1 Overview of changes in 2.6
2 ==========================
7 We want to deprecate our old Trac bug tracking system.
8 Please report any issues with this release in GitHub
9 instead: https://github.com/OpenVPN/openvpn/issues
13 Support unlimited number of connection entries and remote entries
15 New management commands to enumerate and list remote entries
16 Use ``remote-entry-count`` and ``remote-entry-get``
17 commands from the management interface to get the number of
18 remote entries and the entries themselves.
20 Keying Material Exporters (RFC 5705) based key generation
21 As part of the cipher negotiation OpenVPN will automatically prefer
22 the RFC5705 based key material generation to the current custom
23 OpenVPN PRF. This feature requires OpenSSL or mbed TLS 2.18+.
25 Compatibility with OpenSSL in FIPS mode
26 OpenVPN will now work with OpenSSL in FIPS mode. Note, no effort
27 has been made to check or implement all the
28 requirements/recommendation of FIPS 140-2. This just allows OpenVPN
29 to be run on a system that be configured OpenSSL in FIPS mode.
31 ``mlock`` will now check if enough memlock-able memory has been reserved,
32 and if less than 100MB RAM are available, use setrlimit() to upgrade
33 the limit. See Trac #1390. Not available on OpenSolaris.
35 Certificate pinning/verify peer fingerprint
36 The ``--peer-fingerprint`` option has been introduced to give users an
37 easy to use alternative to the ``tls-verify`` for matching the
38 fingerprint of the peer. The option takes use a number of allowed
39 SHA256 certificate fingerprints.
41 See the man page section "Small OpenVPN setup with peer-fingerprint"
42 for a tutorial on how to use this feature. This is also available online
43 under https://github.com/openvpn/openvpn/blob/master/doc/man-sections/example-fingerprint.rst
45 TLS mode with self-signed certificates
46 When ``--peer-fingerprint`` is used, the ``--ca`` and ``--capath`` option
47 become optional. This allows for small OpenVPN setups without setting up
48 a PKI with Easy-RSA or similar software.
50 Deferred auth support for scripts
51 The ``--auth-user-pass-verify`` script supports now deferred authentication.
53 Pending auth support for plugins and scripts
54 Both auth plugin and script can now signal pending authentication to
55 the client when using deferred authentication. The new ``client-crresponse``
56 script option and ``OPENVPN_PLUGIN_CLIENT_CRRESPONSE`` plugin function can
57 be used to parse a client response to a ``CR_TEXT`` two factor challenge.
59 See ``sample/sample-scripts/totpauth.py`` for an example.
61 Compatibility mode (``--compat-mode``)
62 The modernisation of defaults can impact the compatibility of OpenVPN 2.6.0
63 with older peers. The options ``--compat-mode`` allows UIs to provide users
64 with an easy way to still connect to older servers.
67 OpenSSL 3.0 has been added. Most of OpenSSL 3.0 changes are not user visible but
68 improve general compatibility with OpenSSL 3.0. ``--tls-cert-profile insecure``
69 has been added to allow selecting the lowest OpenSSL security level (not
70 recommended, use only if you must). OpenSSL 3.0 no longer supports the Blowfish
71 (and other deprecated) algorithm by default and the new option ``--providers``
72 allows loading the legacy provider to renable these algorithms.
74 Optional ciphers in ``--data-ciphers``
75 Ciphers in ``--data-ciphers`` can now be prefixed with a ``?`` to mark
76 those as optional and only use them if the SSL library supports them.
79 Improved ``--mssfix`` and ``--fragment`` calculation
80 The ``--mssfix`` and ``--fragment`` options now allow an optional :code:`mtu`
81 parameter to specify that different overhead for IPv4/IPv6 should taken into
82 account and the resulting size is specified as the total size of the VPN packets
83 including IP and UDP headers.
85 Cookie based handshake for UDP server
86 Instead of allocating a connection for each client on the initial packet
87 OpenVPN server will now use an HMAC based cookie as its session id. This
88 way the server can verify it on completing the handshake without keeping
89 state. This eliminates the amplification and resource exhaustion attacks.
90 For tls-crypt-v2 clients, this requires OpenVPN 2.6 clients or later
91 because the client needs to resend its client key on completing the hand
92 shake. The tls-crypt-v2 option allows controlling if older clients are
95 By default the rate of initial packet responses is limited to 100 per 10s
96 interval to avoid OpenVPN servers being abused in reflection attacks
97 (see ``--connect-freq-initial``).
99 Data channel offloading with ovpn-dco
100 2.6.0+ implements support for data-channel offloading where the data packets
101 are directly processed and forwarded in kernel space thanks to the ovpn-dco
102 kernel module. The userspace openvpn program acts purely as a control plane
103 application. Note that DCO will use DATA_V2 packets in P2P mode, therefore,
104 this implies that peers must be running 2.6.0+ in order to have P2P-NCP
105 which brings DATA_V2 packet support.
108 It is now possible to terminate a session (or all) after a specified amount
109 of seconds has passed session commencement. This behaviour can be configured
110 using ``--session-timeout``. This option can be configured on the server, on
111 the client or can also be pushed.
113 Inline auth username and password
114 Username and password can now be specified inline in the configuration file
115 within the <auth-user-pass></auth-user-pass> tags. If the password is
116 missing OpenVPN will prompt for input via stdin. This applies to inline'd
117 http-proxy-user-pass too.
119 Tun MTU can be pushed
120 The client can now also dynamically configure its MTU and the server
121 will try to push the client MTU when the client supports it. The
122 directive ``--tun-mtu-max`` has been introduced to increase the maximum
123 pushable MTU size (defaults to 1600).
125 Improved control channel packet size control (``max-packet-size``)
126 The size of control channel is no longer tied to
127 ``--link-mtu``/``--tun-mtu`` and can be set using ``--max-packet-size``.
128 Sending large control channel frames is also optimised by allowing 6
129 outstanding packets instead of just 4. ``max-packet-size`` will also set
130 ``mssfix`` to try to limit data-channel packets as well.
