Add systemd unit file for OpenVPN

This is to encourage all Linux distributions to use a unified systemd
unit file.

This unit file also tries to reduce the capabilities of the running
openvpn process.

Signed-off-by: David Sommerseth <davids@redhat.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: 1411030936-16309-1-git-send-email-openvpn.list@topphemmelig.net
URL: http://article.gmane.org/gmane.network.openvpn.devel/9043
ocsp_check - signature verification and cert staus results are separate

when openssl returns result of parsing and verification of the
OCSP response, the signature verification is separate from the certificate
status, as such it's necessary to check both of them.

Otherwise results like:

Response Verify Failure
140170966779776:error:27069076:OCSP routines:OCSP_basic_verify:signer
certificate not found:ocsp_vfy.c:85:
ca/cert.pem: good
        This Update: Sep 23 12:12:28 2014 GMT

will be accepted as being trustworthy.

Note that "Response verify OK" is printed on stderr, so it can't
be discarded.

Signed-off-by: Hubert Kario <hkario@redhat.com>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <1411727041-11884-1-git-send-email-hkario@redhat.com>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9054
Signed-off-by: Gert Doering <gert@greenie.muc.de>
ocsp_check - double check if ocsp didn't report any errors in execution

in case the reposnses are too old, ocsp tool can return text like this:

Response verify OK
ca/cert.pem: WARNING: Status times invalid.
139990703290240:error:2707307D:OCSP routines:OCSP_check_validity:status
expired:ocsp_cl.c:358:
good
        This Update: Sep 21 12:12:48 2014 GMT
        Next Update: Sep 22 12:12:48 2014 GMT

light change in buffering can cause "verify OK" and "ca/cert.pem: good"
to be placed in a way that matching will be valid
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <1411727041-11884-2-git-send-email-hkario@redhat.com>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9055

Signed-off-by: Gert Doering <gert@greenie.muc.de>
systemd: Use systemd functions to consider systemd availability

This is another systemd implementation clean-up.  It was found that
SELinux will block OpenVPN from checking /sys/fs/cgroups.  As OpenVPN
only checked /sys/fs/cgroups and /sys/fs/cgroups/systemd to see if
systemd was available or not, it was considered better to query
systemd directly to see whether or not to query for usernames and
passwords via systemd.

This patch has been compile tested on Fedora 19 and Fedora 21 alpha and
function tested on Fedora 19.

  v2 - Use PKG_CHECK_MODULES() + check for libsystemd before
       libystemd-daemon.  systemd >= 209 use a unified library

Signed-off-by: David Sommerseth <davids@redhat.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1412356567-27125-1-git-send-email-openvpn.list@topphemmelig.net>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9072
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Add documentation for PERSIST_TUN_ACTION (Android specific)

Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1412712650-5173-1-git-send-email-arne@rfc2549.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9090

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Merge remote-tracking branch 'upstream/master'
Brought upstream changes in.