diff --git a/net/openvpn/Makefile b/net/openvpn/Makefile
index 31e0b1e..9dd1af0 100644
--- a/net/openvpn/Makefile
+++ b/net/openvpn/Makefile
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2006-2012 OpenWrt.org
+# Copyright (C) 2010-2012 OpenWrt.org
 #
 # This is free software, licensed under the GNU General Public License v2.
 # See /LICENSE for more information.
@@ -8,162 +8,116 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=openvpn
-PKG_VERSION:=2.2.2
-PKG_RELEASE:=2
 
+PKG_VERSION:=2.3.0
+PKG_RELEASE=1
+
+PKG_SOURCE_URL:=http://swupdate.openvpn.net/community/releases
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=http://swupdate.openvpn.net/community/releases @SF/openvpn
-PKG_MD5SUM:=c5181e27b7945fa6276d21873329c5c7
+
+PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_VERSION)
 
 PKG_INSTALL:=1
+PKG_FIXUP:=autoreconf
 PKG_BUILD_PARALLEL:=1
 
 include $(INCLUDE_DIR)/package.mk
 
-define Package/openvpn
+define Package/openvpn/Default
+  TITLE:=Open source VPN solution using $(2)
   SECTION:=net
   CATEGORY:=Network
-  SUBMENU:=VPN
-  DEPENDS:=+kmod-tun +libopenssl +!OPENVPN_DISABLE_LZO:liblzo
-  TITLE:=Open source VPN solution using SSL
   URL:=http://openvpn.net
+  SUBMENU:=VPN
   MENU:=1
+  DEPENDS:=+kmod-tun +OPENVPN_$(1)_ENABLE_LZO:liblzo +OPENVPN_$(1)_ENABLE_IPROUTE2:ip $(3)
+  VARIANT:=$(1)
+  MAINTAINER:=Mirko Vogt <mirko@openwrt.org>
 endef
 
-define Package/openvpn/description
- Open source VPN solution using SSL
-endef
-
-define Package/openvpn/config
-	source "$(SOURCE)/Config.in"
-endef
-
+Package/openvpn-openssl=$(call Package/openvpn/Default,openssl,OpenSSL,+libopenssl)
+Package/openvpn-polarssl=$(call Package/openvpn/Default,polarssl,PolarSSL,+libpolarssl)
+Package/openvpn-nossl=$(call Package/openvpn/Default,nossl,plaintext (no SSL))
 
-define Package/openvpn-easy-rsa
-  $(call Package/openvpn)
-  DEPENDS:=+openssl-util
-  TITLE:=Simple shell scripts to manage a Certificate Authority
+define Package/openvpn/config/Default
+	source "$(SOURCE)/Config-$(1).in"
 endef
 
-define Package/openvpn-easy-rsa/conffiles
-/etc/easy-rsa/keys/serial
-/etc/easy-rsa/keys/index.txt
-/etc/easy-rsa/vars
-endef
+Package/openvpn-openssl/config=$(call Package/openvpn/config/Default,openssl)
+Package/openvpn-polarssl/config=$(call Package/openvpn/config/Default,polarssl)
+Package/openvpn-nossl/config=$(call Package/openvpn/config/Default,nossl)
 
