aboutsummaryrefslogtreecommitdiff
path: root/doc
AgeCommit message (Collapse)Author
2022-08-05dco: add documentation for ovpn-dco-linuxAntonio Quartulli
Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20220805093703.27940-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24817.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-07-19dco: allow user to disable it at runtimeAntonio Quartulli
Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20220718221923.2033-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24702.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-06-21Update the replay-window backtrack log messageMartin Janů
The man pages reference a logging message which has been rephrased in ac1310528a248c99e039e7afaf48724ad1b7f10e. This commit updates the man page message to reflect the change for improved grep-ability. Signed-off-by: Martin Janů <martin.janu@protonmail.com> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <SVrvuTydxR6Qs_mvwvG7mqT8iLV0inlcCMXoenZTMI8M0LkosV4pZsH9m_XCTwcRWAPN5H8Zdro0ubhJrnSp6v5KC2ZNAL9So0Y2SKiSe7g=@protonmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24472.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-05-28doc: fix literal block in tls-options.rstHeiko Hund
Signed-off-by: Heiko Hund <heiko@ist.eigentlich.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20220511121038.1002898-1-heiko@ist.eigentlich.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24320.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-05-22cipher-negotiation.rst missing from doc/Makefile.amJan Mikkelsen
Trac: #1461 Signed-off-by: Jan Mikkelsen <janm@transactionware.com> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20220518183715.931-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24394.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-05-06Implement HMAC based session id for tls-crypt v2Arne Schwabe
Tls-crypt v2 is more complicated to implement a proper stateless handshake. To allow state handshake this commit does - introduce a new packet CONTROL_WKC_V1 that repeats the wrapped client key. - introduce a way to negotiate the support for this packet in the three way handshake Details about the protocol changes are in tls-crypt-v2.txt. Optional arguments to the tls-crypt-v2 option have been added to explicitly allow or disallow client that do not support the stateless handshake. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Patch v3: improve grammar, style, comments, fix unit tests Patch v4: remove explicit flag for ability to resend WKc, clean up comments, improve code style in some instances Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <20220505130348.1183195-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24287.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-05-05Implement stateless HMAC-based sesssion-id three-way-handshakeArne Schwabe
OpenVPN currently has a bit of a weakness in its early three way handshake A single client reset packet (first packet of the handshake) will - trigger creating a session on the server side leading to potential ressource exhaustion - make the server respond with 3 answers trying to get an ACK for its P_CONTROL_HARD_RESET_SERVER_V2 answer making it an amplification Instead of allocating a connection for each client on the initial packet OpenVPN will now calculate a session id based on a HMAC that serves as verifiable cookie that can be checked for authenticity when the client responds with it. This eliminates the amplification attack and resource exhaustion attacks. For tls-crypt-v2 clients the HMAC based handshake is not used yet (will be added in one of the next patches). Patch v2: rebase on master patch v3: fix unit tests, improve comment/style of code Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20220502154310.836947-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24262.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-03-29add support for --dns optionHeiko Hund
As a first step towards DNS configuration in openvpn and a unified way to push DNS related settings to clients in v2 and v3, this commit adds support for parsing the new --dns option. Later commits will add support for setting up DNS on different platforms. For now, --dns and DNS related --dhcp-option can be used together for smoother transition. Settings from --dns will override ones --dhcp-option where applicable. For detailed information about the option consult the documentation in this commit. Signed-off-by: Heiko Hund <heiko@ist.eigentlich.net> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20220323143452.1100446-1-heiko@ist.eigentlich.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23997.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-03-17Implement fixed MSS value for mssfix and use it for non default MTUsArne Schwabe
This allows to set the MSS value inside the tunnel to a user specified value instead of calculating it form (somewhat) dynamic encapsulation overhead. Also default to the MTU when tun-mtu does not have the default value to ensure that packets are not larger than the tun-mtu. This only affects packets that are routed via the VPN and none of the peers is an endpoint since otherwise the peer would already set a lower MTU. Acked-by: Lev Stipakov <lstipakov@gmail.com> Message-Id: <20220224144245.878056-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23886.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-03-15plug-ins: Disallow multiple deferred authentication plug-insDavid Sommerseth
