wiki:BuildingOnWindows

Version 42 (modified by Samuli Seppänen, 13 years ago) (diff)

--

Introduction

The traditional way to build OpenVPN for Windows is to cross-compile it on *NIX. This works, but does not allow signing the TUN/TAP driver, which is required for Windows Vista/7 and later. Due to this a new, relatively simple Python-based build system was written. This new build system allows building OpenVPN on Windows more easily, but requires the use of a commercial version of Visual Studio development environment. However, the new build system is "external" from Visual Studio's viewpoint, so meddling with VS's graphical user interface is not necessary.

Installing prequisites

Visual Studio 2008 Professional

Visual Studio 2008 Professional is required to build OpenVPN on Windows. Note that the free Express edition might not work. Also make sure you select "Typical installation", not "Full installation". Full installation installs x86 cross-tools which can cause nasty, hard to debug issues. See Troubleshooting section for details.

Windows Software Development Kit

Windows Software Development Kit (Wikipedia page) may be necessary to build OpenVPN (verify this).

Windows Driver Kit

Windows Driver Kit (Wikipedia page) is required to build the TUN/TAP driver.

Python

The new Windows build system is written in Python. The Windows installer does not seem to add the python.exe to the PATH, so you need to do it [manually.

WinRAR

WinRAR or some other tool capable of extracting .tar.gz and .tar.bz2 archives is necessary to extract the LZO and OpenSSL release archives.

ActivePerl

ActivePerl is required to build OpenSSL, which in turn is required to build OpenVPN. Look here for details. Probably a standard Perl installation would also do the trick.

Installing optional Git support

Git support is needed if you want to conveniently build the latest development code. You don't need Git support if you fetch the sources from another computer and copy them over, or use source code from release tar.gz or zip files.

Git for Windows

Git for Windows or msysgit is required to work with Git repositories on Windows.

GitExtensions

GitExtensions makes working with Git easier on Windows. It includes Visual Studio 2008 plugin, Windows explorer support and a GUI to configure and use Git repositories.

KDiff3

KDiff3 is used in handling merge conflicts. It's required by GitExtensions.

Git Source Control Provider

Git Source Control Provider is a Visual Studio 2008/2010 plugin. It can also be used to launch Git for Windows and GitExtensions from within Visual Studio.

Building pkcs11-helper

Download latest release of pkcs11-helper from http://www.opensc-project.org and extract it somewhere. The install process for Visual Studio is described in the INSTALL file.

To build pkcs11-helper, do the following:

  • Go to pkcs11-helper-<version>/lib
  • Copy <openssl-install-directory>/lib/libeay32.lib to that directory - this is required by the linker
  • Run nmake -f Makefile.w32-vc OPENSSL=1 OPENSSL_HOME=<path-to-openssl-sources>

In theory this should do it. If you need to rebuild, clean up first with

$ nmake -f Makefile.w32-vc clean

and then repeat the above steps. Unless you're using very latest development code, you probably get this error message during build:

pkcs11h-threading.c(477) : error C2036: 'void *' : unknown size

If so, edit that file as suggested here. After this build should succeed, as long as libeay32.lib is present in the build directory.

Building OpenSSL

First download OpenSSL from here and extract it somewhere. Using the latest one ensures there are no (known) security holes in OpenSSL. For the most part you can then follow the instructions in INSTALL.W32 and INSTALL.W64 files. Before you start, though, launch the Visual Studio 2008 Command Prompt, which can be found from the Start menu. Unlike the standard command prompt it has all the paths to VC binaries set correctly.

From within this command prompt you'll first configure OpenSSL using the provided Perl script:

C:\openssl-1.0.0> perl Configure VC-WIN32 --prefix=c:/<openssl-install-directory>

Some of the crypto routines are written in assembler to increase performance, so you need to/should use an assembler in the next step. If you're building OpenSSL 0.9.8x you can choose between Microsoft Macro Assembler and NASM assembler. On OpenSSL-1.0.0 you need to use NASM as MASM is not supported anymore. Note that you need to add nasm.exe to the PATH. There are good generic instructions here.

If you're using MASM, run

C:\openssl-1.0.0> ms\do_masm

Or if you're using NASM, run

C:\openssl-1.0.0> ms\do_nasm

Next compile OpenSSL using the generated makefile:

C:\openssl-1.0.0> '''nmake -f ms\ntdll.mak'''
C:\openssl-1.0.0> nmake -f ms\ntdll.mak test
C:\openssl-1.0.0> nmake -f ms\ntdll.mak install 

Building LZO

The LZO library is required to build OpenVPN. Once you've unpacked the source package, open the B/00README.txt file to get an overview of the Windows build process. If all goes well, you'll only need to run one .bat file:

C:\lzo-2.0.4> B\win32\vc_dll.bat

Note that this does not install lzo; in fact, you need to copy the relevant files to openvpn's build directory manually as shown below.