-CONFIGURE_ARGS+= \
-	--with-ifconfig-path=/sbin/ifconfig \
-	--with-iproute-path=/usr/sbin/ip \
-	--with-route-path=/sbin/route \
-	--enable-password-save \
-	--disable-debug \
-	--disable-plugins \
-	--disable-pthread \
-	--disable-selinux \
-	--disable-socks \
-	--enable-small
-
-ifeq ($(CONFIG_OPENVPN_DISABLE_LZO),y)
-CONFIGURE_ARGS += \
-	--disable-lzo
+ifeq ($(BUILD_VARIANT),polarssl)
+CONFIG_OPENVPN_POLARSSL:=y
 endif
-
-ifeq ($(CONFIG_OPENVPN_DISABLE_CRYPTO),y)
-CONFIGURE_ARGS += \
-	--disable-crypto
+ifeq ($(BUILD_VARIANT),openssl)
+CONFIG_OPENVPN_OPENSSL:=y
 endif
-
-ifeq ($(CONFIG_OPENVPN_DISABLE_SSL),y)
-CONFIGURE_ARGS += \
-	--disable-ssl
-endif
-
-ifeq ($(CONFIG_OPENVPN_X509_ALT_USERNAME),y)
-CONFIGURE_ARGS += \
-	--enable-x509-alt-username
-endif
-
-ifeq ($(CONFIG_OPENVPN_DISABLE_MULTI),y)
-CONFIGURE_ARGS += \
-	--disable-multi
-endif
-
-ifeq ($(CONFIG_OPENVPN_DISABLE_SERVER),y)
-CONFIGURE_ARGS += \
-	--disable-server
-endif
-
-ifeq ($(CONFIG_OPENVPN_DISABLE_EUREPHIA),y)
-CONFIGURE_ARGS += \
-	--disable-eurephia
+ifeq ($(BUILD_VARIANT),nossl)
+CONFIG_OPENVPN_NOSSL:=y
 endif
 
-ifeq ($(CONFIG_OPENVPN_DISABLE_MANAGEMENT),y)
-CONFIGURE_ARGS += \
-	--disable-management
-endif
-
-ifeq ($(CONFIG_OPENVPN_DISABLE_PKCS11),y)
-CONFIGURE_ARGS += \
-	--disable-pkcs11
-endif
-
-ifeq ($(CONFIG_OPENVPN_DISABLE_HTTP),y)
-CONFIGURE_ARGS += \
-	--disable-http
-endif
-
-ifeq ($(CONFIG_OPENVPN_DISABLE_FRAGMENT),y)
-CONFIGURE_ARGS += \
-	--disable-fragment
-endif
-
-ifeq ($(CONFIG_OPENVPN_DISABLE_MULTIHOME),y)
-CONFIGURE_ARGS += \
-	--disable-multihome
-endif
+CONFIGURE_VARS += \
+	IFCONFIG=/sbin/ifconfig \
+	ROUTE=/sbin/route \
+	IPROUTE=/usr/sbin/ip \
+	NETSTAT=/sbin/netstat
+
+define Build/Configure
+	$(call Build/Configure/Default, \
+		--enable-small \
+		--disable-selinux \
+		--disable-systemd \
+		--disable-plugins \
+		--disable-debug \
+		--disable-eurephia \
+		--disable-pkcs11 \
+		--enable-password-save \
+		$(if $(CONFIG_OPENVPN_$(BUILD_VARIANT)_ENABLE_LZO),--enable,--disable)-lzo \
+		$(if $(CONFIG_OPENVPN_$(BUILD_VARIANT)_ENABLE_X509_ALT_USERNAME),enable,disable-x509-alt-username)-ssl \
+		$(if $(CONFIG_OPENVPN_$(BUILD_VARIANT)_ENABLE_SERVER),--enable,--disable)-server \
+		$(if $(CONFIG_OPENVPN_$(BUILD_VARIANT)_ENABLE_MANAGEMENT),--enable,--disable)-management \
+		$(if $(CONFIG_OPENVPN_$(BUILD_VARIANT)_ENABLE_SOCKS),--enable,--disable)-socks \
+		$(if $(CONFIG_OPENVPN_$(BUILD_VARIANT)_ENABLE_HTTP),--enable,--disable)-http \
+		$(if $(CONFIG_OPENVPN_$(BUILD_VARIANT)_ENABLE_FRAGMENT),--enable,--disable)-fragment \
+		$(if $(CONFIG_OPENVPN_$(BUILD_VARIANT)_ENABLE_MULTIHOME),--enable,--disable)-multihome \
+		$(if $(CONFIG_OPENVPN_$(BUILD_VARIANT)_ENABLE_IPROUTE2),--enable,--disable)-iproute2 \
+		$(if $(CONFIG_OPENVPN_$(BUILD_VARIANT)_ENABLE_DEF_AUTH),--enable,--disable)-def-auth \
+		$(if $(CONFIG_OPENVPN_$(BUILD_VARIANT)_ENABLE_PF),--enable,--disable)-pf \
+		$(if $(CONFIG_OPENVPN_NOSSL),--disable-ssl --disable-crypto,--enable-ssl --enable-crypto) \
+		$(if $(CONFIG_OPENVPN_OPENSSL),--with-crypto-library=openssl) \
+		$(if $(CONFIG_OPENVPN_POLARSSL),--with-crypto-library=polarssl) \
+	)
+endef
 
