Upgrade OpenVPN to 2.3.0

Bump openvpn-acct-wtmpx to add its licence and to take into account the
new location of plugin directory

Significant changes since 2.2.x:
 * Full IPv6 support
 * SSL layer modularised, enabling easier implementation for other SSL
   libraries
 * PolarSSL support as a drop-in replacement for OpenSSL
 * New plug-in API providing direct certificate access, improved logging API
   and easier to extend in the future
 * Added 'dev_type' environment variable to scripts and plug-ins - which
   is set to 'TUN' or 'TAP'
 * New feature: --management-external-key - to provide access to the
   encryption keys via the management interface
 * New feature: --x509-track option, more fine grained access to X.509
   fields in scripts and plug-ins
 * New feature: --client-nat support
 * New feature: --mark which can mark encrypted packets from the tunnel,
   suitable for more advanced routing and firewalling
 * New feature: --management-query-proxy - manage proxy settings via the
   management interface (supercedes --http-proxy-fallback)
 * New feature: --stale-routes-check, which cleans up the internal
   routing table
 * New feature: --x509-username-field, where other X.509v3 fields can be
   used for the authentication instead of Common Name
 * Improved client-kill management interface command
 * Improved UTF-8 support - and added --compat-names to provide backwards
   compatibility with older scripts/plug-ins
 * Improved auth-pam with COMMONNAME support, passing the certificate's
   common name in the PAM conversation
 * More options can now be used inside <connection> blocks
 * Completely new build system, enabling easier cross-compilation and
   Windows builds
 * Much of the code has been better documented
 * Many documentation updates
 * Plenty of bug fixes and other code clean-ups

18 files changed, 150 insertions, 196 deletions

diff --git a/net/openvpn-acct-wtmpx/MESSAGE b/net/openvpn-acct-wtmpx/MESSAGE
index e7ea4e553b8..922b46b5d59 100644
--- a/net/openvpn-acct-wtmpx/MESSAGE
+++ b/net/openvpn-acct-wtmpx/MESSAGE
@@ -1,10 +1,10 @@
 ===========================================================================
-$NetBSD: MESSAGE,v 1.1.1.1 2010/07/14 04:46:18 manu Exp $
+$NetBSD: MESSAGE,v 1.2 2013/02/10 05:55:07 manu Exp $
 
 In order to enable the use of this module, add this directive to your
 OpenVPN server configuration file
 
-  plugin /usr/pkg/lib/openvpn/openvpn-acct-wtmpx.so openvpn
+  plugin ${OPENVPN_PLUGINSDIR}/openvpn-acct-wtmpx.so openvpn
 
 In order to write to wtmpx(5) databases, OpenVPN needs root privileges.
 It acquires them for that purpose by using the logwtmpx program, which
diff --git a/net/openvpn-acct-wtmpx/Makefile b/net/openvpn-acct-wtmpx/Makefile
index cd0f33976f7..80ce3142254 100644
--- a/net/openvpn-acct-wtmpx/Makefile
+++ b/net/openvpn-acct-wtmpx/Makefile
@@ -1,22 +1,29 @@
-# $NetBSD: Makefile,v 1.3 2012/10/23 17:18:44 asau Exp $
+# $NetBSD: Makefile,v 1.4 2013/02/10 05:55:08 manu Exp $
 #
 
-DISTNAME=	openvpn-acct-wtmpx-20091110
-PKGREVISION=	1
-DISTFILES=	${DISTNAME}${EXTRACT_SUFX} openvpn-2.1_rc20.tar.gz
+.include "../../net/openvpn/Makefile.common"
+
+DISTNAME=	openvpn-acct-wtmpx-20130210
+DISTFILES=	${DISTNAME}${EXTRACT_SUFX} ${OPENVPN_DISTFILE}
 CATEGORIES=	net
 MASTER_SITES=	http://ftp.espci.fr/pub/openvpn-acct-wtmpx/
-SITES.openvpn-2.1_rc20.tar.gz=	http://openvpn.net/release/
 EXTRACT_SUFX=	.tgz
 
 MAINTAINER=	manu@NetBSD.org
 HOMEPAGE=	http://ftp.espci.fr/pub/openvpn-acct-wtmpx/
 COMMENT=	Log OpenVPN logins and logouts to wtmpx
+LICENSE=	2-clause-bsd
+
+PKG_DESTDIR_SUPPORT=	user-destdir
 
