From: chantra In-Reply-To: <4E14B584.9040905@...515...> References: <1CED409804E2164C8104F9E623B08B901269D8E391@...1436...> <4E14B584.9040905@...515...> Content-Type: multipart/alternative; boundary="=-IYIkY049vQTOoKhUNCzU" Date: Thu, 07 Jul 2011 01:08:09 +0200 Message-ID: <1309993689.2862.60.camel@...1471...> Mime-Version: 1.0 Subject: Re: [Openvpn-devel] PolarSSL patches List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Samuli =?ISO-8859-1?Q?Sepp=E4nen?= Cc: "openvpn-devel@lists.sourceforge.net" --=-IYIkY049vQTOoKhUNCzU Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Samuli,=20 You will need patch openvpn-plugin.h diff --git a/openvpn-plugin.h b/openvpn-plugin.h index 9cce9d8..529a1c6 100644 --- a/openvpn-plugin.h +++ b/openvpn-plugin.h @@ -25,12 +25,8 @@ #ifndef OPENVPN_PLUGIN_H_ #define OPENVPN_PLUGIN_H_ =20 -#ifdef USE_OPENSSL -#include "ssl_verify_openssl.h" -#endif -#ifdef USE_POLARSSL -#include "ssl_verify_polarssl.h" -#endif +struct x509_cert; +typedef struct x509_cert x509_cert_t; That will get the plugin to compile, but will break when using openssl. I believe the plugins should not need to know if openvpn uses polarssl or openssl... that might meant that openvpn will need to provide a generic x509 cert library to be used by openvpn plugins. chantra On Wed, 2011-07-06 at 12:20 -0700, Samuli Sepp=C3=A4nen wrote: > Hi Adriaan, >=20 > I tried building your tree on Debian 5 (amd64) VM and got this error: >=20 > #make plugins > /usr/bin/make -C plugin/auth-pam/ > make[1]: Entering directory > `/home/buildslave/andj-openvpn-ssl-refactoring-4970f14/plugin/auth-pam' > gcc -O2 -Wall -DDLOPEN_PAM=3D0 -fPIC -c -I../.. auth-pam.c > In file included from auth-pam.c:49: > ../../openvpn-plugin.h:283: error: expected specifier-qualifier-list > before =E2=80=98x509_cert_t=E2=80=99 > make[1]: *** [auth-pam.o] Error 1 > make[1]: Leaving directory > `/home/buildslave/andj-openvpn-ssl-refactoring-4970f14/plugin/auth-pam' > make: *** [build-stamp] Error 2 >=20 > The same VM has been used to successfully build the official release > packages. >=20 > Samuli >=20 >=20 >=20 > > Hi everyone, > >=20 > >=20=20 > >=20 > > During last week=E2=80=99s meeting we decided to temporarily create a g= ithub > > tree for OpenVPN. It can be found at > > https://github.com/andj/openvpn-ssl-refactoring . The version found > > there is now ready for testing, and will (hopefully) be included in > > the 2.3 alpha versions. > >=20 > >=20=20 > >=20 > > Could interested parties please have a look and provide me with > > feedback (through IRC/e-mail?).=20 > >=20 > >=20=20 > >=20 > > Thanks! > >=20 > >=20=20 > >=20 > > Adriaan de Jong > >=20 > >=20=20 > >=20 > > PS. Note that due to limitations in PolarSSL, it is still missing a > > number of features: > >=20 > >=20=20 > >=20 > > * PKCS#12 file support > >=20 > > * --capath support - Loading certificate authorities from a > > directory > >=20 > > * Windows CryptoAPI support > >=20 > > * Management external key support > >=20 > > * X.509 alternative username fields (must be "CN") > >=20 > >=20=20 > >=20 > > Plugin/Script features: > >=20 > >=20=20 > >=20 > > * X.509 Serial number is in hex, not decimal as with OpenSSL > >=20 > > * X.509 subject line has a different format than the OpenSSL > > subject line > >=20 > > * X.509 certificate export does not work > >=20 > > * X.509 certificate tracking > >=20 > >=20=20 > >=20 > > Fox-IT ...for a more secure society=20 > >=20 > > I www.fox-it.com > >=20 > >=20 > >=20 > >=20=20 > >=20 > >=20 >=20 >=20 >=20 > -------------------------------------------------------------------------= ----- > All of the data generated in your IT infrastructure is seriously valuable. > Why? It contains a definitive record of application performance, security= =20 > threats, fraudulent activity, and more. Splunk takes this data and makes= =20 > sense of it. IT sense. And common sense. > http://p.sf.net/sfu/splunk-d2d-c2 > _______________________________________________ Openvpn-devel mailing lis= t Openvpn-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/l= istinfo/openvpn-devel --=20 http://www.debuntu.org --=-IYIkY049vQTOoKhUNCzU Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: 7bit Samuli,