-ifeq ($(CONFIG_OPENVPN_DISABLE_PORT_SHARE),y)
-CONFIGURE_ARGS += \
-	--disable-port-share
-endif
+define Package/openvpn-$(BUILD_VARIANT)/conffiles
+/etc/config/openvpn
+endef
 
-ifeq ($(CONFIG_OPENVPN_DISABLE_DEF_AUTH),y)
-CONFIGURE_ARGS += \
-	--disable-def-auth
-endif
+define Package/openvpn-$(BUILD_VARIANT)/install
+	$(INSTALL_DIR) \
+		$(1)/usr/sbin \
+		$(1)/etc/init.d \
+		$(1)/etc/config \
+		$(1)/etc/openvpn \
+		$(1)/lib/upgrade/keep.d
 
-ifeq ($(CONFIG_OPENVPN_DISABLE_PF),y)
-CONFIGURE_ARGS += \
-	--disable-pf
-endif
+	$(INSTALL_BIN) \
+		$(PKG_INSTALL_DIR)/usr/sbin/openvpn \
+		$(1)/usr/sbin/
 
-define Package/openvpn/conffiles
-/etc/config/openvpn
-endef
+	$(INSTALL_BIN) \
+		files/openvpn.init \
+		$(1)/etc/init.d/openvpn
 
-define Package/openvpn/install
-	$(INSTALL_DIR) $(1)/usr/sbin
-	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/openvpn $(1)/usr/sbin/
-	$(INSTALL_DIR) $(1)/etc/init.d/
-	$(INSTALL_BIN) files/$(PKG_NAME).init $(1)/etc/init.d/$(PKG_NAME)
-	$(INSTALL_DIR) $(1)/etc/config
-	$(INSTALL_CONF) files/$(PKG_NAME).config $(1)/etc/config/$(PKG_NAME)
-	$(INSTALL_DIR) $(1)/etc/openvpn
-	$(INSTALL_DIR) $(1)/lib/upgrade/keep.d
-	$(INSTALL_DATA) files/openvpn.upgrade $(1)/lib/upgrade/keep.d/openvpn
-endef
+	$(INSTALL_CONF) files/openvpn.config \
+		$(1)/etc/config/openvpn
 
-define Package/openvpn-easy-rsa/install
-	$(INSTALL_DIR) $(1)/usr/sbin
-	$(CP) $(PKG_BUILD_DIR)/easy-rsa/2.0/{build-*,clean-all,inherit-inter,list-crl,pkitool,revoke-full,sign-req,whichopensslcnf} $(1)/usr/sbin/
-	$(INSTALL_DIR) $(1)/etc/easy-rsa
-	$(INSTALL_DATA) $(PKG_BUILD_DIR)/easy-rsa/2.0/openssl-1.0.0.cnf $(1)/etc/easy-rsa/openssl-1.0.0.cnf
-	$(INSTALL_DATA) $(PKG_BUILD_DIR)/easy-rsa/2.0/vars $(1)/etc/easy-rsa/vars
-	$(INSTALL_DIR) $(1)/etc/easy-rsa/keys
-	$(INSTALL_DATA) files/easy-rsa.index $(1)/etc/easy-rsa/keys/index.txt
-	$(INSTALL_DATA) files/easy-rsa.serial $(1)/etc/easy-rsa/keys/serial
+	$(INSTALL_DATA) \
+		files/openvpn.upgrade \
+		$(1)/lib/upgrade/keep.d/openvpn
 endef
 
