Hi,

there was one line for the script left in the rootfile.

I removed that myself and merged the patch into the OpenSSL 1.1.0 branch. I will build this now and see if everything goes through. If it does I suppose we will be able to ship OpenSSL very soon.

Please keep working on the other patches in the meantime.

Best, -Michael

On Wed, 2018-01-31 at 10:34 +0100, Erik Kapfer wrote:

Changed LFS and ROOTFILE for OpenVPN 2.4.4 update.

Signed-off-by: Erik Kapfer erik.kapfer@ipfire.org

config/rootfiles/common/openvpn | 5 ++++- lfs/openvpn | 8 +++++--- 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/config/rootfiles/common/openvpn b/config/rootfiles/common/openvpn index b58e30c..cbfd03e 100644 --- a/config/rootfiles/common/openvpn +++ b/config/rootfiles/common/openvpn @@ -1,3 +1,5 @@ +etc/fcron.daily/ovpn_crl_updater.sh +#usr/include/openvpn-msg.h #usr/include/openvpn-plugin.h #usr/lib/openvpn #usr/lib/openvpn/plugins @@ -10,11 +12,12 @@ usr/sbin/openvpn #usr/share/doc/openvpn #usr/share/doc/openvpn/COPYING #usr/share/doc/openvpn/COPYRIGHT.GPL +#usr/share/doc/openvpn/Changes.rst #usr/share/doc/openvpn/README #usr/share/doc/openvpn/README.IPv6 #usr/share/doc/openvpn/README.auth-pam #usr/share/doc/openvpn/README.down-root -#usr/share/doc/openvpn/README.polarssl +#usr/share/doc/openvpn/README.mbedtls #usr/share/doc/openvpn/management-notes.txt #usr/share/man/man8/openvpn.8 var/ipfire/ovpn/ca diff --git a/lfs/openvpn b/lfs/openvpn index 8307d01..a925f78 100644 --- a/lfs/openvpn +++ b/lfs/openvpn @@ -1,7 +1,7 @@ ############################################################################# ## # # # IPFire.org - A linux based firewall # -# Copyright (C) 2017 IPFire Team info@ipfire.org # +# Copyright (C) 2018 IPFire Team info@ipfire.org # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@

include Config

-VER = 2.3.18 +VER = 2.4.4

THISAPP = openvpn-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE)

$(DL_FILE) = $(DL_FROM)/$(DL_FILE)

-$(DL_FILE)_MD5 = 844ec9c64aae62051478784b8562f881 +$(DL_FILE)_MD5 = 7a2002aad1671b24457bc9432a0c5c52

install : $(TARGET)

@@ -96,5 +96,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) mv -v /var/ipfire/ovpn/verify /usr/lib/openvpn/verify chown root:root /usr/lib/openvpn/verify chmod 755 /usr/lib/openvpn/verify

• @rm -rf $(DIR_APP) @$(POSTBUILD)

Hi,

yes I will keep the openssl-11 branch up to date. Make sure that you rebase any local branches on it instead of merging it because I might remove commits in between.

I do not know when I am going to merge everything into next. So far at least the OpenVPN stuff in the webUI are missing and I haven't really done any testing with the new OpenSSL library, yet. I just built it. Therefore I have no idea what bugs we might still find.

Best, -Michael

On Thu, 2018-02-01 at 09:35 +0100, ummeegge wrote:

Hi, thanks for corrections. Do you keep the openssl-11 branch up to date then so i could pull all changes from there or do you want to use the next branch ?

Greetings,

Erik

Am 31.01.2018 um 17:41 schrieb Michael Tremer:

...

Hi,

there was one line for the script left in the rootfile.

I removed that myself and merged the patch into the OpenSSL 1.1.0 branch. I will build this now and see if everything goes through. If it does I suppose we will be able to ship OpenSSL very soon.

Please keep working on the other patches in the meantime.

Best, -Michael

On Wed, 2018-01-31 at 10:34 +0100, Erik Kapfer wrote:

...

Changed LFS and ROOTFILE for OpenVPN 2.4.4 update.

