Changes 2.2.0:

* Several man-page updates
* Several buildsystem fixes
* Fixed a bug with GUI icon deletion on upgrade from 2.2-RC or earlier
* Change the default --tmp-dir path to a more suitable path
* Improve the mysprintf() issue in openvpnserv.c
* Fixed bug in port-share that could cause port share process to crash
* Fix the --client-cert-not-required feature

10 files changed, 77 insertions, 297 deletions

diff --git a/net/openvpn/Makefile b/net/openvpn/Makefile
index 950d0c9bc09..3632c020d41 100644
--- a/net/openvpn/Makefile
+++ b/net/openvpn/Makefile
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.40 2011/04/22 14:40:44 obache Exp $
+# $NetBSD: Makefile,v 1.41 2011/04/28 07:27:24 adam Exp $
 
-DISTNAME=	openvpn-2.1.4
-PKGREVISION=	1
+DISTNAME=	openvpn-2.2.0
 CATEGORIES=	net
 MASTER_SITES=	http://swupdate.openvpn.net/community/releases/
 
@@ -12,9 +11,14 @@ LICENSE=	gnu-gpl-v2
 
 PKG_DESTDIR_SUPPORT=	user-destdir
 
-GNU_CONFIGURE=		yes
-USE_TOOLS+=		grep:run
 USE_LIBTOOL=		yes
+USE_TOOLS+=		grep:run
+GNU_CONFIGURE=		yes
+CONFIGURE_ARGS+=	--disable-debug
+CONFIGURE_ARGS+=	--disable-dependency-tracking
+CONFIGURE_ARGS+=	--enable-password-save
+CONFIGURE_ARGS+=	--sysconfdir=${PKG_SYSCONFDIR}
+
 USE_OLD_DES_API=	yes
 TEST_TARGET=		check
 
@@ -24,30 +28,10 @@ EGDIR=			${PREFIX}/share/examples/${PKGBASE}
 EASYRSADIR=		${DATADIR}/easy-rsa
 RCD_SCRIPTS=		openvpn
 
-CONFIGURE_ARGS+=	--sysconfdir=${PKG_SYSCONFDIR}
-CONFIGURE_ARGS+=	--enable-password-save
-CONFIGURE_ARGS+=	--disable-dependency-tracking
-
-# Pthread support is still considered very experimental, so don't enable
-# it for the default (production) build.
-#CONFIGURE_ARGS+=	--enable-pthread
-
-INSTALLATION_DIRS=	${DATADIR}/easy-rsa	${EGDIR}/config		\
-			${EGDIR}/keys		${EGDIR}/scripts
-
-.include "../../mk/bsd.prefs.mk"
-
-# OpenVPN 2.x has a shared module "plugin" architecture that allows
-# inserting callbacks into the server for various tasks.
-DL_AUTO_VARS=		yes
-.include "../../mk/dlopen.buildlink3.mk"
-
-.include "../../archivers/lzo/buildlink3.mk"
-.include "../../security/openssl/buildlink3.mk"
-.include "../../mk/pthread.buildlink3.mk"
-.if ${OPSYS} == "SunOS"
-.include "../../net/solaris-tap/buildlink3.mk"
-.endif
+INSTALLATION_DIRS=	${DATADIR}/easy-rsa
+INSTALLATION_DIRS+=	${EGDIR}/config
+INSTALLATION_DIRS+=	${EGDIR}/keys
+INSTALLATION_DIRS+=	${EGDIR}/scripts
 
 REPLACE_SH=		easy-rsa/2.0/*
 SUBST_CLASSES+=		pkitool
@@ -77,4 +61,17 @@ post-install: post-install-pam
 	done
 
