWSTR url,
+			    WINHTTP_AUTOPROXY_OPTIONS *options,
+			    WINHTTP_PROXY_INFO *proxy_info);
+
+#endif /* HAVE_WINHTTP */
+
 #endif
 #endif
diff --git a/winhttp32.def b/winhttp32.def
new file mode 100644
index 0000000..4be9274
--- /dev/null
+++ b/winhttp32.def
@@ -0,0 +1,8 @@
+LIBRARY "WINHTTP.dll"
+EXPORTS
+WinHttpCloseHandle@...
+WinHttpDetectAutoProxyConfigUrl@...
+WinHttpGetDefaultProxyConfiguration@...
+WinHttpGetIEProxyConfigForCurrentUser@...
+WinHttpGetProxyForUrl@...
+WinHttpOpen@...
diff --git a/winhttp64.def b/winhttp64.def
new file mode 100644
index 0000000..dd8cc9b
--- /dev/null
+++ b/winhttp64.def
@@ -0,0 +1,8 @@
+LIBRARY "WINHTTP.dll"
+EXPORTS
+WinHttpCloseHandle
+WinHttpDetectAutoProxyConfigUrl
+WinHttpGetDefaultProxyConfiguration
+WinHttpGetIEProxyConfigForCurrentUser
+WinHttpGetProxyForUrl
+WinHttpOpen
-- 
1.7.5.4

Re: [Openvpn-devel] Snapshot openvpn-2.x-20110909-master-install.exe fails

[Samuli Seppänen <samuli@op...>]

> Current snapshot openvpn-2.x-20110909-master-install.exe.
> openvpngui fails with "no entry inet_ntop found in ws2_32.dll library'
> on windows xp
Hmm, this one rings a bell - I recall it having caused compile-time
errors, too. I'll try to reproduce it a.s.a.p.

Krashan: how can I reproduce this? Is trying to connect to an OpenVPN
server enough?

-- 
Samuli Seppänen
Community Manager
OpenVPN Technologies, Inc

irc freenode net: mattock

Re: [Openvpn-devel] First Windows snapshot installer of "master" branch now available

[David Sommerseth <openvpn.list@to...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 13/09/11 12:02, Krashan Brahmanjara wrote:
> Can you release also version compatibile with Windows XP
> and patches from thres "PATCH 0/3] better --auto-proxy support for Windows"?
> 

Those patches have not been accepted yet.  They are under review and if I
understood things correctly, there will be done some changes to those patches:

  <http://thread.gmane.org/gmane.network.openvpn.devel/4974/focus=4979>;

When the patches have been ACKed properly, they will be applied to the
master branch, and then a new snapshot will contain these updates.


kind regards,

David Sommerseth
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk5vbqUACgkQDC186MBRfrr0PACeM6YIshWod7LAdIp80MkBx+i+
pXoAn3hYqLqd8DknpcIdSOZs795IYoZ/
=AzNw
-----END PGP SIGNATURE-----

Re: [Openvpn-devel] First Windows snapshot installer of "master" branch now available

[Krashan Brahmanjara <krokodylowy3@wp...>]

Can you release also version compatibile with Windows XP
and patches from thres "PATCH 0/3] better --auto-proxy support for Windows"?

[Openvpn-devel] Snapshot openvpn-2.x-20110909-master-install.exe fails

[Krashan Brahmanjara <krokodylowy3@wp...>]

Current snapshot openvpn-2.x-20110909-master-install.exe.
openvpngui fails with "no entry inet_ntop found in ws2_32.dll library'
on windows xp

Re: [Openvpn-devel] [PATCH 0/3] better --auto-proxy support for Windows

[Krashan Brahmanjara <krokodylowy3@wp...>]

>On Wednesday 17 August 2011 16:07:42 Alon Bar-Lev wrote:
>> How do you configure Internet Explorer proxy detection for local system
>> account? Or... alternatively you need to create a user for openvpn
>> service, login, execute IE, set whatever.
>> Quite difficult for unattended setup.
>> Well, maybe find places in registry where IE stores the settings...

>I don't think that's a problem. If no IE proxy configuration can be fetched, 
>the default config set with proxycfg will be used. And besides that there's 
>still the option to manually configure proxy settings in openvpn directly for 
>such setups.

>Heiko

At this moment main problem is invalid proxy search sequence.
I'm in network with high protection policy. Proxy got password and IE settings are available but password is not visible. Only proxycfg data are visible and Firefox problablu use them with success.