Signed-off-by: Erik Kapfer erik.kapfer@ipfire.org

config/rootfiles/common/openvpn | 5 ++++- lfs/openvpn | 8 +++++--- 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/config/rootfiles/common/openvpn b/config/rootfiles/common/openvpn index b58e30c..cbfd03e 100644 --- a/config/rootfiles/common/openvpn +++ b/config/rootfiles/common/openvpn @@ -1,3 +1,5 @@ +etc/fcron.daily/ovpn_crl_updater.sh +#usr/include/openvpn-msg.h #usr/include/openvpn-plugin.h #usr/lib/openvpn #usr/lib/openvpn/plugins @@ -10,11 +12,12 @@ usr/sbin/openvpn #usr/share/doc/openvpn #usr/share/doc/openvpn/COPYING #usr/share/doc/openvpn/COPYRIGHT.GPL +#usr/share/doc/openvpn/Changes.rst #usr/share/doc/openvpn/README #usr/share/doc/openvpn/README.IPv6 #usr/share/doc/openvpn/README.auth-pam #usr/share/doc/openvpn/README.down-root -#usr/share/doc/openvpn/README.polarssl +#usr/share/doc/openvpn/README.mbedtls #usr/share/doc/openvpn/management-notes.txt #usr/share/man/man8/openvpn.8 var/ipfire/ovpn/ca diff --git a/lfs/openvpn b/lfs/openvpn index 8307d01..a925f78 100644 --- a/lfs/openvpn +++ b/lfs/openvpn @@ -1,7 +1,7 @@ ########################################################################## ### ## #

# # IPFire.org - A linux based firewall # -# Copyright (C) 2017 IPFire Team info@ipfire.org

# +# Copyright (C) 2018 IPFire Team info@ipfire.org

# #

# # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@

include Config

-VER = 2.3.18 +VER = 2.4.4

THISAPP = openvpn-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE)

$(DL_FILE) = $(DL_FROM)/$(DL_FILE)

-$(DL_FILE)_MD5 = 844ec9c64aae62051478784b8562f881 +$(DL_FILE)_MD5 = 7a2002aad1671b24457bc9432a0c5c52

install : $(TARGET)

@@ -96,5 +96,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) mv -v /var/ipfire/ovpn/verify /usr/lib/openvpn/verify chown root:root /usr/lib/openvpn/verify chmod 755 /usr/lib/openvpn/verify

• @rm -rf $(DIR_APP) @$(POSTBUILD)

Hi Michael, thanks for your feedback.

Am 02.02.2018 um 11:51 schrieb Michael Tremer:

Hi,

thanks for working on this.

On Fri, 2018-02-02 at 07:34 +0100, Erik Kapfer wrote:

...

Update script for OpenVPNs CRL has been integrated cause OpenVPN refactors the CRL handling since v.2.4.0 . Script checks the next update field from the CRL and executes an update two days before it expires. Script is placed under fcron.daily for daily checks. OpenVPN changes can be found in here https://github.com/OpenVPN/openvpn/commit/160504a2955c4478cd2c0323452929e070... .

Signed-off-by: Erik Kapfer erik.kapfer@ipfire.org

config/ovpn/ovpn_crl_updater.sh | 53 +++++++++++++++++++++++++++++++++++++++++ lfs/openvpn | 4 ++++ 2 files changed, 57 insertions(+) create mode 100644 config/ovpn/ovpn_crl_updater.sh

diff --git a/config/ovpn/ovpn_crl_updater.sh b/config/ovpn/ovpn_crl_updater.sh new file mode 100644 index 0000000..309edc2 --- /dev/null +++ b/config/ovpn/ovpn_crl_updater.sh @@ -0,0 +1,53 @@ +#!/bin/bash

The file needs a GPL header here or what ever license you choose this will be.

OK, I think i would use then GPL 3 like IPFire.

...

+# +# Script Name: ovpn_crl_updater.sh +# Description: This script checks the "Next Update:" field of the CRL and renews it if needed, +# which prevents the expiration of OpenVPNs CRL. +# With OpenVPN 2.4.x the CRL handling has been refactored, +# whereby the verification logic has been removed from ssl_verify_<backend>.c . +# See for more infos: +# https://github.com/OpenVPN/openvpn/commit/160504a2955c4478cd2c0323452929e070... +# +# Run Information: If OpenVPNs CRL is presant, +# this script provides a cronjob which checks daily if an update of the CRL is needed. +# If the expiring date reaches the value (defined in the 'UPDATE' variable in days) +# before the CRL expiration, an openssl command will be executed to renew the CRL. +# The renewing of the CRL will be logged into /var/log/messages. +# +# Author: Erik Kapfer +# +# Date: 17.01.2018 +# +###############################################################################################

+# Check if OpenVPN is active or if the CRL is presant +if [ ! -e "/var/ipfire/ovpn/crls/cacrl.pem" ]; then

• exit 0;

+fi

+## Paths +OVPN="/var/ipfire/ovpn"; +CRL="${OVPN}/crls/cacrl.pem"; +CAKEY="${OVPN}/ca/cakey.pem"; +CACERT="${OVPN}/ca/cacert.pem"; +OPENSSLCONF="${OVPN}/openssl/ovpn.cnf";

You may use some empty lines here to make the coder easier to read.