The plug-in API in OpenVPN 2.x is not designed for running multiple deferred authentication processes in parallel. The authentication results of such configurations are not to be trusted. For now we bail out when this is discovered with an error in the log. CVE: 2022-0547 Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <20220313193154.9350-3-openvpn@sf.lists.topphemmelig.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23931.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-03-15sample-plugin: New plugin for testing multiple auth pluginsDavid Sommerseth
This plugin allows setting username/passwords as well as configure deferred authentication behaviour as part of the runtime initialization. With this plug-in it is easier to test various scenarios where multiple authentication plug-ins are active on the server side. A test documentation was also added to describe various test cases and the expected results. Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <20220313193154.9350-2-openvpn@sf.lists.topphemmelig.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23932.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-02-16doc/options: clean up documentation for --proto and related optionsFrank Lichtenheld
The family specific options were generally omitted. Cc: David Sommerseth <openvpn@sf.lists.topphemmelig.net> Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <20220215145425.1989-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23798.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-02-15doc: fix misc documentation issuesFrank Lichtenheld
- Broken/missing formatting - Make it obvious which arguments are optional Only the files touched have been reviewed, all other files likely have similar issues. Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <20220214173342.12655-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23788.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-02-13Add mtu paramter to --fragment and change fragment calculationArne Schwabe
Instead relying on the link_mtu_dynamic field and its calculation in the frame struct, add a new field max_fragment_size and add a calculation of it similar to mssfix. Also whenever mssfix value is calculated, we also want to calculate the values for fragment as both options need to be calculated from the real overhead. Patch v2: Fix syntax in rst man page Patch v5: fix segfault when get_ip_encap_overhead gets called early in init_instance and note that these calls will always be overwritten by NCP in tls_session_update_crypto_params Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20220212003331.3483107-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23764.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-02-10doc/Makefile: rebuild rst docs if input files changeFrank Lichtenheld
For now the dependencies are statically defined, which should be fine and is still a much better solution than to have no dependencies. Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <20211209171138.8589-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23369.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-02-03Remove link_mtu parameter when running up/down scriptsArne Schwabe
The link mtu is no longer used and calculating a compatibility link MTU just for scripts makes little sense as well. Replace the parameter instead with a fixed parameter 0. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20220101162532.2251835-9-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23493.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-02-02Implement optional mtu parameter for mssfixArne Schwabe
The current mssfix parameter is a bit difficult to use as it needs manual calculation of the allowable packet size and also the resulting MSS value does not take into account if IPv4 or IPv6 is used on the outer tunnel. Add 'mtu' parameter to fix both of these problem by dynamically including the real overhead. The syntax and naming of the parameter is chosen for compatiblity with OpenVPN3. Patch V2: document mssfix 0 disabling mssfix, fix rst syntax Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20220101162532.2251835-6-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23495.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-01-27Deprecate link-mtuArne Schwabe
This options might have been useful in the past but nowadays it has a very unclear semantics, so better remove/deprecate it. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20220101162532.2251835-2-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23496.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-01-26update copyright year to 2022Antonio Quartulli
Update performed by means of: dev-tools/update-copyright.sh Cc: David Sommerseth <davids@openvpn.net> Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <20220125142456.18176-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23650.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-01-20Allow management client to announce pss padding supportSelva Nair