So in auto-proxy mode proxycfg setting should be checked before IE settings. 

Re: [Openvpn-devel] First Windows snapshot installer of "master" branch now available

[David Sommerseth <openvpn.list@to...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 09/09/11 11:34, Samuli Seppänen wrote:
> Hi all,
> 
> The first Windows snapshot installer based on current "master" branch is
> now available:
> 
> <http://build.openvpn.net/downloads/snapshots/openvpn-2.x-20110909-master-install.exe>;
> 
> There are lots of changes compared to OpenVPN 2.2.1, including IPv6
> support and a new GUI. Perhaps somebody else could provide a more
> through list of changes using some Git magic?

The development we're doing on the master branch is what will come in the
future v2.3 release.  Complete IPv6 support is definitely the biggest
change since v2.2.  However, there are more things added as well:

* Getting up-to-sync with the latest OpenVPN AS
The OpenVPN version in OpenVPN AS has diverged a bit from the community
version, and new features have been added to the AS version.  We should now
be synced with all the features James Yonan have put into AS.  Some key
points from this merge are:

  - Added "management-external-key" option.
  - Added --x509-track option.
  - Added --management-up-down option
  - Added "client-nat" option for stateless, one-to-one NAT
  - Extended "client-kill" management interface command (server-side)
  - Added "auth-token" client directive
  - Added 'dir' flag to "crl-verify"
  - Added new "extra-certs" and "verify-hash" options
  - Added --enable-lzo-stub ./configure option
  - Added optional journal directory argument to "port-share" directive
  - Added redirect-gateway block-local flag
  - Added "management-query-remote" directive (client)
  - Added username to "status" management interface command

* A new plug-in API
This is the v3 API, which provides a more dynamic approach for plug-ins.
The new function API is designed so that the function calls should not need
to change much more from now on.  This API passes over structs which
contains the same information as the former APIs, but will in addition
during TLS certificate authentications provide a pointer to the complete
X509 based SSL certificate.

* Add extv3 X509 field support to --x509-username-field

* Provide 'dev_type' environment variable to plug-ins and script hooks

* common_name passing in auth_pam plugin

* Several build issues have been fixed

* Plenty of bug fixes

* Several man page updates, adding missing information or fixing errors

* Most of the source code is now document, using Doxygen

And there's probably more things I've forgotten, deliberately ignored or
simply overlooked when looking through the commit history.

What we're putting effort to now is to modularise the SSL layer and add a
compile-time switch to use PolarSSL as a replacement to OpenSSL.  OpenSSL
will be the default.  Hopefully this will make it easier for others wanting
to use other SSL implementations than OpenSSL or PolarSSL, as crypto and
SSL is now more clearly separated.

There are also more patches in the queue, but that is less visible changes
than what's listed here.

Even though we have achieved a lot, and 17 different people (if I've
counted correctly) have gotten their patches applied - we still have a lot
more to do.  So if you want to get involved, changing OpenVPN, please get
in touch!  If you don't know where to start, please have a look at our bug
tracker:

   <https://community.openvpn.net/openvpn/report/3>;

And if you don't feel like writing docs or code, please test our snapshots
as much as possible and please provide feedback - good or bad.


kind regards,

David Sommerseth
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk5qAzsACgkQDC186MBRfrrBIgCfcBc/EvGQm3XJqc6983Y9MrUK
P5cAnRT6TZQhuYLgUGqK0ZCbVY6EB+KE
=/7a5
-----END PGP SIGNATURE-----

[Openvpn-devel] First Windows snapshot installer of "master" branch now available

[Samuli Seppänen <samuli@op...>]

Hi all,

The first Windows snapshot installer based on current "master" branch is
now available:

<http://build.openvpn.net/downloads/snapshots/openvpn-2.x-20110909-master-install.exe>;

There are lots of changes compared to OpenVPN 2.2.1, including IPv6
support and a new GUI. Perhaps somebody else could provide a more
through list of changes using some Git magic?

This installer also contains signed TAP-drivers (from 2.2.1), so it
should install without any trickery on Windows Vista and later. Please
note that this installer has been tested only briefly and while it
_seems_ to work ok on Windows 7 64-bit, it may still have issues. If you
have any issues with the installer, OpenVPN or the new GUI, please let
us know.

