Re: [Openvpn-devel] [PATCH] Serial number export, fixed

2010-04-26 Thread Peter Stuge
Davide Brini wrote: > The users are supposed to adapt it to their needs and make it more > robust. Hah! Users will not. //Peter

Re: [Openvpn-devel] [PATCH] Serial number export, fixed

2010-04-26 Thread David Sommerseth
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 26/04/10 17:55, Davide Brini wrote: > On Monday 26 Apr 2010 16:19:20 David Sommerseth wrote: > >>> (I still think it would be nice to have some sort of channel to send >>> errors to OpenVPN's main log from the children scripts or programs, so >>> u

Re: [Openvpn-devel] [PATCH] Serial number export, fixed

2010-04-26 Thread Davide Brini
On Monday 26 Apr 2010 16:19:20 David Sommerseth wrote: > > (I still think it would be nice to have some sort of channel to send > > errors to OpenVPN's main log from the children scripts or programs, so > > users could inspect it.) > > This begins to look very good! > > Just for the errors ... t

Re: [Openvpn-devel] [PATCH] Serial number export, fixed

2010-04-26 Thread David Sommerseth
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 26/04/10 17:08, Davide Brini wrote: > On Monday 26 Apr 2010 15:50:56 Karl O. Pinc wrote: > itself. So if the script could fail gracefully giving a hint like "you've not done as I told you to", some support issues will be avoided. >>

Re: [Openvpn-devel] [PATCH] Serial number export, fixed

2010-04-26 Thread Davide Brini
On Monday 26 Apr 2010 15:50:56 Karl O. Pinc wrote: > > > itself. So if the script could fail gracefully giving a hint like > > > "you've not done as I told you to", some support issues will be > > > avoided. > > > > Ok, that makes sense. I didn't look at it this way, but then I > > perfectly know

Re: [Openvpn-devel] [PATCH] Serial number export, fixed

2010-04-26 Thread Karl O. Pinc
On 04/26/2010 05:48:38 AM, Davide Brini wrote: > On Monday 26 Apr 2010 11:04:16 David Sommerseth wrote: > > > > Agreed, but from experience with many users ... it's a lot of users > who > > just take a script and try it out without even looking at the > script > > itself. So if the script could

Re: [Openvpn-devel] [PATCH] Serial number export, fixed

2010-04-26 Thread Karl O. Pinc
On 04/26/2010 03:56:16 AM, Davide Brini wrote: > On Monday 26 Apr 2010 00:13:39 David Sommerseth wrote: > > > +# OCSP responder URL (mandatory) > > > +ocsp_url="http://some.ocsp.server/"; > > > +#ocsp_url="https://some.secure.ocsp.server/"; > > > > Wouldn't it be better to use a more valid URL? >

Re: [Openvpn-devel] [PATCH] Serial number export, fixed

2010-04-26 Thread Davide Brini
On Monday 26 Apr 2010 11:04:16 David Sommerseth wrote: > >> ... and have a check that this variable is set? If unset, exit with > >> error. > > > > Ah well, as I said the script is meant to be a barebone skeleton to > > demonstrate basic usage. That is by no means the only thing that lacks > > pr

Re: [Openvpn-devel] [PATCH] Serial number export, fixed

2010-04-26 Thread David Sommerseth
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 26/04/10 10:56, Davide Brini wrote: > On Monday 26 Apr 2010 00:13:39 David Sommerseth wrote: [...snip...] >>> +# OCSP responder URL (mandatory) >>> +ocsp_url="http://some.ocsp.server/"; >>> +#ocsp_url="https://some.secure.ocsp.server/"; >> >> Wouldn

Re: [Openvpn-devel] [PATCH] Serial number export, fixed

2010-04-26 Thread Davide Brini
On Monday 26 Apr 2010 00:13:39 David Sommerseth wrote: > Btw! Very good idea by introducing the OCSP_check.sh example! And even > a proper git patch! I like that :) Thanks! > > +# OCSP responder URL (mandatory) > > +ocsp_url="http://some.ocsp.server/"; > > +#ocsp_url="https://some.secure.ocsp

Re: [Openvpn-devel] [PATCH] Serial number export, fixed

2010-04-25 Thread David Sommerseth
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 25/04/10 17:49, Davide Brini wrote: > ssl.c: > correctly manage and export serial numbers of any size (as > parsed by OpenSSL) into the environment. Set to empty string > in case of errors, as 0 and negative numbers are al

[Openvpn-devel] [PATCH] Serial number export, fixed

2010-04-25 Thread Davide Brini
ssl.c: correctly manage and export serial numbers of any size (as parsed by OpenSSL) into the environment. Set to empty string in case of errors, as 0 and negative numbers are all possible (although illegal) certificate serial numbers. Use an OpenSSL BIO