[Openvpn-devel] OpenVPN 2.1-rc5 released

[Openvpn-devel] OpenVPN 2.1-rc5 released

[James Yonan]

OpenVPN 2.1-rc5 is available, please test.  I would especially like 
feedback on the Windows TAP driver.  We've made some portability changes 
recently to the driver to allow it to run on Win2K through Vista in x86 
or x64 modes.

Download:

http://openvpn.net/beta/

File Signatures:

http://openvpn.net/signatures/

Here is the change log:

2008.01.23 -- Version 2.1_rc5

* Fixed Win2K TAP driver bug that was introduced by Vista fixes,
  incremented driver version to 9.4.

* Windows build system changes:

  Incremented included OpenSSL version to openssl-0.9.7m.

  Updated openssl.patch for openssl-0.9.7m and added some
  brief usage comments to the head of the patch.

  Added build-pkcs11-helper.sh for building the pkcs11-helper
  library.

  Integrated inclusion of pkcs11-helper into Windows build
  system.

  Upgraded TAP build scripts to use WDK 6001.17121
  (Windows 2008 Server pre-RTM).

* Windows installer changes:

  Clean up the start menu folder.

  Allow for a site-specific sample configuration file and keys
  to be included in a custom installer (see SAMPCONF macros
  in settings.in).

  New icon (temporary).

* Added "forget-passwords" command to the management interface
  (Alon Bar-Lev).

* Added --management-signal option to signal SIGUSR1 when the
  management interface disconnects (Alon Bar-Lev).

* Modified command line and config file parser to allow
  quoted strings using single quotes ('') (Alon Bar-Lev).

* Use pkcs11-helper as external library, can be downloaded from
  https://www.opensc-project.org/pkcs11-helper (Alon Bar-Lev).

* Fixed interim memory growth issue in TCP connect loop where
  "TCP: connect to %s failed, will try again in %d seconds: %s"
  is output.

* Fixed bug in epoll driver in event.c, where the lack of a
  handler for EPOLLHUP could cause 99% CPU usage.

* Defined ALLOW_NON_CBC_CIPHERS for people who don't
  want to use a CBC cipher for OpenVPN's data channel.

* Added PLUGIN_LIBDIR preprocessor string to prepend a default
  plugin directory to the dlopen search list when the user
  specifies the basename of the plugin only (Marius Tomaschewski).

* Rewrote extract_x509_field and modified COMMON_NAME_CHAR_CLASS
  to allow forward slash characters ("/") in the X509 common name
  (Pavel Shramov).

* Allow OpenVPN to run completely unprivileged under Linux
  by allowing openvpn --mktun to be used with --user and --group
  to set the UID/GID of the tun device node.  Also added --iproute
  option to allow an alternative command to be executed in place
  of the default iproute2 command (Alon Bar-Lev).

* Fixed --disable-iproute2 in ./configure to actually disable
  iproute2 usage (Alon Bar-Lev).

* Added --management-forget-disconnect option -- forget
  passwords when management session disconnects (Alon Bar-Lev).

James

Re: [Openvpn-devel] [Openvpn-users] OpenVPN 2.1-rc5 released

[Alon Bar-Lev]

All PKCS#11 users, please notice,
There was a major change in the parameters of PKCS#11, please refer to
the HOWTO:
http://openvpn.net/howto.html#pkcs11

Regards,
Alon Bar-Lev.