Done.

...

+## Values +# CRL check for the the 'Next Update:' in seconds +EXPIRINGDATEINSEC="$(( $(date -d "$(openssl crl -in "${CRL}" -text | grep -oP 'Next Update: *\K.*')" +%s) - $(date +%s) ))";

Complicated command. Can we break this down a little bit? Code doesn't necessarily run faster when everything is just one line, but it will be way easier to understand.

Done.

...

+# Day in seconds to calculate +DAYINSEC="86400";

No ; needed here and everywhere else...

It's shell, not C.

OK :-) done

...

+# Convert seconds to days +NEXTUPDATE="$((EXPIRINGDATEINSEC / DAYINSEC))"; +# Update of the CRL in days before CRL expiring date +UPDATE="2";

I think we should update every 14 days if the usual expiry time is 30. Therefore we will never get too close by accident.

So i would need then an frcontab entry and another location for the script since the fcron directories provides only daily, weekly and monthly. Another possibility might be a weekly check so we can use the fcron directories ?

...

+# Check if OpenVPNs CRL needs to be renewed +if [ "${NEXTUPDATE}" -le "${UPDATE}" ]; then

• openssl ca -gencrl -keyfile "${CAKEY}" -cert "${CACERT}" -out "${CRL}" -config "${OPENSSLCONF}";
• logger -t openssl "OpenVPN CRL has been renewed";

+fi

You don't need the quotes around the integer comparison.

Done

Should we catch any errors of the openssl command?

OK i would then use may a '2>&1 | logger -i -t openvpn' instead so we get an OpenSSL command output in messages if the CRL has been renewed.

I think the logging tag should rather be openvpn instead of openssl.

Done.

...

+exit 0

+# EOF diff --git a/lfs/openvpn b/lfs/openvpn index a925f78..1e1ddc2 100644 --- a/lfs/openvpn +++ b/lfs/openvpn @@ -96,6 +96,10 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) mv -v /var/ipfire/ovpn/verify /usr/lib/openvpn/verify chown root:root /usr/lib/openvpn/verify chmod 755 /usr/lib/openvpn/verify

• # Add crl updater
• mv -v /var/ipfire/ovpn/ovpn_crl_updater.sh /etc/fcron.daily
• chown root:root /etc/fcron.daily/ovpn_crl_updater.sh
• chmod 750 /etc/fcron.daily/ovpn_crl_updater.sh

Can we rename the script to openvpn-crl-updater?

Done.

...

@rm -rf $(DIR_APP) @$(POSTBUILD)

Apart from that this looks good. Just minor stuff.

Great that you looked over it.

Best, -Michael

Greetings,

Erik

Hi,

On Tue, 2018-02-06 at 21:09 +0100, Erik Kapfer wrote:

Update script for OpenVPNs CRL cause OpenVPN refactors the CRL handling since v.2.4.0 . Script checks the next update field from the CRL and executes an update before it expires. Script is placed under fcron.daily for daily checks.

Signed-off-by: Erik Kapfer erik.kapfer@ipfire.org

config/ovpn/openvpn-crl-updater | 88 +++++++++++++++++++++++++++++++++++++++++ config/rootfiles/common/openvpn | 1 + lfs/openvpn | 6 +++ 3 files changed, 95 insertions(+) create mode 100644 config/ovpn/openvpn-crl-updater

diff --git a/config/ovpn/openvpn-crl-updater b/config/ovpn/openvpn-crl-updater new file mode 100644 index 0000000..9063b04 --- /dev/null +++ b/config/ovpn/openvpn-crl-updater @@ -0,0 +1,88 @@ +#!/bin/bash

+############################################################################# ############

There is an extra empty line before the header and an extra hash in the first line of the header.