 USE_LIBTOOL=	yes
 USE_TOOLS+=	install
 
-WRKSRC=	${WRKDIR}/openvpn-acct-wtmpx
+MAKE_ENV+=	OPENVPN_PLUGINSDIR=${PREFIX:Q}/${OPENVPN_PLUGINSDIR:Q}
+MAKE_ENV+=	OPENVPN_DISTNAME=${OPENVPN_DISTNAME:Q}
+
+PLIST_SUBST+=	OPENVPN_PLUGINSDIR=${OPENVPN_PLUGINSDIR:Q}
+MESSAGE_SUBST+=	OPENVPN_PLUGINSDIR=${PREFIX:Q}/${OPENVPN_PLUGINSDIR:Q}
 
 SPECIAL_PERMS+=	bin/logwtmpx ${SETUID_ROOT_PERMS}
 
diff --git a/net/openvpn-acct-wtmpx/PLIST b/net/openvpn-acct-wtmpx/PLIST
index 1b6ce9bd160..2e5986ce46d 100644
--- a/net/openvpn-acct-wtmpx/PLIST
+++ b/net/openvpn-acct-wtmpx/PLIST
@@ -1,3 +1,3 @@
-@comment $NetBSD: PLIST,v 1.2 2011/11/23 23:31:22 joerg Exp $
+@comment $NetBSD: PLIST,v 1.3 2013/02/10 05:55:08 manu Exp $
 bin/logwtmpx
-lib/openvpn/openvpn-acct-wtmpx.la
+${OPENVPN_PLUGINSDIR}/openvpn-acct-wtmpx.la
diff --git a/net/openvpn-acct-wtmpx/distinfo b/net/openvpn-acct-wtmpx/distinfo
index 1fb60fef78f..34280bfe2ef 100644
--- a/net/openvpn-acct-wtmpx/distinfo
+++ b/net/openvpn-acct-wtmpx/distinfo
@@ -1,11 +1,9 @@
-$NetBSD: distinfo,v 1.3 2013/01/11 13:32:58 joerg Exp $
+$NetBSD: distinfo,v 1.4 2013/02/10 05:55:08 manu Exp $
 
-SHA1 (openvpn-2.1_rc20.tar.gz) = ab0e928bd7d4896ddb0061bf3aba9f3cd6cefe6e
-RMD160 (openvpn-2.1_rc20.tar.gz) = 4dd7924cb41a268e76a93af66fd05f948f22e5f3
-Size (openvpn-2.1_rc20.tar.gz) = 844253 bytes
-SHA1 (openvpn-acct-wtmpx-20091110.tgz) = 3bbe32fdc4bf17f4decef2b3dfb2fb92885934c9
-RMD160 (openvpn-acct-wtmpx-20091110.tgz) = 1146c27fe190a8b8d6ef863f1861acfeb1f61b39
-Size (openvpn-acct-wtmpx-20091110.tgz) = 1983 bytes
-SHA1 (patch-aa) = 399514cb7eabe9c589d56638e01034fbdb7208a6
-SHA1 (patch-logwtmpx.c) = bca4b658c3f9f44966c9bb8e9965d55177cc5a63
-SHA1 (patch-openvpn-acct-wtmpx.c) = cbf931f474702ca41c7db4ac68c1d7560a088766
+SHA1 (openvpn-2.3.0.tar.gz) = 18b51f7ba0b9e18939451d7787c00e04165efe90
+RMD160 (openvpn-2.3.0.tar.gz) = f24ac128fcd874bf40e8ffd5161065e84170d69f
+Size (openvpn-2.3.0.tar.gz) = 1130659 bytes
+SHA1 (openvpn-acct-wtmpx-20130210.tgz) = cf7bc26b12a65493cdf5db93b03bbb938a2f0f33
+RMD160 (openvpn-acct-wtmpx-20130210.tgz) = d9000789f04606bfa17db1597a45a4235b1119ea
+Size (openvpn-acct-wtmpx-20130210.tgz) = 2778 bytes
+SHA1 (patch-aa) = 8b216edb0e48dd54fd19b436433fafeb686948b8
diff --git a/net/openvpn-acct-wtmpx/patches/patch-aa b/net/openvpn-acct-wtmpx/patches/patch-aa
index 17a41b9c7b7..cf4db015210 100644
--- a/net/openvpn-acct-wtmpx/patches/patch-aa
+++ b/net/openvpn-acct-wtmpx/patches/patch-aa
@@ -1,17 +1,19 @@
-$NetBSD: patch-aa,v 1.2 2011/11/23 23:31:22 joerg Exp $
+$NetBSD: patch-aa,v 1.3 2013/02/10 05:55:08 manu Exp $
 