On 1/23/08, James Yonan <jim@...41...> wrote:
> OpenVPN 2.1-rc5 is available, please test.  I would especially like
> feedback on the Windows TAP driver.  We've made some portability changes
> recently to the driver to allow it to run on Win2K through Vista in x86
> or x64 modes.
>
> Download:
>
> http://openvpn.net/beta/
>
> File Signatures:
>
> http://openvpn.net/signatures/
>
> Here is the change log:
>
> 2008.01.23 -- Version 2.1_rc5
>
> * Fixed Win2K TAP driver bug that was introduced by Vista fixes,
>   incremented driver version to 9.4.
>
> * Windows build system changes:
>
>   Incremented included OpenSSL version to openssl-0.9.7m.
>
>   Updated openssl.patch for openssl-0.9.7m and added some
>   brief usage comments to the head of the patch.
>
>   Added build-pkcs11-helper.sh for building the pkcs11-helper
>   library.
>
>   Integrated inclusion of pkcs11-helper into Windows build
>   system.
>
>   Upgraded TAP build scripts to use WDK 6001.17121
>   (Windows 2008 Server pre-RTM).
>
> * Windows installer changes:
>
>   Clean up the start menu folder.
>
>   Allow for a site-specific sample configuration file and keys
>   to be included in a custom installer (see SAMPCONF macros
>   in settings.in).
>
>   New icon (temporary).
>
> * Added "forget-passwords" command to the management interface
>   (Alon Bar-Lev).
>
> * Added --management-signal option to signal SIGUSR1 when the
>   management interface disconnects (Alon Bar-Lev).
>
> * Modified command line and config file parser to allow
>   quoted strings using single quotes ('') (Alon Bar-Lev).
>
> * Use pkcs11-helper as external library, can be downloaded from
>   https://www.opensc-project.org/pkcs11-helper (Alon Bar-Lev).
>
> * Fixed interim memory growth issue in TCP connect loop where
>   "TCP: connect to %s failed, will try again in %d seconds: %s"
>   is output.
>
> * Fixed bug in epoll driver in event.c, where the lack of a
>   handler for EPOLLHUP could cause 99% CPU usage.
>
> * Defined ALLOW_NON_CBC_CIPHERS for people who don't
>   want to use a CBC cipher for OpenVPN's data channel.
>
> * Added PLUGIN_LIBDIR preprocessor string to prepend a default
>   plugin directory to the dlopen search list when the user
>   specifies the basename of the plugin only (Marius Tomaschewski).
>
> * Rewrote extract_x509_field and modified COMMON_NAME_CHAR_CLASS
>   to allow forward slash characters ("/") in the X509 common name
>   (Pavel Shramov).
>
> * Allow OpenVPN to run completely unprivileged under Linux
>   by allowing openvpn --mktun to be used with --user and --group
>   to set the UID/GID of the tun device node.  Also added --iproute
>   option to allow an alternative command to be executed in place
>   of the default iproute2 command (Alon Bar-Lev).
>
> * Fixed --disable-iproute2 in ./configure to actually disable
>   iproute2 usage (Alon Bar-Lev).
>
> * Added --management-forget-disconnect option -- forget
>   passwords when management session disconnects (Alon Bar-Lev).
>
> James
>
>
>
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2008.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> _______________________________________________
> Openvpn-users mailing list
> Openvpn-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/openvpn-users
>

Re: [Openvpn-devel] [Openvpn-users] OpenVPN 2.1-rc5 released

[@ 2008-01-23 23:21 UTC (permalink / raw)]

Hello Alon,

> True!
> Found it!

> Patch attached.

Please recompile for windows

I try to setup a toolchain for windows.

greetings
Carsten

Re: [Openvpn-devel] [Openvpn-users] OpenVPN 2.1-rc5 released

[@ 2008-01-24 1:18 UTC (permalink / raw)]

> I try to setup a toolchain for windows.

I build lzo-2.0.2 and openssl-0.9.7m (patched)

OPENSSL_DIR=~/openssl-0.9.7m
export OPENSSL_DIR

building openvpn didn't work (maybe it's only to late and I didn't see
an obvious thing)

Carsten@...1075... ~/openvpn-2.1_rc5
$ make -f makefile.w32
gcc -g -O2 -Wall -Wno-unused-function -Wno-unused-variable -mno-cygwin -I./openssl/include -I/include -I/include -c crypto.c -o crypto.o
In file included from crypto.c:35:
crypto.h:40:29: openssl/objects.h: No such file or directory
crypto.h:41:26: openssl/rand.h: No such file or directory
crypto.h:42:25: openssl/evp.h: No such file or directory
crypto.h:43:26: openssl/hmac.h: No such file or directory


greetings
Carsten

Re: [Openvpn-devel] [Openvpn-users] OpenVPN 2.1-rc5 released

[James Yonan]