-- 
Samuli Seppänen
Community Manager
OpenVPN Technologies, Inc

irc freenode net: mattock


PS. Future snapshots will also be available as Debian, Ubuntu and
hopefully Fedora/RHEL packages, too. There are already apt repositories
available for the stable releases:

<https://community.openvpn.net/openvpn/wiki/OpenvpnAptRepos>;

[Openvpn-devel] Summary of the IRC meeting / sprint (8th Sep 2011)

[Samuli Seppänen <samuli@op...>]

Hi,

Here's the summary of the previous IRC meeting / sprint.

---

COMMUNITY MEETING

Place: #openvpn-devel on irc.freenode.net
Date: Thursday 8th Sep 2011
Time: 18:00 UTC

Planned meeting topics for this meeting were on this page:

<https://community.openvpn.net/openvpn/wiki/Topics-2011-09-08>;

Next meeting will be announced in advance, but will probably be on the same
weekday and at the same time. Your local meeting time is easy to check
from services such as

<http://www.timeanddate.com/worldclock>;

or with

$ date -u


SUMMARY

andj, d457k, krzee, jamesyonan, mattock and uuuppz participated in
this meeting.

--

Discussed the "Fix warnings in event.c when building for win32-64" patch:

<http://thread.gmane.org/gmane.network.openvpn.devel/4941>;

Although %p is not a standard printf feature, this patch only affects
Windows where %p is guaranteed to be available. Therefore jamesyonan and
andj gave this patch an ACK.  For further details, see:

<http://stackoverflow.com/questions/2369541/where-is-p-useful-with-printf>;

--

Discussed the "Remove wrapper code for Windows CryptoAPI function" patch:

<http://thread.gmane.org/gmane.network.openvpn.devel/4937>;

Jamesyonan gave this patch an ACK.

--

Discussed the "Better --auto-proxy support for Windows" patchset:

<http://thread.gmane.org/gmane.network.openvpn.devel/4927>;

Suggested the following modifications:

Patch [1/3]: Add MinGW WinHTTP compatibility layer

- Make use of import libraries:
<http://www.mingw.org/wiki/CreateImportLibraries>;

Patch [2/3]: Do automatic proxy detection on Windows right...
Patch [3/3]: Query auto-proxy information when connecting...

- Verify that these patches play well with existing functionality:
  - PROXY queries from the management interface
  - http-proxy-fallback option
  - http-proxy-override option

--

Discussed Adriaan's (andj's) PolarSSL patches. All remaining "SSL
library separation" patches were reviewed and ACKed. The full status of
the PolarSSL patchset before and after the meeting:

<https://community.openvpn.net/openvpn/wiki/PolarSSLintegration?version=54>;
<https://community.openvpn.net/openvpn/wiki/PolarSSLintegration?version=60>;

If you have any comments regarding any of the patches (or ACKs) please
chime in. If there are no complaints, the ACKed patches will be merged
to the main Git repository soon.

It will probably take 1-2 IRC sprints to go through the remaining
PolarSSL patches.

---

Full chatlog as an attachment

-- 
Samuli Seppänen
Community Manager
OpenVPN Technologies, Inc

irc freenode net: mattock

[Openvpn-devel] Topics for today's meeting

[Samuli Seppänen <samuli@op...>]

Hi,

We're having an IRC meeting today, starting at 18:00 UTC on
#openvpn-devel@... Current topic list is here:

<https://community.openvpn.net/openvpn/wiki/Topics-2011-09-08>;

If you have any other things you'd like to bring up, respond to this
mail, send me mail privately or add them to the list yourself.

In case you can't attend the meeting, please feel free to make comments
on the topics by responding to this email or to the summary email sent
after the meeting.

NOTE: It's required to use a registered Freenode IRC nickname to join
#openvpn-devel - look here for details:

<https://community.openvpn.net/openvpn/wiki/GettingHelp#DeveloperIRCchannel>;

-- 
Samuli Seppänen
Community Manager
OpenVPN Technologies, Inc

irc freenode net: mattock

[Openvpn-devel] Does OpenVPN get IP_PKTINFO in the correct manner?