---- Makefile.orig	2009-11-07 04:12:24.000000000 +0000
-+++ Makefile
-@@ -1,13 +1,13 @@
+--- Makefile.orig	2009-11-07 05:12:24.000000000 +0100
++++ Makefile	2013-02-09 18:22:49.000000000 +0100
+@@ -1,14 +1,14 @@
 -prefix=/usr/pkg
 -PLUGINDIR=$(prefix)/lib/openvpn
 -bindir=/usr/local/bin
 +#prefix=/usr/pkg
-+PLUGINDIR=${DESTDIR}${PREFIX}/lib/openvpn
++PLUGINDIR=${DESTDIR}${OPENVPN_PLUGINSDIR}
 +bindir=${DESTDIR}${PREFIX}/bin
  
- OPENVPN_SRC=../openvpn-2.1_rc20
- CFLAGS= -Wall -Werror -ansi -g -I$(OPENVPN_SRC) -DBINDIR=\"$(bindir)\"
+-OPENVPN_SRC=../openvpn-2.1_rc20
+-CFLAGS= -Wall -Werror -ansi -g -I$(OPENVPN_SRC) -DBINDIR=\"$(bindir)\"
++OPENVPN_SRC=../${OPENVPN_DISTNAME}
++CFLAGS= -Wall -Werror -ansi -g -I$(OPENVPN_SRC)/include -DBINDIR=\"$(bindir)\"
  OPENVPN_GROUP=nobody
  
 -LIBTOOL=libtool
@@ -21,7 +23,9 @@ $NetBSD: patch-aa,v 1.2 2011/11/23 23:31:22 joerg Exp $
  
  
  all: openvpn-acct-wtmpx.la logwtmpx
-@@ -23,9 +23,11 @@ logwtmpx:	logwtmpx.o
+ 
+@@ -22,10 +22,12 @@
+ logwtmpx:	logwtmpx.o
  	$(CC) -o $@ -lutil $?
  
  install:	openvpn-acct-wtmpx.la logwtmpx
diff --git a/net/openvpn-acct-wtmpx/patches/patch-logwtmpx.c b/net/openvpn-acct-wtmpx/patches/patch-logwtmpx.c
deleted file mode 100644
index d8f01fcbb7d..00000000000
--- a/net/openvpn-acct-wtmpx/patches/patch-logwtmpx.c
+++ /dev/null
@@ -1,12 +0,0 @@
-$NetBSD: patch-logwtmpx.c,v 1.1 2013/01/11 13:32:58 joerg Exp $
-
---- logwtmpx.c.orig	2013-01-11 01:19:28.000000000 +0000
-+++ logwtmpx.c
-@@ -1,6 +1,7 @@
- #include <stdio.h>
- #include <err.h>
- #include <util.h>
-+#include <utmpx.h>
- #include <sysexits.h>
- 
- int
diff --git a/net/openvpn-acct-wtmpx/patches/patch-openvpn-acct-wtmpx.c b/net/openvpn-acct-wtmpx/patches/patch-openvpn-acct-wtmpx.c
deleted file mode 100644
index 958ac4ff146..00000000000
--- a/net/openvpn-acct-wtmpx/patches/patch-openvpn-acct-wtmpx.c
+++ /dev/null
@@ -1,12 +0,0 @@
-$NetBSD: patch-openvpn-acct-wtmpx.c,v 1.1 2013/01/11 13:32:58 joerg Exp $
-
---- openvpn-acct-wtmpx.c.orig	2013-01-11 01:18:53.000000000 +0000
-+++ openvpn-acct-wtmpx.c
-@@ -4,6 +4,7 @@
- #include <util.h>
- #include <stdlib.h>
- #include <syslog.h>
-+#include <utmpx.h>
- #include <sys/param.h>
- 
- #include "openvpn-plugin.h"
diff --git a/net/openvpn/MESSAGE b/net/openvpn/MESSAGE
index 78520dffe99..f605845992d 100644
--- a/net/openvpn/MESSAGE
+++ b/net/openvpn/MESSAGE
@@ -1,5 +1,5 @@
 ===========================================================================
-$NetBSD: MESSAGE,v 1.1 2005/08/17 19:55:57 jlam Exp $
+$NetBSD: MESSAGE,v 1.2 2013/02/10 05:55:07 manu Exp $
 
 The openvpn rc.d script looks for configuration files in:
 
@@ -15,12 +15,8 @@ The sample configuration files have been installed into:
 Please refer to the openvpn(8) manpage for full documentation on the
 available options.
 
