OpenVPN update to v2.4.0, old version in openvpn23*.

OpenVPN has been updated to v2.4.0.
Changes: <https://github.com/OpenVPN/openvpn/blob/v2.4.0/Changes.rst>

openvpn-polarssl has been renamed to openvpn-mbedtls to match the TLS
library's change of name.

The prior versions of the openvpn ports have been preserved in openvpn23
and openvpn23-polarssl, respectively, and are set to expire 2017-03-31.

1 files changed, 186 insertions, 186 deletions

diff --git a/security/openvpn/files/extra-tunnelblick-openvpn_xorpatch b/security/openvpn/files/extra-tunnelblick-openvpn_xorpatch
index 690b86b83e16..63e73bae2b08 100644
--- a/security/openvpn/files/extra-tunnelblick-openvpn_xorpatch
+++ b/security/openvpn/files/extra-tunnelblick-openvpn_xorpatch
@@ -10,128 +10,129 @@ detail on the following wiki page:
 
 https://tunnelblick.net/cOpenvpn_xorpatch.html
 
+The patch was ported to OpenVPN 2.4 by OPNsense.
 
---- src/openvpn/forward.c.orig	2016-08-23 14:16:28 UTC
+--- src/openvpn/forward.c.orig	2016-12-22 07:25:18 UTC
 +++ src/openvpn/forward.c
-@@ -674,7 +674,10 @@ read_incoming_link (struct context *c)
+@@ -730,7 +730,10 @@ read_incoming_link(struct context *c)
  
-   status = link_socket_read (c->c2.link_socket,
- 			     &c->c2.buf,
--			     &c->c2.from);
-+			     &c->c2.from,
-+			     c->options.ce.xormethod,
-+			     c->options.ce.xormask,
-+			     c->options.ce.xormasklen);
+     status = link_socket_read(c->c2.link_socket,
+                               &c->c2.buf,
+-                              &c->c2.from);
++                              &c->c2.from,
++                              c->options.ce.xormethod,
++                              c->options.ce.xormask,
++                              c->options.ce.xormasklen);
  
-   if (socket_connection_reset (c->c2.link_socket, status))
+     if (socket_connection_reset(c->c2.link_socket, status))
      {
-@@ -1151,7 +1154,10 @@ process_outgoing_link (struct context *c
- 	    /* Send packet */
- 	    size = link_socket_write (c->c2.link_socket,
- 				      &c->c2.to_link,
--				      to_addr);
-+				      to_addr,
-+				      c->options.ce.xormethod,
-+				      c->options.ce.xormask,
-+				      c->options.ce.xormasklen);
+@@ -1368,7 +1371,10 @@ process_outgoing_link(struct context *c)
+                 /* Send packet */
+                 size = link_socket_write(c->c2.link_socket,
+                                          &c->c2.to_link,
+-                                         to_addr);
++                                         to_addr,
++                                         c->options.ce.xormethod,
++                                         c->options.ce.xormask,
++                                         c->options.ce.xormasklen);
  
- #ifdef ENABLE_SOCKS
- 	    /* Undo effect of prepend */
---- src/openvpn/options.c.orig	2016-08-23 14:16:22 UTC
+                 /* Undo effect of prepend */
+                 link_socket_write_post_size_adjust(&size, size_delta, &c->c2.to_link);
+--- src/openvpn/options.c.orig	2016-12-22 07:25:18 UTC
 +++ src/openvpn/options.c
-@@ -792,6 +792,9 @@ init_options (struct options *o, const b
-   o->max_routes = MAX_ROUTES_DEFAULT;
-   o->resolve_retry_seconds = RESOLV_RETRY_INFINITE;
-   o->proto_force = -1;
-+  o->ce.xormethod = 0;
-+  o->ce.xormask = "\0";
-+  o->ce.xormasklen = 0;
+@@ -811,6 +811,9 @@ init_options(struct options *o, const bo
+     o->resolve_retry_seconds = RESOLV_RETRY_INFINITE;
+     o->resolve_in_advance = false;
+     o->proto_force = -1;
++    o->ce.xormethod = 0;
++    o->ce.xormask = "\0";
++    o->ce.xormasklen = 0;
  #ifdef ENABLE_OCC
-   o->occ = true;
+     o->occ = true;
  #endif
-@@ -907,6 +910,9 @@ setenv_connection_entry (struct env_set 
-   setenv_int_i (es, "local_port", e->local_port, i);
-   setenv_str_i (es, "remote", e->remote, i);
-   setenv_int_i (es, "remote_port", e->remote_port, i);
-+  setenv_int_i (es, "xormethod", e->xormethod, i);
-+  setenv_str_i (es, "xormask", e->xormask, i);
-+  setenv_int_i (es, "xormasklen", e->xormasklen, i);
+@@ -972,6 +975,9 @@ setenv_connection_entry(struct env_set *
+     setenv_str_i(es, "local_port", e->local_port, i);
+     setenv_str_i(es, "remote", e->remote, i);
+     setenv_str_i(es, "remote_port", e->remote_port, i);
++    setenv_int_i(es, "xormethod", e->xormethod, i);
++    setenv_str_i(es, "xormask", e->xormask, i);
++    setenv_int_i(es, "xormasklen", e->xormasklen, i);
  