Carsten Krüger wrote:
>> I try to setup a toolchain for windows.
>>     
>
> I build lzo-2.0.2 and openssl-0.9.7m (patched)
>
> OPENSSL_DIR=~/openssl-0.9.7m
> export OPENSSL_DIR
>
> building openvpn didn't work (maybe it's only to late and I didn't see
> an obvious thing)
>
> Carsten@...1075... ~/openvpn-2.1_rc5
> $ make -f makefile.w32
> gcc -g -O2 -Wall -Wno-unused-function -Wno-unused-variable -mno-cygwin -I./openssl/include -I/include -I/include -c crypto.c -o crypto.o
> In file included from crypto.c:35:
> crypto.h:40:29: openssl/objects.h: No such file or directory
> crypto.h:41:26: openssl/rand.h: No such file or directory
> crypto.h:42:25: openssl/evp.h: No such file or directory
> crypto.h:43:26: openssl/hmac.h: No such file or directory
>
>
>   

Use ./domake-win to build OpenVPN on Windows (see comments as well in 
this file).  Build settings are in install-win32/settings.in.

James

Re: [Openvpn-devel] [Openvpn-users] OpenVPN 2.1-rc5 released

[@ 2008-01-24 7:37 UTC (permalink / raw)]

Hello James,

> Use ./domake-win to build OpenVPN on Windows (see comments as well in

That file didn't exist in rc5, I found it in rc4.

greetings
Carsten

Re: [Openvpn-devel] [Openvpn-users] OpenVPN 2.1-rc5 released

[James Yonan]

2.1-rc5 has a minor pkcs11 option processing bug.  I've built 2.1-rc6 with the fix.

Download:

http://openvpn.net/beta/

James

James Yonan wrote:
> OpenVPN 2.1-rc5 is available, please test.  I would especially like 
> feedback on the Windows TAP driver.  We've made some portability changes 
> recently to the driver to allow it to run on Win2K through Vista in x86 
> or x64 modes.
>
> Download:
>
> http://openvpn.net/beta/
>
> File Signatures:
>
> http://openvpn.net/signatures/
>
> Here is the change log:
>
> 2008.01.23 -- Version 2.1_rc5
>
> * Fixed Win2K TAP driver bug that was introduced by Vista fixes,
>   incremented driver version to 9.4.
>
> * Windows build system changes:
>
>   Incremented included OpenSSL version to openssl-0.9.7m.
>
>   Updated openssl.patch for openssl-0.9.7m and added some
>   brief usage comments to the head of the patch.
>
>   Added build-pkcs11-helper.sh for building the pkcs11-helper
>   library.
>
>   Integrated inclusion of pkcs11-helper into Windows build
>   system.
>
>   Upgraded TAP build scripts to use WDK 6001.17121
>   (Windows 2008 Server pre-RTM).
>
> * Windows installer changes:
>
>   Clean up the start menu folder.
>
>   Allow for a site-specific sample configuration file and keys
>   to be included in a custom installer (see SAMPCONF macros
>   in settings.in).
>
>   New icon (temporary).
>
> * Added "forget-passwords" command to the management interface
>   (Alon Bar-Lev).
>
> * Added --management-signal option to signal SIGUSR1 when the
>   management interface disconnects (Alon Bar-Lev).
>
> * Modified command line and config file parser to allow
>   quoted strings using single quotes ('') (Alon Bar-Lev).
>
> * Use pkcs11-helper as external library, can be downloaded from
>   https://www.opensc-project.org/pkcs11-helper (Alon Bar-Lev).
>
> * Fixed interim memory growth issue in TCP connect loop where
>   "TCP: connect to %s failed, will try again in %d seconds: %s"
>   is output.
>
> * Fixed bug in epoll driver in event.c, where the lack of a
>   handler for EPOLLHUP could cause 99% CPU usage.
>
> * Defined ALLOW_NON_CBC_CIPHERS for people who don't
>   want to use a CBC cipher for OpenVPN's data channel.
>
> * Added PLUGIN_LIBDIR preprocessor string to prepend a default
>   plugin directory to the dlopen search list when the user
>   specifies the basename of the plugin only (Marius Tomaschewski).
>
> * Rewrote extract_x509_field and modified COMMON_NAME_CHAR_CLASS
>   to allow forward slash characters ("/") in the X509 common name
>   (Pavel Shramov).
>
> * Allow OpenVPN to run completely unprivileged under Linux
>   by allowing openvpn --mktun to be used with --user and --group
>   to set the UID/GID of the tun device node.  Also added --iproute
>   option to allow an alternative command to be executed in place
>   of the default iproute2 command (Alon Bar-Lev).
>
> * Fixed --disable-iproute2 in ./configure to actually disable
>   iproute2 usage (Alon Bar-Lev).
>
> * Added --management-forget-disconnect option -- forget
>   passwords when management session disconnects (Alon Bar-Lev).
>
> James
>
>
>
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2008.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> _______________________________________________
> Openvpn-users mailing list
> Openvpn-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/openvpn-users
>   

