Changes.rst

   1 Overview of changes in 2.4
   2 ==========================
   3
   4
   5 New features
   6 ------------
   7 Seamless client IP/port floating
   8     Added new packet format P_DATA_V2, which includes peer-id. If both the
   9     server and client support it, the client sends all data packets in
  10     the new format. When a data packet arrives, the server identifies peer
  11     by peer-id. If peer's ip/port has changed, server assumes that
  12     client has floated, verifies HMAC and updates ip/port in internal structs.
  13     This allows the connection to be immediatly restored, instead of requiring
  14     a TLS handshake before the server accepts packets from the new client
  15     ip/port.
  16
  17 Data channel cipher negotiation
  18     Data channel ciphers (``--cipher``) are now by default negotiated.  If a
  19     client advertises support for Negotiable Crypto Parameters (NCP), the
  20     server will choose a cipher (by default AES-256-GCM) for the data channel,
  21     and tell the client to use that cipher.  Data channel cipher negotiation
  22     can be controlled using ``--ncp-ciphers`` and ``--ncp-disable``.
  23
  24     A more limited version also works in client-to-server and server-to-client
  25     scenarios where one of the end points uses a v2.4 client or server and the
  26     other side uses an older version.  In such scenarios the v2.4 side will
  27     change to the ``--cipher`` set by the remote side, if permitted by by
  28     ``--ncp-ciphers``.  For example, a v2.4 client with ``--cipher BF-CBC``
  29     and ``ncp-ciphers AES-256-GCM:AES-256-CBC`` can connect to both a v2.3
  30     server with ``cipher BF-CBC`` as well as a server with
  31     ``cipher AES-256-CBC`` in its config.  The other way around, a v2.3 client
  32     with either ``cipher BF-CBC`` or ``cipher AES-256-CBC`` can connect to a
  33     v2.4 server with e.g. ``cipher BF-CBC`` and
  34     ``ncp-ciphers AES-256-GCM:AES-256-CBC`` in its config.  For this to work
  35     it requires that OpenVPN was built without disabling OCC support.
  36
  37 AEAD (GCM) data channel cipher support
  38     The data channel now supports AEAD ciphers (currently only GCM).  The AEAD
  39     packet format has a smaller crypto overhead than the CBC packet format,
  40     (e.g. 20 bytes per packet for AES-128-GCM instead of 36 bytes per packet
  41     for AES-128-CBC + HMAC-SHA1).
  42
  43 ECDH key exchange
  44     The TLS control channel now supports for elliptic curve diffie-hellmann
  45     key exchange (ECDH).
  46
  47 Dualstack round-robin DNS client connect
  48     Instead of only using the first address of each ``--remote`` OpenVPN
  49     will now try all addresses (IPv6 and IPv4) of a ``--remote`` entry.
  50
  51 Support for providing IPv6 DNS servers
  52     A new DHCP sub-option ``DNS6`` is added alongside with the already existing
  53     ``DNS`` sub-option.  This is used to provide DNS resolvers available over
  54     IPv6.  This may be pushed to clients where `` --up`` scripts and ``--plugin``
  55     can act upon it through the ``foreign_option_<n>`` environment variables.
  56
  57     Support for the Windows client picking up this new sub-option is added,
  58     however IPv6 DNS resolvers need to be configured via ``netsh`` which requires
  59     administrator privileges unless the new interactive services on Windows is
  60     being used.  If the interactive service is used, this service will execute
  61     ``netsh`` in the background with the proper privileges.
  62
  63 New improved Windows Background service
  64     The new OpenVPNService is based on openvpnserv2, a complete rewrite of the OpenVPN
  65     service wrapper. It is intended for launching OpenVPN instances that should be
  66     up at all times, instead of being manually launched by a user. OpenVPNService is
  67     able to restart individual OpenVPN processes if they crash, and it also works
  68     properly on recent Windows versions. OpenVPNServiceLegacy tends to work poorly,
  69     if at all, on newer Windows versions (8+) and its use is not recommended.
  70
  71 New interactive Windows service
  72     The installer starts OpenVPNServiceInteractive automatically and configures
  73     it to start at system startup.
  74
  75     The interactive Windows service allows unprivileged users to start
  76     OpenVPN connections in the global config directory (usually
  77     C:\\Program Files\\OpenVPN\\config) using OpenVPN GUI without any
  78     extra configuration.
  79
  80     Users who belong to the built-in Administrator group or to the
  81     local "OpenVPN Administrator" group can also store configuration
  82     files under %USERPROFILE%\\OpenVPN\\config for use with the
  83     interactive service.