134 ``inetd`` has been removed
135 This was a very limited and not-well-tested way to run OpenVPN, on TCP
138 ``verify-hash`` has been deprecated
139 This option has very limited usefulness and should be replaced by either
140 a better ``--ca`` configuration or with a ``--tls-verify`` script.
142 ``secret`` has been deprecated
143 static key mode (non-TLS) is no longer considered "good and secure enough"
144 for today's requirements. Use TLS mode instead. If deploying a PKI CA
145 is considered "too complicated", using ``--peer-fingerprint`` makes
146 TLS mode about as easy as using ``--secret``.
148 ``ncp-disable`` has been removed
149 This option mainly served a role as debug option when NCP was first
150 introduced. It should now no longer be necessary.
152 TLS 1.0 and 1.1 are deprecated
153 ``tls-version-min`` is set to 1.2 by default. OpenVPN 2.6.0 defaults
154 to a minimum TLS version of 1.2 as TLS 1.0 and 1.1 should be generally
155 avoided. Note that OpenVPN versions older than 2.3.7 use TLS 1.0 only.
157 ``--cipher`` argument is no longer appended to ``--data-ciphers``
158 by default. Data cipher negotiation has been introduced in 2.4.0
159 and been significantly improved in 2.5.0. The implicit fallback
160 to the cipher specified in ``--cipher`` has been removed.
161 Effectively, ``--cipher`` is a no-op in TLS mode now, and will
162 only have an effect in pre-shared-key mode (``--secret``).
163 From now on ``--cipher`` should not be used in new configurations
165 Should backwards compatibility with older OpenVPN peers be
166 required, please see the ``--compat-mode`` instead.
168 ``--prng`` has beeen removed
169 OpenVPN used to implement its own PRNG based on a hash. However implementing
170 a PRNG is better left to a crypto library. So we use the PRNG
171 mbed TLS or OpenSSL now.
174 Compression no longer enabled by default
175 Unless an explicit compression option is specified in the configuration,
176 ``--allow-compression`` defaults to ``no`` in OpeNVPN 2.6.0.
177 By default, OpenVPN 2.5 still allowed a server to enable compression by
178 pushing compression related options.
180 PF (Packet Filtering) support has been removed
181 The built-in PF functionality has been removed from the code base. This
182 feature wasn't really easy to use and was long unmaintained.
183 This implies that also ``--management-client-pf`` and any other compile
184 time or run time related option do not exist any longer.
189 - CHACHA20-POLY1305 is included in the default of ``--data-ciphers`` when available.
190 - Option ``--prng`` is ignored as we rely on the SSL library random number generator.
191 - Option ``--nobind`` is default when ``--client`` or ``--pull`` is used in the configuration
192 - :code:`link_mtu` parameter is removed from environment or replaced with 0 when scripts are
193 called with parameters. This parameter is unreliable and no longer internally calculated.
195 - control channel packet maximum size is no longer influenced by
196 ``--link-mtu``/``--tun-mtu`` and must be set by ``--max-packet-size`` now.
197 The default is 1250 for the control channel size.
199 - In point-to-point OpenVPN setups (no ``--server``), using
200 ``--explict-exit-notiy`` on one end would terminate the other side at
201 session end. This is considered a no longer useful default and has
202 been changed to "restart on reception of explicit-exit-notify message".
203 If the old behaviour is still desired, ``--remap-usr1 SIGTERM`` can be used.
205 - FreeBSD tun interfaces with ``--topology subnet`` are now put into real
206 subnet mode (IFF_BROADCAST instead of IFF_POINTOPOINT) - this might upset
207 software that enumerates interfaces, looking for "broadcast capable?" and
208 expecting certain results. Normal uses should not see any difference.
210 - The default configurations will no longer allow connections to OpenVPN 2.3.x
211 peer or earlier, use the new ``--compat-mode`` option if you need
212 compatibility with older versions. See the manual page on the
213 ``--compat-mode`` for details.
215 Common errors with OpenSSL 3.0 and OpenVPN 2.6
216 ----------------------------------------------
217 Both OpenVPN 2.6 and OpenSSL 3.0 tighten the security considerable, so some
218 configuration will no longer work. This section will cover the most common
219 causes and error message we have seen and explain their reason and temporary
220 workarounds. You should fix the underlying problems as soon as possible since
221 these workaround are not secure and will eventually stop working in a future
224 - weak SHA1 or MD5 signature on certificates
226 This will happen on either loading of certificates or on connection
229 OpenSSL: error:0A00018E:SSL routines::ca md too weak
230 Cannot load certificate file cert.crt
231 Exiting due to fatal error
233 OpenSSL 3.0 no longer allows weak signatures on certificates. You can
234 downgrade your security to allow them by using ``--tls-cert-profile insecure``
235 but should replace/regenerate these certificates as soon as possible.
238 - 1024 bit RSA certificates, 1024 bit DH parameters, other weak keys
240 This happens if you use private keys or other cryptographic material that
241 does not meet today's cryptographic standards anymore. Messages are similar
244 OpenSSL: error:0A00018F:SSL routines::ee key too small
245 OpenSSL: error:1408518A:SSL routines:ssl3_ctx_ctrl:dh key too small
247 DH parameters (``--dh``) can be regenerated with ``openssl dhparam 2048``.
248 For other cryptographic keys, these keys and certificates need to be
249 regenerated. TLS Security level can be temporarily lowered with
250 ``--tls-cert-profile legacy`` or even ``--tls-cert-profile insecure``.
252 - Connecting to a OpenVPN 2.3.x server or allowing OpenVPN 2.3.x or earlier
255 This will normally result in messages like::
257 OPTIONS ERROR: failed to negotiate cipher with server. Add the server's cipher ('AES-128-CBC') to --data-ciphers (currently 'AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305') if you want to connect to this server.
