Re: [Openvpn-devel] [PATCH] Set SSL_OP_NO_TICKET flag in SSL context for OpenSSL builds, to disable TLS stateless session resumption.

2014-03-23 Thread Steffan Karger
Hi, On Sat, Mar 22, 2014 at 7:35 PM, Gert Doering wrote: > On Tue, Mar 18, 2014 at 05:40:41PM +0100, Steffan Karger wrote: > > > So it seems I spoke too soon... sorry for the noise, although I must > > > say that I'm still in favour of checking for the existence of an IFDEF > > > instead of rely

[Openvpn-devel] [PATCH 5/12 v2] Introduce an option to resolve dns names in advance for —remote, —local and http-proxy

2014-03-23 Thread Arne Schwabe
Also introduce x_gc_addspeical function that allows to add objects with a custom free function to the gc. Some additional addrinfo cleanup --- src/openvpn/buffer.c | 38 + src/openvpn/buffer.h | 28 +++- src/openvpn/init.c| 33 +++-- src/openvpn/manage.c | 18 ++- src/openvpn/open

Re: [Openvpn-devel] [PATCH] Set SSL_OP_NO_TICKET flag in SSL context for OpenSSL builds, to disable TLS stateless session resumption.

2014-03-23 Thread Gert Doering
Hi, On Sun, Mar 23, 2014 at 10:22:57AM +0100, Steffan Karger wrote: > ACK. Message looks correct and clear to me. Thanks. Committed and pushed as 2cf9d4e3f06f4a61cb6d159728ac6c8a790d6849. Can you send the needed patch for master/2.4? gert -- USENET is *not* the non-clickable part of WWW!

[Openvpn-devel] [PATCH applied] Re: Adjusted autotools files to build more cleanly on newer autoconf/automake versions

2014-03-23 Thread Gert Doering
Your patch has been applied to the master branch. commit fb69bfd05eef20547848f901bb66d394f64308a2 Author: David Sommerseth List-Post: openvpn-devel@lists.sourceforge.net Date: Wed Jan 15 17:36:04 2014 +0100 Adjusted autotools files to build more cleanly on newer autoconf/automake versions

Re: [Openvpn-devel] [PATCH] Set SSL_OP_NO_TICKET flag in SSL context for OpenSSL builds, to disable TLS stateless session resumption.

2014-03-23 Thread Steffan Karger
On Sun, Mar 23, 2014 at 1:26 PM, Gert Doering wrote: > On Sun, Mar 23, 2014 at 10:22:57AM +0100, Steffan Karger wrote: > > ACK. Message looks correct and clear to me. > > Thanks. Committed and pushed as 2cf9d4e3f06f4a61cb6d159728ac6c8a790d6849. > > Can you send the needed patch for master/2.4? >

Re: [Openvpn-devel] [PATCH 1/2] Add openssl-specific common cipher list names to ssl.c.

2014-03-23 Thread Arne Schwabe
On 01.03.2014 15:36, Steffan Karger wrote: This adds a number of commonly used cipher list names to ssl.c, which makes OpenVPN not give a "translation not found" warning when using these. ACK. Arne

Re: [Openvpn-devel] [PATCH 2/2] Disable unsupported TLS cipher modes by default, cleans --show-tls output.

2014-03-23 Thread Arne Schwabe
On 01.03.2014 15:36, Steffan Karger wrote: This explicitly disables a number of tls ciphers that OpenVPN has currently no support for. OpenSSL will automatically detect this during negotiation, but --show-tls would erroneously show a number of unsupported ciphers. ACK. Arne

[Openvpn-devel] [PATCH] Bump minimum OpenSSL version to 0.9.8

2014-03-23 Thread Steffan Karger
OpenSSL 0.9.7 and older are considered obsolete (see http://www.openssl.org/news/news.html). This patch updates configure.ac to require OpenSSL 0.9.8 or newer, and removes a number of #ifdefs that are now no longer needed. Signed-off-by: Steffan Karger --- configure.ac | 4 +

Re: [Openvpn-devel] [PATCH] Bump minimum OpenSSL version to 0.9.8

2014-03-23 Thread Arne Schwabe
On 23.03.2014 14:53, Steffan Karger wrote: OpenSSL 0.9.7 and older are considered obsolete (see http://www.openssl.org/news/news.html). This patch updates configure.ac to require OpenSSL 0.9.8 or newer, and removes a number of #ifdefs that are now no longer needed. ACK. Arne