-$(eval $(call BuildPackage,openvpn))
-$(eval $(call BuildPackage,openvpn-easy-rsa))
+$(eval $(call BuildPackage,openvpn-openssl))
+$(eval $(call BuildPackage,openvpn-polarssl))
+$(eval $(call BuildPackage,openvpn-nossl))
--- a/net/openvpn/Config.in	2013-04-25 00:23:58.074722824 +0200
+++ /dev/null	2013-04-24 21:51:28.706000050 +0200
@@ -1,79 +0,0 @@
-menu "Configuration"
-	depends on PACKAGE_openvpn
-
-config OPENVPN_DISABLE_LZO
-	bool "Disable LZO compression support"
-	depends on PACKAGE_openvpn
-	default n
-
-config OPENVPN_DISABLE_CRYPTO
-	bool "Disable OpenSSL crypto support"
-	depends on PACKAGE_openvpn
-	default n
-
-config OPENVPN_DISABLE_SSL
-	bool "Disable OpenSSL SSL support for TLS-based key exchange"
-	depends on PACKAGE_openvpn
-	default n
-
-config OPENVPN_X509_ALT_USERNAME
-	bool "Enable the --x509-username-field feature"
-	depends on PACKAGE_openvpn
-	default n
-
-config OPENVPN_DISABLE_MULTI
-	bool "Disable client/server support (--mode server + client mode)"
-	depends on PACKAGE_openvpn
-	default n
-
-config OPENVPN_DISABLE_SERVER
-	bool "Disable server support only (but retain client support)"
-	depends on PACKAGE_openvpn
-	default n
-
-config OPENVPN_DISABLE_EUREPHIA
-	bool "Disable support for the eurephia plug-in"
-	depends on PACKAGE_openvpn
-	default y
-
-config OPENVPN_DISABLE_MANAGEMENT
-	bool "Disable management server support"
-	depends on PACKAGE_openvpn
-	default y
-
-config OPENVPN_DISABLE_PKCS11
-	bool "Disable pkcs11 support"
-	depends on PACKAGE_openvpn
-	default n
-
-config OPENVPN_DISABLE_HTTP
-	bool "Disable HTTP proxy support"
-	depends on PACKAGE_openvpn
-	default n
-
-config OPENVPN_DISABLE_FRAGMENT
-	bool "Disable internal fragmentation support (--fragment)"
-	depends on PACKAGE_openvpn
-	default n
-
-config OPENVPN_DISABLE_MULTIHOME
-	bool "Disable multi-homed UDP server support (--multihome)"
-	depends on PACKAGE_openvpn
-	default n
-
-config OPENVPN_DISABLE_PORT_SHARE
-	bool "Disable TCP server port-share support (--port-share)"
-	depends on PACKAGE_openvpn
-	default n
-
-config OPENVPN_DISABLE_DEF_AUTH
-	bool "Disable deferred authentication"
-	depends on PACKAGE_openvpn
-	default n
-
-config OPENVPN_DISABLE_PF
-	bool "Disable internal packet filter"
-	depends on PACKAGE_openvpn
-	default n
-
-endmenu
--- a/net/openvpn/patches/001-easy_rsa.patch	2013-04-25 00:23:58.076722776 +0200
+++ /dev/null	2013-04-24 21:51:28.706000050 +0200
@@ -1,152 +0,0 @@
---- a/easy-rsa/2.0/build-ca
-+++ b/easy-rsa/2.0/build-ca
-@@ -5,4 +5,4 @@
- #
- 
- export EASY_RSA="${EASY_RSA:-.}"
--"$EASY_RSA/pkitool" --interact --initca $*
-+"/usr/sbin/pkitool" --interact --initca $*