  84
  85 redirect-gateway ipv6
  86     OpenVPN has now feature parity between IPv4 and IPv6 for redirect
  87     gateway including the handling of overlapping IPv6 routes with
  88     IPv6 remote VPN server address.
  89
  90 LZ4 Compression and pushable compression
  91     Additionally to LZO compression OpenVPN now also supports LZ4 compression.
  92     Compression options are now pushable from the server.
  93
  94 Filter pulled options client-side: pull-filter
  95     New option to explicitly allow or reject options pushed by the server.
  96     May be used multiple times and is applied in the order specified.
  97
  98 Per-client remove push options: push-remove
  99     New option to remove options on a per-client basis from the "push" list
 100     (more fine-grained than ``--push-reset``).
 101
 102 Http proxy password inside config file
 103     Http proxy passwords can be specified with the inline file option
 104     ``<http-proxy-user-pass>`` .. ``</http-proxy-user-pass>``
 105
 106 Windows version detection
 107     Windows version is detected, logged and possibly signalled to server
 108     (IV_PLAT_VER=<nn> if ``--push-peer-info`` is set on client).
 109
 110 Authentication tokens
 111     In situations where it is not suitable to save user passwords on the client,
 112     OpenVPN has support for pushing a --auth-token since v2.3.  This option is
 113     pushed from the server to the client with a token value to be used instead
 114     of the users password.  For this to work, the authentication plug-in would
 115     need to implement this support as well.  In OpenVPN 2.4 --auth-gen-token
 116     is introduced, which will allow the OpenVPN server to generate a random
 117     token and push it to the client without any changes to the authentication
 118     modules.  When the clients need to re-authenticate the OpenVPN server will
 119     do the authentication internally, instead of sending the re-authentication
 120     request to the authentication module .  This feature is especially
 121     useful in configurations which use One Time Password (OTP) authentication
 122     schemes, as this allows the tunnel keys to be renegotiated regularly without
 123     any need to supply new OTP codes.
 124
 125 keying-material-exporter
 126     Keying Material Exporter [RFC-5705] allow additional keying material to be
 127     derived from existing TLS channel.
 128
 129 Mac OS X Keychain management client
 130     Added contrib/keychain-mcd which allows to use Mac OS X keychain
 131     certificates with OpenVPN.
 132
 133 Android platform support
 134     Support for running on Android using Android's VPNService API has been added.
 135     See doc/android.txt for more details. This support is primarily used in
 136     the OpenVPN for Android app (https://github.com/schwabe/ics-openvpn)
 137
 138 AIX platform support
 139     AIX platform support has been added. The support only includes tap
 140     devices since AIX does not provide tun interface.
 141
 142 Control channel encryption (``--tls-crypt``)
 143     Use a pre-shared static key (like the ``--tls-auth`` key) to encrypt control
 144     channel packets.  Provides more privacy, some obfuscation and poor-man's
 145     post-quantum security.
 146
 147 Asynchronous push reply
 148     Plug-ins providing support for deferred authentication can benefit from a more
 149     responsive authentication where the server sends PUSH_REPLY immediately once
 150     the authentication result is ready, instead of waiting for the the client to
 151     to send PUSH_REQUEST once more.  This requires OpenVPN to be built with
 152     ``./configure --enable-async-push``.  This is a compile-time only switch.
 153
 154
 155 Deprecated features
 156 -------------------
 157 - ``--key-method 1`` is deprecated in 2.4 and will be removed in 2.5.  Migrate
 158   away from ``--key-method 1`` as soon as possible.  The recommended approach
 159   is to remove the ``--key-method`` option from the configuration files, OpenVPN
 160   will then use ``--key-method 2`` by default.  Note that this requires changing
 161   the option in both the client and server side configs.
 162
 163 - CRLs are now handled by the crypto library (OpenSSL or mbed TLS), instead of
 164   inside OpenVPN itself.  The crypto library implementations are more strict
 165   than the OpenVPN implementation was.  This might reject peer certificates
 166   that would previously be accepted.  If this occurs, OpenVPN will log the
 167   crypto library's error description.
 168
 169 - ``--tls-remote`` is removed in 2.4, as indicated in the 2.3 man-pages.  Similar
 170   functionality is provided via ``--verify-x509-name``, which does the same job in
 171   a better way.