-There is also a package for ``easy'' RSA key management installed into:
-
-	${PREFIX}/share/openvpn/easy-rsa
-
-that may optionally be used to set up a certificate authority for
-generating SSL certificates for use with OpenVPN.  Please refer to the
-README file in that directory for specific instructions.
+If you are upgrading from version 2.2.x, note that the plugin directory
+has changed to ${OPENVPN_PLUGINSDIR}. You may need to adjust your 
+configuration files.
 
 ===========================================================================
diff --git a/net/openvpn/Makefile b/net/openvpn/Makefile
index 27a45683ab7..e2653b928ff 100644
--- a/net/openvpn/Makefile
+++ b/net/openvpn/Makefile
@@ -1,17 +1,19 @@
-# $NetBSD: Makefile,v 1.48 2013/02/06 23:23:21 jperkin Exp $
+# $NetBSD: Makefile,v 1.49 2013/02/10 05:55:07 manu Exp $
 
-DISTNAME=	openvpn-2.2.2
-PKGREVISION=	3
+DISTNAME=	${OPENVPN_DISTNAME}
 CATEGORIES=	net
-MASTER_SITES=	http://swupdate.openvpn.net/community/releases/
+MASTER_SITES=	${OPENVPN_MASTER_SITES}
 
 MAINTAINER=	pkgsrc-users@NetBSD.org
 HOMEPAGE=	http://openvpn.net/
 COMMENT=	Easy-to-use SSL VPN daemon
 LICENSE=	gnu-gpl-v2
 
+PKG_DESTDIR_SUPPORT=	user-destdir
+
 USE_LIBTOOL=		yes
 USE_TOOLS+=		grep:run
+USE_TOOLS+=		pkg-config
 GNU_CONFIGURE=		yes
 CONFIGURE_ARGS+=	--disable-debug
 CONFIGURE_ARGS+=	--disable-dependency-tracking
@@ -24,50 +26,33 @@ TEST_TARGET=		check
 PKG_SYSCONFSUBDIR=	openvpn
 DATADIR=		${PREFIX}/share/${PKGBASE}
 EGDIR=			${PREFIX}/share/examples/${PKGBASE}
-EASYRSADIR=		${DATADIR}/easy-rsa
 RCD_SCRIPTS=		openvpn
 
-INSTALLATION_DIRS=	${DATADIR}/easy-rsa
 INSTALLATION_DIRS+=	${EGDIR}/config
 INSTALLATION_DIRS+=	${EGDIR}/keys
 INSTALLATION_DIRS+=	${EGDIR}/scripts
 
-REPLACE_SH=		easy-rsa/2.0/*
-SUBST_CLASSES+=		pkitool
-SUBST_STAGE.pkitool=	post-build
-SUBST_MESSAGE.pkitool=	Fixing up default paths to grep & openssl in pkitool.
-SUBST_FILES.pkitool=	easy-rsa/2.0/pkitool
-SUBST_SED.pkitool=	-e "s|\\(GREP\\)=.*|\\1=\""${GREP:Q}"\"|"
-SUBST_SED.pkitool+=	-e "s|\\(OPENSSL\\)=.*|\\1=\""${SSLBASE:Q}/bin/openssl"\"|"
-
 .include "../../mk/bsd.prefs.mk"
 
-OPENVPN_USER?=		openvpn
-OPENVPN_GROUP?=		openvpn
 PKG_GROUPS=		${OPENVPN_GROUP}
 PKG_USERS=		${OPENVPN_USER}:${OPENVPN_GROUP}
 PKG_GECOS.${OPENVPN_USER}=	OpenVPN\ server\ user
 
-post-install: post-install-pam
-	set -e; cd ${WRKSRC}/easy-rsa/2.0; for file in [a-zR]*; do	\
-		case $$file in						\
-		*.orig|tmp) ;;						\
-		[A-Z]*|*.cnf|vars)					\
-			${INSTALL_DATA} $$file ${DESTDIR}${EASYRSADIR} ;; \
-		*)	${INSTALL_SCRIPT} $$file ${DESTDIR}${EASYRSADIR} ;; \
-		esac;							\
-	done
-	set -e; cd ${WRKSRC}/sample-config-files; for file in *; do	\
-		${INSTALL_DATA} $$file ${DESTDIR}${EGDIR}/config;	\
+MESSAGE_SUBST+= OPENVPN_PLUGINSDIR=${PREFIX:Q}/${OPENVPN_PLUGINSDIR:Q}
+
+post-install:
+	set -e; cd ${WRKSRC}/sample/sample-config-files; for file in *; do \
+		${INSTALL_DATA} $$file ${DESTDIR}${EGDIR}/config;	   \
 	done
-	set -e; cd ${WRKSRC}/sample-scripts; for file in *; do		\
-		${INSTALL_DATA} $$file ${DESTDIR}${EGDIR}/scripts;	\
+	set -e; cd ${WRKSRC}/sample/sample-scripts; for file in *; do	   \
+		${INSTALL_DATA} $$file ${DESTDIR}${EGDIR}/scripts;	   \
 	done
-	set -e; cd ${WRKSRC}/sample-keys; for file in *; do		\
-		${INSTALL_DATA} $$file ${DESTDIR}${EGDIR}/keys;		\
+	set -e; cd ${WRKSRC}/sample/sample-keys; for file in *; do	   \
+		${INSTALL_DATA} $$file ${DESTDIR}${EGDIR}/keys;		   \
 	done
 