---- a/easy-rsa/2.0/build-dh
-+++ b/easy-rsa/2.0/build-dh
-@@ -1,5 +1,7 @@
- #!/bin/sh
- 
-+. /etc/easy-rsa/vars
-+
- # Build Diffie-Hellman parameters for the server side
- # of an SSL/TLS connection.
- 
---- a/easy-rsa/2.0/build-inter
-+++ b/easy-rsa/2.0/build-inter
-@@ -4,4 +4,4 @@
- # root certificate.
- 
- export EASY_RSA="${EASY_RSA:-.}"
--"$EASY_RSA/pkitool" --interact --inter $*
-+"/usr/sbin/pkitool" --interact --inter $*
---- a/easy-rsa/2.0/build-key
-+++ b/easy-rsa/2.0/build-key
-@@ -4,4 +4,4 @@
- # root certificate.
- 
- export EASY_RSA="${EASY_RSA:-.}"
--"$EASY_RSA/pkitool" --interact $*
-+"/usr/sbin/pkitool" --interact $*
---- a/easy-rsa/2.0/build-key-pass
-+++ b/easy-rsa/2.0/build-key-pass
-@@ -4,4 +4,4 @@
- # with a password.
- 
- export EASY_RSA="${EASY_RSA:-.}"
--"$EASY_RSA/pkitool" --interact --pass $*
-+"/usr/sbin/pkitool" --interact --pass $*
---- a/easy-rsa/2.0/build-key-pkcs12
-+++ b/easy-rsa/2.0/build-key-pkcs12
-@@ -5,4 +5,4 @@
- # the CA certificate as well.
- 
- export EASY_RSA="${EASY_RSA:-.}"
--"$EASY_RSA/pkitool" --interact --pkcs12 $*
-+"/usr/sbin/pkitool" --interact --pkcs12 $*
---- a/easy-rsa/2.0/build-key-server
-+++ b/easy-rsa/2.0/build-key-server
-@@ -7,4 +7,4 @@
- # extension in the openssl.cnf file.
- 
- export EASY_RSA="${EASY_RSA:-.}"
--"$EASY_RSA/pkitool" --interact --server $*
-+"/usr/sbin/pkitool" --interact --server $*
---- a/easy-rsa/2.0/build-req
-+++ b/easy-rsa/2.0/build-req
-@@ -4,4 +4,4 @@
- # when your root certificate and key is not available locally.
- 
- export EASY_RSA="${EASY_RSA:-.}"
--"$EASY_RSA/pkitool" --interact --csr $*
-+"/usr/sbin/pkitool" --interact --csr $*
---- a/easy-rsa/2.0/build-req-pass
-+++ b/easy-rsa/2.0/build-req-pass
-@@ -4,4 +4,4 @@
- # with a password.
- 
- export EASY_RSA="${EASY_RSA:-.}"
--"$EASY_RSA/pkitool" --interact --csr --pass $*
-+"/usr/sbin/pkitool" --interact --csr --pass $*
---- a/easy-rsa/2.0/clean-all
-+++ b/easy-rsa/2.0/clean-all
-@@ -1,5 +1,7 @@
- #!/bin/sh
- 
-+. /etc/easy-rsa/vars
-+
- # Initialize the $KEY_DIR directory.
- # Note that this script does a
- # rm -rf on $KEY_DIR so be careful!
---- a/easy-rsa/2.0/inherit-inter
-+++ b/easy-rsa/2.0/inherit-inter
-@@ -1,5 +1,7 @@
- #!/bin/sh
- 
-+. /etc/easy-rsa/vars
-+
- # Build a new PKI which is rooted on an intermediate certificate generated
- # by ./build-inter or ./pkitool --inter from a parent PKI.  The new PKI should
- # have independent vars settings, and must use a different KEY_DIR directory
---- a/easy-rsa/2.0/list-crl
-+++ b/easy-rsa/2.0/list-crl
-@@ -1,5 +1,7 @@
- #!/bin/sh
- 
-+. /etc/easy-rsa/vars
-+
- # list revoked certificates
- 
- CRL="${1:-crl.pem}"