261 client/127.0.0.1:49954 SENT CONTROL [client]: 'AUTH_FAILED,Data channel cipher negotiation failed (no shared cipher)' (status=1)
263 You can manually add the missing cipher to the ``--data-ciphers``. The
264 standard ciphers should be included as well, e.g.
265 ``--data-ciphers AES-256-GCM:AES-128-GCM:?Chacha20-Poly1305:?AES-128-CBC``.
266 You can also use the ``--compat-mode`` option. Note that these message may
267 also indicate other cipher configuration problems. See the data channel
268 cipher negotiation manual section for more details. (Available online under
269 https://github.com/OpenVPN/openvpn/blob/master/doc/man-sections/cipher-negotiation.rst)
271 - Use of a legacy or deprecated cipher (e.g. 64bit block ciphers)
273 OpenSSL 3.0 no longer supports a number of insecure and outdated ciphers in
274 its default configuration. Some of these ciphers are known to be vulnerable (SWEET32 attack).
276 This will typically manifest itself in messages like::
278 OpenSSL: error:0308010C:digital envelope routines::unsupported
279 Cipher algorithm 'BF-CBC' not found
280 Unsupported cipher in --data-ciphers: BF-CBC
282 If your OpenSSL distribution comes with the legacy provider (see
283 also ``man OSSL_PROVIDER-legacy``), you can load it with
284 ``--providers legacy default``. This will re-enable the old algorithms.
286 - OpenVPN version not supporting TLS 1.2 or later
288 The default in OpenVPN 2.6 and also in many distributions is now TLS 1.2 or
289 later. Connecting to a peer that does not support this will results in
292 TLS error: Unsupported protocol. This typically indicates that client and
293 server have no common TLS version enabled. This can be caused by mismatched
294 tls-version-min and tls-version-max options on client and server. If your
295 OpenVPN client is between v2.3.6 and v2.3.2 try adding tls-version-min 1.0
296 to the client configuration to use TLS 1.0+ instead of TLS 1.0 only
297 OpenSSL: error:0A000102:SSL routines::unsupported protocol
299 This can be an OpenVPN 2.3.6 or earlier version. ``compat-version 2.3.0`` will
300 enable TLS 1.0 support if supported by the OpenSSL distribution. Note that
301 on some Linux distributions enabling TLS 1.1 or 1.0 is not possible.
305 Overview of changes in 2.5
306 ==========================
310 Client-specific tls-crypt keys (``--tls-crypt-v2``)
311 ``tls-crypt-v2`` adds the ability to supply each client with a unique
312 tls-crypt key. This allows large organisations and VPN providers to profit
313 from the same DoS and TLS stack protection that small deployments can
314 already achieve using ``tls-auth`` or ``tls-crypt``.
316 ChaCha20-Poly1305 cipher support
317 Added support for using the ChaCha20-Poly1305 cipher in the OpenVPN data
320 Improved Data channel cipher negotiation
321 The option ``ncp-ciphers`` has been renamed to ``data-ciphers``.
322 The old name is still accepted. The change in name signals that
323 ``data-ciphers`` is the preferred way to configure data channel
324 ciphers and the data prefix is chosen to avoid the ambiguity that
325 exists with ``--cipher`` for the data cipher and ``tls-cipher``
328 OpenVPN clients will now signal all supported ciphers from the
329 ``data-ciphers`` option to the server via ``IV_CIPHERS``. OpenVPN
330 servers will select the first common cipher from the ``data-ciphers``
331 list instead of blindly pushing the first cipher of the list. This
332 allows to use a configuration like
333 ``data-ciphers ChaCha20-Poly1305:AES-256-GCM`` on the server that
334 prefers ChaCha20-Poly1305 but uses it only if the client supports it.
336 See the data channel negotiation section in the manual for more details.
338 Removal of BF-CBC support in default configuration:
339 By default OpenVPN 2.5 will only accept AES-256-GCM and AES-128-GCM as
340 data ciphers. OpenVPN 2.4 allows AES-256-GCM,AES-128-GCM and BF-CBC when
341 no --cipher and --ncp-ciphers options are present. Accepting BF-CBC can be
344 data-ciphers AES-256-GCM:AES-128-GCM:BF-CBC
346 and when you need to support very old peers also
348 data-ciphers-fallback BF-CBC
350 To offer backwards compatibility with older configs an *explicit*
354 in the configuration will be automatically translated into adding BF-CBC
355 to the data-ciphers option and setting data-ciphers-fallback to BF-CBC
356 (as in the example commands above). We strongly recommend to switching
357 away from BF-CBC to a more secure cipher.
359 Asynchronous (deferred) authentication support for auth-pam plugin.
360 See src/plugins/auth-pam/README.auth-pam for details.
362 Deferred client-connect
363 The ``--client-connect`` option and the connect plugin API allow
364 asynchronous/deferred return of the configuration file in the same way
367 Faster connection setup
368 A client will signal in the ``IV_PROTO`` variable that it is in pull
369 mode. This allows the server to push the configuration options to
370 the client without waiting for a ``PULL_REQUEST`` message. The feature
371 is automatically enabled if both client and server support it and
372 significantly reduces the connection setup time by avoiding one
373 extra packet round-trip and 1s of internal event delays.
376 On Linux, if configured without ``--enable-iproute2``, configuring IP
377 addresses and adding/removing routes is now done via the netlink(3)
378 kernel interface. This is much faster than calling ``ifconfig`` or
379 ``route`` and also enables OpenVPN to run with less privileges.
381 If configured with --enable-iproute2, the ``ip`` command is used
382 (as in 2.4). Support for ``ifconfig`` and ``route`` is gone.
385 On Windows, OpenVPN can now use ``wintun`` devices. They are faster
386 than the traditional ``tap9`` tun/tap devices, but do not provide
387 ``--dev tap`` mode - so the official installers contain both. To use
388 a wintun device, add ``--windows-driver wintun`` to your config
389 (and use of the interactive service is required as wintun needs
390 SYSTEM privileges to enable access).
393 It is now possible to have only IPv6 addresses inside the VPN tunnel,
394 and IPv6-only address pools (2.4 always required IPv4 config/pools
395 and IPv6 was the "optional extra").