The --management-external-key option can currently indicate support for 'nopadding' or 'pkcs1' signatures in the client. Add 'pss' as an option to announce that PSS signing requests are accepted. To match, extend the algorithm string in PK_SIGN request to include the following format: - RSA_PKCS1_PSS_PADDING,hashalg=name,saltlen=[max|digest] Here 'name' is the short common name of the hash algorithm. E.g., SHA1, SHA256 etc. Existing formats 'ECDSA' and 'RSA_PKCS1_PADDING' are unchanged. v2 changes: Fix typos and other sloppiness in documentation and commit message. Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20211214165928.30676-10-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23430.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-01-14doc: remove PF leftovers from documentationAntonio Quartulli
PF (Packet Filter) has been dropped from the OpenVPN code base, however some bits and pieces are left in the documentation. Erase them all. Reported-by: Arne Schwabe <arne@rfc2549.org> Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20220113200030.18656-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23531.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-01-10doc/cipher-negotiation.rst: avoid warning by fixing indentationAntonio Quartulli
Indentation is wrong and triggers the following: rst2man.py openvpn.8.rst > openvpn.8 man-sections/cipher-negotiation.rst:20: (WARNING/2) Definition list ends without a blank line; unexpected unindent. rst2man.py openvpn-examples.5.rst > openvpn-examples.5 rst2html.py openvpn.8.rst > openvpn.8.html man-sections/cipher-negotiation.rst:20: (WARNING/2) Definition list ends without a blank line; unexpected unindent. Get rid of it. Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20220110144013.7233-1-a@unstable.cc> URL: https://www.mail-archive.com/search?l=mid&q=20220110144013.7233-1-a@unstable.cc Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-12-13Adjust cipher-negotiation.rst with compat-mode changesArne Schwabe
This explains that 2.6 will ignore --cipher without --compat-mode and restructures the whole paragraph to better readable. Patch V2: Adjust grammar, use consistently "and later" Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20211213152529.3995394-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23403.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-12-10Move '--push-peer-info' documentation from 'server' to 'client options'Gert Doering
While --push-peer-info can be configured on the server, it's not really intended for that, and it ended in the "SERVER OPTIONS" section by mishap. Fix that. Reported-by: Stella Ashburne <rewefie@gmx.com> Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Message-Id: <20211207130436.22187-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23325.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-12-05doc/protocol-options.rst: Correct default for --allow-compressionRichard T Bonhomme
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20211129165538.2948077-1-tincantech@protonmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23268.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-12-05Remove cipher_kt_var_key_size and remaining --keysize documentationArne Schwabe
Remove --keysize from the manual page and also remove mentioning variable key size in output of ciphers as there is no longer a way to change the keysize. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20211201180727.2496903-4-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23275.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-12-05Implement optional cipher in --data-ciphers prefixed with ?Arne Schwabe
This allows to use the same configuration multiple platforms/ssl libraries and include optional algorithms that are not available on all platforms For example "AES-256-GCM:AES-128-GCM:?CHACHA20-POLY1305" can be used to emulate the default behaviour of OpenVPN 2.6. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20211201180727.2496903-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23279.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-11-22doc/man (vpn-network-options): fix foreign_option_{n} typoTodd Zullinger
In 2da29362 (Improve the documentation for --dhcp-option, 2020-08-16), `foreign_option_{n}` became plural between the first and second versions of the patch. Correct it. Signed-off-by: Todd Zullinger <tmz@pobox.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20211122114104.4814-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23217.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-11-17doc link-options.rst: Use free open-source dynamic-DNS provider URLRichard T Bonhomme
Trac: #1417 Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20211103202014.1121244-2-tincantech@protonmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23095.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-11-12Use network address for emulated DHCP server as a defaultLev Stipakov