 .include "options.mk"
+
+# OpenVPN 2.x has a shared module "plugin" architecture that allows
+# inserting callbacks into the server for various tasks.
+DL_AUTO_VARS=		yes
+.include "../../mk/dlopen.buildlink3.mk"
+
+.include "../../mk/bsd.prefs.mk"
+.if ${OPSYS} == "SunOS"
+.include "../../net/solaris-tap/buildlink3.mk"
+.endif
+.include "../../archivers/lzo/buildlink3.mk"
+.include "../../security/openssl/buildlink3.mk"
+.include "../../mk/pthread.buildlink3.mk"
 .include "../../mk/bsd.pkg.mk"
diff --git a/net/openvpn/PLIST b/net/openvpn/PLIST
index c4300d5ea0a..027e148de08 100644
--- a/net/openvpn/PLIST
+++ b/net/openvpn/PLIST
@@ -1,6 +1,7 @@
-@comment $NetBSD: PLIST,v 1.11 2010/09/05 20:33:48 adam Exp $
+@comment $NetBSD: PLIST,v 1.12 2011/04/28 07:27:24 adam Exp $
 man/man8/openvpn.8
 sbin/openvpn
+share/doc/openvpn/management-notes.txt
 share/examples/openvpn/config/README
 share/examples/openvpn/config/client.conf
 share/examples/openvpn/config/firewall.sh
@@ -28,6 +29,7 @@ share/examples/openvpn/keys/pass.key
 share/examples/openvpn/keys/pkcs12.p12
 share/examples/openvpn/keys/server.crt
 share/examples/openvpn/keys/server.key
+share/examples/openvpn/keys/ta.key
 share/examples/openvpn/scripts/auth-pam.pl
 share/examples/openvpn/scripts/bridge-start
 share/examples/openvpn/scripts/bridge-stop
diff --git a/net/openvpn/distinfo b/net/openvpn/distinfo
index d1c7a660fc7..e938fb9fd1c 100644
--- a/net/openvpn/distinfo
+++ b/net/openvpn/distinfo
@@ -1,12 +1,12 @@
-$NetBSD: distinfo,v 1.22 2010/11/30 08:50:17 adam Exp $
+$NetBSD: distinfo,v 1.23 2011/04/28 07:27:24 adam Exp $
 
-SHA1 (openvpn-2.1.4.tar.gz) = 07c59c5b89b762761bfe1a6997ec847279f5a2da
-RMD160 (openvpn-2.1.4.tar.gz) = 3d4be2fe625883598370d74e8f7d9274eb40a636
-Size (openvpn-2.1.4.tar.gz) = 863726 bytes
-SHA1 (patch-aa) = df289c5ff2be22ff7cf54ce5f2e6a59f1cfa21dd
-SHA1 (patch-ab) = 4d6010e938c53ea903f535a061e7794f7e6b5b9d
-SHA1 (patch-ac) = 599b324cb67f80e99d18504a9bb17ef24aa601c8
-SHA1 (patch-ad) = 09d5289c922a3d60e5193f9f6b7df1e738002972
-SHA1 (patch-ae) = b6682c115d9d6fa894313416107ad275eab9e5ce
-SHA1 (patch-af) = d7e516662a84e5bb653820efd4dc761f5592c724
+SHA1 (openvpn-2.2.0.tar.gz) = 97e3389814a1bcef5a6d22774534a30e41d48bff
+RMD160 (openvpn-2.2.0.tar.gz) = 32aa52c886d98b6b92150dfc64d3a9c07f6e8b30
+Size (openvpn-2.2.0.tar.gz) = 898381 bytes
+SHA1 (patch-aa) = 87ba516fa1ad73ef093d11a35c01ee660a782d99
+SHA1 (patch-ab) = 75611d54a120cd20e867d21137d1736206c3195d
+SHA1 (patch-ac) = f4ae13ab73193205ad5a301b6756b9c9624b5369
+SHA1 (patch-ad) = c00d15ae2e6c27e3e3c01bca90ab9481e3305941
+SHA1 (patch-ae) = 9f9b601f3c44d8e70b0c28d999e65fe0f538ce33
+SHA1 (patch-af) = 7895af588f229350b8a1d8e8779117dce5f455cc
 SHA1 (patch-ag) = f8afd660bc5c52cc4a8986765857eef1f3c48402
diff --git a/net/openvpn/options.mk b/net/openvpn/options.mk
index 58648d6f19d..45dd3e0fa2c 100644
--- a/net/openvpn/options.mk
+++ b/net/openvpn/options.mk
@@ -1,4 +1,4 @@
-# $NetBSD: options.mk,v 1.4 2010/09/05 20:33:48 adam Exp $
+# $NetBSD: options.mk,v 1.5 2011/04/28 07:27:24 adam Exp $
 