397 Improved Windows 10 detection
398 Correctly log OS on Windows 10 now.
401 Using the new ``--bind-dev`` option, the OpenVPN outside socket can
402 now be put into a Linux VRF. See the "Virtual Routing and Forwarding"
403 documentation in the man page.
406 TLS 1.3 support has been added to OpenVPN. Currently, this requires
408 The options ``--tls-ciphersuites`` and ``--tls-groups`` have been
409 added to fine tune TLS protocol options. Most of the improvements
410 were also backported to OpenVPN 2.4 as part of the maintainance
413 Support setting DHCP search domain
414 A new option ``--dhcp-option DOMAIN-SEARCH my.example.com`` has been
415 defined, and Windows support for it is implemented (tun/tap only, no
416 wintun support yet). Other platforms need to support this via ``--up``
417 script (Linux) or GUI (OSX/Tunnelblick).
419 per-client changing of ``--data-ciphers`` or ``data-ciphers-fallback``
420 from client-connect script/dir (NOTE: this only changes preference of
421 ciphers for NCP, but can not override what the client announces as
424 Handle setting of tun/tap interface MTU on Windows
425 If IPv6 is in use, MTU must be >= 1280 (Windows enforces IETF requirements)
427 Add support for OpenSSL engines to access private key material (like TPM).
429 HMAC based auth-token support
430 The ``--auth-gen-token`` support has been improved and now generates HMAC
431 based user token. If the optional ``--auth-gen-token-secret`` option is
432 used clients will be able to seamlessly reconnect to a different server
433 using the same secret file or to the same server after a server restart.
435 Improved support for pending authentication
436 The protocol has been enhanced to be able to signal that
437 the authentication should use a secondary authentication
438 via web (like SAML) or a two factor authentication without
439 disconnecting the OpenVPN session with AUTH_FAILED. The
440 session will instead be stay in a authenticated state and
441 wait for the second factor authentication to complete.
443 This feature currently requires usage of the managent interface
444 on both client and server side. See the `management-notes.txt`
445 ``client-pending-auth`` and ``cr-response`` commands for more
449 OpenVPN servers in TAP mode can now use 802.1q tagged VLANs
450 on the TAP interface to separate clients into different groups
451 that can then be handled differently (different subnets / DHCP,
452 firewall zones, ...) further down the network. See the new
453 options ``--vlan-tagging``, ``--vlan-accept``, ``--vlan-pvid``.
455 802.1q tagging on the client side TAP interface is not handled
456 today (= tags are just forwarded transparently to the server).
458 Support building of .msi installers for Windows
460 Allow unicode search string in ``--cryptoapicert`` option (Windows)
462 Support IPv4 configs with /31 netmasks now
463 (By no longer trying to configure ``broadcast x.x.x.x'' in
464 ifconfig calls, /31 support "just works")
466 New option ``--block-ipv6`` to reject all IPv6 packets (ICMPv6)
467 this is useful if the VPN service has no IPv6, but the clients
468 might have (LAN), to avoid client connections to IPv6-enabled
469 servers leaking "around" the IPv4-only VPN.
471 ``--ifconfig-ipv6`` and ``--ifconfig-ipv6-push`` will now accept
472 hostnames and do a DNS lookup to get the IPv6 address to use
477 For an up-to-date list of all deprecated options, see this wiki page:
478 https://community.openvpn.net/openvpn/wiki/DeprecatedOptions
480 - ``ncp-disable`` has been deprecated
481 With the improved and matured data channel cipher negotiation, the use
482 of ``ncp-disable`` should not be necessary anymore.
484 - ``inetd`` has been deprecated
485 This is a very limited and not-well-tested way to run OpenVPN, on TCP
486 and TAP mode only, which complicates the code quite a bit for little gain.
487 To be removed in OpenVPN 2.6 (unless users protest).
489 - ``no-iv`` has been removed
490 This option was made into a NOOP option with OpenVPN 2.4. This has now
491 been completely removed.
493 - ``--client-cert-not-required`` has been removed
494 This option will now cause server configurations to not start. Use
495 ``--verify-client-cert none`` instead.
497 - ``--ifconfig-pool-linear`` has been removed
498 This option is removed. Use ``--topology p2p`` or ``--topology subnet``
501 - ``--compress xxx`` is considered risky and is warned against, see below.
503 - ``--key-method 1`` has been removed
508 - If multiple connect handlers are used (client-connect, ccd, connect
509 plugin) and one of the handler succeeds but a subsequent fails, the
510 client-disconnect-script is now called immediately. Previously it
511 was called, when the VPN session was terminated.
513 - Support for building with OpenSSL 1.0.1 has been removed. The minimum
514 supported OpenSSL version is now 1.0.2.
516 - The GET_CONFIG management state is omitted if the server pushes
517 the client configuration almost immediately as result of the
518 faster connection setup feature.
520 - ``--compress`` is nowadays considered risky, because attacks exist
521 leveraging compression-inside-crypto to reveal plaintext (VORACLE). So
522 by default, ``--compress xxx`` will now accept incoming compressed
523 packets (for compatibility with peers that have not been upgraded yet),
524 but will not use compression outgoing packets. This can be controlled with
525 the new option ``--allow-compression yes|no|asym``.
527 - Stop changing ``--txlen`` aways from OS defaults unless explicitly specified
528 in config file. OS defaults nowadays are actually larger then what we used
529 to configure, so our defaults sometimes caused packet drops = bad performance.