This is the rebase of original Selva Nair's patch which hasn't been merged: https://sourceforge.net/p/openvpn/mailman/message/34674818/ and documentation change to reflect code changes, which is basically a revert of another Selva's patch (which got merged): https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg13387.h tml For subnet topology use "offset 0" as default for calculating DHCP server address, which makes it equal to the network address. There is no know reason why non-zero default offset is needed. Besides, offset -1 breaks subnet /30 case, which in some cases is pushed by OpenVPN Cloud product. Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20211109015927.311-1-lstipakov@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23156.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-11-12Allow loading of non default providersArne Schwabe
This allows OpenVPN to load non-default providers. This is mainly useful for loading the legacy provider with --providers legacy default Patch v4: use spaces to seperate providers, unload providers. Patch v5: General cleanup, rename option to --providers, add option to usage() and add an entry to Changes.rst Patch v6: allow --providers also to be used (and be ignored) with mbed TLS Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20211112130231.3799480-1-arne@rfc2549.org> URL: https://www.mail-archive.com/search?l=mid&q=20211112130231.3799480-1-arne@rfc2549.org Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-11-07Remove custom PRNG functionArne Schwabe
Remove the custom PRNG from OpenVPN and instead rely always on the random number generator from the SSL library. The only place that this is in a performance critical place is the CBC IV generation. Even with that in mind a micro benchmark shows no significant enough change with OpenSSL 3.0: ------------------------------------------------------------------------ Benchmark Time CPU Iterations ------------------------------------------------------------------------ BM_OpenSSL_RAND 842 ns 842 ns 753401 BM_OpenVPN_RAND 743 ns 743 ns 826690 BM_Encrypt_AES_CBC_dummy 1044 ns 1044 ns 631530 BM_Encrypt_AES_CBC_RAND_bytes 1892 ns 1891 ns 346566 BM_Encrypt_AES_CBC_prng_bytes 1818 ns 1817 ns 373970 (source https://gist.github.com/schwabe/029dc5e5a690df8e2e3f774a13ec7bce) Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Steffan Karger <steffan@karger.me> Message-Id: <20211107090147.3150261-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23116.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-11-05Add insecure tls-cert-profile optionsArne Schwabe
The recent deprecation of SHA1 certificates in OpenSSL 3.0 makes it necessary to reallow them in certain deployments. Currently this works by using the hack of using tls-cipher "DEFAULT:@SECLEVEL=0". Add "insecure" as option to tls-cert-profile to allow setting a seclevel of 0. Patch v4: fix default accidentially changed to insecure Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Max Fillinger <maximilian.fillinger@foxcrypto.com> Message-Id: <20211029112407.2004234-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23076.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-09-21doc: fix indentation in protocol-options.rstAntonio Quartulli
The bullet points are not proeprly indented and they trigger the following error/warning: rst2man.py openvpn.8.rst > openvpn.8 man-sections/protocol-options.rst:62: (ERROR/3) Unexpected indentation. man-sections/protocol-options.rst:67: (WARNING/2) Block quote ends without a blank line; unexpected unindent. rst2man.py openvpn-examples.5.rst > openvpn-examples.5 rst2html.py openvpn.8.rst > openvpn.8.html man-sections/protocol-options.rst:62: (ERROR/3) Unexpected indentation. man-sections/protocol-options.rst:67: (WARNING/2) Block quote ends without a blank line; unexpected unindent. Fix indentation and add white lines as expected. Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20210921121519.18912-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22867.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-09-21Set TLS 1.2 as minimum by defaultAntonio Quartulli
Do not accept handshakes with peers trying to negotiate TLS lower than 1.2. TLS 1.1 and 1.0 are not recommended and therefore we will, by default, allow TLS 1.2 as minimum version. The minimum allowed version can still be controlled via '--tls-version-min'. At the same time automatically set '--tls-version-min' to 1.0 if the user requires compatibility with versions onlder than 2.3.7, as that was the only version supported back then. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20210913192929.26391-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22838.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-09-20compat-mode: add --data-cipher-fallback auomatically if requestedAntonio Quartulli
For compatibility with OpenVPN older than 2.4.0, the '--data-cipher-fallback' argument is automatically added with the same value as specified by '--cipher'. This happens only when the user specifies compat-mode with a version older than 2.4.0. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20210904095629.6273-6-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22798.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-09-20do not include --cipher value in data-ciphersAntonio Quartulli