 PKG_OPTIONS_VAR=	PKG_OPTIONS.openvpn
 PKG_SUPPORTED_OPTIONS=	pkcs11 pam
@@ -7,27 +7,25 @@ PKG_SUGGESTED_OPTIONS=
 .include "../../mk/bsd.options.mk"
 
 # include support for certificates on a stick (or card)
-
 .if !empty(PKG_OPTIONS:Mpkcs11)
 .include "../../security/pkcs11-helper/buildlink3.mk"
 .else
-# it would pick it up halfways when installed, and fail building
-CONFIGURE_ARGS+= --disable-pkcs11
+CONFIGURE_ARGS+=	--disable-pkcs11
 .endif
 
-PLIST_VARS+=	pam
+PLIST_VARS+=		pam
 .if !empty(PKG_OPTIONS:Mpam)
-USE_TOOLS+=	gmake
-BUILD_DIRS+=	plugin/auth-pam
-BUILD_TARGET=	# empty
-INSTALL_DIRS=	.
-INSTALL_TARGET=	install
+PLIST.pam=		yes
+USE_TOOLS+=		gmake
+
+BUILD_DIRS+=		plugin/auth-pam
+BUILD_TARGET=		# empty
+INSTALL_DIRS=		.
+INSTALL_TARGET=		install
 INSTALLATION_DIRS+=	lib/openvpn
-PLIST.pam=	yes
 post-install-pam:
-	cd ${WRKSRC}/plugin/auth-pam &&				\
-	${INSTALL_LIB} openvpn-auth-pam.so 			\
-		       ${DESTDIR}${PREFIX}/lib/openvpn || ${TRUE}
+	${INSTALL_LIB} ${WRKSRC}/plugin/auth-pam/openvpn-auth-pam.so \
+		${DESTDIR}${PREFIX}/lib/openvpn || ${TRUE}
 .include "../../mk/pam.buildlink3.mk"
 .else
 post-install-pam:
diff --git a/net/openvpn/patches/patch-aa b/net/openvpn/patches/patch-aa
index 8a9aeff0fde..a1964e56d20 100644
--- a/net/openvpn/patches/patch-aa
+++ b/net/openvpn/patches/patch-aa
@@ -1,8 +1,8 @@
-$NetBSD: patch-aa,v 1.5 2010/11/30 08:50:17 adam Exp $
+$NetBSD: patch-aa,v 1.6 2011/04/28 07:27:25 adam Exp $
 
 --- route.c.orig	2010-11-04 19:29:40.000000000 +0000
 +++ route.c
-@@ -1636,7 +1636,11 @@ get_default_gateway (in_addr_t *gateway,
+@@ -1614,7 +1614,11 @@ get_default_gateway (in_addr_t *gateway,
  #define RTA_NETMASK 0x4
  
  #define RTM_GET     0x4
diff --git a/net/openvpn/patches/patch-ab b/net/openvpn/patches/patch-ab
index 968f35ddc8d..9121092ff9f 100644
--- a/net/openvpn/patches/patch-ab
+++ b/net/openvpn/patches/patch-ab
@@ -1,8 +1,8 @@
-$NetBSD: patch-ab,v 1.6 2010/11/30 08:50:17 adam Exp $
+$NetBSD: patch-ab,v 1.7 2011/04/28 07:27:25 adam Exp $
 
 --- syshead.h.orig	2010-11-04 19:29:02.000000000 +0000
 +++ syshead.h
-@@ -305,6 +305,10 @@
+@@ -306,6 +306,10 @@
  