- #ifdef ENABLE_HTTP_PROXY
-   if (e->http_proxy_options)
-@@ -1366,6 +1372,9 @@ show_connection_entry (const struct conn
-   SHOW_INT (connect_retry_seconds);
-   SHOW_INT (connect_timeout);
-   SHOW_INT (connect_retry_max);
-+  SHOW_INT (xormethod);
-+  SHOW_STR (xormask);
-+  SHOW_INT (xormasklen);
+     if (e->http_proxy_options)
+     {
+@@ -1474,6 +1480,9 @@ show_connection_entry(const struct conne
+     SHOW_BOOL(bind_ipv6_only);
+     SHOW_INT(connect_retry_seconds);
+     SHOW_INT(connect_timeout);
++    SHOW_INT(xormethod);
++    SHOW_STR(xormask);
++    SHOW_INT(xormasklen);
  
- #ifdef ENABLE_HTTP_PROXY
-   if (o->http_proxy_options)
-@@ -5131,6 +5140,46 @@ add_option (struct options *options,
-       options->proto_force = proto_force;
-       options->force_connection_list = true;
+     if (o->http_proxy_options)
+     {
+@@ -5915,6 +5924,46 @@ add_option(struct options *options,
+         }
+         options->proto_force = proto_force;
      }
-+  else if (streq (p[0], "scramble") && p[1])
++    else if (streq (p[0], "scramble") && p[1])
 +    {
-+      VERIFY_PERMISSION (OPT_P_GENERAL|OPT_P_CONNECTION);
-+      if (streq (p[1], "xormask") && p[2] && (!p[3]))
-+	{
-+	  options->ce.xormethod = 1;
-+	  options->ce.xormask = p[2];
-+	  options->ce.xormasklen = strlen(options->ce.xormask);
-+	}
-+      else if (streq (p[1], "xorptrpos") && (!p[2]))
-+	{
-+	  options->ce.xormethod = 2;
-+	  options->ce.xormask = NULL;
-+	  options->ce.xormasklen = 0;
-+	}
-+      else if (streq (p[1], "reverse") && (!p[2]))
-+	{
-+	  options->ce.xormethod = 3;
-+	  options->ce.xormask = NULL;
-+	  options->ce.xormasklen = 0;
-+	}
-+      else if (streq (p[1], "obfuscate") && p[2] && (!p[3]))
-+	{
-+	  options->ce.xormethod = 4;
-+	  options->ce.xormask = p[2];
-+	  options->ce.xormasklen = strlen(options->ce.xormask);
-+	}
-+      else if (!p[2])
-+	{
-+	  msg (M_WARN, "WARNING: No recognized 'scramble' method specified; using 'scramble xormask \"%s\"'", p[1]);
-+	  options->ce.xormethod = 1;
-+	  options->ce.xormask = p[1];
-+	  options->ce.xormasklen = strlen(options->ce.xormask);
-+	}
-+      else
-+	{
-+	  msg (msglevel, "No recognized 'scramble' method specified or extra parameters for 'scramble'");
-+	  goto err;
-+	}
++        VERIFY_PERMISSION (OPT_P_GENERAL|OPT_P_CONNECTION);
++        if (streq (p[1], "xormask") && p[2] && (!p[3]))
++        {
++            options->ce.xormethod = 1;
++            options->ce.xormask = p[2];
++            options->ce.xormasklen = strlen(options->ce.xormask);
++        }
++        else if (streq (p[1], "xorptrpos") && (!p[2]))
++        {
++            options->ce.xormethod = 2;
++            options->ce.xormask = NULL;
++            options->ce.xormasklen = 0;
++        }
++        else if (streq (p[1], "reverse") && (!p[2]))
++        {
++            options->ce.xormethod = 3;
++            options->ce.xormask = NULL;
++            options->ce.xormasklen = 0;
++        }
++        else if (streq (p[1], "obfuscate") && p[2] && (!p[3]))
++        {
++            options->ce.xormethod = 4;
++            options->ce.xormask = p[2];
++            options->ce.xormasklen = strlen(options->ce.xormask);
++        }
++        else if (!p[2])
++        {
++            msg(M_WARN, "WARNING: No recognized 'scramble' method specified; using 'scramble xormask \"%s\"'", p[1]);
++            options->ce.xormethod = 1;
++            options->ce.xormask = p[1];
++            options->ce.xormasklen = strlen(options->ce.xormask);
++        }
++        else
++        {
++            msg(msglevel, "No recognized 'scramble' method specified or extra parameters for 'scramble'");
++            goto err;
++        }
 +    }
- #ifdef ENABLE_HTTP_PROXY
-   else if (streq (p[0], "http-proxy") && p[1])
+     else if (streq(p[0], "http-proxy") && p[1] && !p[5])
      {
---- src/openvpn/options.h.orig	2016-08-23 14:16:22 UTC
+         struct http_proxy_options *ho;
+--- src/openvpn/options.h.orig	2016-12-22 07:25:18 UTC
 +++ src/openvpn/options.h
-@@ -100,6 +100,9 @@ struct connection_entry
-   int connect_retry_max;
-   int connect_timeout;
-   bool connect_timeout_defined;
-+  int xormethod;
-+  const char *xormask;
-+  int xormasklen;
- #ifdef ENABLE_HTTP_PROXY
-   struct http_proxy_options *http_proxy_options;
- #endif  
---- src/openvpn/socket.c.orig	2016-08-23 14:16:22 UTC
+@@ -98,6 +98,9 @@ struct connection_entry
+     int connect_retry_seconds;
+     int connect_retry_seconds_max;
+     int connect_timeout;
++    int xormethod;
++    const char *xormask;
++    int xormasklen;
+     struct http_proxy_options *http_proxy_options;
+     const char *socks_proxy_server;
+     const char *socks_proxy_port;
+--- src/openvpn/socket.c.orig	2016-12-22 07:25:18 UTC
 +++ src/openvpn/socket.c
-@@ -52,6 +52,53 @@ const int proto_overhead[] = { /* indexe
-   IPv6_TCP_HEADER_SIZE,
+@@ -55,6 +55,53 @@ const int proto_overhead[] = { /* indexe
+     IPv6_TCP_HEADER_SIZE,
  };
  