[PATCH applied] Re: Introduce an option to resolve dns names in advance for —remote, —local and http-proxy

2014-03-23 Thread Gert Doering
ACK, with some whitespace fixes (undoing spurious changes, cleaning up others), and swapping the if/else branches in socket.c/do_preresolve_host() for easier readability (no functional change) as agreed on IRC. t_client tested OK (without --preresolve). Patch has been applied to the master branc

[Openvpn-devel] [PATCH applied] Re: Fix for server selecting address family

2014-03-23 Thread Gert Doering
I take this as "fixes fallout of the of the grand socket.c restructuring", so ACK, even if I won't claim to truly understand under which conditions this makes a difference. Patch has been applied to the master branch. commit 45184804c477aed2ae91ce23d6606da1bfccbaa7 Author: Arne Schwabe List-Post:

[PATCH applied] Re: Don’t show the connection profile store in options->ce if there is a connection_list defined.

2014-03-23 Thread Gert Doering
ACK. "Makes sense" :-) Your patch has been applied to the master branch. commit 98e24cc7e8ce3dafada43e46aef32a3d6a7a4f27 Author: Arne Schwabe List-Post: openvpn-devel@lists.sourceforge.net Date: Fri Mar 21 14:18:40 2014 +0100 Don't show the connection profile store in options->ce if there

[Openvpn-devel] [PATCH applied] Re: Add gateway and device to android control messages

2014-03-23 Thread Gert Doering
ACK, on the basis of "this is all happening inside #ifdef ANDROID, and from the description on IRC" (necessary to enable the GUI to properly exclude routes-to-eth0 by recognizing routes-to-eth0 in the first place, like the vpn gateway in the "redirect-gateway" case). Patch has been applied to the

[Openvpn-devel] [PATCH applied] Re: Bump minimum OpenSSL version to 0.9.8

2014-03-23 Thread Gert Doering
Your patch has been applied to the master branch. commit 69a6b0c388fe1f463ab59cc8e414a4c5c635ab79 Author: Steffan Karger List-Post: openvpn-devel@lists.sourceforge.net Date: Sun Mar 23 14:53:01 2014 +0100 Bump minimum OpenSSL version to 0.9.8 Signed-off-by: Steffan Karger Acked

[Openvpn-devel] [PATCH applied] Re: Add openssl-specific common cipher list names to ssl.c.

2014-03-23 Thread Gert Doering
Your patch has been applied to the master and release/2.3 branch. commit 0146fd00c3bd70a470290be7be27ee75db2db63b (master) commit a39ceebc4f7cf05f07941556c9d11430cf855e22 (master) Author: Steffan Karger List-Post: openvpn-devel@lists.sourceforge.net Date: Sat Mar 1 15:36:14 2014 +0100 Add

[Openvpn-devel] [PATCH applied] Re: Disable unsupported TLS cipher modes by default, cleans --show-tls output.

2014-03-23 Thread Gert Doering
Your patch has been applied to the master branch. commit f8c4e88280b060ee8aa77ac5d00133848689694b Author: Steffan Karger List-Post: openvpn-devel@lists.sourceforge.net Date: Sat Mar 1 15:36:15 2014 +0100 Disable unsupported TLS cipher modes by default, cleans --show-tls output. Signe

Re: [Openvpn-devel] [PATCH applied] Re: Add openssl-specific common cipher list names to ssl.c.

2014-03-23 Thread Gert Doering
Hi, On Sun, Mar 23, 2014 at 10:13:32PM +0100, Gert Doering wrote: > Your patch has been applied to the master and release/2.3 branch. > > commit 0146fd00c3bd70a470290be7be27ee75db2db63b (master) > commit a39ceebc4f7cf05f07941556c9d11430cf855e22 (master) The second line should, obviously, have be

[Openvpn-devel] [PATCH applied] Re: configure.ac: check for SSL_OP_NO_TICKET flag in OpenSSL

2014-03-23 Thread Gert Doering
ACK. Tested on my "normal" OpenSSL installation (OK) and by deliberately removing SSL_OP_NO_TICKET from openssl/ssl.h -> correct error message: .. checking for SSL_OP_NO_TICKET flag in OpenSSL... no configure: error: OpenVPN 2.4+ requires SSL_OP_NO_TICKET in OpenSSL Your patch has been appli