  #ifdef TARGET_NETBSD
  
diff --git a/net/openvpn/patches/patch-ac b/net/openvpn/patches/patch-ac
index 3e2fdf4bb3a..8c01d06e83a 100644
--- a/net/openvpn/patches/patch-ac
+++ b/net/openvpn/patches/patch-ac
@@ -1,30 +1,8 @@
-$NetBSD: patch-ac,v 1.8 2010/11/30 08:50:17 adam Exp $
+$NetBSD: patch-ac,v 1.9 2011/04/28 07:27:25 adam Exp $
 
---- tun.c.orig	2010-11-04 19:29:02.000000000 +0000
+--- tun.c.orig	2011-04-06 16:05:52.000000000 +0000
 +++ tun.c
-@@ -63,6 +63,7 @@ static const char *netsh_get_id (const c
- 
- #ifdef TARGET_SOLARIS
- static void solaris_error_close (struct tuntap *tt, const struct env_set *es, const char *actual);
-+#include <stropts.h>
- #endif
- 
- bool
-@@ -701,7 +702,12 @@ do_ifconfig (struct tuntap *tt,
- 			    );
- 	}
-       else
--	no_tap_ifconfig ();
-+	openvpn_snprintf (command_line, sizeof (command_line),
-+			  IFCONFIG_PATH " %s %s netmask %s broadcast + up",
-+			  actual,
-+			  ifconfig_local,
-+			  ifconfig_remote_netmask
-+			  );
- 
-       argv_msg (M_INFO, &argv);
-       if (!openvpn_execve_check (&argv, es, 0, "Solaris ifconfig phase-2 failed"))
-@@ -771,15 +777,15 @@ do_ifconfig (struct tuntap *tt,
+@@ -805,15 +805,15 @@ do_ifconfig (struct tuntap *tt,
         * NetBSD has distinct tun and tap devices
         * so we don't need the "link0" extra parameter to specify we want to do 
         * tunneling at the ethernet level
@@ -43,7 +21,7 @@ $NetBSD: patch-ac,v 1.8 2010/11/30 08:50:17 adam Exp $
  			  );
        argv_msg (M_INFO, &argv);
        openvpn_execve_check (&argv, es, S_FATAL, "NetBSD ifconfig failed");
-@@ -1000,7 +1006,37 @@ open_tun_generic (const char *dev, const
+@@ -1023,7 +1023,37 @@ open_tun_generic (const char *dev, const
  	  if (dynamic && !has_digit((unsigned char *)dev))
  	    {
  	      int i;
@@ -82,174 +60,3 @@ $NetBSD: patch-ac,v 1.8 2010/11/30 08:50:17 adam Exp $
  		{
  		  openvpn_snprintf (tunname, sizeof (tunname),
  				    "/dev/%s%d", dev, i);
-@@ -1383,13 +1419,16 @@ read_tun (struct tuntap* tt, uint8_t *bu
- void
- open_tun (const char *dev, const char *dev_type, const char *dev_node, bool ipv6, struct tuntap *tt)
- {
--  int if_fd, muxid, ppa = -1;
--  struct ifreq ifr;
-+  int if_fd, ip_muxid, arp_muxid, arp_fd, ppa = -1;
-+  struct lifreq ifr;
-   const char *ptr;
--  const char *ip_node;
-+  const char *ip_node, *arp_node;
-   const char *dev_tuntap_type;
-   int link_type;
-   bool is_tun;
-+  struct strioctl strioc_if, strioc_ppa;
-+
-+  memset(&ifr, 0x0, sizeof(ifr));
- 
-   ipv6_support (ipv6, false, tt);
- 
-@@ -1410,9 +1449,10 @@ open_tun (const char *dev, const char *d
-     }
-   else if (tt->type == DEV_TYPE_TAP)
-     {
--      ip_node = "/dev/ip";
-+      ip_node = "/dev/udp";
-       if (!dev_node)