The --cipher option has been there since a while, but it became more and more confusing since the introduction of NCP (data cipher negotiation). The fallback cipher can now be specified via --data-cipher-fallback, while the list of accepted ciphers is specified via --data-ciphers. --cipher can still be used for compatibility reasons, but won't affect the cipher negotiation. Adjust manpage to make clear that using --cipher in today's config really is a thing from the past, and --data-ciphers should be used instead. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20210904095629.6273-5-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22799.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-09-12Remove support for PF (Packet Filter)Antonio Quartulli
OpenVPN shipped a small packet filtering tool called PF. It has never been straightforward as it required a plugin to work. On top of that, keeping PF support, makes the code more complicated and increases the maintenance cost of OpenVPN. PF itself is not actually maintained at all and there is little motivation in keeping it alive. Some years ago an IPv6 extension for PF was proposed, but it was never picked up for the reasons above. External (and more appropriate) tools can still be used to implement packet filtering on the OpenVPN interface. Drop PF support for good. Note that IDs used for external communication (i.e. to the plugin or management interface) have been commented out, but not removed, as they should not be used in the future. v2: * changed // to /* */ * changed "NOT IMPLEMENTED" to "REMOVED FEATURE" * removed extra empty lines after removing ifdef blocks * clarified on IRC that tls_final has to be removed and therefore that hunk is correct * removed mi_prefix() function as it is now unused Cc: Arne Schwabe <arne@rfc2549.org> Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20210827190014.12640-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22780.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-09-08reject compression by defaultAntonio Quartulli
With this change the value of '--allow-compression' is set to 'no'. Therefore compression is not enabled by default and cannot be enabled by the server either. This change is in line with the current trend of not recommending compression over VPN tunnels for security reasons (check Voracle). Of top of that compression is mostly useless nowadays, therefore there is not real reason to enable it. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20210904095629.6273-4-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22797.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-09-08compat-mode: allow user to specify version to be compatible withAntonio Quartulli
This changes introduces the basic infrastructure required to allow the user to specify a specific OpenVPN version to be compatible with. The next commits will modify defaults to more modern and safer values, while allowing backwards-compatible behaviour on demand. The backwards-compatible behaviour is intructed via the config knob '--compat-mode' implemented in this patch. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20210908072606.5863-1-a@unstable.cc> URL: https://www.mail-archive.com/search?l=mid&q=20210908072606.5863-1-a@unstable.cc Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-09-07Include Chacha20-Poly1305 into default --data-ciphers when availableArne Schwabe
Most TLS 1.3 libraries inlcude the Chacha20-Poly1305 based cipher suite beside the AES-GCM based ones int he list of default ciphers suites. Chacha20-Poly1305 is accepted as good alternative AEAD algorithm to the AES-GCM algorithm by crypto community. Follow this and include Chacha20-Poly1305 by default in data-ciphers when available. This makes picking Chacha20-Poly1305 easier as it only requires to change server (by changing priority) or client side (removing AES-GCM from data-ciphers) to change to Chacha20-Poly1305. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <20210818213354.687736-2-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22745.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-08-28man/protocol-options: add missing ending metacharAntonio Quartulli
A code string terminating character (`) is missing, thus leading to the following warning: man-sections/protocol-options.rst:99: (WARNING/2) Inline interpreted text or phrase reference start-string without end-string. Add missing char at the end of the code word. Cc: David Sommerseth <davids@openvpn.net> Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20210827145656.21646-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22779.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-08-23Minor doc correction: tls-crypt-v2 key generationSelva Nair
Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20210822152820.7072-1-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22747.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-08-16Introduce webauth auth pending method and deprecate openurlArne Schwabe
