Re: [Openvpn-devel] [PATCH (master)] Drop gnu89/c89 support, switch to c99

2016-08-30 Thread Jens Neuhalfen
Hi all, hopefully this message is not completely garbled by Apple Mail ... > > > […] > > Just some more benchmarks. I just compiled successfully with -std=c99 > on an old Scientific Linux 6.5 (RHEL 6.5 clone) I found. Another > important detail, RHEL5 will reach the "End of Production" phas

Re: [Openvpn-devel] Time to change the default cipher?

2016-08-30 Thread Jens Neuhalfen
Hi > On Mon, Aug 29, 2016 at 08:45:52PM +0200, Jan Just Keijser wrote: >> uhoh: https://sweet32.info/ >> >> shall we change the default cipher in the master tree to AES-256 (if not >> done so already) ? > > […] > OTOH, what we could do is: indeed *change+ the default, and add a big fat > wa

Re: [Openvpn-devel] Time to change the default cipher?

2016-08-30 Thread Steffan Karger
Hi, On 30 August 2016 at 09:01, Jens Neuhalfen wrote: >> OTOH, what we could do is: indeed *change+ the default, and add a big fat >> warning ("you have not specified a --cipher directive. The default has >> been changed from 2.3 to 2.4, so please ensure your config matches the >> other end" or

Re: [Openvpn-devel] Fixing non-standard PKCS#11 serialization format using a patched pkcs11-helper?

2016-08-30 Thread Samuli Seppänen
>> With that in mind, if shipping a patched pkcs11-helper in Windows >> makes your life easier I'd consider doing this. But step carefully, >> avoid getting in a situation where you suddenly have to maintain these >> patches yourself. Rather try to see what Fedora does and see if that >> can be

Re: [Openvpn-devel] Time to change the default cipher?

2016-08-30 Thread Arne Schwabe
Am 30.08.16 um 09:42 schrieb Steffan Karger: > Hi, > > On 30 August 2016 at 09:01, Jens Neuhalfen > wrote: >>> OTOH, what we could do is: indeed *change+ the default, and add a big fat >>> warning ("you have not specified a --cipher directive. The default has >>> been changed from 2.3 to 2.4,

Re: [Openvpn-devel] [PATCH (master)] Drop gnu89/c89 support, switch to c99

2016-08-30 Thread Steffan Karger
On 30 August 2016 at 00:41, David Sommerseth wrote: > Just some more benchmarks. I just compiled successfully with -std=c99 > on an old Scientific Linux 6.5 (RHEL 6.5 clone) I found. Another > important detail, RHEL5 will reach the "End of Production" phase March > 2017, OpenVPN have generally s

Re: [Openvpn-devel] [PATCH (master)] Drop gnu89/c89 support, switch to c99

2016-08-30 Thread Gert Doering
Hi, On Mon, Aug 29, 2016 at 11:03:00PM +0200, David Sommerseth wrote: > -std=c89 >Makes the LZ4 library we're shipping explode. We could fix that, but right now the LZ4 sources are "very close to upstream" (just a few file and #include renames) so that would make comparison "are these sane s

Re: [Openvpn-devel] Fixing non-standard PKCS#11 serialization format using a patched pkcs11-helper?

2016-08-30 Thread David Woodhouse
On Tue, 2016-08-30 at 11:11 +0300, Samuli Seppänen wrote: > > >> With that in mind, if shipping a patched pkcs11-helper in Windows > >> makes your life easier I'd consider doing this.  But step carefully, > >> avoid getting in a situation where you suddenly have to maintain these > >> patches your

Re: [Openvpn-devel] [PATCH v2] Drop recursively routed packets

2016-08-30 Thread Lev Stipakov
So, following changes are required for V3: 1) No drop_if_recursive() call for P2P 2) Same for TAP 3) Add an option to disable it Sounds reasonable? 2016-08-24 16:13 GMT+03:00 Gert Doering : > Hi, > > On Wed, Aug 24, 2016 at 10:12:54AM +0200, Jan Just Keijser wrote: > > may I suggest to make th

Re: [Openvpn-devel] Fixing non-standard PKCS#11 serialization format using a patched pkcs11-helper?

2016-08-30 Thread Gert Doering
Hi, On Tue, Aug 30, 2016 at 04:12:17PM +0100, David Woodhouse wrote: > I'm accumulating a torture test suite (which I expect OpenVPN to fail) at > http://git.infradead.org/users/dwmw2/openconnect.git/blob/HEAD:/tests/Makefile.am Torture test suites are good :-) - Steffan regularily tries to beat

Re: [Openvpn-devel] [PATCH v2] Drop recursively routed packets

2016-08-30 Thread Gert Doering
Hi, On Tue, Aug 30, 2016 at 09:59:52PM +0300, Lev Stipakov wrote: > So, following changes are required for V3: > > 1) No drop_if_recursive() call for P2P Well, sort of. It's useful in p2p mode as well, but it needs to check if we already know the remote address before trying to read via the poi