 +int buffer_mask (struct buffer *buf, const char *mask, int xormasklen) {
@@ -184,9 +185,9 @@ https://tunnelblick.net/cOpenvpn_xorpatch.html
  /*
   * Convert sockflags/getaddr_flags into getaddr_flags
   */
---- src/openvpn/socket.h.orig	2016-08-23 14:16:22 UTC
+--- src/openvpn/socket.h.orig	2016-12-22 07:25:18 UTC
 +++ src/openvpn/socket.h
-@@ -245,6 +245,10 @@ struct link_socket
+@@ -249,6 +249,10 @@ struct link_socket
  #endif
  };
  
@@ -197,100 +198,99 @@ https://tunnelblick.net/cOpenvpn_xorpatch.html
  /*
   * Some Posix/Win32 differences.
   */
-@@ -873,30 +877,56 @@ int link_socket_read_udp_posix (struct l
+@@ -1046,30 +1050,55 @@ int link_socket_read_udp_posix(struct li
  static inline int
- link_socket_read (struct link_socket *sock,
- 		  struct buffer *buf,
--		  struct link_socket_actual *from)
-+		  struct link_socket_actual *from,
-+		  int xormethod,
-+		  const char *xormask,
-+		  int xormasklen)
+ link_socket_read(struct link_socket *sock,
+                  struct buffer *buf,
+-                 struct link_socket_actual *from)
++                 struct link_socket_actual *from,
++                 int xormethod,
++                 const char *xormask,
++                 int xormasklen)
  {
-+  int res;
-   if (proto_is_udp(sock->info.proto)) /* unified UDPv4 and UDPv6 */
++    int res;
++
+     if (proto_is_udp(sock->info.proto)) /* unified UDPv4 and UDPv6 */
      {
--      int res;
- 
- #ifdef WIN32
-       res = link_socket_read_udp_win32 (sock, buf, from);
+-        int res;
+-
+ #ifdef _WIN32
+         res = link_socket_read_udp_win32(sock, buf, from);
  #else
-       res = link_socket_read_udp_posix (sock, buf, from);
+         res = link_socket_read_udp_posix(sock, buf, from);
  #endif
--      return res;
+-        return res;
      }
-   else if (proto_is_tcp(sock->info.proto)) /* unified TCPv4 and TCPv6 */
+     else if (proto_is_tcp(sock->info.proto)) /* unified TCPv4 and TCPv6 */
      {
-       /* from address was returned by accept */
-       addr_copy_sa(&from->dest, &sock->info.lsa->actual.dest);
--      return link_socket_read_tcp (sock, buf);
-+      res = link_socket_read_tcp (sock, buf);
+         /* from address was returned by accept */
+         addr_copy_sa(&from->dest, &sock->info.lsa->actual.dest);
+-        return link_socket_read_tcp(sock, buf);
++        res = link_socket_read_tcp(sock, buf);
      }
-   else
+     else
      {
-       ASSERT (0);
-       return -1; /* NOTREACHED */
+         ASSERT(0);
+         return -1; /* NOTREACHED */
      }
-+  switch(xormethod)
-+    {
-+      case 0:
-+       break;
-+      case 1:
-+       buffer_mask(buf,xormask,xormasklen);
-+       break;
-+      case 2:
-+       buffer_xorptrpos(buf);
-+       break;
-+      case 3:
-+       buffer_reverse(buf);