---- a/easy-rsa/2.0/pkitool
-+++ b/easy-rsa/2.0/pkitool
-@@ -1,5 +1,7 @@
- #!/bin/sh
- 
-+. /etc/easy-rsa/vars
-+
- #  OpenVPN -- An application to securely tunnel IP networks
- #             over a single TCP/UDP port, with support for SSL/TLS-based
- #             session authentication and key exchange,
---- a/easy-rsa/2.0/revoke-full
-+++ b/easy-rsa/2.0/revoke-full
-@@ -1,5 +1,7 @@
- #!/bin/sh
- 
-+. /etc/easy-rsa/vars
-+
- # revoke a certificate, regenerate CRL,
- # and verify revocation
- 
---- a/easy-rsa/2.0/sign-req
-+++ b/easy-rsa/2.0/sign-req
-@@ -4,4 +4,4 @@
- # with a local root certificate and key.
- 
- export EASY_RSA="${EASY_RSA:-.}"
--"$EASY_RSA/pkitool" --interact --sign $*
-+"/usr/sbin/pkitool" --interact --sign $*
---- a/easy-rsa/2.0/vars
-+++ b/easy-rsa/2.0/vars
-@@ -12,7 +12,7 @@
- # This variable should point to
- # the top level of the easy-rsa
- # tree.
--export EASY_RSA="`pwd`"
-+export EASY_RSA="/etc/easy-rsa"
- 
- #
- # This variable should point to
-@@ -26,7 +26,7 @@ export GREP="grep"
- # This variable should point to
- # the openssl.cnf file included
- # with easy-rsa.
--export KEY_CONFIG=`$EASY_RSA/whichopensslcnf $EASY_RSA`
-+export KEY_CONFIG=`/usr/sbin/whichopensslcnf $EASY_RSA`
- 
- # Edit this variable to point to
- # your soon-to-be-created key
--- a/net/openvpn/Config-nossl.in	2013-04-24 21:51:28.706000050 +0200
+++ b/net/openvpn/Config-nossl.in	2013-04-24 20:06:57.000000000 +0200
@@ -0,0 +1,47 @@
+if PACKAGE_openvpn-nossl
+
+config OPENVPN_nossl_ENABLE_LZO
+	bool "Enable LZO compression support"
+	default y
+
+config OPENVPN_nossl_ENABLE_SERVER
+	bool "Enable server support (otherwise only client mode is support)"
+	default y
+
+config OPENVPN_nossl_ENABLE_MANAGEMENT
+	bool "Enable management server support"
+	default n
+
+config OPENVPN_nossl_ENABLE_HTTP
+	bool "Enable HTTP proxy support"
+	default y
+
+config OPENVPN_nossl_ENABLE_SOCKS
+	bool "Enable SOCKS proxy support"
+	default y
+
+config OPENVPN_nossl_ENABLE_FRAGMENT
+	bool "Enable internal fragmentation support (--fragment)"
+	default y
+
+config OPENVPN_nossl_ENABLE_MULTIHOME
+	bool "Enable multi-homed UDP server support (--multihome)"
+	default y
+
+config OPENVPN_nossl_ENABLE_PORT_SHARE
+	bool "Enable TCP server port-share support (--port-share)"
+	default y
+
+config OPENVPN_nossl_ENABLE_DEF_AUTH
+	bool "Enable deferred authentication"
+	default y
+
+config OPENVPN_nossl_ENABLE_PF
+	bool "Enable internal packet filter"
+	default y
+
+config OPENVPN_nossl_ENABLE_IPROUTE2
+	bool "Enable support for iproute2"
+	default n
+
+endif
--- a/net/openvpn/Config-openssl.in	2013-04-24 21:51:28.706000050 +0200