- 	dev_node = "/dev/tap";
-+      arp_node = dev_node;
-       dev_tuntap_type = "tap";
-       link_type = I_PLINK; /* was: I_LINK */
-       is_tun = false;
-@@ -1439,7 +1479,11 @@ open_tun (const char *dev, const char *d
-     msg (M_ERR, "Can't open %s", dev_node);
- 
-   /* Assign a new PPA and get its unit number. */
--  if ((ppa = ioctl (tt->fd, TUNNEWPPA, ppa)) < 0)
-+  strioc_ppa.ic_cmd = TUNNEWPPA;
-+  strioc_ppa.ic_timout = 0;
-+  strioc_ppa.ic_len = sizeof(ppa);
-+  strioc_ppa.ic_dp = (char *)&ppa;
-+  if ((ppa = ioctl (tt->fd, I_STR, &strioc_ppa)) < 0)
-     msg (M_ERR, "Can't assign new interface");
- 
-   if ((if_fd = open (dev_node, O_RDWR, 0)) < 0)
-@@ -1448,27 +1492,81 @@ open_tun (const char *dev, const char *d
-   if (ioctl (if_fd, I_PUSH, "ip") < 0)
-     msg (M_ERR, "Can't push IP module");
- 
--  /* Assign ppa according to the unit number returned by tun device */
--  if (ioctl (if_fd, IF_UNITSEL, (char *) &ppa) < 0)
--    msg (M_ERR, "Can't set PPA %d", ppa);
--
--  if ((muxid = ioctl (tt->ip_fd, link_type, if_fd)) < 0)
--    msg (M_ERR, "Can't link %s device to IP", dev_tuntap_type);
--
--  close (if_fd);
-+  if (tt->type == DEV_TYPE_TUN) 
-+    {
-+      /* Assign ppa according to the unit number returned by tun device */
-+      if (ioctl (if_fd, IF_UNITSEL, (char *) &ppa) < 0)
-+	msg (M_ERR, "Can't set PPA %d", ppa);
-+    }
- 
-   tt->actual_name = (char *) malloc (32);
-   check_malloc_return (tt->actual_name);
- 
-   openvpn_snprintf (tt->actual_name, 32, "%s%d", dev_tuntap_type, ppa);
- 
--  CLEAR (ifr);
--  strncpynt (ifr.ifr_name, tt->actual_name, sizeof (ifr.ifr_name));
--  ifr.ifr_ip_muxid = muxid;
-+  if (tt->type == DEV_TYPE_TAP) 
-+    {
-+      if (ioctl(if_fd, SIOCGLIFFLAGS, &ifr) < 0)
-+	msg (M_ERR, "Can't get flags\n");
-+      strncpynt (ifr.lifr_name, tt->actual_name, sizeof (ifr.lifr_name));          
-+      ifr.lifr_ppa = ppa;
-+      /* Assign ppa according to the unit number returned by tun device */          
-+      if (ioctl (if_fd, SIOCSLIFNAME, &ifr) < 0)
-+	msg (M_ERR, "Can't set PPA %d", ppa);              
-+      if (ioctl(if_fd, SIOCGLIFFLAGS, &ifr) <0)
-+	msg (M_ERR, "Can't get flags\n");
-+      /* Push arp module to if_fd */
-+      if (ioctl (if_fd, I_PUSH, "arp") < 0)
-+	msg (M_ERR, "Can't push ARP module");
-+
-+      /* Push arp module to ip_fd */
-+      if (ioctl (tt->ip_fd, I_POP, NULL) < 0)
-+	msg (M_ERR, "I_POP failed\n");  
-+      if (ioctl (tt->ip_fd, I_PUSH, "arp") < 0) 
-+	msg (M_ERR, "Can't push ARP module\n");
-+
-+      /* Open arp_fd */
-+      if ((arp_fd = open (arp_node, O_RDWR, 0)) < 0)
-+	msg (M_ERR, "Can't open %s\n", arp_node);
-+      /* Push arp module to arp_fd */          
-+      if (ioctl (arp_fd, I_PUSH, "arp") < 0)
