aboutsummaryrefslogtreecommitdiff
path: root/doc
AgeCommit message (Collapse)Author
2022-02-03Remove link_mtu parameter when running up/down scriptsArne Schwabe
The link mtu is no longer used and calculating a compatibility link MTU just for scripts makes little sense as well. Replace the parameter instead with a fixed parameter 0. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20220101162532.2251835-9-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23493.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-02-02Implement optional mtu parameter for mssfixArne Schwabe
The current mssfix parameter is a bit difficult to use as it needs manual calculation of the allowable packet size and also the resulting MSS value does not take into account if IPv4 or IPv6 is used on the outer tunnel. Add 'mtu' parameter to fix both of these problem by dynamically including the real overhead. The syntax and naming of the parameter is chosen for compatiblity with OpenVPN3. Patch V2: document mssfix 0 disabling mssfix, fix rst syntax Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20220101162532.2251835-6-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23495.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-01-27Deprecate link-mtuArne Schwabe
This options might have been useful in the past but nowadays it has a very unclear semantics, so better remove/deprecate it. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20220101162532.2251835-2-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23496.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-01-26update copyright year to 2022Antonio Quartulli
Update performed by means of: dev-tools/update-copyright.sh Cc: David Sommerseth <davids@openvpn.net> Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <20220125142456.18176-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23650.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-01-20Allow management client to announce pss padding supportSelva Nair
The --management-external-key option can currently indicate support for 'nopadding' or 'pkcs1' signatures in the client. Add 'pss' as an option to announce that PSS signing requests are accepted. To match, extend the algorithm string in PK_SIGN request to include the following format: - RSA_PKCS1_PSS_PADDING,hashalg=name,saltlen=[max|digest] Here 'name' is the short common name of the hash algorithm. E.g., SHA1, SHA256 etc. Existing formats 'ECDSA' and 'RSA_PKCS1_PADDING' are unchanged. v2 changes: Fix typos and other sloppiness in documentation and commit message. Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20211214165928.30676-10-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23430.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-01-14doc: remove PF leftovers from documentationAntonio Quartulli
PF (Packet Filter) has been dropped from the OpenVPN code base, however some bits and pieces are left in the documentation. Erase them all. Reported-by: Arne Schwabe <arne@rfc2549.org> Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20220113200030.18656-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23531.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-01-10doc/cipher-negotiation.rst: avoid warning by fixing indentationAntonio Quartulli
Indentation is wrong and triggers the following: rst2man.py openvpn.8.rst > openvpn.8 man-sections/cipher-negotiation.rst:20: (WARNING/2) Definition list ends without a blank line; unexpected unindent. rst2man.py openvpn-examples.5.rst > openvpn-examples.5 rst2html.py openvpn.8.rst > openvpn.8.html man-sections/cipher-negotiation.rst:20: (WARNING/2) Definition list ends without a blank line; unexpected unindent. Get rid of it. Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20220110144013.7233-1-a@unstable.cc> URL: https://www.mail-archive.com/search?l=mid&q=20220110144013.7233-1-a@unstable.cc Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-12-13Adjust cipher-negotiation.rst with compat-mode changesArne Schwabe
This explains that 2.6 will ignore --cipher without --compat-mode and restructures the whole paragraph to better readable. Patch V2: Adjust grammar, use consistently "and later" Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20211213152529.3995394-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23403.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-12-10Move '--push-peer-info' documentation from 'server' to 'client options'Gert Doering
While --push-peer-info can be configured on the server, it's not really intended for that, and it ended in the "SERVER OPTIONS" section by mishap. Fix that. Reported-by: Stella Ashburne <rewefie@gmx.com> Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20211207130436.22187-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23325.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-12-05doc/protocol-options.rst: Correct default for --allow-compressionRichard T Bonhomme
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20211129165538.2948077-1-tincantech@protonmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23268.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-12-05Remove cipher_kt_var_key_size and remaining --keysize documentationArne Schwabe
Remove --keysize from the manual page and also remove mentioning variable key size in output of ciphers as there is no longer a way to change the keysize. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20211201180727.2496903-4-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23275.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-12-05Implement optional cipher in --data-ciphers prefixed with ?Arne Schwabe