+++ b/net/openvpn/Config-openssl.in	2013-04-24 20:06:57.000000000 +0200
@@ -0,0 +1,59 @@
+if PACKAGE_openvpn-openssl
+
+config OPENVPN_openssl_ENABLE_LZO
+	bool "Enable LZO compression support"
+	default y
+
+config OPENVPN_openssl_ENABLE_X509_ALT_USERNAME
+	bool "Enable the --x509-username-field feature"
+	default n
+
+config OPENVPN_openssl_ENABLE_SERVER
+	bool "Enable server support (otherwise only client mode is support)"
+	default y
+
+#config OPENVPN_openssl_ENABLE_EUREPHIA
+#	bool "Enable support for the eurephia plug-in"
+#	default n
+
+config OPENVPN_openssl_ENABLE_MANAGEMENT
+	bool "Enable management server support"
+	default n
+
+#config OPENVPN_openssl_ENABLE_PKCS11
+#	bool "Enable pkcs11 support"
+#	default n
+
+config OPENVPN_openssl_ENABLE_HTTP
+	bool "Enable HTTP proxy support"
+	default y
+
+config OPENVPN_openssl_ENABLE_SOCKS
+	bool "Enable SOCKS proxy support"
+	default y
+
+config OPENVPN_openssl_ENABLE_FRAGMENT
+	bool "Enable internal fragmentation support (--fragment)"
+	default y
+
+config OPENVPN_openssl_ENABLE_MULTIHOME
+	bool "Enable multi-homed UDP server support (--multihome)"
+	default y
+
+config OPENVPN_openssl_ENABLE_PORT_SHARE
+	bool "Enable TCP server port-share support (--port-share)"
+	default y
+
+config OPENVPN_openssl_ENABLE_DEF_AUTH
+	bool "Enable deferred authentication"
+	default y
+
+config OPENVPN_openssl_ENABLE_PF
+	bool "Enable internal packet filter"
+	default y
+
+config OPENVPN_openssl_ENABLE_IPROUTE2
+	bool "Enable support for iproute2"
+	default n
+
+endif
--- a/net/openvpn/Config-polarssl.in/dev/null	2013-04-24 21:51:28.706000050 +0200
+++ b/net/openvpn/Config-polarssl.in	2013-04-24 20:06:57.000000000 +0200
@@ -0,0 +1,59 @@
+if PACKAGE_openvpn-polarssl
+
+config OPENVPN_polarssl_ENABLE_LZO
+	bool "Enable LZO compression support"
+	default y
+
+config OPENVPN_polarssl_ENABLE_X509_ALT_USERNAME
+	bool "Enable the --x509-username-field feature"
+	default n
+
+config OPENVPN_polarssl_ENABLE_SERVER
+	bool "Enable server support (otherwise only client mode is support)"
+	default y
+
+#config OPENVPN_polarssl_ENABLE_EUREPHIA
+#	bool "Enable support for the eurephia plug-in"
+#	default n
+
+config OPENVPN_polarssl_ENABLE_MANAGEMENT
+	bool "Enable management server support"
+	default n
+
+#config OPENVPN_polarssl_ENABLE_PKCS11
+#	bool "Enable pkcs11 support"
+#	default n
+
+config OPENVPN_polarssl_ENABLE_HTTP
+	bool "Enable HTTP proxy support"
+	default y
+
+config OPENVPN_polarssl_ENABLE_SOCKS
+	bool "Enable SOCKS proxy support"
+	default y
+
+config OPENVPN_polarssl_ENABLE_FRAGMENT
+	bool "Enable internal fragmentation support (--fragment)"
+	default y
+
