Add configure check for the path to systemd-ask-password

Gentoo Linux installs this in /usr/bin by default. Also, the user may
have installed it in /usr/local/bin if building from source.

Acked-by: David Sommerseth <davids@redhat.com>
Message-Id: 1404419045-14728-1-git-send-email-floppym@gentoo.org
URL: http://article.gmane.org/gmane.network.openvpn.devel/8825

Signed-off-by: David Sommerseth <davids@redhat.com>
Don't let openvpn_popen() keep zombies around

Commit 9449e6a9eba30c9ed054f57d630a88c9f087080f introduced the
openvpn_popen() function to support retrieving passwords via systemd.

It was discovered that the child processes openvpn fork()ed would
be lingering around until openvpn stopped.  This was due to the lack
of a wait() call.

This patch also cleans up a few minor white-space issues in the same
code segment.

 [v2 proper initialisation of status variable]

Signed-off-by: David Sommerseth <davids@redhat.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: 1409930731-15263-2-git-send-email-davids@redhat.com
URL: http://article.gmane.org/gmane.network.openvpn.devel/9021
Don't try to use systemd-ask-password if it is not available

If the SYSTEMD_ASK_PASSWORD_PATH executable cannot be found, we
don't consider systemd as running.

[v2 - Don't clean up white-space]

Signed-off-by: David Sommerseth <davids@redhat.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: 20140909202044.GJ1118@greenie.muc.de
URL: http://article.gmane.org/gmane.network.openvpn.devel/9035
Clean up the pipe closing in openvpn_popen()

Do the proper closing of the pipe ends which is not being used,
also in error situations.  Moved the closing of the parent side
before the waitpid(), to be consistent with the child side (as
early as possible).

Also improved the error messages with more details.

[v2 - Don't call close() if execve() fails]

Signed-off-by: David Sommerseth <davids@redhat.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: 20140909202408.GK1118@greenie.muc.de
URL: http://article.gmane.org/gmane.network.openvpn.devel/9036
Remove quadratic complexity from openvpn_base64_decode()

Every four input characters, openvpn_base64_decode called token_decode,
which in turn called strlen() on the remaining input. This means that
base64 decoding in openvpn had quadratic complexity.

All we really need to know is whether the token is complete, so replace
the check to check just that, and make the complexity linear wrt the
input length.

Signed-off-by: Steffan Karger <steffan.karger@fox-it.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <5408494D.7050407@fox-it.com>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9016
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Fix some unintialized variable warnings

Does not actually change behaviour, but fixes compiler warnings
and properly initializing is good habit anyway.

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: David Sommerseth <dazo@users.sourceforge.net>
Message-Id: <1408568426-19601-1-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9003
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Fix clang warning in options.c

fixed warning: expression which evaluates to zero treated as a
null pointer constant of type 'struct addrinfo *'

Seems to be innocent, but clang is correct that this is strange.
init_tun() expects two pointers, but options_string() tried to
feed it two uint32_t values.

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: David Sommerseth <dazo@users.sourceforge.net>
Message-Id: <1408568426-19601-2-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9004
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Fix compiler warnings in ssl_polarssl.c.

No functional changes, just add missing includes and make casts explicit.

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1408396155-9017-1-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8991
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Add systemd unit file for OpenVPN

This is to encourage all Linux distributions to use a unified systemd
unit file.

This unit file also tries to reduce the capabilities of the running
openvpn process.

Signed-off-by: David Sommerseth <davids@redhat.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: 1411030936-16309-1-git-send-email-openvpn.list@topphemmelig.net
URL: http://article.gmane.org/gmane.network.openvpn.devel/9043
ocsp_check - signature verification and cert staus results are separate

when openssl returns result of parsing and verification of the
OCSP response, the signature verification is separate from the certificate
status, as such it's necessary to check both of them.

Otherwise results like:

Response Verify Failure
140170966779776:error:27069076:OCSP routines:OCSP_basic_verify:signer
certificate not found:ocsp_vfy.c:85:
ca/cert.pem: good
        This Update: Sep 23 12:12:28 2014 GMT

will be accepted as being trustworthy.

Note that "Response verify OK" is printed on stderr, so it can't
be discarded.

Signed-off-by: Hubert Kario <hkario@redhat.com>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <1411727041-11884-1-git-send-email-hkario@redhat.com>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9054
Signed-off-by: Gert Doering <gert@greenie.muc.de>
ocsp_check - double check if ocsp didn't report any errors in execution

in case the reposnses are too old, ocsp tool can return text like this:

Response verify OK
ca/cert.pem: WARNING: Status times invalid.
139990703290240:error:2707307D:OCSP routines:OCSP_check_validity:status
expired:ocsp_cl.c:358:
good
        This Update: Sep 21 12:12:48 2014 GMT
        Next Update: Sep 22 12:12:48 2014 GMT

light change in buffering can cause "verify OK" and "ca/cert.pem: good"
to be placed in a way that matching will be valid
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <1411727041-11884-2-git-send-email-hkario@redhat.com>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9055

Signed-off-by: Gert Doering <gert@greenie.muc.de>
systemd: Use systemd functions to consider systemd availability

This is another systemd implementation clean-up.  It was found that
SELinux will block OpenVPN from checking /sys/fs/cgroups.  As OpenVPN
only checked /sys/fs/cgroups and /sys/fs/cgroups/systemd to see if
systemd was available or not, it was considered better to query
systemd directly to see whether or not to query for usernames and
passwords via systemd.

This patch has been compile tested on Fedora 19 and Fedora 21 alpha and
function tested on Fedora 19.

  v2 - Use PKG_CHECK_MODULES() + check for libsystemd before
       libystemd-daemon.  systemd >= 209 use a unified library

Signed-off-by: David Sommerseth <davids@redhat.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1412356567-27125-1-git-send-email-openvpn.list@topphemmelig.net>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9072
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Add documentation for PERSIST_TUN_ACTION (Android specific)

Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1412712650-5173-1-git-send-email-arne@rfc2549.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9090

Signed-off-by: Gert Doering <gert@greenie.muc.de>