+# # +# This file is part of the IPFire Firewall. # +# # +# IPFire is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# IPFire is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with IPFire. If not, see http://www.gnu.org/licenses/. # +# # +# Copyright (C) 2007 IPFire-Team info@ipfire.org. # +# # +############################################################################# ############ +# # +# Script Name: openvpn-crl-updater # +# Description: This script checks the "Next Update:" field of the CRL # +# and renews it if needed, which prevents the expiration of OpenVPNs CRL. # +# With OpenVPN 2.4.x the CRL handling has been refactored, # +# whereby the verification logic has been removed from ssl_verify_<backend>.c . # +# For more infos: # +# https://github.com/OpenVPN/openvpn/commit/160504a2955c4478cd2c0323452929e 07016a336 # +# # +# Run Information: If OpenVPNs CRL is presant,

*present*

#

+# this script provides a cronjob which checks daily if an update of the CRL # +# is needed. If the expiring date reaches the value # +# (defined in the 'UPDATE' variable in days) before the CRL expiration, an openssl # +# command will be executed to renew the CRL. # +# Script execution will be logged into /var/log/messages. # +# # +# Author: Erik Kapfer # +# # +# Date: 06.02.2018

Dates are not required. Git does this for us.

# +# # +############################################################################# ############

+# Check if OpenVPN is active or if the CRL is presant +if [ ! -e "/var/ipfire/ovpn/crls/cacrl.pem" ]; then

• exit 0;

+fi

You got a hardcoded path here. Variables are set after this. It probably makes sense to move the check after the initialisation block and then check things and/or exit.

+## Paths +OVPN="/var/ipfire/ovpn" +CRL="${OVPN}/crls/cacrl.pem" +CAKEY="${OVPN}/ca/cakey.pem" +CACERT="${OVPN}/ca/cacert.pem" +OPENSSLCONF="${OVPN}/openssl/ovpn.cnf"

+## Values +# CRL check for the 'Next Update:' in seconds +EXPIRINGDATEINSEC="$(( +$(/bin/date -d "$(/usr/bin/openssl crl -in "${CRL}" -text | \

• /bin/grep -oP 'Next Update: *\K.*')" +%s) - \
• $(/bin/date +%s) \

+))"

You never need to use "/bin" or so before a command. The shell will find it. Just use date, grep, and (further down) openssl.

And I didn't mean just breaking the lines. I meant splitting this into smaller chunks that are easy to understand and modify if we need to. Like:

NOW="$(date "+%s")" EXPIRES_AT="$(openssl ... | grep ...)"

# Convert into seconds from epoch EXPIRES_AT="$(date "${EXPIRES_AT}" "+%s")"

EXPIRINGDATEINSEC=$(( EXPIRES_AT - NOW ))

I find this way easier to read and audit and it will execute in the same amount of time.

+# Day in seconds to calculate +DAYINSEC="86400"

+# Convert seconds to days +NEXTUPDATE="$((EXPIRINGDATEINSEC / DAYINSEC))"

Here this is super easy to read and understand. Way better.

+# Update of the CRL in days before CRL expiring date +UPDATE="14"

+# Check if OpenVPNs CRL needs to be renewed +if [ ${NEXTUPDATE} -le ${UPDATE} ]; then

• if /usr/bin/openssl ca -gencrl -keyfile "${CAKEY}" -cert "${CACERT}" -out

"${CRL}" -config "${OPENSSLCONF}"; then

• logger -t openvpn "CRL has been updated"
• else
• logger -t openvpn "error: Could not update CRL"
• fi

+fi

+exit 0

+# EOF

diff --git a/config/rootfiles/common/openvpn b/config/rootfiles/common/openvpn index 2b63424..131d798 100644 --- a/config/rootfiles/common/openvpn +++ b/config/rootfiles/common/openvpn @@ -1,3 +1,4 @@ +etc/fcron.daily/openvpn-crl-updater #usr/include/openvpn-msg.h #usr/include/openvpn-plugin.h #usr/lib/openvpn diff --git a/lfs/openvpn b/lfs/openvpn index 3913f02..1ecc18c 100644 --- a/lfs/openvpn +++ b/lfs/openvpn @@ -96,5 +96,11 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) mv -v /var/ipfire/ovpn/verify /usr/lib/openvpn/verify chown root:root /usr/lib/openvpn/verify chmod 755 /usr/lib/openvpn/verify

• # Add crl updater
• mv -v /var/ipfire/ovpn/openvpn-crl-updater /etc/fcron.daily
• chown root:root /etc/fcron.daily/openvpn-crl-updater
• chmod 750 /etc/fcron.daily/openvpn-crl-updater
• @rm -rf $(DIR_APP) @$(POSTBUILD)

There is an extra empty line at the end of the LFS file.

Best, -Michael

Hello,

I merged this patch into the openssl-11 branch and rebased the branch.

What other steps are urgently necessary that we can roll out OpenVPN 2.4? Are the CGI changes necessary or new features?

Best, -Michael

On Wed, 2018-02-07 at 18:31 +0100, Erik Kapfer wrote:

Update script for OpenVPNs CRL cause OpenVPN refactors the CRL handling since v.2.4.0 . Script checks the next update field from the CRL and executes an update before it expires. Script is placed under fcron.daily for daily checks.