This allows to use the same configuration multiple platforms/ssl libraries and include optional algorithms that are not available on all platforms For example "AES-256-GCM:AES-128-GCM:?CHACHA20-POLY1305" can be used to emulate the default behaviour of OpenVPN 2.6. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20211201180727.2496903-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23279.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-11-22doc/man (vpn-network-options): fix foreign_option_{n} typoTodd Zullinger
In 2da29362 (Improve the documentation for --dhcp-option, 2020-08-16), `foreign_option_{n}` became plural between the first and second versions of the patch. Correct it. Signed-off-by: Todd Zullinger <tmz@pobox.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20211122114104.4814-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23217.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-11-17doc link-options.rst: Use free open-source dynamic-DNS provider URLRichard T Bonhomme
Trac: #1417 Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20211103202014.1121244-2-tincantech@protonmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23095.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-11-12Use network address for emulated DHCP server as a defaultLev Stipakov
This is the rebase of original Selva Nair's patch which hasn't been merged: https://sourceforge.net/p/openvpn/mailman/message/34674818/ and documentation change to reflect code changes, which is basically a revert of another Selva's patch (which got merged): https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg13387.h tml For subnet topology use "offset 0" as default for calculating DHCP server address, which makes it equal to the network address. There is no know reason why non-zero default offset is needed. Besides, offset -1 breaks subnet /30 case, which in some cases is pushed by OpenVPN Cloud product. Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20211109015927.311-1-lstipakov@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23156.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-11-12Allow loading of non default providersArne Schwabe
This allows OpenVPN to load non-default providers. This is mainly useful for loading the legacy provider with --providers legacy default Patch v4: use spaces to seperate providers, unload providers. Patch v5: General cleanup, rename option to --providers, add option to usage() and add an entry to Changes.rst Patch v6: allow --providers also to be used (and be ignored) with mbed TLS Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20211112130231.3799480-1-arne@rfc2549.org> URL: https://www.mail-archive.com/search?l=mid&q=20211112130231.3799480-1-arne@rfc2549.org Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-11-07Remove custom PRNG functionArne Schwabe
Remove the custom PRNG from OpenVPN and instead rely always on the random number generator from the SSL library. The only place that this is in a performance critical place is the CBC IV generation. Even with that in mind a micro benchmark shows no significant enough change with OpenSSL 3.0: ------------------------------------------------------------------------ Benchmark Time CPU Iterations ------------------------------------------------------------------------ BM_OpenSSL_RAND 842 ns 842 ns 753401 BM_OpenVPN_RAND 743 ns 743 ns 826690 BM_Encrypt_AES_CBC_dummy 1044 ns 1044 ns 631530 BM_Encrypt_AES_CBC_RAND_bytes 1892 ns 1891 ns 346566 BM_Encrypt_AES_CBC_prng_bytes 1818 ns 1817 ns 373970 (source https://gist.github.com/schwabe/029dc5e5a690df8e2e3f774a13ec7bce) Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Steffan Karger <steffan@karger.me> Message-Id: <20211107090147.3150261-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23116.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-11-05Add insecure tls-cert-profile optionsArne Schwabe
The recent deprecation of SHA1 certificates in OpenSSL 3.0 makes it necessary to reallow them in certain deployments. Currently this works by using the hack of using tls-cipher "DEFAULT:@SECLEVEL=0". Add "insecure" as option to tls-cert-profile to allow setting a seclevel of 0. Patch v4: fix default accidentially changed to insecure Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Max Fillinger <maximilian.fillinger@foxcrypto.com> Message-Id: <20211029112407.2004234-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23076.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-09-21doc: fix indentation in protocol-options.rstAntonio Quartulli
The bullet points are not proeprly indented and they trigger the following error/warning: rst2man.py openvpn.8.rst > openvpn.8 man-sections/protocol-options.rst:62: (ERROR/3) Unexpected indentation. man-sections/protocol-options.rst:67: (WARNING/2) Block quote ends without a blank line; unexpected unindent. rst2man.py openvpn-examples.5.rst > openvpn-examples.5 rst2html.py openvpn.8.rst > openvpn.8.html man-sections/protocol-options.rst:62: (ERROR/3) Unexpected indentation. man-sections/protocol-options.rst:67: (WARNING/2) Block quote ends without a blank line; unexpected unindent. Fix indentation and add white lines as expected. Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20210921121519.18912-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22867.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-09-21Set TLS 1.2 as minimum by defaultAntonio Quartulli
