PolarSSL v1.1.1 support

[palatinux]

In order to enable PolarSSL v.1.1.1 support for openvpn-2.3-alpha1, all functions containing the instruction 'havege_rand' should be changed to 'havege_random'

The Fortress Linux security team.
​https://www.fortresslinux.org

[andj]

Hi! Thanks for the bug report. The issue should be fixed a while ago, but the patches are waiting for the new build system to be included. For reference, please see:

​http://article.gmane.org/gmane.network.openvpn.devel/5689
​http://article.gmane.org/gmane.network.openvpn.devel/5693
​http://article.gmane.org/gmane.network.openvpn.devel/5688

[Palatinux]

Thanks, the first patch worked. Though the involvement of FOX-IT in OpenVPN may raise some supposition:

​https://forums.openvpn.net/topic10180.html

[Palatinux]

Sorry, I meant suspicion.

[David Sommerseth]

I've replied to the forum thread, in regards to the concerns of the Fox-IT involvement.

When it comes to Havege RNG support, that should be removed from OpenVPN 2.3. OpenVPN 2.3 will require PolarSSL v1.1 or newer, which supports better random generators.

commit 1d92d06dca5ac38990261cb546a766b91fc53f9b
Author: Adriaan de Jong <dejong@fox-it.com>
Date:   Mon Apr 2 09:28:05 2012 +0200

    Removed support for PolarSSL < 1.1
    
    PolarSSL 1.0 and earlier use only the Havege RNG. Havege is based on timing
    certain operations, using the RDTSC instruction. Although this is fine on
    bare metal PCs, the RDTSC instruction is virtualised on some virtual
    machine implementations. This can result in issues on those virtual
    machines. PolarSSL fixes this potential issue by also using platform
    entropy.
    
    To ensure that OpenVPN is always built against a decent RNG, PolarSSL <1.1
    is therefore no longer supported.
    
    Signed-off-by: Adriaan de Jong <dejong@fox-it.com>
    Acked-by: David Sommerseth <davids@redhat.com>
    Message-Id: 1333351687-3732-4-git-send-email-dejong@fox-it.com
    URL: http://article.gmane.org/gmane.network.openvpn.devel/6211
    Signed-off-by: David Sommerseth <davids@redhat.com>

And checking the source code for 2.3_beta1, I see this:

$ git grep havege_rand | wc -l
0
$

If you still feel this is not fully solved, please feel free to re-open this ticket.