-+       break;
-+      case 4:
-+       buffer_mask(buf,xormask,xormasklen);
-+       buffer_xorptrpos(buf);
-+       buffer_reverse(buf);
-+       buffer_xorptrpos(buf);
-+       break;
-+      default:
-+       ASSERT (0);
-+       return -1; /* NOTREACHED */
++    switch (xormethod) {
++    case 0:
++        break;
++    case 1:
++        buffer_mask(buf,xormask,xormasklen);
++        break;
++    case 2:
++        buffer_xorptrpos(buf);
++        break;
++    case 3:
++        buffer_reverse(buf);
++        break;
++    case 4:
++        buffer_mask(buf,xormask,xormasklen);
++        buffer_xorptrpos(buf);
++        buffer_reverse(buf);
++        buffer_xorptrpos(buf);
++        break;
++    default:
++        ASSERT (0);
++        return -1; /* NOTREACHED */
 +    }
-+  return res;
++    return res;
  }
  
  /*
-@@ -980,8 +1010,34 @@ link_socket_write_udp (struct link_socke
+@@ -1159,8 +1188,33 @@ link_socket_write_udp(struct link_socket
  static inline int
- link_socket_write (struct link_socket *sock,
- 		   struct buffer *buf,
--		   struct link_socket_actual *to)
-+		   struct link_socket_actual *to,
-+		   int xormethod,
-+		   const char *xormask,
-+		   int xormasklen)
+ link_socket_write(struct link_socket *sock,
+                   struct buffer *buf,
+-                  struct link_socket_actual *to)
++                  struct link_socket_actual *to,
++                  int xormethod,
++                  const char *xormask,
++                  int xormasklen)
  {
-+  switch(xormethod)
-+    {
-+      case 0:
-+       break;
-+      case 1:
-+       buffer_mask(buf,xormask,xormasklen);
-+       break;
-+      case 2:
-+       buffer_xorptrpos(buf);
-+       break;
-+      case 3:
-+       buffer_reverse(buf);
-+       break;
-+      case 4:
-+       buffer_xorptrpos(buf);
-+       buffer_reverse(buf);
-+       buffer_xorptrpos(buf);
-+       buffer_mask(buf,xormask,xormasklen);
-+       break;
-+      default:
-+       ASSERT (0);
-+       return -1; /* NOTREACHED */
++    switch (xormethod) {
++    case 0:
++        break;
++    case 1:
++        buffer_mask(buf,xormask,xormasklen);
++        break;
++    case 2:
++        buffer_xorptrpos(buf);
++        break;
++    case 3:
++        buffer_reverse(buf);
++        break;
++    case 4:
++        buffer_xorptrpos(buf);
++        buffer_reverse(buf);
++        buffer_xorptrpos(buf);
++        buffer_mask(buf,xormask,xormasklen);
++        break;
++    default:
++        ASSERT (0);
++        return -1; /* NOTREACHED */
 +    }
-   if (proto_is_udp(sock->info.proto)) /* unified UDPv4 and UDPv6 */
+     if (proto_is_udp(sock->info.proto)) /* unified UDPv4 and UDPv6 */
      {
-       return link_socket_write_udp (sock, buf, to);
+         return link_socket_write_udp(sock, buf, to);