531 - remove ``--writepid`` pid file on exit now
533 - plugin-auth-pam now logs via OpenVPN logging method, no longer to stderr
534 (this means you'll have log messages in syslog or openvpn log file now)
536 - use ISO 8601 time format for file based logging now (YYYY-MM-DD hh:mm:dd)
537 (syslog is not affected, nor is ``--machine-readable-output``)
539 - ``--clr-verify`` now loads all CRLs if more than one CRL is in the same
540 file (OpenSSL backend only, mbedTLS always did that)
542 - when ``--auth-user-pass file`` has no password, and the management interface
543 is active, query management interface (instead of trying console query,
544 which does not work on windows)
546 - skip expired certificates in Windows certificate store (``--cryptoapicert``)
548 - ``--socks-proxy`` + ``--proto udp*`` will now allways use IPv4, even if
549 IPv6 is requested and available. Our SOCKS code does not handle IPv6+UDP,
550 and before that change it would just fail in non-obvious ways.
552 - TCP listen() backlog queue is now set to 32 - this helps TCP servers that
553 receive lots of "invalid" connects by TCP port scanners
555 - do no longer print OCC warnings ("option mismatch") about ``key-method``,
556 ``keydir``, ``tls-auth`` and ``cipher`` - these are either gone now, or
557 negotiated, and the warnings do not serve a useful purpose.
559 - ``dhcp-option DNS`` and ``dhcp-option DNS6`` are now treated identically
560 (= both accept an IPv4 or IPv6 address for the nameserver)
563 Maintainer-visible changes
564 --------------------------
565 - the man page is now in maintained in .rst format, so building the openvpn.8
566 manpage from a git checkout now requires python-docutils (if this is missing,
567 the manpage will not be built - which is not considered an error generally,
568 but for package builders or ``make distcheck`` it is). Release tarballs
569 contain the openvpn.8 file, so unless some .rst is changed, doc-utils are
570 not needed for building.
572 - OCC support can no longer be disabled
574 - AEAD support is now required in the crypto library
576 - ``--disable-server`` has been removed from configure (so it is no longer
577 possible to build a client-/p2p-only OpenVPN binary) - the saving in code
578 size no longer outweighs the extra maintenance effort.
580 - ``--enable-iproute2`` will disable netlink(3) support, so maybe remove
581 that from package building configs (see above)
583 - support building with MSVC 2019
585 - cmocka based unit tests are now only run if cmocka is installed externally
586 (2.4 used to ship a local git submodule which was painful to maintain)
588 - ``--disable-crypto`` configure option has been removed. OpenVPN is now always
589 built with crypto support, which makes the code much easier to maintain.
590 This does not affect ``--cipher none`` to do a tunnel without encryption.
592 - ``--disable-multi`` configure option has been removed
596 Overview of changes in 2.4
597 ==========================
602 Seamless client IP/port floating
603 Added new packet format P_DATA_V2, which includes peer-id. If both the
604 server and client support it, the client sends all data packets in
605 the new format. When a data packet arrives, the server identifies peer
606 by peer-id. If peer's ip/port has changed, server assumes that
607 client has floated, verifies HMAC and updates ip/port in internal structs.
608 This allows the connection to be immediately restored, instead of requiring
609 a TLS handshake before the server accepts packets from the new client
612 Data channel cipher negotiation
613 Data channel ciphers (``--cipher``) are now by default negotiated. If a
614 client advertises support for Negotiable Crypto Parameters (NCP), the
615 server will choose a cipher (by default AES-256-GCM) for the data channel,
616 and tell the client to use that cipher. Data channel cipher negotiation
617 can be controlled using ``--ncp-ciphers`` and ``--ncp-disable``.
619 A more limited version also works in client-to-server and server-to-client
620 scenarios where one of the end points uses a v2.4 client or server and the
621 other side uses an older version. In such scenarios the v2.4 side will
622 change to the ``--cipher`` set by the remote side, if permitted by by
623 ``--ncp-ciphers``. For example, a v2.4 client with ``--cipher BF-CBC``
624 and ``ncp-ciphers AES-256-GCM:AES-256-CBC`` can connect to both a v2.3
625 server with ``cipher BF-CBC`` as well as a server with
626 ``cipher AES-256-CBC`` in its config. The other way around, a v2.3 client
627 with either ``cipher BF-CBC`` or ``cipher AES-256-CBC`` can connect to a
628 v2.4 server with e.g. ``cipher BF-CBC`` and
629 ``ncp-ciphers AES-256-GCM:AES-256-CBC`` in its config. For this to work
630 it requires that OpenVPN was built without disabling OCC support.
632 AEAD (GCM) data channel cipher support
633 The data channel now supports AEAD ciphers (currently only GCM). The AEAD
634 packet format has a smaller crypto overhead than the CBC packet format,
635 (e.g. 20 bytes per packet for AES-128-GCM instead of 36 bytes per packet
636 for AES-128-CBC + HMAC-SHA1).
639 The TLS control channel now supports for elliptic curve diffie-hellmann
642 Improved Certificate Revocation List (CRL) processing
643 CRLs are now handled by the crypto library (OpenSSL or mbed TLS), instead
644 of inside OpenVPN itself. The crypto library implementations are more
645 strict than the OpenVPN implementation was. This might reject peer
646 certificates that would previously be accepted. If this occurs, OpenVPN
647 will log the crypto library's error description.
649 Dualstack round-robin DNS client connect
650 Instead of only using the first address of each ``--remote`` OpenVPN
651 will now try all addresses (IPv6 and IPv4) of a ``--remote`` entry.
653 Support for providing IPv6 DNS servers
654 A new DHCP sub-option ``DNS6`` is added alongside with the already existing
655 ``DNS`` sub-option. This is used to provide DNS resolvers available over
656 IPv6. This may be pushed to clients where `` --up`` scripts and ``--plugin``
657 can act upon it through the ``foreign_option_<n>`` environment variables.
659 Support for the Windows client picking up this new sub-option is added,
660 however IPv6 DNS resolvers need to be configured via ``netsh`` which requires
661 administrator privileges unless the new interactive services on Windows is
662 being used. If the interactive service is used, this service will execute
663 ``netsh`` in the background with the proper privileges.