Do not accept handshakes with peers trying to negotiate TLS lower than 1.2. TLS 1.1 and 1.0 are not recommended and therefore we will, by default, allow TLS 1.2 as minimum version. The minimum allowed version can still be controlled via '--tls-version-min'. At the same time automatically set '--tls-version-min' to 1.0 if the user requires compatibility with versions onlder than 2.3.7, as that was the only version supported back then. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20210913192929.26391-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22838.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-09-20compat-mode: add --data-cipher-fallback auomatically if requestedAntonio Quartulli
For compatibility with OpenVPN older than 2.4.0, the '--data-cipher-fallback' argument is automatically added with the same value as specified by '--cipher'. This happens only when the user specifies compat-mode with a version older than 2.4.0. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20210904095629.6273-6-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22798.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-09-20do not include --cipher value in data-ciphersAntonio Quartulli
The --cipher option has been there since a while, but it became more and more confusing since the introduction of NCP (data cipher negotiation). The fallback cipher can now be specified via --data-cipher-fallback, while the list of accepted ciphers is specified via --data-ciphers. --cipher can still be used for compatibility reasons, but won't affect the cipher negotiation. Adjust manpage to make clear that using --cipher in today's config really is a thing from the past, and --data-ciphers should be used instead. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20210904095629.6273-5-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22799.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-09-12Remove support for PF (Packet Filter)Antonio Quartulli
OpenVPN shipped a small packet filtering tool called PF. It has never been straightforward as it required a plugin to work. On top of that, keeping PF support, makes the code more complicated and increases the maintenance cost of OpenVPN. PF itself is not actually maintained at all and there is little motivation in keeping it alive. Some years ago an IPv6 extension for PF was proposed, but it was never picked up for the reasons above. External (and more appropriate) tools can still be used to implement packet filtering on the OpenVPN interface. Drop PF support for good. Note that IDs used for external communication (i.e. to the plugin or management interface) have been commented out, but not removed, as they should not be used in the future. v2: * changed // to /* */ * changed "NOT IMPLEMENTED" to "REMOVED FEATURE" * removed extra empty lines after removing ifdef blocks * clarified on IRC that tls_final has to be removed and therefore that hunk is correct * removed mi_prefix() function as it is now unused Cc: Arne Schwabe <arne@rfc2549.org> Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20210827190014.12640-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22780.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-09-08reject compression by defaultAntonio Quartulli
With this change the value of '--allow-compression' is set to 'no'. Therefore compression is not enabled by default and cannot be enabled by the server either. This change is in line with the current trend of not recommending compression over VPN tunnels for security reasons (check Voracle). Of top of that compression is mostly useless nowadays, therefore there is not real reason to enable it. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20210904095629.6273-4-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22797.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-09-08compat-mode: allow user to specify version to be compatible withAntonio Quartulli
This changes introduces the basic infrastructure required to allow the user to specify a specific OpenVPN version to be compatible with. The next commits will modify defaults to more modern and safer values, while allowing backwards-compatible behaviour on demand. The backwards-compatible behaviour is intructed via the config knob '--compat-mode' implemented in this patch. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20210908072606.5863-1-a@unstable.cc> URL: https://www.mail-archive.com/search?l=mid&q=20210908072606.5863-1-a@unstable.cc Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-09-07Include Chacha20-Poly1305 into default --data-ciphers when availableArne Schwabe
Most TLS 1.3 libraries inlcude the Chacha20-Poly1305 based cipher suite beside the AES-GCM based ones int he list of default ciphers suites. Chacha20-Poly1305 is accepted as good alternative AEAD algorithm to the AES-GCM algorithm by crypto community. Follow this and include Chacha20-Poly1305 by default in data-ciphers when available. This makes picking Chacha20-Poly1305 easier as it only requires to change server (by changing priority) or client side (removing AES-GCM from data-ciphers) to change to Chacha20-Poly1305. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <20210818213354.687736-2-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22745.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-08-28man/protocol-options: add missing ending metacharAntonio Quartulli