 .include "options.mk"
+.include "../../net/openvpn/Makefile.common"
 
 # OpenVPN 2.x has a shared module "plugin" architecture that allows
 # inserting callbacks into the server for various tasks.
diff --git a/net/openvpn/Makefile.common b/net/openvpn/Makefile.common
new file mode 100644
index 00000000000..06e28851699
--- /dev/null
+++ b/net/openvpn/Makefile.common
@@ -0,0 +1,14 @@
+# $NetBSD: Makefile.common,v 1.1 2013/02/10 05:55:07 manu Exp $
+
+# used by net/openvpn/Makefile
+# used by net/openvpn-acct-wtmpx/Makefile
+# used by net/openvpn-nagios/Makefile
+
+OPENVPN_DISTNAME=	openvpn-2.3.0
+OPENVPN_DISTFILE=	${OPENVPN_DISTNAME}.tar.gz
+OPENVPN_MASTER_SITES=	http://swupdate.openvpn.net/community/releases/
+SITES.${OPENVPN_DISTFILE}=	${OPENVPN_MASTER_SITES}
+
+OPENVPN_USER?=		openvpn
+OPENVPN_GROUP?=		openvpn
+OPENVPN_PLUGINSDIR?=	lib/openvpn/plugins
diff --git a/net/openvpn/PLIST b/net/openvpn/PLIST
index aec0120660b..be3d92028c3 100644
--- a/net/openvpn/PLIST
+++ b/net/openvpn/PLIST
@@ -1,6 +1,7 @@
-@comment $NetBSD: PLIST,v 1.14 2012/01/19 13:26:55 adam Exp $
+@comment $NetBSD: PLIST,v 1.15 2013/02/10 05:55:07 manu Exp $
 man/man8/openvpn.8
 sbin/openvpn
+include/openvpn-plugin.h
 share/doc/openvpn/management-notes.txt
 share/examples/openvpn/config/README
 share/examples/openvpn/config/client.conf
@@ -29,33 +30,20 @@ share/examples/openvpn/keys/pass.key
 share/examples/openvpn/keys/pkcs12.p12
 share/examples/openvpn/keys/server.crt
 share/examples/openvpn/keys/server.key
-share/examples/openvpn/keys/ta.key
 share/examples/openvpn/scripts/auth-pam.pl
 share/examples/openvpn/scripts/bridge-start
 share/examples/openvpn/scripts/bridge-stop
-share/examples/openvpn/scripts/openvpn.init
 share/examples/openvpn/scripts/ucn.pl
 share/examples/openvpn/scripts/verify-cn
 share/examples/rc.d/openvpn
-share/openvpn/easy-rsa/README
-share/openvpn/easy-rsa/build-ca
-share/openvpn/easy-rsa/build-dh
-share/openvpn/easy-rsa/build-inter
-share/openvpn/easy-rsa/build-key
-share/openvpn/easy-rsa/build-key-pass
-share/openvpn/easy-rsa/build-key-pkcs12
-share/openvpn/easy-rsa/build-key-server
-share/openvpn/easy-rsa/build-req
-share/openvpn/easy-rsa/build-req-pass
-share/openvpn/easy-rsa/clean-all
-share/openvpn/easy-rsa/inherit-inter
-share/openvpn/easy-rsa/list-crl
-share/openvpn/easy-rsa/openssl-0.9.6.cnf
-share/openvpn/easy-rsa/openssl-0.9.8.cnf
-share/openvpn/easy-rsa/openssl-1.0.0.cnf
-share/openvpn/easy-rsa/pkitool
-share/openvpn/easy-rsa/revoke-full
-share/openvpn/easy-rsa/sign-req
-share/openvpn/easy-rsa/vars
-share/openvpn/easy-rsa/whichopensslcnf
-${PLIST.pam}lib/openvpn/openvpn-auth-pam.so
+share/doc/openvpn/COPYING
+share/doc/openvpn/COPYRIGHT.GPL
+share/doc/openvpn/README
+share/doc/openvpn/README.IPv6
+${PLIST.pam}share/doc/openvpn/README.auth-pam
+share/doc/openvpn/README.down-root
+share/doc/openvpn/README.polarssl
+${PLIST.pam}lib/openvpn/plugins/openvpn-plugin-auth-pam.so
+${PLIST.pam}lib/openvpn/plugins/openvpn-plugin-auth-pam.la
+lib/openvpn/plugins/openvpn-plugin-down-root.so
+lib/openvpn/plugins/openvpn-plugin-down-root.la
diff --git a/net/openvpn/distinfo b/net/openvpn/distinfo
index bc9b9791ad5..219305c114f 100644
--- a/net/openvpn/distinfo
+++ b/net/openvpn/distinfo
@@ -1,12 +1,10 @@
-$NetBSD: distinfo,v 1.26 2012/01/19 13:26:55 adam Exp $
+$NetBSD: distinfo,v 1.27 2013/02/10 05:55:07 manu Exp $
 