You will need patch openvpn-plugin.h

diff --git a/openvpn-plugin.h b/openvpn-plugin.h
index 9cce9d8..529a1c6 100644
--- a/openvpn-plugin.h
+++ b/openvpn-plugin.h
@@ -25,12 +25,8 @@
#ifndef OPENVPN_PLUGIN_H_
#define OPENVPN_PLUGIN_H_

-#ifdef USE_OPENSSL
-#include "ssl_verify_openssl.h"
-#endif
-#ifdef USE_POLARSSL
-#include "ssl_verify_polarssl.h"
-#endif
+struct x509_cert;
+typedef struct x509_cert x509_cert_t;

That will get the plugin to compile, but will break when using openssl.

I believe the plugins should not need to know if openvpn uses polarssl or openssl... that might meant that openvpn will need to provide a generic x509 cert library to be used by openvpn plugins.

chantra

On Wed, 2011-07-06 at 12:20 -0700, Samuli Seppänen wrote:
Hi Adriaan,

I tried building your tree on Debian 5 (amd64) VM and got this error:

#make plugins
/usr/bin/make -C plugin/auth-pam/
make[1]: Entering directory `/home/buildslave/andj-openvpn-ssl-refactoring-4970f14/plugin/auth-pam'
gcc -O2 -Wall -DDLOPEN_PAM=0 -fPIC -c -I../.. auth-pam.c
In file included from auth-pam.c:49:
../../openvpn-plugin.h:283: error: expected specifier-qualifier-list before ‘x509_cert_t’
make[1]: *** [auth-pam.o] Error 1
make[1]: Leaving directory `/home/buildslave/andj-openvpn-ssl-refactoring-4970f14/plugin/auth-pam'
make: *** [build-stamp] Error 2

The same VM has been used to successfully build the official release packages.

Samuli


Hi everyone,

 

During last week’s meeting we decided to temporarily create a github tree for OpenVPN. It can be found at https://github.com/andj/openvpn-ssl-refactoring . The version found there is now ready for testing, and will (hopefully) be included in the 2.3 alpha versions.

 

Could interested parties please have a look and provide me with feedback (through IRC/e-mail?).

 

Thanks!

 

Adriaan de Jong

 

PS. Note that due to limitations in PolarSSL, it is still missing a number of features:

 

 * PKCS#12 file support

 * --capath support - Loading certificate authorities from a directory

 * Windows CryptoAPI support

 * Management external key support

 * X.509 alternative username fields (must be "CN")

 

Plugin/Script features:

 

 * X.509 Serial number is in hex, not decimal as with OpenSSL

 * X.509 subject line has a different format than the OpenSSL subject line

 * X.509 certificate export does not work

 * X.509 certificate tracking

 

Fox-IT    ...for a more secure society

I www.fox-it.com



 



------------------------------------------------------------------------------
All of the data generated in your IT infrastructure is seriously valuable.
Why? It contains a definitive record of application performance, security 
threats, fraudulent activity, and more. Splunk takes this data and makes 
sense of it. IT sense. And common sense.
http://p.sf.net/sfu/splunk-d2d-c2
_______________________________________________ Openvpn-devel mailing list Openvpn-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-devel


-- 
http://www.debuntu.org
--=-IYIkY049vQTOoKhUNCzU--