665 New improved Windows Background service
666 The new OpenVPNService is based on openvpnserv2, a complete rewrite of the OpenVPN
667 service wrapper. It is intended for launching OpenVPN instances that should be
668 up at all times, instead of being manually launched by a user. OpenVPNService is
669 able to restart individual OpenVPN processes if they crash, and it also works
670 properly on recent Windows versions. OpenVPNServiceLegacy tends to work poorly,
671 if at all, on newer Windows versions (8+) and its use is not recommended.
673 New interactive Windows service
674 The installer starts OpenVPNServiceInteractive automatically and configures
675 it to start at system startup.
677 The interactive Windows service allows unprivileged users to start
678 OpenVPN connections in the global config directory (usually
679 C:\\Program Files\\OpenVPN\\config) using OpenVPN GUI without any
682 Users who belong to the built-in Administrator group or to the
683 local "OpenVPN Administrator" group can also store configuration
684 files under %USERPROFILE%\\OpenVPN\\config for use with the
687 redirect-gateway ipv6
688 OpenVPN has now feature parity between IPv4 and IPv6 for redirect
689 gateway including the handling of overlapping IPv6 routes with
690 IPv6 remote VPN server address.
692 LZ4 Compression and pushable compression
693 Additionally to LZO compression OpenVPN now also supports LZ4 compression.
694 Compression options are now pushable from the server.
696 Filter pulled options client-side: pull-filter
697 New option to explicitly allow or reject options pushed by the server.
698 May be used multiple times and is applied in the order specified.
700 Per-client remove push options: push-remove
701 New option to remove options on a per-client basis from the "push" list
702 (more fine-grained than ``--push-reset``).
704 Http proxy password inside config file
705 Http proxy passwords can be specified with the inline file option
706 ``<http-proxy-user-pass>`` .. ``</http-proxy-user-pass>``
708 Windows version detection
709 Windows version is detected, logged and possibly signalled to server
710 (IV_PLAT_VER=<nn> if ``--push-peer-info`` is set on client).
712 Authentication tokens
713 In situations where it is not suitable to save user passwords on the client,
714 OpenVPN has support for pushing a --auth-token since v2.3. This option is
715 pushed from the server to the client with a token value to be used instead
716 of the users password. For this to work, the authentication plug-in would
717 need to implement this support as well. In OpenVPN 2.4 --auth-gen-token
718 is introduced, which will allow the OpenVPN server to generate a random
719 token and push it to the client without any changes to the authentication
720 modules. When the clients need to re-authenticate the OpenVPN server will
721 do the authentication internally, instead of sending the re-authentication
722 request to the authentication module . This feature is especially
723 useful in configurations which use One Time Password (OTP) authentication
724 schemes, as this allows the tunnel keys to be renegotiated regularly without
725 any need to supply new OTP codes.
727 keying-material-exporter
728 Keying Material Exporter [RFC-5705] allow additional keying material to be
729 derived from existing TLS channel.
731 Android platform support
732 Support for running on Android using Android's VPNService API has been added.
733 See doc/android.txt for more details. This support is primarily used in
734 the OpenVPN for Android app (https://github.com/schwabe/ics-openvpn)
737 AIX platform support has been added. The support only includes tap
738 devices since AIX does not provide tun interface.
740 Control channel encryption (``--tls-crypt``)
741 Use a pre-shared static key (like the ``--tls-auth`` key) to encrypt control
742 channel packets. Provides more privacy, some obfuscation and poor-man's
743 post-quantum security.
745 Asynchronous push reply
746 Plug-ins providing support for deferred authentication can benefit from a more
747 responsive authentication where the server sends PUSH_REPLY immediately once
748 the authentication result is ready, instead of waiting for the the client to
749 to send PUSH_REQUEST once more. This requires OpenVPN to be built with
750 ``./configure --enable-async-push``. This is a compile-time only switch.
755 For an up-to-date list of all deprecated options, see this wiki page:
756 https://community.openvpn.net/openvpn/wiki/DeprecatedOptions
758 - ``--key-method 1`` is deprecated in OpenVPN 2.4 and will be removed in v2.5.
759 Migrate away from ``--key-method 1`` as soon as possible. The recommended
760 approach is to remove the ``--key-method`` option from the configuration
761 files, OpenVPN will then use ``--key-method 2`` by default. Note that this
762 requires changing the option in both the client and server side configs.
764 - ``--tls-remote`` is removed in OpenVPN 2.4, as indicated in the v2.3
765 man-pages. Similar functionality is provided via ``--verify-x509-name``,
766 which does the same job in a better way.
768 - ``--compat-names`` and ``--no-name-remapping`` were deprecated in OpenVPN 2.3
769 and will be removed in v2.5. All scripts and plug-ins depending on the old
770 non-standard X.509 subject formatting must be updated to the standardized
771 formatting. See the man page for more information.
773 - ``--no-iv`` is deprecated in OpenVPN 2.4 and will be removed in v2.5.
775 - ``--keysize`` is deprecated in OpenVPN 2.4 and will be removed in v2.6
776 together with the support of ciphers with cipher block size less than
779 - ``--comp-lzo`` is deprecated in OpenVPN 2.4. Use ``--compress`` instead.
781 - ``--ifconfig-pool-linear`` has been deprecated since OpenVPN 2.1 and will be
782 removed in v2.5. Use ``--topology p2p`` instead.
784 - ``--client-cert-not-required`` is deprecated in OpenVPN 2.4 and will be removed
785 in v2.5. Use ``--verify-client-cert none`` for a functional equivalent.
787 - ``--ns-cert-type`` is deprecated in OpenVPN 2.3.18 and v2.4. It will be removed
788 in v2.5. Use the far better ``--remote-cert-tls`` option which replaces this
794 - When using ciphers with cipher blocks less than 128-bits,
795 OpenVPN will complain loudly if the configuration uses ciphers considered
796 weak, such as the SWEET32 attack vector. In such scenarios, OpenVPN will by
797 default renegotiate for each 64MB of transported data (``--reneg-bytes``).