Re: [Openvpn-devel] [Openvpn-users] OpenVPN 2.1-rc5 released

[James Yonan]

Carsten Krüger wrote:
> Hello James,
>
>   
>> Use ./domake-win to build OpenVPN on Windows (see comments as well in
>>     
>
> That file didn't exist in rc5, I found it in rc4.
>
>   

The domake script exists in the subversion repository:

http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn

however I see that it was not making it into the tarball via make dist.  
I've committed a change that will fix this:  make dist will now build a 
tarball with all of the subversion files + the usual "autoreconf -i -v" 
generated files.

James

Re: [Openvpn-devel] [Openvpn-users] OpenVPN 2.1-rc5 released

[Matthias Andree]

On Thu, 24 Jan 2008, James Yonan wrote:

> 2.1-rc5 has a minor pkcs11 option processing bug.  I've built 2.1-rc6 with the fix.
> 
> Download:
> 
> http://openvpn.net/beta/

I've submitted port updates to -rc6 for FreeBSD, to appear once a
committer finds the time to go forward.
<http://www.freebsd.org/cgi/query-pr.cgi?pr=119953>

Hope that anyone finds it useful ;-)

Best,
Matthias

Re: [Openvpn-devel] OpenVPN 2.1-rc5 released

[Steven Pritchard]

Trying to build the Fedora package for rc6, I'm getting an error from
%check, which basically does this:

  ./openvpn --config sample-config-files/loopback-client &
  ./openvpn --config sample-config-files/loopback-server
  wait

I'm getting the following error:

  Thu Jan 24 14:15:33 2008 /sbin/ip addr flush dev null
  Device "null" does not exist.
  Thu Jan 24 14:15:33 2008 Linux ip flush failed: shell command exited with error status: 255

Full build log here:

  http://koji.fedoraproject.org/koji/getfile?taskID=370966&name=build.log

Steve
-- 
Steven Pritchard - K&S Pritchard Enterprises, Inc.
Email: steve@...610...             http://www.kspei.com/
Phone: (618)624-4440               Mobile: (618)567-7320

Re: [Openvpn-devel] OpenVPN 2.1-rc5 released

[Alon Bar-Lev]

[-- Attachment #1: Type: text/plain, Size: 1407 bytes --]

Thanks!
I was not aware of the null tun.
The following should fix the problem.

-r 2677:2679 https://svn.openvpn.net/projects/openvpn/contrib/alon/BETA21-userpriv-fixups

Alon.

On 1/25/08, Steven Pritchard <steve@...609...> wrote:
> Trying to build the Fedora package for rc6, I'm getting an error from
> %check, which basically does this:
>
>   ./openvpn --config sample-config-files/loopback-client &
>   ./openvpn --config sample-config-files/loopback-server
>   wait
>
> I'm getting the following error:
>
>   Thu Jan 24 14:15:33 2008 /sbin/ip addr flush dev null
>   Device "null" does not exist.
>   Thu Jan 24 14:15:33 2008 Linux ip flush failed: shell command exited with error status: 255
>
> Full build log here:
>
>   http://koji.fedoraproject.org/koji/getfile?taskID=370966&name=build.log
>
> Steve
> --
> Steven Pritchard - K&S Pritchard Enterprises, Inc.
> Email: steve@...610...             http://www.kspei.com/
> Phone: (618)624-4440               Mobile: (618)567-7320
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2008.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> _______________________________________________
> Openvpn-devel mailing list
> Openvpn-devel@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/openvpn-devel
>