-SHA1 (openvpn-2.2.2.tar.gz) = 992373cdf12e1b50655b13765a6d36a87cfd3ca3
-RMD160 (openvpn-2.2.2.tar.gz) = 60990f183bdd46933724b3bf39ba5861ed0258a6
-Size (openvpn-2.2.2.tar.gz) = 911158 bytes
-SHA1 (patch-aa) = 87ba516fa1ad73ef093d11a35c01ee660a782d99
-SHA1 (patch-ab) = 47bd8f8cabaa689d1320904213dc42202aa7c604
-SHA1 (patch-ac) = f4ae13ab73193205ad5a301b6756b9c9624b5369
+SHA1 (openvpn-2.3.0.tar.gz) = 18b51f7ba0b9e18939451d7787c00e04165efe90
+RMD160 (openvpn-2.3.0.tar.gz) = f24ac128fcd874bf40e8ffd5161065e84170d69f
+Size (openvpn-2.3.0.tar.gz) = 1130659 bytes
+SHA1 (patch-aa) = e856b156656c575bfcb339eee17ed694b541872e
+SHA1 (patch-ac) = d1918a08f8b3dd150b44737a236da58be7fa1f8c
 SHA1 (patch-ad) = c00d15ae2e6c27e3e3c01bca90ab9481e3305941
-SHA1 (patch-ae) = 9f9b601f3c44d8e70b0c28d999e65fe0f538ce33
-SHA1 (patch-af) = 7895af588f229350b8a1d8e8779117dce5f455cc
-SHA1 (patch-ag) = f8afd660bc5c52cc4a8986765857eef1f3c48402
+SHA1 (patch-ae) = b3e9a47d1e5c8aecda41ac144ad2ca443f7977b3
+SHA1 (patch-af) = cb4d2b35b4373bf7b7b3f6adff9c776e15a16986
diff --git a/net/openvpn/options.mk b/net/openvpn/options.mk
index 45dd3e0fa2c..8fbf7366191 100644
--- a/net/openvpn/options.mk
+++ b/net/openvpn/options.mk
@@ -1,4 +1,4 @@
-# $NetBSD: options.mk,v 1.5 2011/04/28 07:27:24 adam Exp $
+# $NetBSD: options.mk,v 1.6 2013/02/10 05:55:07 manu Exp $
 
 PKG_OPTIONS_VAR=	PKG_OPTIONS.openvpn
 PKG_SUPPORTED_OPTIONS=	pkcs11 pam
@@ -9,8 +9,7 @@ PKG_SUGGESTED_OPTIONS=
 # include support for certificates on a stick (or card)
 .if !empty(PKG_OPTIONS:Mpkcs11)
 .include "../../security/pkcs11-helper/buildlink3.mk"
-.else
-CONFIGURE_ARGS+=	--disable-pkcs11
+CONFIGURE_ARGS+=	--enable-pkcs11
 .endif
 
 PLIST_VARS+=		pam
@@ -18,15 +17,11 @@ PLIST_VARS+=		pam
 PLIST.pam=		yes
 USE_TOOLS+=		gmake
 