[Yang Zhe <yangzhe1990@gm...>]

Let's say openvpn 2.2.0

In function link_socket_read_udp_posix_recvmsg() writes:

     struct cmsghdr *cmsg;
     fromlen = mesg.msg_namelen;
     cmsg = CMSG_FIRSTHDR (&mesg);
     if (cmsg != NULL
         && CMSG_NXTHDR (&mesg, cmsg) == NULL
#ifdef IP_PKTINFO
         && cmsg->cmsg_level == SOL_IP
         && cmsg->cmsg_type == IP_PKTINFO
#elif defined(IP_RECVDSTADDR)
         && cmsg->cmsg_level == IPPROTO_IP
         && cmsg->cmsg_type == IP_RECVDSTADDR
#else
#error ENABLE_IP_PKTINFO is set without IP_PKTINFO xor IP_RECVDSTADDR (fix
syshead.h)
#endif
         && cmsg->cmsg_len >= sizeof (struct openvpn_in4_pktinfo))
       {
#ifdef IP_PKTINFO
         struct in_pktinfo *pkti = (struct in_pktinfo *) CMSG_DATA (cmsg);
         from->pi.in4.ipi_ifindex = pkti->ipi_ifindex;
         from->pi.in4.ipi_spec_dst = pkti->ipi_spec_dst;
#elif defined(IP_RECVDSTADDR)
         from->pi.in4 = *(struct in_addr*) CMSG_DATA (cmsg);
#else
#error ENABLE_IP_PKTINFO is set without IP_PKTINFO xor IP_RECVDSTADDR (fix
syshead.h)
#endif
       }

I looked up manpages and other web resources, normally they iterated in the
cmsghdr list then find the required information by

for (cmsg = CMSG_FIRSTHDR(&mesg); cmsg; cmsg = CMSG_NXTHDR(&mesg, cmsg))
  if (cmsg->cmsg_level == SOL_IP && cmsg->cmsg_type == IP_PKTINFO
      && ... ) {
  }

In the openvpn's code, it only examine the FIRSTHDR, and assuming CMSG_NXTHDR =
NULL, which is odd.

Anybody get "--multihome" worked?

-- 
Sincerely,
    Yang Zhe

Re: [Openvpn-devel] [PATCH-UPDATE] define IN6_ARE_ADDR_EQUAL macro for WIN32

[Gert Doering <gert@gr...>]

Hi,

On Wed, Aug 31, 2011 at 02:49:22PM +0000, Heiko Hund wrote:
> Windows headers do not define the IN6_ARE_ADDR_EQUAL macro. It needs
> to be defined locally when building for WIN32.
> 
> Signed-off-by: Heiko Hund <heiko.hund@...>
> 
> Update: remove check for USE_PF_INET6 since commit
> eb23089183745853fac9414d45a559a478ef51d6 removed the definition
> of this macro. IPv6 is now always compiled in.

ACK.

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert@...
fax: +49-89-35655025                        gert@...

[Openvpn-devel] script to rename a network node.

[Jeff Sadowski <jeff.sadowski@gm...>]

I was looking for a scripted way to rename the tap network node to
make it easier for installing my clients.
Attached is the batch file I used to rename my network node. I still
have to answer yes to two questions but that is much easier to
instruct someone to do.
This was tested on Windows 7 it should work on older versions of
windows (with XP it should work even better) but I haven't tried it
yet.
Basically what this script does is as follows
it dumps the content of
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}
and looks for the "TAP-Win32 Adapter V9" DriverDesc and matches it up
with its NetCfgInstanceId
It then creates a reg file that modifies the
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\[NetCfgInstanceId]\Connection\Name
registry entry to the name you have in the client.ovpn config file.

Could Microsoft have picked a more obscure naming convention?

[Openvpn-devel] Summary of the IRC meeting / sprint (1st Sep 2011)

[Samuli Seppänen <samuli@op...>]

Hi,

Here's the summary of the previous IRC meeting / sprint.

---

COMMUNITY MEETING

Place: #openvpn-devel on irc.freenode.net
Date: Thursday 1st Sep 2011
Time: 18:00 UTC

Planned meeting topics for this meeting were on this page:

<https://community.openvpn.net/openvpn/wiki/Topics-2011-09-01>;

Next meeting will be announced in advance, but will probably be on the same
weekday and at the same time. Your local meeting time is easy to check
from services such as

<http://www.timeanddate.com/worldclock>;

or with

$ date -u


SUMMARY

andj, cron2, dazo, krzee, mattock and novaflash participated in
this meeting.