A code string terminating character (`) is missing, thus leading to the following warning: man-sections/protocol-options.rst:99: (WARNING/2) Inline interpreted text or phrase reference start-string without end-string. Add missing char at the end of the code word. Cc: David Sommerseth <davids@openvpn.net> Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20210827145656.21646-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22779.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-08-23Minor doc correction: tls-crypt-v2 key generationSelva Nair
Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20210822152820.7072-1-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22747.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-08-16Introduce webauth auth pending method and deprecate openurlArne Schwabe
The experience with openurl/OPEN_URL has shown that just sending a URL to a client is not enough and we often need different behaviour of the client depending on circumstances. Replace OPEN_URL with a more flexible WEB_AUTH pending auth method. Patch v2: use WEB_AUTH instead WEBAUTH Patch v3: incooperate other comments from Selva Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Selva Nair <selva.nair@gmail.com> Message-Id: <20210813115542.2794-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22737.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-08-14Fix client-pending-auth help message in management interfaceSelva Nair
- Add the missing timeout value that is required (not optional) - Split the long line - Also make the AUTH_PENDING state message format in management-notes.txt more precise. Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Message-Id: <20210814044834.2236-1-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22739.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-08-01Add detailed man page section to setup a OpenVPN setup with peer-fingerprintArne Schwabe
This is meant to give new users a quickstart for a useable OpenVPN setup. Our own documentation is lacking in this regard and many tutorials that can be found online are often questionable in some aspects. Linking the individual RST file on github also give a tutorial in a nicely formatted way. Patch V2: Fix grammar/spelling mistakes (thanks tincantech), move to openvpn-examples(5). Patch v3: use server.key and server.crt instead of server.pem/serverkey.pem Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20210728154922.568796-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22674.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-07-28Remove --ncp-disable optionArne Schwabe
NCP has proven to be stable and apart from the one VPN Provider doing hacky things with homebrewed NCP we have not had any reports about ncp-disable being required. Remove ncp-disable to simplify code paths. Note: This patch breaks client without --pull. The follow up patch for P2P NCP will restore that. But to avoid all the NCP/non-NCP special cases to be implemented in P2P. P2P will directly switch from always non-NCP to always NCP. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <20210520151148.2565578-8-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22418.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-07-28Cleanup handling of initial auth tokenArne Schwabe
This changes that auth_token_initial is set when the token is initially generated instead when pushing the token. Even I do not know anymore why I did it in this way in the first place. Also use multi->auth_token_initial as source for the sesssion ID since it should now always be available. Also set auth_token_initial directly to up->password once we verified that we have gotten a valid token from a client. This cleans ups the logic in generating the environment and makes the code flow clearer. Since the change makes auth_token_initial always available we need to add a check to only send a PUSH reply to update the token on renegotiations. The old code relied on multi->auth_token not being set in this case. This commit also removes the workaround for old OpenVPN clients. These were only available as commercial OpenVPN Connect client and not in use anymore. Furthermore, introduce a check if the session ID has changed during a session. Even though this is still a valid authentication changing to a different auth token mid session is highly irregular and should never occur naturally. Patch V2: rebase. Patch V3: fix formatting, clarifying commit message, remove initial token workaround for old v3. Patch v4: move sending the auth-token for renegotiations to a sane place and trigger it when the TLS session reaches its fully authenticated state. Patch v5: Move also setting auth_token_inital from up->password to a more logical place, general cleanups, add session id mismatch check Patch v6: Rework some comments and general cleanup of small things Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <20210719133132.128783-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22645.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-07-09man: Clarify IV_HWADDRDavid Sommerseth
The IV_HWADDR description was only partially correct, as there are more implementations using other values than the MAC address of the default gateway. The intention of this value is to provide a unique identifier of the client and on some platforms this is not possible to retrieve other than to generate this information. The 64 bytes limitation is an arbitrary value, it is not enforced by OpenVPN 2.x. But it was considered a good idea to at least have some reasonable upper limit of how long this string can be, at least for those implementing support for this information. Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20210709134849.161728-1-openvpn@sf.lists.topphemmelig.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22625.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-07-02Update Fox e-mail address in copyright noticesMax Fillinger
