Re: [Openvpn-devel] [PATCH] systemd: Enable systemd's auto-restart feature for server profiles

2017-09-06 Thread Gert Doering
Hi, On Thu, Sep 07, 2017 at 01:52:02AM +0200, David Sommerseth wrote: > @@ -18,6 +18,8 @@ DeviceAllow=/dev/net/tun rw > ProtectSystem=true > ProtectHome=true > KillMode=process > +RestartSec=5s > +Restart=on-failure Is there a way to get exponential backoff on restart? Restarting is good, but

Re: [Openvpn-devel] [PATCH] lz4: Move towards a newer LZ4 API

2017-09-06 Thread Gert Doering
HI, On Thu, Sep 07, 2017 at 04:28:27AM +0200, David Sommerseth wrote: > We are using a deprecated function, LZ4_compress_limitedOutput(), which > will be removed with time. The correct function to use is > LZ4_compress_default(). > Both function takes the same number of arguments and data types,

Re: [Openvpn-devel] [PATCH] lz4: Changing how LZ4 library handling is done

2017-09-06 Thread Gert Doering
Hi, On Thu, Sep 07, 2017 at 03:22:25AM +0200, David Sommerseth wrote: > This change will expect the system to have LZ4 libraries and headers > installed by default. We still carry a bundled LZ4 library, which > must now be explicitly enabled through providing --enable-bundled-lz4 > to ./configure

[Openvpn-devel] [PATCH] lz4: Move towards a newer LZ4 API

2017-09-06 Thread David Sommerseth
We are using a deprecated function, LZ4_compress_limitedOutput(), which will be removed with time. The correct function to use is LZ4_compress_default(). Both function takes the same number of arguments and data types, so the change is minimal. To ensure we still build without issues against old

Re: [Openvpn-devel] [PATCH] lz4: Changing how LZ4 library handling is done

2017-09-06 Thread Antonio Quartulli
On 07/09/17 09:22, David Sommerseth wrote: > This change will expect the system to have LZ4 libraries and headers > installed by default. We still carry a bundled LZ4 library, which > must now be explicitly enabled through providing --enable-bundled-lz4 > to ./configure. Otherwise, as before, -

[Openvpn-devel] [PATCH] lz4: Changing how LZ4 library handling is done

2017-09-06 Thread David Sommerseth
This change will expect the system to have LZ4 libraries and headers installed by default. We still carry a bundled LZ4 library, which must now be explicitly enabled through providing --enable-bundled-lz4 to ./configure. Otherwise, as before, --disable-lz4 will completely remove any LZ4 support.

[Openvpn-devel] [PATCH] systemd: Enable systemd's auto-restart feature for server profiles

2017-09-06 Thread David Sommerseth
Systemd supervises services it has started and can act upon unexpected scenarios. This change will restart OpenVPN after 5 seconds if the OpenVPN process exits unexpectedly. The on-failure mode is the recommended mode by upstream systemd. This change have been tested on a test server for some mo

[Openvpn-devel] [PATCH] systemd: Ensure systemd shuts down OpenVPN in a proper way

2017-09-06 Thread David Sommerseth
By default, when systemd is stopping OpenVPN it will send the SIGTERM to all processes within the same process control-group. This can come as a surprise to plug-ins which may have fork()ed out child processes. So we tell systemd to only send the SIGTERM signal to the main OpenVPN process and let

Re: [Openvpn-devel] [PATCH applied] Warn that DH config option is only meaningful in a tls-server context

2017-09-06 Thread David Sommerseth
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 ACK. Glared at code and tested a simple client config. Works as expected. I did one simple on-the-fly update, prefixing the message with 'WARNING: ', which is what we do other places where M_WARN is used. Your patch has been applied to the follow

Re: [Openvpn-devel] [PATCH applied] OpenSSL: Always set SSL_OP_CIPHER_SERVER_PREFERENCE flag

2017-09-06 Thread David Sommerseth
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Your patch has been applied to the following branches commit 5fd8e94d311825571931414064e4d13ed808f9b5 (master) commit a4c5c4bba4963ad107d6bf6eb5937a4cde6c1a0c (release/2.4) Author: Szilárd Pfeiffer Date: Mon Sep 4 10:10:12 2017 +0200 OpenS

Re: [Openvpn-devel] [PATCH applied] fragment.c: simplify boolean expression

2017-09-06 Thread David Sommerseth
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 ACK. Code change is just obvious. Your patch has been applied to the following branches commit 10ae9ed5fe7f09c7edb5af266149a9b5e9bcbaa4 (master) commit 14e4c58b6f903c562475379bb806e26c42d6a52e (release/2.4) Author: Antonio Quartulli Date: Thu

Re: [Openvpn-devel] [PATCH applied] docs: Replace all PolarSSL references to mbed TLS

2017-09-06 Thread David Sommerseth
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Thanks for the ACK. I did a quick on-the-fly update on top of this, to ensure our buildbots and Make in general wouldn't explode or complain. Makefile.am still referenced README.polarssl instead of README.mbedtls, so this is the only additional cha

Re: [Openvpn-devel] [PATCH applied] travis: reorder matrix to speed up build

2017-09-06 Thread David Sommerseth
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Your patch has been applied to the following branches commit e0a6afa12ea14685d0497ab27453ccc2b09e6e1f (master) commit cac73d4b93e14f3bd5a1ed11b33f73adb29507a3 (release/2.4) Author: Steffan Karger Date: Sun Aug 20 11:19:04 2017 +0200 travis

Re: [Openvpn-devel] [PATCH applied] man: Corrections to doc/openvpn.8

2017-09-06 Thread David Sommerseth
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 ACK. Thanks a lot for putting efforts into improving this. It will for sure make various distribution packagers happy, as this should remove several potential complaints from lint/sanity checkers. Plus it fixes a glaring and ugly typo for --verify

Re: [Openvpn-devel] [PATCH applied] fix a couple of typ0s in comments and strings

2017-09-06 Thread David Sommerseth
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 ACK. No real code change, so this is safe. Your patch has been applied to the following branches commit 42d9f324f7362abfb9b51b24ef0fb7635b0194fc (master) commit 010ffbed20bcb19c59aeb6e46ae76d93c08c67ea (release/2.4) Author: Antonio Quartulli Dat

Re: [Openvpn-devel] [PATCH applied] tls-crypt: don't leak memory for incorrect tls-crypt messages

2017-09-06 Thread David Sommerseth
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 ACK. This code looks good. Hard to trigger to fully test it, but it follows the usual coding paterns we have. Your patch has been applied to the following branches commit fca89379c53fe2c145db96a5bcd32327c4bcfa78 (master) commit db52b6df6915d38a2

Re: [Openvpn-devel] [PATCH applied] route: avoid definition of unused variables in certain configurations

2017-09-06 Thread David Sommerseth
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 ACK. Looks good to me, but I haven't tested on all kind of platforms so if buildbot explodes, we'll take it from there. Your patch has been applied to the following branches commit 22e75ca1a88b83e83a12b7d7d0095651f547411d (master) commit 3c4e2a39

Re: [Openvpn-devel] [PATCH] route: cleanup codestyle and make code more readable

2017-09-06 Thread David Sommerseth
On 23/08/17 07:30, Antonio Quartulli wrote: > This patch does not introduce any functional change. > > The code in route.c seems to have been written in different > periods by different people, without sticking to a clear > codestyle. For this reason the code in this file in not > consistent at al