--

This meeting was mostly a sprint, where Adriaan's (andj's) PolarSSL
patches were reviewed, fixed and ACKed on the fly. The sprint focused on
the "SSL library separation" patchset. This is the status of these
patches before and after the meeting:

<https://community.openvpn.net/openvpn/wiki/PolarSSLintegration?version=45#SSLlibraryseparation>;
<https://community.openvpn.net/openvpn/wiki/PolarSSLintegration?version=54#SSLlibraryseparation>;

If you have any comments regarding any of the patches (or ACKs) please
chime in. If there are no complaints, the ACKed patches will be merged
to the main Git repository soon.

It will probably take 2-3 IRC sprints to go through the remaining
PolarSSL patches.

---

Full chatlog as an attachment

-- 
Samuli Seppänen
Community Manager
OpenVPN Technologies, Inc

irc freenode net: mattock

Re: [Openvpn-devel] [PATCH 3/4] Win32: Fill "Details" properties for openvpn.exe

[Heiko Hund <heiko.hund@so...>]

On Sunday 07 August 2011 12:59:16 Bertrand Jacquin wrote:
> @@ -161,6 +168,11 @@ dist_noinst_DATA += openvpn.8
>  nodist_html_DATA = openvpn.8.html
>  openvpn.8.html: $(srcdir)/openvpn.8
>  	$(MAN2HTML) < $(srcdir)/openvpn.8 > openvpn.8.html
> +
> +comma = ,
> +
> +%.o: %.rc
> +	$(WINDRES) -D _VERSION_=$(subst .,$(comma),$(VERSION)),0 -i $< -o $@
>  else
>  dist_man_MANS = openvpn.8
>  endif

This will at least break compilation on master where 

	#define VERSION "2.x-master"

_VERSION_ needs needs to be stricly numerical. Maybe we could define a 
WINDOWS_VERSION a,b,c,0 in version.m4 for this. Or even have separate major, 
minor and patch version definitions in there that could be used to build the 
versions in the .rc file itself.

Heiko
-- 
Heiko Hund | Software Engineer | Phone +49-721-25516-237 | Fax -200
Astaro a Sophos Company | Amalienbadstr. 41 Bau 52 | 76227 Karlsruhe | Germany
Commercial Register: Mannheim HRA 702710 | Headquarter Location: Karlsruhe
 
Represented by the General Partner Astaro Verwaltungs GmbH
Amalienbadstraße 41 Bau 52 | 76227 Karlsruhe | Germany 
Commercial Register: Mannheim HRB 708248 | Executive Board: Gert Hansen,
Markus Hennig, Jan Hichert, Günter Junk, Dr. Frank Nellissen

Re: [Openvpn-devel] [PATCH 1/4] WIN32: Check for windres tool

[Heiko Hund <heiko.hund@so...>]

On Sunday 07 August 2011 12:59:14 Bertrand Jacquin wrote:
> +	AC_CHECK_TOOL(WINDRES, windres)

The values should be quoted in square brackets besides that ACK.

Heiko
-- 
Heiko Hund | Software Engineer | Phone +49-721-25516-237 | Fax -200
Astaro a Sophos Company | Amalienbadstr. 41 Bau 52 | 76227 Karlsruhe | Germany
Commercial Register: Mannheim HRA 702710 | Headquarter Location: Karlsruhe
 
Represented by the General Partner Astaro Verwaltungs GmbH
Amalienbadstraße 41 Bau 52 | 76227 Karlsruhe | Germany 
Commercial Register: Mannheim HRB 708248 | Executive Board: Gert Hansen,
Markus Hennig, Jan Hichert, Günter Junk, Dr. Frank Nellissen

[Openvpn-devel] Topics for today's meeting

[Samuli Seppänen <samuli@op...>]

Hi,

We're having an IRC meeting today, starting at 18:00 UTC on
#openvpn-devel@... Current topic list is here:

<https://community.openvpn.net/openvpn/wiki/Topics-2011-09-01>;

If you have any other things you'd like to bring up, respond to this
mail, send me mail privately or add them to the list yourself.

In case you can't attend the meeting, please feel free to make comments
on the topics by responding to this email or to the summary email sent
after the meeting.

NOTE: It's required to use a registered Freenode IRC nickname to join
#openvpn-devel - look here for details:

<https://community.openvpn.net/openvpn/wiki/GettingHelp#DeveloperIRCchannel>;

-- 
Samuli Seppänen
Community Manager
OpenVPN Technologies, Inc

irc freenode net: mattock