-+	msg (M_ERR, "Can't push ARP module\n");
-+
-+      /* Set ifname to arp */
-+      strioc_if.ic_cmd = SIOCSLIFNAME;
-+      strioc_if.ic_timout = 0;
-+      strioc_if.ic_len = sizeof(ifr);
-+      strioc_if.ic_dp = (char *)&ifr;
-+      if (ioctl(arp_fd, I_STR, &strioc_if) < 0){
-+	msg (M_ERR, "Can't set ifname to arp\n");
-+      }
-+    }
-+  
-+  if ((ip_muxid = ioctl (tt->ip_fd, link_type, if_fd)) < 0)
-+    msg (M_ERR, "Can't link %s device to IP", dev_tuntap_type);
- 
--  if (ioctl (tt->ip_fd, SIOCSIFMUXID, &ifr) < 0)
-+  if (tt->type == DEV_TYPE_TAP) {
-+    if ((arp_muxid = ioctl (tt->ip_fd, link_type, arp_fd)) < 0)
-+      msg (M_ERR, "Can't link %s device to ARP", dev_tuntap_type);
-+    close (arp_fd);
-+  }
-+
-+  close (if_fd);
-+
-+  CLEAR (ifr);
-+  strncpynt (ifr.lifr_name, tt->actual_name, sizeof (ifr.lifr_name));
-+  ifr.lifr_ip_muxid  = ip_muxid;
-+  if (tt->type == DEV_TYPE_TAP) {
-+    ifr.lifr_arp_muxid = arp_muxid;
-+  }
-+  
-+  if (ioctl (tt->ip_fd, SIOCSLIFMUXID, &ifr) < 0)
-     {
--      ioctl (tt->ip_fd, I_PUNLINK, muxid);
-+      if (tt->type == DEV_TYPE_TAP) 
-+        {
-+	  ioctl (tt->ip_fd, I_PUNLINK , arp_muxid);
-+        }
-+      ioctl (tt->ip_fd, I_PUNLINK, ip_muxid);
-       msg (M_ERR, "Can't set multiplexor id");
-     }
- 
-@@ -1486,18 +1584,24 @@ solaris_close_tun (struct tuntap *tt)
-     {
-       if (tt->ip_fd >= 0)
- 	{
--	  struct ifreq ifr;
-+	  struct lifreq ifr;
- 	  CLEAR (ifr);
--	  strncpynt (ifr.ifr_name, tt->actual_name, sizeof (ifr.ifr_name));
-+	  strncpynt (ifr.lifr_name, tt->actual_name, sizeof (ifr.lifr_name));
- 
--	  if (ioctl (tt->ip_fd, SIOCGIFFLAGS, &ifr) < 0)
-+	  if (ioctl (tt->ip_fd, SIOCGLIFFLAGS, &ifr) < 0)
- 	    msg (M_WARN | M_ERRNO, "Can't get iface flags");
- 
--	  if (ioctl (tt->ip_fd, SIOCGIFMUXID, &ifr) < 0)
-+	  if (ioctl (tt->ip_fd, SIOCGLIFMUXID, &ifr) < 0)
- 	    msg (M_WARN | M_ERRNO, "Can't get multiplexor id");
- 
--	  if (ioctl (tt->ip_fd, I_PUNLINK, ifr.ifr_ip_muxid) < 0)
--	    msg (M_WARN | M_ERRNO, "Can't unlink interface");
-+	  if (tt->type == DEV_TYPE_TAP)
-+            {
-+	      if (ioctl (tt->ip_fd, I_PUNLINK, ifr.lifr_arp_muxid) < 0)
-+		msg (M_WARN | M_ERRNO, "Can't unlink interface(arp)");
-+	    }
-+
-+	  if (ioctl (tt->ip_fd, I_PUNLINK, ifr.lifr_ip_muxid) < 0)
-+	    msg (M_WARN | M_ERRNO, "Can't unlink interface(ip)");
- 
- 	  close (tt->ip_fd);
- 	  tt->ip_fd = -1;
diff --git a/net/openvpn/patches/patch-ad b/net/openvpn/patches/patch-ad
index e08f5844dac..2a4a98da851 100644
--- a/net/openvpn/patches/patch-ad
+++ b/net/openvpn/patches/patch-ad
@@ -1,8 +1,8 @@
-$NetBSD: patch-ad,v 1.3 2010/11/30 08:50:17 adam Exp $
+$NetBSD: patch-ad,v 1.4 2011/04/28 07:27:25 adam Exp $
 