Replace openvpn@fox-it.com with openvpn@foxcrypto.com. Signed-off-by: Max Fillinger <maximilian.fillinger@foxcrypto.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20210701171458.8897-1-maximilian.fillinger@foxcrypto.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22608.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-07-02doc: Use generic rules for man/html generationDavid Sommerseth
Prior to this patch, the Makefile.am needs to be modified multiple places to add a new man or HTML page to be generated. Since it is not too often we modify this, it is easy to miss these finer details. This changes the man and HTML generator rules to be more generic and use variables as many places as possible. Also moved all the lines which should not need to be changed as much towards the bottom-half of the file. Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20210630185134.144826-1-openvpn@sf.lists.topphemmelig.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22604.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-07-02Move examples into openvpn-examples(5) man pageArne Schwabe
Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <20210520150932.2565217-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22414.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-06-15Implement auth-token-userArne Schwabe
When not using username and password (i.e. auth-user-pass) it can still be desirable to provide the client with an auth-token, e.g. for allowing a session to continue after a reconnect without requiring 2FA again. However, without --auth-user-pass openvpn does not have a username and will ignore any pushed auth-token command. This patch adds support for auth-token-user to set the username that should be used for auth-token The spec of using auth-token-user base64-encoded-user are the ones that OpenVPN3 already implements. Patch V2: Improve style, fix comments and commit message Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <20210520151148.2565578-2-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22417.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-06-15Improve documentation of AUTH_PENDING related directivesSelva Nair
Also fix some typos. Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20210602034253.19984-2-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22475.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-06-15Update copyrightsDavid Sommerseth
- Update the update-copyright script to include more contributors as well as correcting a few typos - Correct a copyright address in the source code to now used address (dazo) - Update copyright year to 2021 Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20210609213231.22576-1-openvpn@sf.lists.topphemmelig.net> URL: https://www.mail-archive.com/search?l=mid&q=20210609213231.22576-1-openvpn@sf.lists.topphemmelig.net URL: https://sourceforge.net/p/openvpn/mailman/message/37299719/ Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-05-14Document stub-v2 being basically an alias for no compression at allArne Schwabe
Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20210512131511.1309914-9-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22346.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-04-28Implement deferred auth for scriptsArne Schwabe
This patch also refactors the if condition that checks the result of the authentication since that has become quite unreadable. It renames s1/s2 and extracts some parts of the condition into individual variables to make the condition better understandle Patch v2: add refactoring of the if condition Patch v4: fix documentation not mentioning method as 2nd line Patch v5: fix deferred auth used by both plugin and script not working Patch v6: Add missing async inotify for script deferred auth Signed-off-by: Arne Schwabe <arne@rfc2549.org> Tested-by: Antonio Quartulli <antonio@openvpn.net> Acked-by: Antonio Quartulli <antonio@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20210407154951.13330-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22072.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-04-18Add parsing of dhcp-option PROXY_HTTPArne Schwabe
This adds support for setting a HTTP proxy that should be used after connecting to a VPN. The syntax has been picked to have compatibility with OpenVPN3. Otherwise I would have used HTTP-PROXY instead. Since this option requires an additional argument compared to the existing dhcp-option keywords, move checking the number of arguments to the individual keywords. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20210416110955.1162574-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22129.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-04-03Deprecate non TLS mode in OpenVPNArne Schwabe