+config OPENVPN_polarssl_ENABLE_MULTIHOME
+	bool "Enable multi-homed UDP server support (--multihome)"
+	default y
+
+config OPENVPN_polarssl_ENABLE_PORT_SHARE
+	bool "Enable TCP server port-share support (--port-share)"
+	default y
+
+config OPENVPN_polarssl_ENABLE_DEF_AUTH
+	bool "Enable deferred authentication"
+	default y
+
+config OPENVPN_polarssl_ENABLE_PF
+	bool "Enable internal packet filter"
+	default y
+
+config OPENVPN_polarssl_ENABLE_IPROUTE2
+	bool "Enable support for iproute2"
+	default n
+
+endif
--- a/net/openvpn/patches/100-polarssl_update.patch	2013-04-24 21:51:28.706000050 +0200
+++ b/net/openvpn/patches/100-polarssl_update.patch	2013-04-24 20:06:57.000000000 +0200
@@ -0,0 +1,60 @@
+--- a/src/openvpn/crypto_polarssl.h
++++ b/src/openvpn/crypto_polarssl.h
+@@ -60,7 +60,7 @@ typedef md_context_t hmac_ctx_t;
+ #define OPENVPN_MODE_OFB 	POLARSSL_MODE_OFB
+ 
+ /** Cipher is in CFB mode */
+-#define OPENVPN_MODE_CFB 	POLARSSL_MODE_CFB128
++#define OPENVPN_MODE_CFB 	POLARSSL_MODE_CFB
+ 
+ /** Cipher should encrypt */
+ #define OPENVPN_OP_ENCRYPT 	POLARSSL_ENCRYPT
+--- a/src/openvpn/ssl_polarssl.c
++++ b/src/openvpn/ssl_polarssl.c
+@@ -65,23 +65,6 @@ tls_clear_error()
+ {
+ }
+ 
+-static int default_ciphersuites[] =
+-{
+-    SSL_EDH_RSA_AES_256_SHA,
+-    SSL_EDH_RSA_CAMELLIA_256_SHA,
+-    SSL_EDH_RSA_AES_128_SHA,
+-    SSL_EDH_RSA_CAMELLIA_128_SHA,
+-    SSL_EDH_RSA_DES_168_SHA,
+-    SSL_RSA_AES_256_SHA,
+-    SSL_RSA_CAMELLIA_256_SHA,
+-    SSL_RSA_AES_128_SHA,
+-    SSL_RSA_CAMELLIA_128_SHA,
+-    SSL_RSA_DES_168_SHA,
+-    SSL_RSA_RC4_128_SHA,
+-    SSL_RSA_RC4_128_MD5,
+-    0
+-};
+-
+ void
+ tls_ctx_server_new(struct tls_root_ctx *ctx)
+ {
+@@ -515,11 +498,11 @@ void key_state_ssl_init(struct key_state
+       ssl_set_rng (ks_ssl->ctx, ctr_drbg_random, rand_ctx_get());
+ 
+       ALLOC_OBJ_CLEAR (ks_ssl->ssn, ssl_session);
+-      ssl_set_session (ks_ssl->ctx, 0, 0, ks_ssl->ssn );
++      ssl_set_session (ks_ssl->ctx, ks_ssl->ssn );
+       if (ssl_ctx->allowed_ciphers)
+ 	ssl_set_ciphersuites (ks_ssl->ctx, ssl_ctx->allowed_ciphers);
+       else
+-	ssl_set_ciphersuites (ks_ssl->ctx, default_ciphersuites);
++	ssl_set_ciphersuites (ks_ssl->ctx, ssl_default_ciphersuites);
+ 
+       /* Initialise authentication information */
+       if (is_server)
+@@ -828,7 +811,7 @@ print_details (struct key_state_ssl * ks
+ 		    ssl_get_version (ks_ssl->ctx),
+ 		    ssl_get_ciphersuite(ks_ssl->ctx));
+ 
+-  cert = ks_ssl->ctx->peer_cert;
++  cert = ssl_get_peer_cert(ks_ssl->ctx);
+   if (cert != NULL)
+     {
+       openvpn_snprintf (s2, sizeof (s2), ", " counter_format " bit RSA", (counter_type) cert->rsa.len * 8);