 172
 173 - ``--compat-names`` and ``--no-name-remapping`` were deprecated in 2.3 and will
 174   be removed in 2.5.  All scripts and plug-ins depending on the old non-standard
 175   X.509 subject formatting must be updated to the standardized formatting.  See
 176   the man page for more information.
 177
 178 - ``--no-iv`` is deprecated in 2.4 and will be removed in 2.5.
 179
 180 User-visible Changes
 181 --------------------
 182 - When using ciphers with cipher blocks less than 128-bits,
 183   OpenVPN will complain loudly if the configuration uses ciphers considered
 184   weak, such as the SWEET32 attack vector.  In such scenarios, OpenVPN will by
 185   default renegotiate for each 64MB of transported data (``--reneg-bytes``).
 186   This renegotiation can be disabled, but is HIGHLY DISCOURAGED.
 187
 188 - For certificate DNs with duplicate fields, e.g. "OU=one,OU=two", both fields
 189   are now exported to the environment, where each second and later occurrence
 190   of a field get _$N appended to it's field name, starting at N=1.  For the
 191   example above, that would result in e.g. X509_0_OU=one, X509_0_OU_1=two.
 192   Note that this breaks setups that rely on the fact that OpenVPN would
 193   previously (incorrectly) only export the last occurence of a field.
 194
 195 - ``proto udp`` and ``proto tcp`` now use both IPv4 and IPv6. The new
 196   options ``proto udp4`` and ``proto tcp4`` use IPv4 only.
 197
 198 - ``--sndbuf`` and ``--recvbuf`` default now to OS defaults instead of 64k
 199
 200 - OpenVPN exits with an error if an option has extra parameters;
 201   previously they were silently ignored
 202
 203 - ``--tls-auth`` always requires OpenVPN static key files and will no
 204   longer work with free form files
 205
 206 - ``--proto udp6/tcp6`` in server mode will now try to always listen to
 207   both IPv4 and IPv6 on platforms that allow it. Use ``--bind ipv6only``
 208   to explicitly listen only on IPv6.
 209
 210 - Removed ``--enable-password-save`` from configure. This option is now
 211   always enabled.
 212
 213 - Stricter default TLS cipher list (override with ``--tls-cipher``), that now
 214   also disables:
 215
 216   * Non-ephemeral key exchange using static (EC)DH keys
 217   * DSS private keys
 218
 219 - mbed TLS builds: changed the tls_digest_N values exported to the script
 220   environment to be equal to the ones exported by OpenSSL builds, namely
 221   the certificate fingerprint (was the hash of the 'to be signed' data).
 222
 223 - mbed TLS builds: minimum RSA key size is now 2048 bits.  Shorter keys will
 224   not be accepted, both local and from the peer.
 225
 226 - ``--connect-timeout`` now specifies the timeout until the first TLS packet
 227   is received (identical to ``--server-poll-timeout``) and this timeout now
 228   includes the removed socks proxy timeout and http proxy timeout.
 229
 230   In ``--static`` mode ``connect-timeout`` specifies the timeout for TCP and
 231   proxy connection establishment
 232
 233 - ``--connect-retry-max`` now specifies the maximum number of unsuccessful
 234   attempts of each remote/connection entry before exiting.
 235
 236 - ``--http-proxy-timeout`` and the static non-changeable socks timeout (5s)
 237   have been folded into a "unified" ``--connect-timeout`` which covers all
 238   steps needed to connect to the server, up to the start of the TLS exchange.
 239   The default value has been raised to 120s, to handle slow http/socks
 240   proxies graciously.  The old "fail TCP fast" behaviour can be achieved by
 241   adding "``--connect-timeout 10``" to the client config.
 242
 243 - ``--http-proxy-retry`` and ``--sock-proxy-retry`` have been removed. Proxy connections
 244   will now behave like regular connection entries and generate a USR1 on failure.
 245
 246 - ``--connect-retry`` gets an optional second argument that specifies the maximum
 247   time in seconds to wait between reconnection attempts when an exponential
 248   backoff is triggered due to repeated retries. Default = 300 seconds.
 249
 250 - Data channel cipher negotiation (see New features section) can override
 251   ciphers configured in the config file.  Use ``--ncp-disable`` if you do not want
 252   this behavior.
 253
 254 - All tun devices on all platforms are always considered to be IPv6
 255   capable. The ``--tun-ipv6`` option is ignored (behaves like it is always
 256   on).
 257
 258 - On the client side recursively routed packets, which have the same destination
 259   as the VPN server, are dropped. This can be disabled with
 260   --allow-recursive-routing option.