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: BETA21-userpriv-fixups.patch --]
[-- Type: text/x-diff; name=BETA21-userpriv-fixups.patch, Size: 929 bytes --]

Index: openvpn/tun.c
===================================================================
--- openvpn/tun.c	(revision 2677)
+++ openvpn/tun.c	(revision 2679)
@@ -1221,17 +1221,20 @@
   if (tt)
     {
 #ifdef CONFIG_FEATURE_IPROUTE
-	char command_line[256];
-	/*
-	 * Flush IP configuration for the device
-	 */
-	openvpn_snprintf (command_line, sizeof (command_line),
+	if (tt->type != DEV_TYPE_NULL)
+	  {
+	    char command_line[256];
+	    /*
+	     * Flush IP configuration for the device
+	     */
+	    openvpn_snprintf (command_line, sizeof (command_line),
 			  "%s addr flush dev %s",
 			  iproute_path,
 			  tt->actual_name
 			  );
-	msg (M_INFO, "%s", command_line);
-	system_check (command_line, NULL, S_FATAL, "Linux ip flush failed");
+	    msg (M_INFO, "%s", command_line);
+	    system_check (command_line, NULL, S_FATAL, "Linux ip flush failed");
+	  }
 #endif
       close_tun_generic (tt);
       free (tt);

Re: [Openvpn-devel] OpenVPN 2.1-rc5 released

[Alon Bar-Lev]

[-- Attachment #1: Type: text/plain, Size: 1888 bytes --]

Well...
From: http://bugs.gentoo.org/show_bug.cgi?id=207320, found out that:
When executing:
ip addr flush dev XXXX
On unprivileged user, you get infinite loop of iproute2... Reported
this to upstream.
So I had to workaround this using explicit del.

-r 2677:2682 https://svn.openvpn.net/projects/openvpn/contrib/alon/BETA21-userpriv-fixups

On 1/25/08, Alon Bar-Lev <alon.barlev@...277...> wrote:
> Thanks!
> I was not aware of the null tun.
> The following should fix the problem.
>
> -r 2677:2679 https://svn.openvpn.net/projects/openvpn/contrib/alon/BETA21-userpriv-fixups
>
> Alon.
>
> On 1/25/08, Steven Pritchard <steve@...609...> wrote:
> > Trying to build the Fedora package for rc6, I'm getting an error from
> > %check, which basically does this:
> >
> >   ./openvpn --config sample-config-files/loopback-client &
> >   ./openvpn --config sample-config-files/loopback-server
> >   wait
> >
> > I'm getting the following error:
> >
> >   Thu Jan 24 14:15:33 2008 /sbin/ip addr flush dev null
> >   Device "null" does not exist.
> >   Thu Jan 24 14:15:33 2008 Linux ip flush failed: shell command exited with error status: 255
> >
> > Full build log here:
> >
> >   http://koji.fedoraproject.org/koji/getfile?taskID=370966&name=build.log
> >
> > Steve
> > --
> > Steven Pritchard - K&S Pritchard Enterprises, Inc.
> > Email: steve@...610...             http://www.kspei.com/
> > Phone: (618)624-4440               Mobile: (618)567-7320
> >
> > -------------------------------------------------------------------------
> > This SF.net email is sponsored by: Microsoft
> > Defy all challenges. Microsoft(R) Visual Studio 2008.
> > http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> > _______________________________________________
> > Openvpn-devel mailing list
> > Openvpn-devel@lists.sourceforge.net
> > https://lists.sourceforge.net/lists/listinfo/openvpn-devel
> >
>
>

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: BETA21-userpriv-fixups.patch --]
[-- Type: text/x-diff; name=BETA21-userpriv-fixups.patch, Size: 1113 bytes --]