Signed-off-by: Erik Kapfer erik.kapfer@ipfire.org

config/ovpn/openvpn-crl-updater | 90 +++++++++++++++++++++++++++++++++++++++++ config/rootfiles/common/openvpn | 1 + lfs/openvpn | 5 +++ 3 files changed, 96 insertions(+) create mode 100644 config/ovpn/openvpn-crl-updater

diff --git a/config/ovpn/openvpn-crl-updater b/config/ovpn/openvpn-crl-updater new file mode 100644 index 0000000..5fbe210 --- /dev/null +++ b/config/ovpn/openvpn-crl-updater @@ -0,0 +1,90 @@ +#!/bin/bash +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2018 IPFire Team erik.kapfer@ipfire.org # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see http://www.gnu.org/licenses/. # +# # +###############################################################################

+############################################################################### +# # +# Script Location/Name: /etc/fcron.daily/openvpn-crl-updater # +# # +# Description: This script checks the "Next Update:" field of the CRL # +# and renews it if needed, which prevents the expiration of OpenVPNs CRL. # +# With OpenVPN 2.4.x the CRL handling has been refactored, # +# whereby the verification logic has been removed # +# from ssl_verify_<backend>.c . # +# # +# Run Information: If OpenVPNs CRL is present, # +# this script provides a cronjob which checks daily if an update # +# of the CRL is needed. If the expiring date reaches the value # +# (defined in the 'UPDATE' variable in days) before the CRL expiration, # +# an openssl command will be executed to renew the CRL. # +# Script execution will be logged into /var/log/messages. # +# # +###############################################################################

+## Paths +OVPN="/var/ipfire/ovpn" +CRL="${OVPN}/crls/cacrl.pem" +CAKEY="${OVPN}/ca/cakey.pem" +CACERT="${OVPN}/ca/cacert.pem" +OPENSSLCONF="${OVPN}/openssl/ovpn.cnf"

+# Check if CRL is presant or if OpenVPN is active +if [ ! -e "${CAKEY}" ]; then

• exit 0;

+fi

+## Values +# Actual time in epoch format +NOW="$(date +%s)"

+# Investigate CRLs 'Next Update' date +EXPIRES_CRL="$(openssl crl -in "${CRL}" -text | grep -oP 'Next Update: *\K.*')"

+# Convert 'Next Update:' date from epoch to seconds +EXPIRES_AT="$(date -d "${EXPIRES_CRL}" "+%s")"

+# Seconds left until CRL expires +EXPIRINGDATEINSEC="$(( EXPIRES_AT - NOW ))"

+# Day in seconds to calculate +DAYINSEC="86400"

+# Convert seconds to days +NEXTUPDATE="$(( EXPIRINGDATEINSEC / DAYINSEC ))"

+# Update of the CRL in days before CRL expiring date +UPDATE="14"

+## Mainpart +# Check if OpenVPNs CRL needs to be renewed +if [ ${NEXTUPDATE} -le ${UPDATE} ]; then

• if openssl ca -gencrl -keyfile "${CAKEY}" -cert "${CACERT}" -out "${CRL}" -config "${OPENSSLCONF}"; then

• logger -t openvpn "CRL has been updated"
  

• else

• logger -t openvpn "error: Could not update CRL"
  

• fi

+fi

+exit 0

+# EOF

diff --git a/config/rootfiles/common/openvpn b/config/rootfiles/common/openvpn index 2b63424..131d798 100644 --- a/config/rootfiles/common/openvpn +++ b/config/rootfiles/common/openvpn @@ -1,3 +1,4 @@ +etc/fcron.daily/openvpn-crl-updater #usr/include/openvpn-msg.h #usr/include/openvpn-plugin.h #usr/lib/openvpn diff --git a/lfs/openvpn b/lfs/openvpn index 3913f02..ef25c25 100644 --- a/lfs/openvpn +++ b/lfs/openvpn @@ -96,5 +96,10 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) mv -v /var/ipfire/ovpn/verify /usr/lib/openvpn/verify chown root:root /usr/lib/openvpn/verify chmod 755 /usr/lib/openvpn/verify

• # Add crl updater
• mv -v /var/ipfire/ovpn/openvpn-crl-updater /etc/fcron.daily
• chown root:root /etc/fcron.daily/openvpn-crl-updater
• chmod 750 /etc/fcron.daily/openvpn-crl-updater
• @rm -rf $(DIR_APP) @$(POSTBUILD)