-1

Using code base of OpenVPN (GNU GPLv2 license) in proprietary closed source project is under consideration. OpenVPN uses OpenSSL (Apache License 2.0). Changes in OpenSSL are needed only (OpenVPN will be intact). So OpenSSL has permissive license (allows changing of license of proprietary project) and OpenVPN - strong copyleft - license can not be changed.

If changes will be in OpenSSL only is it legal to distribute part of proprietary project as closed source (hide changes in OpenSSL)?

5
  • 1
    The choice of GPLv2 for OpenVPN was most certainly made to swart attempts like you outline here in your question. As a general guide: if you need the header files of a project to build your solution, then you are bound by the license of the project you need the files from. Thus if you need OpenVPN development header files installed to build your product, you almost certainly are not allowed to distribute your product under terms different than GPLv2. May 16, 2022 at 6:51
  • @planetmaker Thank you. OpenVPN has commercial license also (OpenVPN Access Server). Correct me please if I wrong: as authors of OpenVPN they can provide the same code base both with GPLv2 for community edition and with commercial license for Access Server. So if one need to distribute closed source project (based on OpenVPN) he can use OpenVPN commercial license?
    – Vlad
    May 16, 2022 at 8:33
  • I don't know. But if I look at the changelog of OpenVPN I doubt that they are legally allowed to distriubte OpenVPN under anything but the GPLv2. They don't need a "commercial license" to offer anything of their services as SAAS. That's perfectly fine under GPL as under any open source license. Open source actually implies commercial utizilation is allowed. GPL additionally implies you need to disclose sources to your customers / recipients of the software, if you distribute binaries. May 16, 2022 at 8:41
  • In essence what they seem to do is: they offer security services. And they stress their serviousness by using open source. Thus anyone can review that they use properly working technology. And deriving closed-source software with security-by-obscurity from it is guarded against by the use of GPL (though it cannot stop anyone in messing with it for undistributed only in-house used server-side components - but this then cannot ever be distributed with anything other than GPL, too) May 16, 2022 at 8:47
  • Thanks. Likely they provide standalone components. According to wiki: "OpenVPN Access Server is based on the Community Edition, but provides additional paid and proprietary features like LDAP integration, SMB server, Web UI management and provides a set of installation and configuration tools"
    – Vlad
    May 17, 2022 at 2:02

1 Answer 1

6

Almost certainly not.

Due to the GPL license on OpenVPN, you must make available the source code of anything which forms a combined work with OpenVPN. If the rest of your program communicates only "at arm's length" with the OpenVPN code (e.g. via a subprocess communicating via command-line arguments only) then you have a reasonable case that OpenVPN is a separate work and the GPL does not extend across the boundary.

However, given the nature of OpenVPN and OpenSSL I strongly suspect OpenVPN is tightly coupled with OpenSSL, in which case the GPL does extend across the boundary and you must distribute the changes to OpenSSL.

As an aside, if any vendor ever tried to ship me a product which contained their own modifications to OpenSSL, I would immediately be asking them to provide, at their cost, an independent security audit showing that they haven't screwed things up. Don't write your own crypto.

3
  • Thank you. I can't "write my own crypto" because this is my profession. Sure - certification is mandatory. You are right - OpenVPN is tightly coupled with OpenSSL - within one process. I just hoped that if it's possible to compile and link executable (GPL) with dynamic library(Apache lic) then GPL will not extend to dynamic library.
    – Vlad
    May 15, 2022 at 16:19
  • Interesting - if one change interface between OpenVPN and OpenSSL from linkage to IPC - does it mean that it's possible to hide algorithms in modified OpenSSL?
    – Vlad
    May 15, 2022 at 16:25
  • 5
    @VladNovakovsky Still "almost certainly not"; IPC with deep knowledge of the internals on either side is still one work. For further reading, see the GPL FAQ and numerous questions on this site - if they aren't enough for you, your company should engage a specialist IP lawyer. May 15, 2022 at 19:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.