Index: openvpn/tun.c
===================================================================
--- openvpn/tun.c	(revision 2677)
+++ openvpn/tun.c	(revision 2682)
@@ -1221,17 +1221,24 @@
   if (tt)
     {
 #ifdef CONFIG_FEATURE_IPROUTE
-	char command_line[256];
-	/*
-	 * Flush IP configuration for the device
-	 */
-	openvpn_snprintf (command_line, sizeof (command_line),
-			  "%s addr flush dev %s",
+	if (tt->type != DEV_TYPE_NULL && tt->did_ifconfig)
+	  {
+	    char command_line[256];
+	    struct gc_arena gc = gc_new ();
+
+	    openvpn_snprintf (command_line, sizeof (command_line),
+			  "%s addr del dev %s local %s peer %s",
 			  iproute_path,
-			  tt->actual_name
+			  tt->actual_name,
+			  print_in_addr_t (tt->local, 0, &gc),
+			  print_in_addr_t (tt->remote_netmask, 0, &gc)
 			  );
-	msg (M_INFO, "%s", command_line);
-	system_check (command_line, NULL, S_FATAL, "Linux ip flush failed");
+
+	    msg (M_INFO, "%s", command_line);
+	    system_check (command_line, NULL, S_FATAL, "Linux ip addr del failed");
+
+	    gc_free (&gc);
+	  }
 #endif
       close_tun_generic (tt);
       free (tt);

Re: [Openvpn-devel] OpenVPN 2.1-rc5 released

[Alon Bar-Lev]

iproute2 was fixed at latest git... No infinite loop anymore...
But it will take much time until it pushed into users...

On 1/26/08, Alon Bar-Lev <alon.barlev@...277...> wrote:
> Well...
> From: http://bugs.gentoo.org/show_bug.cgi?id=207320, found out that:
> When executing:
> ip addr flush dev XXXX
> On unprivileged user, you get infinite loop of iproute2... Reported
> this to upstream.
> So I had to workaround this using explicit del.
>
> -r 2677:2682 https://svn.openvpn.net/projects/openvpn/contrib/alon/BETA21-userpriv-fixups
>
> On 1/25/08, Alon Bar-Lev <alon.barlev@...277...> wrote:
> > Thanks!
> > I was not aware of the null tun.
> > The following should fix the problem.
> >
> > -r 2677:2679 https://svn.openvpn.net/projects/openvpn/contrib/alon/BETA21-userpriv-fixups
> >
> > Alon.
> >
> > On 1/25/08, Steven Pritchard <steve@...609...> wrote:
> > > Trying to build the Fedora package for rc6, I'm getting an error from
> > > %check, which basically does this:
> > >
> > >   ./openvpn --config sample-config-files/loopback-client &
> > >   ./openvpn --config sample-config-files/loopback-server
> > >   wait
> > >
> > > I'm getting the following error:
> > >
> > >   Thu Jan 24 14:15:33 2008 /sbin/ip addr flush dev null
> > >   Device "null" does not exist.
> > >   Thu Jan 24 14:15:33 2008 Linux ip flush failed: shell command exited with error status: 255
> > >
> > > Full build log here:
> > >
> > >   http://koji.fedoraproject.org/koji/getfile?taskID=370966&name=build.log
> > >
> > > Steve
> > > --
> > > Steven Pritchard - K&S Pritchard Enterprises, Inc.
> > > Email: steve@...610...             http://www.kspei.com/
> > > Phone: (618)624-4440               Mobile: (618)567-7320
> > >
> > > -------------------------------------------------------------------------
> > > This SF.net email is sponsored by: Microsoft
> > > Defy all challenges. Microsoft(R) Visual Studio 2008.
> > > http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> > > _______________________________________________
> > > Openvpn-devel mailing list
> > > Openvpn-devel@lists.sourceforge.net
> > > https://lists.sourceforge.net/lists/listinfo/openvpn-devel
> > >
> >
> >
>
>

Re: [Openvpn-devel] [Openvpn-users] OpenVPN 2.1-rc5 released

[Alon Bar-Lev]

Can anyone who uses PKCS#11 on Windows can acknowledge it works?

Thanks!

On 1/24/08, Alon Bar-Lev <alon.barlev@...277...> wrote:
> All PKCS#11 users, please notice,
> There was a major change in the parameters of PKCS#11, please refer to
> the HOWTO:
> http://openvpn.net/howto.html#pkcs11
>
> Regards,
> Alon Bar-Lev.