 261
 262 - On Windows, when the ``--register-dns`` option is set, OpenVPN no longer
 263   restarts the ``dnscache`` service - this had unwanted side effects, and
 264   seems to be no longer necessary with currently supported Windows versions.
 265
 266 - If no flags are given, and the interactive Windows service is used, "def1"
 267   is implicitly set (because "delete and later reinstall the existing
 268   default route" does not work well here).  If not using the service,
 269   the old behaviour is kept.
 270
 271 - OpenVPN now reloads a CRL only if the modication time or file size has
 272   changed, instead of for each new connection.  This reduces the connection
 273   setup time, in particular when using large CRLs.
 274
 275 - OpenVPN now ships with more up-to-date systemd unit files which take advantage
 276   of the improved service management as well as some hardening steps.  The
 277   configuration files are picked up from the /etc/openvpn/server/ and
 278   /etc/openvpn/client/ directories (depending on unit file).  This also avoids
 279   these new unit files and how they work to collide with older pre-existing
 280   unit files.
 281
 282 - Using ``--no-iv`` (which is generally not a recommended setup) will
 283   require explicitly disabling NCP with ``--disable-ncp``.  This is
 284   intentional because NCP will by default use AES-GCM, which requires
 285   an IV - so we want users of that option to consciously reconsider.
 286
 287
 288 Maintainer-visible changes
 289 --------------------------
 290 - OpenVPN no longer supports building with crypto support, but without TLS
 291   support.  As a consequence, OPENSSL_CRYPTO_{CFLAGS,LIBS} and
 292   OPENSSL_SSL_{CFLAGS,LIBS} have been merged into OPENSSL_{CFLAGS,LIBS}.  This
 293   is particularly relevant for maintainers who build their own OpenSSL library,
 294   e.g. when cross-compiling.
 295
 296 - Linux distributions using systemd is highly encouraged to ship these new unit
 297   files instead of older ones, to provide a unified behaviour across systemd
 298   based Linux distributions.
 299
 300 - With OpenVPN v2.4, the project has moved over to depend on and actively use
 301   the official C99 standard (-std=c99).  This may fail on some older compiler/libc
 302   header combinations.  In most of these situations it is recommended to
 303   use -std=gnu99 in CFLAGS.  This is known to be needed when doing
 304   i386/i686 builds on RHEL5.
 305
 306 Version 2.4.3
 307 =============
 308 - ``--verify-hash`` can now take an optional flag which changes the hashing
 309   algorithm. It can be either SHA1 or SHA256.  The default if not provided is
 310   SHA1 to preserve backwards compatibility with existing configurations.
 311
 312 Version 2.4.1
 313 =============
 314 - ``--remote-cert-ku`` now only requires the certificate to have at least the
 315   bits set of one of the values in the supplied list, instead of requiring an
 316   exact match to one of the values in the list.
 317 - ``--remote-cert-tls`` now only requires that a keyUsage is present in the
 318   certificate, and leaves the verification of the value up to the crypto
 319   library, which has more information (i.e. the key exchange method in use)
 320   to verify that the keyUsage is correct.
 321 - ``--ns-cert-type`` is deprecated.  Use ``--remote-cert-tls`` instead.
 322   The nsCertType x509 extension is very old, and barely used.
 323   ``--remote-cert-tls`` uses the far more common keyUsage and extendedKeyUsage
 324   extension instead.  Make sure your certificates carry these to be able to
 325   use ``--remote-cert-tls``.
 326
 327
 328 Version 2.4.2
 329 =============
 330
 331 Bugfixes
 332 --------
 333 - Fix memory leak introduced in 2.4.1: if --remote-cert-tls is used, we leaked
 334   some memory on each TLS (re)negotiation.
 335
 336 Security
 337 --------
 338 - Fix a pre-authentication denial-of-service attack on both clients and servers.
 339   By sending a too-large control packet, OpenVPN 2.4.0 or 2.4.1 can be forced
 340   to hit an ASSERT() and stop the process.  If ``--tls-auth`` or ``--tls-crypt``
 341   is used, only attackers that have the ``--tls-auth`` or ``--tls-crypt`` key
 342   can mount an attack. (OSTIF/Quarkslab audit finding 5.1, CVE-2017-7478)
 343 - Fix an authenticated remote DoS vulnerability that could be triggered by
 344   causing a packet id roll over.  An attack is rather inefficient; a peer
 345   would need to get us to send at least about 196 GB of data.
 346   (OSTIF/Quarkslab audit finding 5.2, CVE-2017-7479)