-BUILD_DIRS+=		plugin/auth-pam
+BUILD_DIRS+=		src/plugins/auth-pam
 BUILD_TARGET=		# empty
 INSTALL_DIRS=		.
 INSTALL_TARGET=		install
-INSTALLATION_DIRS+=	lib/openvpn
-post-install-pam:
-	${INSTALL_LIB} ${WRKSRC}/plugin/auth-pam/openvpn-auth-pam.so \
-		${DESTDIR}${PREFIX}/lib/openvpn || ${TRUE}
 .include "../../mk/pam.buildlink3.mk"
 .else
-post-install-pam:
+CONFIGURE_ARGS+=	--disable-plugin-auth-pam
 .endif
diff --git a/net/openvpn/patches/patch-aa b/net/openvpn/patches/patch-aa
index a1964e56d20..8d7a1eb219b 100644
--- a/net/openvpn/patches/patch-aa
+++ b/net/openvpn/patches/patch-aa
@@ -1,7 +1,7 @@
-$NetBSD: patch-aa,v 1.6 2011/04/28 07:27:25 adam Exp $
+$NetBSD: patch-aa,v 1.7 2013/02/10 05:55:07 manu Exp $
 
---- route.c.orig	2010-11-04 19:29:40.000000000 +0000
-+++ route.c
+--- src/openvpn/route.c.orig	2010-11-04 19:29:40.000000000 +0000
++++ src/openvpn/route.c
 @@ -1614,7 +1614,11 @@ get_default_gateway (in_addr_t *gateway,
  #define RTA_NETMASK 0x4
  
diff --git a/net/openvpn/patches/patch-ac b/net/openvpn/patches/patch-ac
index 8c01d06e83a..01c8015a057 100644
--- a/net/openvpn/patches/patch-ac
+++ b/net/openvpn/patches/patch-ac
@@ -1,7 +1,7 @@
-$NetBSD: patch-ac,v 1.9 2011/04/28 07:27:25 adam Exp $
+$NetBSD: patch-ac,v 1.10 2013/02/10 05:55:07 manu Exp $
 
---- tun.c.orig	2011-04-06 16:05:52.000000000 +0000
-+++ tun.c
+--- src/openvpn/tun.c.orig	2011-04-06 16:05:52.000000000 +0000
++++ src/openvpn/tun.c
 @@ -805,15 +805,15 @@ do_ifconfig (struct tuntap *tt,
         * NetBSD has distinct tun and tap devices
         * so we don't need the "link0" extra parameter to specify we want to do 
diff --git a/net/openvpn/patches/patch-ae b/net/openvpn/patches/patch-ae
index 0352524afd2..33599303d0d 100644
--- a/net/openvpn/patches/patch-ae
+++ b/net/openvpn/patches/patch-ae
@@ -1,22 +1,26 @@
-$NetBSD: patch-ae,v 1.5 2011/04/28 07:27:25 adam Exp $
+$NetBSD: patch-ae,v 1.6 2013/02/10 05:55:07 manu Exp $
 
---- configure.ac.orig	2011-04-14 21:30:08.000000000 +0000
-+++ configure.ac
-@@ -375,6 +375,7 @@ if test "${WIN32}" != "yes"; then
- 		 sys/mman.h fcntl.h sys/file.h stdlib.h stdint.h dnl
- 		 stdarg.h unistd.h signal.h stdio.h string.h dnl
- 		 strings.h ctype.h errno.h syslog.h pwd.h grp.h dnl
-+		 net/if_tap.h
- 		 net/if_tun.h net/tun/if_tun.h stropts.h sys/sockio.h dnl
- 		 netinet/in.h netinet/in_systm.h dnl
- 		 netinet/tcp.h arpa/inet.h dnl
-@@ -407,6 +408,9 @@ if test "${WIN32}" != "yes"; then
- 		  #ifdef HAVE_SYS_SOCKET_H
- 		  # include <sys/socket.h>
- 		  #endif
-+		  #ifdef HAVE_NET_IF_H
-+		  # include <net/if.h>
-+		  #endif
- 		  #ifdef HAVE_NETINET_IN_H
- 		  # include <netinet/in.h>
- 		  #endif
+--- configure.ac.orig	2012-11-29 20:47:57.000000000 +0000
++++ configure.ac	2013-01-28 09:26:04.000000000 +0000
+@@ -418,8 +418,9 @@
+ 	sys/time.h sys/ioctl.h sys/stat.h \
+ 	sys/mman.h sys/file.h sys/wait.h \
+ 	unistd.h signal.h libgen.h stropts.h \
+ 	syslog.h pwd.h grp.h \
++	net/if_tap.h \
+ 	sys/sockio.h sys/uio.h linux/sockios.h \
+ 	linux/types.h sys/poll.h sys/epoll.h err.h \
+ ])
+ 
+@@ -432,8 +433,11 @@
+ #endif
+ #ifdef HAVE_SYS_SOCKET_H
+ #include <sys/socket.h>
+ #endif
++#ifdef HAVE_NET_IF_H
++#include <net/if.h>
++#endif
+ #ifdef HAVE_NETINET_IN_H
+ #include <netinet/in.h>
+ #endif
+ #ifdef HAVE_WINDOWS_H
diff --git a/net/openvpn/patches/patch-af b/net/openvpn/patches/patch-af
index 10a7d390d31..a835a5a00aa 100644
--- a/net/openvpn/patches/patch-af
+++ b/net/openvpn/patches/patch-af
@@ -1,23 +1,26 @@
-$NetBSD: patch-af,v 1.6 2011/04/28 07:27:25 adam Exp $
+$NetBSD: patch-af,v 1.7 2013/02/10 05:55:07 manu Exp $
 
