Bug 458612

Summary: OpenVPN 2.1rc9 contains two inacceptable regressions for EPEL and Fedora
Product: [Fedora] Fedora EPEL Reporter: Robert Scheck <redhat-bugzilla>
Component: openvpnAssignee: Steven Pritchard <steve>
Status: CLOSED NEXTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: urgent Docs Contact:
Priority: medium    
Version: el5CC: earthbase2008, redhat, robert.scheck
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
URL: http://openvpn.net/index.php/documentation/change-log/changelog-21.html
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2008-12-02 23:16:06 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 458594, 458600    
Bug Blocks:    

Description Robert Scheck 2008-08-10 21:53:51 UTC
Description of problem:
OpenVPN 2.1rc9 contains two inacceptable regressions for EPEL and Fedora:

 1. Missing "--script-security 3" in initscript for backward compatibility
    without breaking current setups during upgrade (2.1rc9 is a security
    bugfix release), see bug #458594

 2. It looks like the change from system() -> execvp() breaks tls-verify
    commands in pipe behaviour or line foldings/endings, see bug #458600

The issues don't exist in OpenVPN 2.1rc8 or previous, came up with 2.1rc9
the first time, so this is an OpenVPN regression then. I know, you're just
the downstream maintainer, but the problems have to be solved, before any
new OpenVPN package should ever go to stable. I really did not have a nice
Sunday today caused by this stuff ;-)

As far as I can see and reproduce, this problem affects Fedora and EPEL.

Version-Release number of selected component (if applicable):
openvpn-2.1-0.27.rc9

How reproducible:
Everytime, see above.

Expected results:
Both issues solved before a push of the new OpenVPN packages to stable.

Comment 1 Robert Scheck 2008-10-13 18:20:27 UTC
OpenVPN 2.1rc13 still shows exactly the same issues to me. It also breaks (as 
starting with rc9) client-connect/disconnect scripts by just not executing 
them - completely independent of what I set script-security option to. Can we 
please unpull the crappy OpenVPN package from EPEL really ASAP?

Comment 2 Robert Scheck 2008-10-14 06:29:34 UTC
James, maybe a more important thing: Can you unbreak client-connect/disconnect 
scripts again, please? Seemingly, both scripts (e.g. /etc/openvpn/connect.sh) are just not executed, script-security 3 doesn't change anything; script has
some iptables commands in it choosed by the given CN.

Comment 3 Robert Scheck 2008-10-30 07:26:41 UTC
James, can we please concentrate on the non-working client-connect/disconnect 
scripts first rather bug #458600? Thank you.

Comment 4 Robert Scheck 2008-11-02 22:52:21 UTC
The non-working client-connect/disconnect scripts are caused by missing PATH 
exports since rc9. Using full path inside of the script solves the issue. For
Fedora and especially EPEL this is a regression.

Comment 5 Fedora Update System 2008-11-30 14:44:48 UTC
openvpn-2.1-0.29.rc15.fc9 has been submitted as an update for Fedora 9.
http://admin.fedoraproject.org/updates/openvpn-2.1-0.29.rc15.fc9

Comment 6 Fedora Update System 2008-11-30 14:44:51 UTC
openvpn-2.1-0.29.rc15.fc10 has been submitted as an update for Fedora 10.
http://admin.fedoraproject.org/updates/openvpn-2.1-0.29.rc15.fc10

Comment 7 Fedora Update System 2008-11-30 14:45:00 UTC
openvpn-2.1-0.29.rc15.fc8 has been submitted as an update for Fedora 8.
http://admin.fedoraproject.org/updates/openvpn-2.1-0.29.rc15.fc8

Comment 8 Fedora Update System 2008-12-21 08:18:28 UTC
openvpn-2.1-0.29.rc15.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 9 Fedora Update System 2008-12-21 08:21:34 UTC
openvpn-2.1-0.29.rc15.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 10 Fedora Update System 2008-12-21 08:33:09 UTC
openvpn-2.1-0.29.rc15.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.