 --- config.h.in.orig	2010-11-04 19:37:13.000000000 +0000
 +++ config.h.in
-@@ -228,6 +228,9 @@
+@@ -234,6 +234,9 @@
  /* Define to 1 if you have the <net/if.h> header file. */
  #undef HAVE_NET_IF_H
  
diff --git a/net/openvpn/patches/patch-ae b/net/openvpn/patches/patch-ae
index 25f28d27117..0352524afd2 100644
--- a/net/openvpn/patches/patch-ae
+++ b/net/openvpn/patches/patch-ae
@@ -1,28 +1,16 @@
-$NetBSD: patch-ae,v 1.4 2010/11/30 08:50:17 adam Exp $
+$NetBSD: patch-ae,v 1.5 2011/04/28 07:27:25 adam Exp $
 
---- configure.ac.orig	2010-11-04 19:29:02.000000000 +0000
+--- configure.ac.orig	2011-04-14 21:30:08.000000000 +0000
 +++ configure.ac
-@@ -362,14 +362,17 @@ if test "${WIN32}" != "yes"; then
+@@ -375,6 +375,7 @@ if test "${WIN32}" != "yes"; then
  		 sys/mman.h fcntl.h sys/file.h stdlib.h stdint.h dnl
  		 stdarg.h unistd.h signal.h stdio.h string.h dnl
  		 strings.h ctype.h errno.h syslog.h pwd.h grp.h dnl
--		 net/if_tun.h net/tun/if_tun.h stropts.h sys/sockio.h dnl
-+		 net/if_tap.h net/if_tun.h net/tun/if_tun.h stropts.h sys/sockio.h dnl
++		 net/if_tap.h
+ 		 net/if_tun.h net/tun/if_tun.h stropts.h sys/sockio.h dnl
  		 netinet/in.h netinet/in_systm.h dnl
  		 netinet/tcp.h arpa/inet.h dnl
- 		 netdb.h sys/uio.h linux/if_tun.h linux/sockios.h dnl
- 		 linux/types.h sys/poll.h sys/epoll.h err.h dnl
-    )
-    AC_CHECK_HEADERS(net/if.h,,,
--		 [#ifdef HAVE_SYS_SOCKET_H 
-+		 [#ifdef HAVE_SYS_TYPES_H 
-+		  # include <sys/types.h>
-+		  #endif
-+		  #ifdef HAVE_SYS_SOCKET_H 
- 		  # include <sys/socket.h>
- 		  #endif
- 		 ])
-@@ -391,6 +394,9 @@ if test "${WIN32}" != "yes"; then
+@@ -407,6 +408,9 @@ if test "${WIN32}" != "yes"; then
  		  #ifdef HAVE_SYS_SOCKET_H
  		  # include <sys/socket.h>
  		  #endif
diff --git a/net/openvpn/patches/patch-af b/net/openvpn/patches/patch-af
index 3e5a808b788..10a7d390d31 100644
--- a/net/openvpn/patches/patch-af
+++ b/net/openvpn/patches/patch-af
@@ -1,29 +1,17 @@
-$NetBSD: patch-af,v 1.5 2010/11/30 08:50:17 adam Exp $
+$NetBSD: patch-af,v 1.6 2011/04/28 07:27:25 adam Exp $
 