Re: [Openvpn-devel] [Openvpn-users] OpenVPN 2.1-rc5 released

[Mirek Zajic]

I was trying to compile PKCS#11 for about three hours and I didn't 
succeed. I rather compiled OpenVPN without PKCS#11 support. Maybe that 
some scripts (.bat) would help because foolish Windows users (like me) 
are used to compile programs just by clicking "Compile". Playing with 
commandline, editing makefiles etc. is sometimes very confusing and it 
really isn't necessary.


Alon Bar-Lev napsal(a):
> Can anyone who uses PKCS#11 on Windows can acknowledge it works?
>
> Thanks!
>
> On 1/24/08, Alon Bar-Lev <alon.barlev@...277...> wrote:
>   
>> All PKCS#11 users, please notice,
>> There was a major change in the parameters of PKCS#11, please refer to
>> the HOWTO:
>> http://openvpn.net/howto.html#pkcs11
>>
>> Regards,
>> Alon Bar-Lev.
>>     
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2008.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> _______________________________________________
> Openvpn-devel mailing list
> Openvpn-devel@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/openvpn-devel
>
>   

Re: [Openvpn-devel] [Openvpn-users] OpenVPN 2.1-rc5 released

[Alon Bar-Lev]

On 1/27/08, Mirek Zajic <zajic@...1068...> wrote:
> I was trying to compile PKCS#11 for about three hours and I didn't
> succeed. I rather compiled OpenVPN without PKCS#11 support. Maybe that
> some scripts (.bat) would help because foolish Windows users (like me)
> are used to compile programs just by clicking "Compile". Playing with
> commandline, editing makefiles etc. is sometimes very confusing and it
> really isn't necessary.

Why do you try to compile it?
You can use James binaries to test OpenVPN on Windows.

Alon.

Re: [Openvpn-devel] [Openvpn-users] OpenVPN 2.1-rc5 released

[Dave]

I would, but I cannot figure out how to map the old options to the current
options.  Previously, I used:


#basic token selection
pkcs11-providers bt_csp11.dll
pkcs11-slot-type "label"
pkcs11-slot "DavidLemley"

pkcs11-sign-mode sign

#select token keyset
pkcs11-id-type label
pkcs11-id "david_lemley_bestoken's ziggurat29 CA ID"

Can you explain the new options, or point me to where they are explained so
I can reconfigure?


> -----Original Message-----
> From: openvpn-users-bounces@lists.sourceforge.net 
> [mailto:openvpn-users-bounces@lists.sourceforge.net] On 
> Behalf Of Alon Bar-Lev
> Sent: Sunday, January 27, 2008 12:58 AM
> To: James Yonan
> Cc: Openvpn-devel@lists.sourceforge.net; 
> openvpn-users@lists.sourceforge.net
> Subject: Re: [Openvpn-users] OpenVPN 2.1-rc5 released
> 
> 
> Can anyone who uses PKCS#11 on Windows can acknowledge it works?
> 
> Thanks!
> 
> On 1/24/08, Alon Bar-Lev <alon.barlev@...277...> wrote:
> > All PKCS#11 users, please notice,
> > There was a major change in the parameters of PKCS#11, 
> please refer to 
> > the HOWTO: http://openvpn.net/howto.html#pkcs11
> >
> > Regards,
> > Alon Bar-Lev.
> 
> --------------------------------------------------------------
> -----------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2008. 
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> _______________________________________________
> Openvpn-users mailing list
> Openvpn-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/openvpn-users
> 

Re: [Openvpn-devel] [Openvpn-users] OpenVPN 2.1-rc5 released

[Mirek Zajic]

Where can I find PKCS#11 Windows binaries? If you mean OpenVPN binaries, 
it is because I want to fix my NTLMv2 patch.

Alon Bar-Lev napsal(a):
> On 1/27/08, Mirek Zajic <zajic@...1068...> wrote:
>   
>> I was trying to compile PKCS#11 for about three hours and I didn't
>> succeed. I rather compiled OpenVPN without PKCS#11 support. Maybe that
>> some scripts (.bat) would help because foolish Windows users (like me)
>> are used to compile programs just by clicking "Compile". Playing with
>> commandline, editing makefiles etc. is sometimes very confusing and it
>> really isn't necessary.
>>     
>
> Why do you try to compile it?
> You can use James binaries to test OpenVPN on Windows.
>
> Alon.
>
>   

Re: [Openvpn-devel] [Openvpn-users] OpenVPN 2.1-rc5 released

[Alon Bar-Lev]

On Jan 27, 2008 7:04 PM, Dave <dev@...575...> wrote:

> Can you explain the new options, or point me to where they are explained so
> I can reconfigure?

