Require a 1.2.x PolarSSL version

Upstream policy on PolarSSL API compatibility does not guarantee
stability between point-releases. For OpenVPN, we must verify a 1.2.x
version with the current codebase.

This fixes bug#343.

Signed-off-by: Josh Cepek <josh.cepek@usa.net>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <5284F32D.3000206@usa.net>
URL: http://article.gmane.org/gmane.network.openvpn.devel/7968
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 7fc9245f5d97c7d76c635f8a3e38ab55ab27b27b)
Add reporting of UI version to basic push-peer-info set.

If a GUIs sets IV_OPENVPN_GUI_VERSION the version will be pushed to the
server.

Usage convention for IV_OPENVPN_GUI_VERSION is "<gui_id><space><version>",
for example "de.blinkt.openvpn 0.5.47" for the ICS Android version.

Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: Gert Doering <gert@greenie.muc.de>
Acked-by: James Yonan <james@openvpn.net>
Message-Id: <1370005175-14871-1-git-send-email-arne@rfc2549.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/7646
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit f3a2cd255a3bc73a546a5e2d09fa30a16cce0d7d)
tls_ctx_load_ca: Improve certificate error messages

If a CA certificate file includes intermediate certificates, and any
of them fail to verify, the current code will file with "Cannot load
CA certificate file".  Instead, generate a more specific error message
identifying the specific sub-certificate(s) which did not validate.

Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <CAK6ywbLVtSgRZEt4N+02fz+vQ0GNp==5KdsbqWtZ+fgUzrZq+g@mail.gmail.com>
URL: http://article.gmane.org/gmane.network.openvpn.devel/7837

Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 9927cdbd929bebbba0d15bb9a6b03453891a485b)
Document authfile for socks server

It looks like it's possible to specify an optional authfile as third
argument of the "socks-proxy" directive. This patch updates the man page to
document that.

Signed-off-by: Davide Brini <dave_br@gmx.com>

Acked-by: Heiko Hund <heiko.hund@sophos.com>
Message-Id: <0MTjMy-1VU1I42Lo0-00QV4k@mail.gmx.com>
URL: http://article.gmane.org/gmane.network.openvpn.devel/7875
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit e0a7471f250e25a384a23dfb9efd2ffef83be913)
Fix IPv6 examples in t_client.rc-sample

IPv6 documentation prefix is 2001:db*8*:: (not :dba:), and the second
test stanza variables need to end in _2, of course...

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Josh Cepek <josh.cepek@usa.net>
Message-Id: <1384624401-27943-1-git-send-email-gert@greenie.muc.de>
URL: http://article.gmane.org/gmane.network.openvpn.devel/7992
(cherry picked from commit bbc3a6473c84ba7cdb87b359f016cd13773e42ec)
Fix slow memory drain on each client renegotiation.

This reverts commit bee92b479414d12035b0422f81ac5fcfe14fa645 and parts
of commit dc7be6d078ba106f9b0de12f3e879c3561c3c537, as these introduced a
subtle memory drain on client renegotiations (es->gc got initialized,
which led to "unused" gc_entry records accumulating while a client is
connected).

Setting es->gc=NULL causes env_set_add_nolock() / remove_env_item() to
free() allocated and no longer used strings in the es, while an active
gc would leave them for cleanup with gc_free() at client disconnect time.

Signed-off-by: Gert Doering <gert@greenie.muc.de>

Conflicts:
	src/openvpn/buffer.c
Acked-by: David Sommerseth <dazo@users.sourceforge.net>
Message-Id: <20131023162618.GP161@greenie.muc.de>
URL: http://article.gmane.org/gmane.network.openvpn.devel/7939
(cherry picked from commit 4368147972d61b598bbcd5d2904d891130d5e517)
Remove duplicate cipher entries from TLS translation table.

Patch from trac#304 - the translation table OpenSSL<->IANA contained
duplicates for four IANA names, causing translation backwards to fail.

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-By: Steffan Karger <steffan.karger@fox-it.com>
URL: https://community.openvpn.net/openvpn/ticket/304
(cherry picked from commit e85d87523af43c5fe5188f7ee1e2fdd2861dcffc)
Refactor tls_ctx_use_external_private_key()

OpenSSL's tls_ctx_load_cert_file() had a parameter in which a copy of the
context's certificate chain was stored on return, used by
tls_ctx_use_external_private_key() only and free()d immediately thereafter.

PolarSSL also supported this output parameter, but returned a pointer to
the
context's certificate chain (rather than to a copy of the certificate, as
OpenSSL does) - which meant that we would have to #ifdef the free().

PolarSSL cannot make a copy of a certificate chain, and OpenSSL cannot
store a
pointer to (instead of a copy of) the cert.

So remove the output parameter from tls_ctx_load_cert_file() and
incorporate
the needed functionality directly into tls_ctx_use_external_private_key()
(which is straightforward for both OpenSSL and PolarSSL, as long as you
don't
try to support both at once.)

Signed-off-by: Joachim Schipper <joachim.schipper@fox-it.com>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <1379587649-25506-2-git-send-email-steffan.karger@fox-it.com>
URL: http://article.gmane.org/gmane.network.openvpn.devel/7888
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit c3b2d487bc5089c8c0cf65df8e6cc2232d84b05b)
--management-external-key for PolarSSL

Add --management-external-key support, compatible with the OpenSSL
implementation. Needs the flexibility of ssl_set_own_cert_alt(), which
is new in PolarSSL-1.2.

Signed-off-by: Joachim Schipper <joachim.schipper@fox-it.com>
Signed-off-by: Steffan Karger <steffan.karger@fox-it.com>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <1379587649-25506-3-git-send-email-steffan.karger@fox-it.com>
URL: http://article.gmane.org/gmane.network.openvpn.devel/7886
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 38ace48c6820c611e689bc69b0cf5380bf7a8891)
external_pkcs1_sign: Support non-RSA_SIG_RAW hash_ids

For TLSv1.2, we need to support various hashes. (GPL) code taken from
PolarSSL pkcs11_sign().

Signed-off-by: Joachim Schipper <joachim.schipper@fox-it.com>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <1379587649-25506-4-git-send-email-steffan.karger@fox-it.com>
URL: http://article.gmane.org/gmane.network.openvpn.devel/7887
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 32f07c8e5b0f6ec66cfa8566cb8e97b4a6238037)
Fix compile error in ssl_openssl introduced by polar external-management patch

Acked-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1385210434-28364-1-git-send-email-arne@rfc2549.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8039

Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 20fe5561dfe7a6f1da3aac07b38d0773c2758e5e)
t_client.sh: ignore fields from "ip -6 route show" output that distort results.

"ip -6 route show" prints stuff like "rtt 38ms rttvar 38ms cwnd 10", which
sometimes changes while an OpenVPN test is running, resulting in spurious
failures in the "ifconfig/route must be restored identically after
OpenVPN ends" test in t_client.sh.  Not all fields are there all the time,
so use "sed" to get rid of whatever is printed this time.

Only relevant for "make check" on linux builds with "--enable-iproute2".

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <1385309584-23209-1-git-send-email-gert@greenie.muc.de>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8047
(cherry picked from commit 8c19087034cb1076874075b9e2896ea3f7be59cf)
Fix assertion when SIGUSR1 is received while getaddrinfo is successful

Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1385064495-25877-4-git-send-email-arne@rfc2549.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8019

Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 282788a835f6c9dfb85e8f9a3bd45f5841271b06)