---- configure.orig	2011-04-21 19:29:34.000000000 +0000
-+++ configure
-@@ -5777,7 +5777,7 @@ $as_echo "#define HAVE_SYS_WAIT_H 1" >>c
+--- configure.orig	2013-01-28 10:29:31.000000000 +0100
++++ configure	2013-01-28 10:29:38.000000000 +0100
+@@ -13427,8 +13427,9 @@
+ 	sys/time.h sys/ioctl.h sys/stat.h \
+ 	sys/mman.h sys/file.h sys/wait.h \
+ 	unistd.h signal.h libgen.h stropts.h \
+ 	syslog.h pwd.h grp.h \
++	net/if_tap.h \
+ 	sys/sockio.h sys/uio.h linux/sockios.h \
+ 	linux/types.h sys/poll.h sys/epoll.h err.h \
  
- fi
- 
--   for ac_header in sys/time.h sys/socket.h sys/un.h sys/ioctl.h sys/stat.h 		 sys/mman.h fcntl.h sys/file.h stdlib.h stdint.h 		 stdarg.h unistd.h signal.h stdio.h string.h 		 strings.h ctype.h errno.h syslog.h pwd.h grp.h 		 net/if_tun.h net/tun/if_tun.h stropts.h sys/sockio.h 		 netinet/in.h netinet/in_systm.h 		 netinet/tcp.h arpa/inet.h 		 netdb.h sys/uio.h linux/if_tun.h linux/sockios.h 		 linux/types.h sys/poll.h sys/epoll.h err.h
-+   for ac_header in sys/time.h sys/socket.h sys/un.h sys/ioctl.h sys/stat.h 		 sys/mman.h fcntl.h sys/file.h stdlib.h stdint.h 		 stdarg.h unistd.h signal.h stdio.h string.h 		 strings.h ctype.h errno.h syslog.h pwd.h grp.h 		 net/if_tap.h net/if_tun.h net/tun/if_tun.h stropts.h sys/sockio.h 		 netinet/in.h netinet/in_systm.h 		 netinet/tcp.h arpa/inet.h 		 netdb.h sys/uio.h linux/if_tun.h linux/sockios.h 		 linux/types.h sys/poll.h sys/epoll.h err.h
  do :
-   as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
- ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default"
-@@ -5839,6 +5839,9 @@ do :
- 		  #ifdef HAVE_SYS_SOCKET_H
- 		  # include <sys/socket.h>
- 		  #endif
-+		  #ifdef HAVE_NET_IF_H
-+		  # include <net/if.h>
-+		  #endif
- 		  #ifdef HAVE_NETINET_IN_H
- 		  # include <netinet/in.h>
- 		  #endif
+@@ -13453,8 +13454,11 @@
+ #endif
+ #ifdef HAVE_SYS_SOCKET_H
+ #include <sys/socket.h>
+ #endif
++#ifdef HAVE_NET_IF_H
++#include <net/if.h>
++#endif
+ #ifdef HAVE_NETINET_IN_H
+ #include <netinet/in.h>
+ #endif
+ #ifdef HAVE_WINDOWS_H
diff --git a/net/openvpn/patches/patch-ag b/net/openvpn/patches/patch-ag
deleted file mode 100644
index cda24fec903..00000000000
--- a/net/openvpn/patches/patch-ag
+++ /dev/null
@@ -1,14 +0,0 @@
-$NetBSD: patch-ag,v 1.2 2010/11/30 08:50:17 adam Exp $
-
---- easy-rsa/2.0/pkitool.orig	2010-11-04 19:29:02.000000000 +0000
-+++ easy-rsa/2.0/pkitool
-@@ -142,6 +142,9 @@ CA="ca"
- PKCS11_MODULE_PATH="dummy"
- PKCS11_PIN="dummy"
- 
-+[ -n "$GREP" ] || GREP=grep
-+[ -n "$OPENSSL" ] || OPENSSL=openssl
-+
- # Process options
- while [ $# -gt 0 ]; do
-     case "$1" in