The experience with openurl/OPEN_URL has shown that just sending a URL to a client is not enough and we often need different behaviour of the client depending on circumstances. Replace OPEN_URL with a more flexible WEB_AUTH pending auth method. Patch v2: use WEB_AUTH instead WEBAUTH Patch v3: incooperate other comments from Selva Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Selva Nair <selva.nair@gmail.com> Message-Id: <20210813115542.2794-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22737.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-08-14Fix client-pending-auth help message in management interfaceSelva Nair
- Add the missing timeout value that is required (not optional) - Split the long line - Also make the AUTH_PENDING state message format in management-notes.txt more precise. Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Message-Id: <20210814044834.2236-1-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22739.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-08-01Add detailed man page section to setup a OpenVPN setup with peer-fingerprintArne Schwabe
This is meant to give new users a quickstart for a useable OpenVPN setup. Our own documentation is lacking in this regard and many tutorials that can be found online are often questionable in some aspects. Linking the individual RST file on github also give a tutorial in a nicely formatted way. Patch V2: Fix grammar/spelling mistakes (thanks tincantech), move to openvpn-examples(5). Patch v3: use server.key and server.crt instead of server.pem/serverkey.pem Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20210728154922.568796-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22674.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-07-28Remove --ncp-disable optionArne Schwabe
NCP has proven to be stable and apart from the one VPN Provider doing hacky things with homebrewed NCP we have not had any reports about ncp-disable being required. Remove ncp-disable to simplify code paths. Note: This patch breaks client without --pull. The follow up patch for P2P NCP will restore that. But to avoid all the NCP/non-NCP special cases to be implemented in P2P. P2P will directly switch from always non-NCP to always NCP. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <20210520151148.2565578-8-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22418.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-07-28Cleanup handling of initial auth tokenArne Schwabe
This changes that auth_token_initial is set when the token is initially generated instead when pushing the token. Even I do not know anymore why I did it in this way in the first place. Also use multi->auth_token_initial as source for the sesssion ID since it should now always be available. Also set auth_token_initial directly to up->password once we verified that we have gotten a valid token from a client. This cleans ups the logic in generating the environment and makes the code flow clearer. Since the change makes auth_token_initial always available we need to add a check to only send a PUSH reply to update the token on renegotiations. The old code relied on multi->auth_token not being set in this case. This commit also removes the workaround for old OpenVPN clients. These were only available as commercial OpenVPN Connect client and not in use anymore. Furthermore, introduce a check if the session ID has changed during a session. Even though this is still a valid authentication changing to a different auth token mid session is highly irregular and should never occur naturally. Patch V2: rebase. Patch V3: fix formatting, clarifying commit message, remove initial token workaround for old v3. Patch v4: move sending the auth-token for renegotiations to a sane place and trigger it when the TLS session reaches its fully authenticated state. Patch v5: Move also setting auth_token_inital from up->password to a more logical place, general cleanups, add session id mismatch check Patch v6: Rework some comments and general cleanup of small things Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <20210719133132.128783-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22645.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-07-09man: Clarify IV_HWADDRDavid Sommerseth
The IV_HWADDR description was only partially correct, as there are more implementations using other values than the MAC address of the default gateway. The intention of this value is to provide a unique identifier of the client and on some platforms this is not possible to retrieve other than to generate this information. The 64 bytes limitation is an arbitrary value, it is not enforced by OpenVPN 2.x. But it was considered a good idea to at least have some reasonable upper limit of how long this string can be, at least for those implementing support for this information. Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20210709134849.161728-1-openvpn@sf.lists.topphemmelig.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22625.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-07-02Update Fox e-mail address in copyright noticesMax Fillinger
Replace openvpn@fox-it.com with openvpn@foxcrypto.com. Signed-off-by: Max Fillinger <maximilian.fillinger@foxcrypto.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20210701171458.8897-1-maximilian.fillinger@foxcrypto.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22608.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
generated by cgit v1.1 at 2024-10-06 20:34:29 +0000