Building OpenVPN

If you want to build the latest development code fetch it using Git for Windows (Git shell) or GitExtensions (GUI). Check these instructions to see which Git URI to use.

The Python-based OpenVPN build system is pretty picky about it's directory layout, which should be like this:

  • C:\openvpn-build: root build directory
  • C:\openvpn-build\openvpn-testing: openvpn sources fetched from git should directly
  • C:\openvpn-build\tapinstall\7600: directory containing Devcon.exe sources, which can be found from C:\WINDDK\7600.16385.1\src\setup\devcon. As you can see, the last part of the tapinstall directory path depends on the major version of WINDDK. Note that in OpenVPN world Devcon.exe is also confusingly also known as tapinstall.exe.
  • C:\openvpn-build\openssl: copy of the openssl install directory which contains the openssl libraries you built earlier. It's location depends on the parameter --prefix paramter you when configuring the openssl build.
  • C:\openvpn-build\lzo\include: this directory is a copy of the include directory in the lzo source package
  • C:\openvpn-build\lzo\bin: this directory must contain the lzo2.dll file generated during lzo build
  • C:\openvpn-build\lzo\lib: this directory must contain the lzo2.lib file generated during lzo build
  • C:\openvpn-build\Microsoft.VC90.CRT: this directory is a copy of C:\Program Files\MicrosofT Visual Studio 9.0\VC\redist\x86\Microsoft.VC90.CRT directory. The exact path may vary.
  • C:\openvpn-build\signtool. a directory containing signtool.exe. This tool can be found from the Microsoft SDK directory (e.g. C:\Program Files\Microsoft SDKs\Windows\V6.0A\bin).

After setting up the directories, you should check win\settings.in file to see if any variables need modifications. Also, the build will fail unless you comment out a few lines from options.c:

--- snip ---

/* #include "configure.h" */

--- snip ---

static void
usage_version (void)
{
  msg (M_INFO|M_NOPREFIX, "%s", title_string);
  msg (M_INFO|M_NOPREFIX, "Originally developed by James Yonan");
  msg (M_INFO|M_NOPREFIX, "Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>");

/* Begin commented section

#ifndef ENABLE_SMALL
#ifdef CONFIGURE_CALL
  msg (M_INFO|M_NOPREFIX, "\n%s\n", CONFIGURE_CALL);
#endif
  msg (M_INFO|M_NOPREFIX, "Compile time defines: %s", CONFIGURE_DEFINES);
#endif

End commented section */

  openvpn_exit (OPENVPN_EXIT_STATUS_USAGE); /* exit point */

Make sure to use a UNIX linefeed-capable editor such as wordpad to do this.

Next fire up a console/MS DOS prompt and go to the win directory and start the build:

C:\openvpn-testing\win> python build_all.py

To clean up before or after the build, issue

C:\openvpn-testing\win> python build.py clean

In theory this should do the trick. If you want to disable driver signing, you need comments out a two lines in win\build_all.py:

#from sign import main as sign

def main(config):
    config_all(config)
    build_openvpn()
    build_ddk(config, 'tap', 'all')
    build_ddk(config, 'tapinstall', 'all')
    #sign(config, 'all')
    make_dist(config)

Integrating Git with Visual Studio (optional)

If you wish to use Windows for OpenVPN development integrating Git with Visual Studio (2008) may make sense.

Troubleshooting

Compiler warnings during OpenSSL build

When building OpenSSL you're most likely encounter issues with trivial compiler warnings stopping the entire build. To circumvent this remove the /WX flag in the makefile as suggested in INSTALL.W32 file. This is harder than it seems for two reasons:

  • The correct makefile is ms\ntdll.mak (not the Makefile in build root)
  • You need to use Wordpad or other UNIX linefeed-aware editor to open and save the makefile

VS 2008 cross-tools issues during OpenSSL build

OpenSSL build is likely to break at several places if you're running Visual Studio 2008 x64 Cross-Tools Command Prompt instead of plain Visual Studio 2008 Command prompt. Consider reinstalling Visual Studio without cross-tools if you encounter either of these errors:

  • fatal error LNK1112: module machine type X86 conflicts with target machine type x64 (in the middle of the build)
  • Linker can't find link.obj (at the end of the build)

External links