diff mbox series

[Openvpn-devel] Add a warning that we do not officially support LibreSSL

Message ID 20180228231123.27782-1-steffan@karger.me
State New
Headers
Series [Openvpn-devel] Add a warning that we do not officially support LibreSSL |

Commit Message

Steffan Karger Feb. 28, 2018, 12:11 p.m. UTC 
  As discussed in the community meeting of 13-12-2017, we should warn our
users that LibreSSL is not officially supported.  We expect that it
currently works, but it might suddenly break or we might decide to no
longer build against LibreSSL in the future.

There seem to be ongoing efforts to make LibreSSL compatible with the
OpenSSL 1.1 API.  If they truly do that, it might also keep working.

For now, make sure people understand we do not really support LibreSSL.

Signed-off-by: Steffan Karger <steffan@karger.me>
---
 src/openvpn/options.c | 5 +++++
 1 file changed, 5 insertions(+)

Comments

Steffan Karger Feb. 28, 2018, 10:08 p.m. UTC | #1 
[resending because the list rejected my mail from yesterday...]

On 1 March 2018 at 00:11, Steffan Karger <steffan@karger.me> wrote:
> +    msg(M_WARN, "WARNING: This OpenVPN was built against LibreSSL. "
> +        "This might work, but is *not* supported and can break at any time.")

Gah, this of course needs a ; at the end of the line - forgot to amend
the commit before git send-email...

-Steffan

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
Gert Doering March 3, 2018, 10:08 p.m. UTC | #2 
Hi,

On Thu, Mar 01, 2018 at 12:11:23AM +0100, Steffan Karger wrote:
> As discussed in the community meeting of 13-12-2017, we should warn our
> users that LibreSSL is not officially supported.  We expect that it
> currently works, but it might suddenly break or we might decide to no
> longer build against LibreSSL in the future.

Generally speaking, I agree.

Should we also add a warning (+ sleep 60 to be extra-annoying?) to
configure if LibreSSL is detected?

gert
Steffan Karger March 3, 2018, 10:34 p.m. UTC | #3 
Hi,

On 04-03-18 10:08, Gert Doering wrote:
> On Thu, Mar 01, 2018 at 12:11:23AM +0100, Steffan Karger wrote:
>> As discussed in the community meeting of 13-12-2017, we should warn our
>> users that LibreSSL is not officially supported.  We expect that it
>> currently works, but it might suddenly break or we might decide to no
>> longer build against LibreSSL in the future.
> 
> Generally speaking, I agree.
> 
> Should we also add a warning (+ sleep 60 to be extra-annoying?) to
> configure if LibreSSL is detected?

I considered that (modulo the sleep 60) and wrote the code to do the
configure check, but then thought that a not-suppressible warning in the
logs would be sufficient.  I still think it is, but don't mind re-adding
it to configure.ac if you prefer that.

-Steffan
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
Jeremie Courreges-Anglas March 4, 2018, 5:22 a.m. UTC | #4 
On Sun, Mar 04 2018, Steffan Karger <steffan@karger.me> wrote:
> Hi,
>
> On 04-03-18 10:08, Gert Doering wrote:
>> On Thu, Mar 01, 2018 at 12:11:23AM +0100, Steffan Karger wrote:
>>> As discussed in the community meeting of 13-12-2017, we should warn our
>>> users that LibreSSL is not officially supported.  We expect that it
>>> currently works, but it might suddenly break or we might decide to no
>>> longer build against LibreSSL in the future.
>> 
>> Generally speaking, I agree.
>> 
>> Should we also add a warning (+ sleep 60 to be extra-annoying?) to
>> configure if LibreSSL is detected?
>
> I considered that (modulo the sleep 60) and wrote the code to do the
> configure check, but then thought that a not-suppressible warning in the
> logs would be sufficient.  I still think it is, but don't mind re-adding
> it to configure.ac if you prefer that.

As an OpenBSD developer and the maintainer of our OpenVPN port,
I certainly care about building and using OpenVPN with LibreSSL.
I have already provided patches in the past, and yesterday I pushed
compat glue in LibreSSL so that openvpn-2.4.5 can build on OpenBSD
(-current).

So I'm wondering what would be needed to consider LibreSSL "supported".

I hear that there are concerns over LibreSSL not being API-compatible
with OpenSSL.  As you may have noticed, LibreSSL recently introduced
lots of OpenSSL-1.1+ interfaces.  While there is no plan to support the
full OpenSSL-1.1 API (tons of functions were added, not all of them seem
useful...), the intent is to provide what the ecosystem actually needs.
I can probably serve as a bridge between the two projects here.

If you see other points where I - or anyone else - can help, please
share. :)
Arne Schwabe Jan. 22, 2019, 10:30 p.m. UTC | #5 
>> I considered that (modulo the sleep 60) and wrote the code to do the
>> configure check, but then thought that a not-suppressible warning in the
>> logs would be sufficient.  I still think it is, but don't mind re-adding
>> it to configure.ac if you prefer that.
> 
> As an OpenBSD developer and the maintainer of our OpenVPN port,
> I certainly care about building and using OpenVPN with LibreSSL.
> I have already provided patches in the past, and yesterday I pushed
> compat glue in LibreSSL so that openvpn-2.4.5 can build on OpenBSD
> (-current).
> 
> So I'm wondering what would be needed to consider LibreSSL "supported".
> 
> I hear that there are concerns over LibreSSL not being API-compatible
> with OpenSSL.  As you may have noticed, LibreSSL recently introduced
> lots of OpenSSL-1.1+ interfaces.  While there is no plan to support the
> full OpenSSL-1.1 API (tons of functions were added, not all of them seem
> useful...), the intent is to provide what the ecosystem actually needs.
> I can probably serve as a bridge between the two projects here.
> 
> If you see other points where I - or anyone else - can help, please
> share. :)
>

With my recent commits that use more OpenSSL 1.1.1 features building
with LibreSSL breaks again since it claims to be OpenSSL 2.0 or
something ridiculous like that. In my book claiming to support APIs you
don't even know is a bad move.

With the current situation I would also ACK this patch. I see no good
way at the moment for supporting LibreSSL.

Arne
diff mbox series

Patch

diff --git a/src/openvpn/options.c b/src/openvpn/options.c
index 41a42cf2..36d67b0f 100644
--- a/src/openvpn/options.c
+++ b/src/openvpn/options.c
@@ -2949,6 +2949,11 @@  options_postprocess_mutate_invariant(struct options *options)
 static void
 options_postprocess_verify(const struct options *o)
 {
+#ifdef LIBRESSL_VERSION_NUMBER
+    msg(M_WARN, "WARNING: This OpenVPN was built against LibreSSL. "
+        "This might work, but is *not* supported and can break at any time.")
+#endif
+
     if (o->connection_list)
     {
         int i;