]> git.ipfire.org Git - thirdparty/openvpn.git/commit
Upgrade OpenVPN 2.3 to PolarSSL 1.3
authorSteffan Karger <steffan@karger.me>
Sat, 19 Dec 2015 11:39:28 +0000 (12:39 +0100)
committerGert Doering <gert@greenie.muc.de>
Sat, 19 Dec 2015 12:49:42 +0000 (13:49 +0100)
commita40b2304fe967053debb4249704a344223707c96
treed8eeded3a45a1d5dca0126d5ab7368b27d11445b
parent2b9b3e598dc5bedc638ebc0a1877b36224398f0f
Upgrade OpenVPN 2.3 to PolarSSL 1.3

PolarSSL 1.2 is going end-of-support by 31-12-2015, so we have to move
on.  Newer versions of polarssl/mbedtls are already released (2.0-2.2),
but as previously agreed upon, we will just move release/2.3 to polar
1.3, where master has been for a while now.

This commit removes support for PolarSSL 1.2.  The mimimum required
version of PolarSSL is now 1.3.8.

This commit is a combination of a number of commits related to upgrading
or fixing polarssl 1.3 support from the master branch, adjusted to apply
to the release/2.3 branch:
03df3a99 Upgrade to PolarSSL 1.3
cc1cee74 Update openvpn-plugin.h for PolarSSL 1.3.
4b9eaa1e Fix regression with password protected private keys (polarssl)
d0f26fb5 polarssl: disable 1/n-1 record splitting
444a93ea polarssl: fix --client-cert-not-required
9571010a polarssl: also allocate PKCS#11 certificate object on demand
67a67e39 polarssl: don't use deprecated functions anymore
9d3b7cec polarssl: require >= 1.3.8

This commit was tested using:
 * Regular private key file
 * Password-protected private key file
 * PKCS#11
 * --management-external-key
 * CRL file (with and w/o revoked cert)
 * With and w/o tls-auth
 * RSA and ECDSA key/certs

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1450525169-12961-1-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/10856
Signed-off-by: Gert Doering <gert@greenie.muc.de>
12 files changed:
README.polarssl
configure.ac
include/openvpn-plugin.h
src/openvpn/crypto_polarssl.c
src/openvpn/pkcs11_polarssl.c
src/openvpn/ssl_polarssl.c
src/openvpn/ssl_polarssl.h
src/openvpn/ssl_verify.c
src/openvpn/ssl_verify_backend.h
src/openvpn/ssl_verify_openssl.c
src/openvpn/ssl_verify_polarssl.c
src/openvpn/ssl_verify_polarssl.h