798 This renegotiation can be disabled, but is HIGHLY DISCOURAGED.
800 - For certificate DNs with duplicate fields, e.g. "OU=one,OU=two", both fields
801 are now exported to the environment, where each second and later occurrence
802 of a field get _$N appended to it's field name, starting at N=1. For the
803 example above, that would result in e.g. X509_0_OU=one, X509_0_OU_1=two.
804 Note that this breaks setups that rely on the fact that OpenVPN would
805 previously (incorrectly) only export the last occurrence of a field.
807 - ``proto udp`` and ``proto tcp`` now use both IPv4 and IPv6. The new
808 options ``proto udp4`` and ``proto tcp4`` use IPv4 only.
810 - ``--sndbuf`` and ``--recvbuf`` default now to OS defaults instead of 64k
812 - OpenVPN exits with an error if an option has extra parameters;
813 previously they were silently ignored
815 - ``--tls-auth`` always requires OpenVPN static key files and will no
816 longer work with free form files
818 - ``--proto udp6/tcp6`` in server mode will now try to always listen to
819 both IPv4 and IPv6 on platforms that allow it. Use ``--bind ipv6only``
820 to explicitly listen only on IPv6.
822 - Removed ``--enable-password-save`` from configure. This option is now
825 - Stricter default TLS cipher list (override with ``--tls-cipher``), that now
828 * Non-ephemeral key exchange using static (EC)DH keys
831 - mbed TLS builds: changed the tls_digest_N values exported to the script
832 environment to be equal to the ones exported by OpenSSL builds, namely
833 the certificate fingerprint (was the hash of the 'to be signed' data).
835 - mbed TLS builds: minimum RSA key size is now 2048 bits. Shorter keys will
836 not be accepted, both local and from the peer.
838 - ``--connect-timeout`` now specifies the timeout until the first TLS packet
839 is received (identical to ``--server-poll-timeout``) and this timeout now
840 includes the removed socks proxy timeout and http proxy timeout.
842 In ``--static`` mode ``connect-timeout`` specifies the timeout for TCP and
843 proxy connection establishment
845 - ``--connect-retry-max`` now specifies the maximum number of unsuccessful
846 attempts of each remote/connection entry before exiting.
848 - ``--http-proxy-timeout`` and the static non-changeable socks timeout (5s)
849 have been folded into a "unified" ``--connect-timeout`` which covers all
850 steps needed to connect to the server, up to the start of the TLS exchange.
851 The default value has been raised to 120s, to handle slow http/socks
852 proxies graciously. The old "fail TCP fast" behaviour can be achieved by
853 adding "``--connect-timeout 10``" to the client config.
855 - ``--http-proxy-retry`` and ``--sock-proxy-retry`` have been removed. Proxy connections
856 will now behave like regular connection entries and generate a USR1 on failure.
858 - ``--connect-retry`` gets an optional second argument that specifies the maximum
859 time in seconds to wait between reconnection attempts when an exponential
860 backoff is triggered due to repeated retries. Default = 300 seconds.
862 - Data channel cipher negotiation (see New features section) can override
863 ciphers configured in the config file. Use ``--ncp-disable`` if you do not want
866 - All tun devices on all platforms are always considered to be IPv6
867 capable. The ``--tun-ipv6`` option is ignored (behaves like it is always
870 - On the client side recursively routed packets, which have the same destination
871 as the VPN server, are dropped. This can be disabled with
872 --allow-recursive-routing option.
874 - On Windows, when the ``--register-dns`` option is set, OpenVPN no longer
875 restarts the ``dnscache`` service - this had unwanted side effects, and
876 seems to be no longer necessary with currently supported Windows versions.
878 - If no flags are given, and the interactive Windows service is used, "def1"
879 is implicitly set (because "delete and later reinstall the existing
880 default route" does not work well here). If not using the service,
881 the old behaviour is kept.
883 - OpenVPN now reloads a CRL only if the modication time or file size has
884 changed, instead of for each new connection. This reduces the connection
885 setup time, in particular when using large CRLs.
887 - OpenVPN now ships with more up-to-date systemd unit files which take advantage
888 of the improved service management as well as some hardening steps. The
889 configuration files are picked up from the /etc/openvpn/server/ and
890 /etc/openvpn/client/ directories (depending on unit file). This also avoids
891 these new unit files and how they work to collide with older pre-existing
894 - Using ``--no-iv`` (which is generally not a recommended setup) will
895 require explicitly disabling NCP with ``--disable-ncp``. This is
896 intentional because NCP will by default use AES-GCM, which requires
897 an IV - so we want users of that option to consciously reconsider.
900 Maintainer-visible changes
901 --------------------------
902 - OpenVPN no longer supports building with crypto support, but without TLS
903 support. As a consequence, OPENSSL_CRYPTO_{CFLAGS,LIBS} and
904 OPENSSL_SSL_{CFLAGS,LIBS} have been merged into OPENSSL_{CFLAGS,LIBS}. This
905 is particularly relevant for maintainers who build their own OpenSSL library,
906 e.g. when cross-compiling.
908 - Linux distributions using systemd is highly encouraged to ship these new unit
909 files instead of older ones, to provide a unified behaviour across systemd
910 based Linux distributions.
912 - With OpenVPN 2.4, the project has moved over to depend on and actively use
913 the official C99 standard (-std=c99). This may fail on some older compiler/libc
914 header combinations. In most of these situations it is recommended to
915 use -std=gnu99 in CFLAGS. This is known to be needed when doing
916 i386/i686 builds on RHEL5.
924 - The new option ``--tls-cert-profile`` can be used to restrict the set of
925 allowed crypto algorithms in TLS certificates in mbed TLS builds. The
926 default profile is 'legacy' for now, which allows SHA1+, RSA-1024+ and any
927 elliptic curve certificates. The default will be changed to the 'preferred'
928 profile in the future, which requires SHA2+, RSA-2048+ and any curve.