There is a single ID now for PKCS#11 certificate, sync to all projects
OpenVPN, OpensSSH, QCA, eCryptfs etc...
You use pkcs11-id 'id' (mind the single quote).
You can view id list using show-pkcs11-ids.

I updated the HOWTO:
http://openvpn.net/howto.html#pkcs11

So you don't need to specify any other option except of:
pkcs11-providers bt_csp11.dll
pkcs11-id 'serialized-id'

Alon

Re: [Openvpn-devel] [Openvpn-users] OpenVPN 2.1-rc5 released

[Alon Bar-Lev]

On Jan 27, 2008 7:22 PM, Mirek Zajic <zajic@...1068...> wrote:
> Where can I find PKCS#11 Windows binaries? If you mean OpenVPN binaries,
> it is because I want to fix my NTLMv2 patch.

Oh... Building OpenVPN for Windows is very difficult task now...
I am working to simplify that...

Alon.

Re: [Openvpn-devel] [Openvpn-users] OpenVPN 2.1-rc5 released

[Dave]

> Behalf Of Alon Bar-Lev

> On Jan 27, 2008 7:04 PM, Dave <dev@...575...> wrote:
> 
> > Can you explain the new options, or point me to where they are 
> > explained so I can reconfigure?
> 
> There is a single ID now for PKCS#11 certificate, sync to all 
> projects OpenVPN, OpensSSH, QCA, eCryptfs etc... You use 
> pkcs11-id 'id' (mind the single quote). You can view id list 
> using show-pkcs11-ids.
> 
> I updated the HOWTO:
> http://openvpn.net/howto.html#pkcs11
> 
> So you don't need to specify any other option except of: 
> pkcs11-providers bt_csp11.dll pkcs11-id 'serialized-id'


OK, I can report success on windows.

-Dave

Re: [Openvpn-devel] [Openvpn-users] OpenVPN 2.1-rc5 released

[Alon Bar-Lev]

On Jan 27, 2008 8:57 PM, Dave <dev@...575...> wrote:
> OK, I can report success on windows.

Thanks!
This is important!

Re: [Openvpn-devel] [Openvpn-users] OpenVPN 2.1-rc5 released

[@ 2008-01-27 22:29 UTC (permalink / raw)]

Hello Alon,

> Oh... Building OpenVPN for Windows is very difficult task now...
> I am working to simplify that...

building pkcs11-helper with openssl support didn't work for me with mingw.
the openssl symlinks don't work.

A server that produces nightly builds would be nice ...

------------------------------
what I done till now:

Download + Install
------------------

MinGW (c-compiler) + MSYS (make, etc) + Perl (alternativly Activestate Perl):
http://www.mingw.org/download.shtml

Man2html:
http://hydra.nac.uci.edu/indiv/ehood/man2html.html

OpenSSL 0.9.7 (need perl):
http://www.openssl.org/source/

LZO 2:
http://www.oberhumer.com/opensource/lzo/download/

pkcs11-helper (need man2html)
http://www.opensc-project.org/files/pkcs11-helper/

nullsoft scriptable install system (NSIS)
http://nsis.sourceforge.net/Download

Windows Driver Development Kit
http://www.microsoft.com/whdc/DevTools/ddk/default.mspx
J:\WINDDK\3790.1830\src\setup\devcon

Platform SDK (Windows Server 2003 R2 Platform SDK)
http://www.microsoft.com/downloads/details.aspx?FamilyId=484269E2-3B89-47E3-8EB7-1F2BE6D7123A&displaylang=en
Service.c
Service.H
(from Simple Service example)

Compile
-------
1. patch openssl
2. build openssl
3. build lzo
4. build pkcs11-helper with openssl engine
5. customize install-win32\settings.in
6. run domake-win

greetings
Carsten