---- configure.orig	2010-11-04 19:37:13.000000000 +0000
+--- configure.orig	2011-04-21 19:29:34.000000000 +0000
 +++ configure
-@@ -6814,7 +6814,7 @@ fi
+@@ -5777,7 +5777,7 @@ $as_echo "#define HAVE_SYS_WAIT_H 1" >>c
  
+ fi
  
- 
--for ac_header in sys/time.h sys/socket.h sys/un.h sys/ioctl.h sys/stat.h 		 sys/mman.h fcntl.h sys/file.h stdlib.h stdint.h 		 stdarg.h unistd.h signal.h stdio.h string.h 		 strings.h ctype.h errno.h syslog.h pwd.h grp.h 		 net/if_tun.h net/tun/if_tun.h stropts.h sys/sockio.h 		 netinet/in.h netinet/in_systm.h 		 netinet/tcp.h arpa/inet.h 		 netdb.h sys/uio.h linux/if_tun.h linux/sockios.h 		 linux/types.h sys/poll.h sys/epoll.h err.h
-+for ac_header in sys/time.h sys/socket.h sys/un.h sys/ioctl.h sys/stat.h 		 sys/mman.h fcntl.h sys/file.h stdlib.h stdint.h 		 stdarg.h unistd.h signal.h stdio.h string.h 		 strings.h ctype.h errno.h syslog.h pwd.h grp.h 		 net/if_tap.h net/if_tun.h net/tun/if_tun.h stropts.h sys/sockio.h 		 netinet/in.h netinet/in_systm.h 		 netinet/tcp.h arpa/inet.h 		 netdb.h sys/uio.h linux/if_tun.h linux/sockios.h 		 linux/types.h sys/poll.h sys/epoll.h err.h
- do
- as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
- if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
-@@ -6979,7 +6979,10 @@ _ACEOF
- cat confdefs.h >>conftest.$ac_ext
- cat >>conftest.$ac_ext <<_ACEOF
- /* end confdefs.h.  */
--#ifdef HAVE_SYS_SOCKET_H
-+#ifdef HAVE_SYS_TYPES_H
-+		  # include <sys/types.h>
-+		  #endif
-+		  #ifdef HAVE_SYS_SOCKET_H
- 		  # include <sys/socket.h>
- 		  #endif
- 
-@@ -7121,6 +7124,9 @@ cat >>conftest.$ac_ext <<_ACEOF
+-   for ac_header in sys/time.h sys/socket.h sys/un.h sys/ioctl.h sys/stat.h 		 sys/mman.h fcntl.h sys/file.h stdlib.h stdint.h 		 stdarg.h unistd.h signal.h stdio.h string.h 		 strings.h ctype.h errno.h syslog.h pwd.h grp.h 		 net/if_tun.h net/tun/if_tun.h stropts.h sys/sockio.h 		 netinet/in.h netinet/in_systm.h 		 netinet/tcp.h arpa/inet.h 		 netdb.h sys/uio.h linux/if_tun.h linux/sockios.h 		 linux/types.h sys/poll.h sys/epoll.h err.h
++   for ac_header in sys/time.h sys/socket.h sys/un.h sys/ioctl.h sys/stat.h 		 sys/mman.h fcntl.h sys/file.h stdlib.h stdint.h 		 stdarg.h unistd.h signal.h stdio.h string.h 		 strings.h ctype.h errno.h syslog.h pwd.h grp.h 		 net/if_tap.h net/if_tun.h net/tun/if_tun.h stropts.h sys/sockio.h 		 netinet/in.h netinet/in_systm.h 		 netinet/tcp.h arpa/inet.h 		 netdb.h sys/uio.h linux/if_tun.h linux/sockios.h 		 linux/types.h sys/poll.h sys/epoll.h err.h
+ do :
+   as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
+ ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default"
+@@ -5839,6 +5839,9 @@ do :
  		  #ifdef HAVE_SYS_SOCKET_H
  		  # include <sys/socket.h>
  		  #endif