936 - Support building with OpenSSL 1.1 now (in addition to older versions)
938 - On Win10, set low interface metric for TAP adapter when block-outside-dns
939 is in use, to make Windows prefer the TAP adapter for DNS queries
940 (avoiding large delays)
945 - CVE-2017-7522: Fix ``--x509-track`` post-authentication remote DoS
946 A client could crash a v2.4+ mbedtls server, if that server uses the
947 ``--x509-track`` option and the client has a correct, signed and unrevoked
948 certificate that contains an embedded NUL in the certificate subject.
949 Discovered and reported to the OpenVPN security team by Guido Vranken.
951 - CVE-2017-7521: Fix post-authentication remote-triggerable memory leaks
952 A client could cause a server to leak a few bytes each time it connects to the
953 server. That can eventually cause the server to run out of memory, and thereby
954 causing the server process to terminate. Discovered and reported to the
955 OpenVPN security team by Guido Vranken. (OpenSSL builds only.)
957 - CVE-2017-7521: Fix a potential post-authentication remote code execution
958 attack on servers that use the ``--x509-username-field`` option with an X.509
959 extension field (option argument prefixed with ``ext:``). A client that can
960 cause a server to run out-of-memory (see above) might be able to cause the
961 server to double free, which in turn might lead to remote code execution.
962 Discovered and reported to the OpenVPN security team by Guido Vranken.
963 (OpenSSL builds only.)
965 - CVE-2017-7520: Pre-authentication remote crash/information disclosure for
966 clients. If clients use a HTTP proxy with NTLM authentication (i.e.
967 ``--http-proxy <server> <port> [<authfile>|'auto'|'auto-nct'] ntlm2``),
968 a man-in-the-middle attacker between the client and the proxy can cause
969 the client to crash or disclose at most 96 bytes of stack memory. The
970 disclosed stack memory is likely to contain the proxy password. If the
971 proxy password is not reused, this is unlikely to compromise the security
972 of the OpenVPN tunnel itself. Clients who do not use the ``--http-proxy``
973 option with ntlm2 authentication are not affected.
975 - CVE-2017-7508: Fix remotely-triggerable ASSERT() on malformed IPv6 packet.
976 This can be used to remotely shutdown an openvpn server or client, if
977 IPv6 and ``--mssfix`` are enabled and the IPv6 networks used inside the VPN
980 - Fix null-pointer dereference when talking to a malicious http proxy
981 that returns a malformed ``Proxy-Authenticate:`` headers for digest auth.
983 - Fix overflow check for long ``--tls-cipher`` option
985 - Windows: Pass correct buffer size to ``GetModuleFileNameW()``
986 (OSTIF/Quarkslabs audit, finding 5.6)
991 - ``--verify-hash`` can now take an optional flag which changes the hashing
992 algorithm. It can be either SHA1 or SHA256. The default if not provided is
993 SHA1 to preserve backwards compatibility with existing configurations.
995 - Restrict the supported ``--x509-username-field`` extension fields to subjectAltName
996 and issuerAltName. Other extensions probably didn't work anyway, and would
997 cause OpenVPN to crash when a client connects.
1002 - Fix fingerprint calculation in mbed TLS builds. This means that mbed TLS users
1003 of OpenVPN 2.4.0, v2.4.1 and v2.4.2 that rely on the values of the
1004 ``tls_digest_*`` env vars, or that use ``--verify-hash`` will have to change
1005 the fingerprint values they check against. The security impact of the
1006 incorrect calculation is very minimal; the last few bytes (max 4, typically
1007 4) are not verified by the fingerprint. We expect no real-world impact,
1008 because users that used this feature before will notice that it has suddenly
1009 stopped working, and users that didn't will notice that connection setup
1010 fails if they specify correct fingerprints.
1012 - Fix edge case with NCP when the server sends an empty PUSH_REPLY message
1013 back, and the client would not initialize it's data channel crypto layer
1014 properly (trac #903)
1016 - Fix SIGSEGV on unaligned buffer access on OpenBSD/Sparc64
1018 - Fix TCP_NODELAY on OpenBSD
1020 - Remove erroneous limitation on max number of args for ``--plugin``
1022 - Fix NCP behaviour on TLS reconnect (Server would not send a proper
1023 "cipher ..." message back to the client, leading to client and server
1024 using different ciphers) (trac #887)
1032 - Fix memory leak introduced in OpenVPN 2.4.1: if ``--remote-cert-tls`` is
1033 used, we leaked some memory on each TLS (re)negotiation.
1038 - Fix a pre-authentication denial-of-service attack on both clients and
1039 servers. By sending a too-large control packet, OpenVPN 2.4.0 or v2.4.1 can
1040 be forced to hit an ASSERT() and stop the process. If ``--tls-auth`` or
1041 ``--tls-crypt`` is used, only attackers that have the ``--tls-auth`` or
1042 ``--tls-crypt`` key can mount an attack.
1043 (OSTIF/Quarkslab audit finding 5.1, CVE-2017-7478)
1045 - Fix an authenticated remote DoS vulnerability that could be triggered by
1046 causing a packet id roll over. An attack is rather inefficient; a peer
1047 would need to get us to send at least about 196 GB of data.
1048 (OSTIF/Quarkslab audit finding 5.2, CVE-2017-7479)
1053 - ``--remote-cert-ku`` now only requires the certificate to have at least the
1054 bits set of one of the values in the supplied list, instead of requiring an
1055 exact match to one of the values in the list.
1056 - ``--remote-cert-tls`` now only requires that a keyUsage is present in the
1057 certificate, and leaves the verification of the value up to the crypto
1058 library, which has more information (i.e. the key exchange method in use)
1059 to verify that the keyUsage is correct.
1060 - ``--ns-cert-type`` is deprecated. Use ``--remote-cert-tls`` instead.
1061 The nsCertType x509 extension is very old, and barely used.
1062 ``--remote-cert-tls`` uses the far more common keyUsage and extendedKeyUsage
1063 extension instead. Make sure your certificates carry these to be able to
1064 use ``--remote-cert-tls``.
projects / thirdparty / openvpn.git / blob