The non-TLS mode is a relict from OpenVPN 1.x or 2.0. When TLS mode was introduced the advantages of TLS over non-TLS were small but TLS mode evolved to include a lot more features (NCP, multipeer, AEAD ciphers to name a few). Today VPN setups that use --secret are mainly used because this mode is easier to setup and does not require setting up a PKI. This shortcoming of TLS mode should be addressed now with the peer-fingerprint option. The primary reason to deprecate --secret is that it is not secure enough anymore for modern environments. This mode uses a fixed pre-shared key and no session keys. Thus, no forward secrecy is possible, which means that any captured VPN traffic can be decrypted later should the --secret key get into the wrong hands. The cryptography overall used here was okay when --secret was introduced but is not acceptable by today's standard anymore. Finally, modern hardware-accelerated crypto modes like AES-GCM can only be used in TLS mode (due to IV requirements). Patch V2: Improve commit message Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20210328090530.10653-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg21868.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-04-02Implement '--compress migrate' to migrate to non-compression setupArne Schwabe
This option allow migration to a non compression server config while still retraining compatibility with client that have a compression setting in their config. For existing setups that used to have comp-lzo no or another compression setting in their configs it is a difficult to migrate to a setup without compression without replacing all client configs at once especially if OpenVPN 2.3 or earlier clients are in the mix that do not support pushing stub-v2. Even with OpenVPN 2.4 and later clients that support pushing this is not a satisfying solution as the clients log occ mismatches and the "push stub-v2" needs to be in the server config "forever". If the new migrate option to compress is set and a client is detected that indicates that compression is used (via OCC), the server will automatically add ``--push compress stub-v2`` to the client specific configuration if stub-v2 is supported by the client and otherwise switch to ``comp-lzo no`` and add ``--push comp-lzo`` to the client specific configuration. Patch v2: better commit message/man page, add USE_COMP ifdefs, various style fixes Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <20210324220853.31246-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg21801.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-04-01Rename tunnel_server_udp_single_threaded to tunnel_server_udpArne Schwabe
This also eliminates the confusing name and eliminates tunnel_server_udp as wrapper that only calls tunnel_server_udp_single_threaded Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20210401131337.3684-4-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg21955.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-03-22Deprecate the --verify-hash optionArne Schwabe
Despite trying to figure out with multiple people what the use case for this option is, we could not come up with a good one. Checking that only a specific CA is used can be also done by only using that CA in the --ca directive. Although it feels a bit strange to deprecate the option after improving it with peer-fingerprint patches, all the improvements are needed for --peer-fingerprint and making them specify to --peer-fingerprint would have added more (unecessary) changes. Patch v3: rebased on v3 version of other patches. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <20210322091621.7864-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg21779.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-03-22Document the simple self-signed certificate setup in examplesArne Schwabe
Also remove the static key setup example as it is less secure and we want to avoid it for new setups as we want to slowly deprecate these. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <20200908154157.13809-5-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg20904.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-03-21Implement peer-fingerprint to check fingerprint of peer certificateArne Schwabe
This option allows to pin one or more more peer certificates. It also prepares for doing TLS authentication without a CA and just self-signed certificates. Patch V2: Allow peer-fingerprint to be specified multiple times to allow multiple peers without needing to use inline syntax. (e.g. on command line). Patch V3: rebase on v3 of 1/4, reword message of verify-hash and peer-fingerpring incompatibility Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <20210321143353.2677-1-arne@rfc2549.org> URL: https://www.mail-archive.com/search?l=mid&q=20210321143353.2677-1-arne@rfc2549.org Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-03-21Extend verify-hash to allow multiple hashesArne Schwabe
This patch introduces support for verify-hash inlining. When inlined, this options now allows to specify multiple fingerprints, one per line. Since this is a new syntax, there is no backwards compatibility to take care of, therefore we can drop support for SHA1. Inlined fingerprints are assumed be to SHA-256 only. Also print a warning about SHA1 hash being deprecated to verify certificates as it is not "industry standard" anymore. Patch v2: fix/clarify various comments, fix a few minor problems, allow the option to be specified multiple times and have that added to the list. Patch v3: Remove leftover variable, always call parse_hash_fingerprint_multiline, add comments clarifying list appending Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <20210321142538.1656-1-arne@rfc2549.org> URL: https://www.mail-archive.com/search?l=mid&q=20210321142538.1656-1-arne@rfc2549.org Signed-off-by: Gert Doering <gert@greenie.muc.de>
generated by cgit v1.1 at 2024-10-08 16:42:29 +0000