1 Overview of changes in 2.7
2 ==========================
3 ``secret`` support has been removed by default.
4 static key mode (non-TLS) is no longer considered "good and secure enough"
5 for today's requirements. Use TLS mode instead. If deploying a PKI CA
6 is considered "too complicated", using ``--peer-fingerprint`` makes
7 TLS mode about as easy as using ``--secret``.
9 This mode can still be enabled by using
10 ``--allow-deprecated-insecure-static-crypto`` but will be removed in
13 Overview of changes in 2.6
14 ==========================
19 We want to deprecate our old Trac bug tracking system.
20 Please report any issues with this release in GitHub
21 instead: https://github.com/OpenVPN/openvpn/issues
25 Support unlimited number of connection entries and remote entries
27 New management commands to enumerate and list remote entries
28 Use ``remote-entry-count`` and ``remote-entry-get``
29 commands from the management interface to get the number of
30 remote entries and the entries themselves.
32 Keying Material Exporters (RFC 5705) based key generation
33 As part of the cipher negotiation OpenVPN will automatically prefer
34 the RFC5705 based key material generation to the current custom
35 OpenVPN PRF. This feature requires OpenSSL or mbed TLS 2.18+.
37 Compatibility with OpenSSL in FIPS mode
38 OpenVPN will now work with OpenSSL in FIPS mode. Note, no effort
39 has been made to check or implement all the
40 requirements/recommendation of FIPS 140-2. This just allows OpenVPN
41 to be run on a system that be configured OpenSSL in FIPS mode.
43 ``mlock`` will now check if enough memlock-able memory has been reserved,
44 and if less than 100MB RAM are available, use setrlimit() to upgrade
45 the limit. See Trac #1390. Not available on OpenSolaris.
47 Certificate pinning/verify peer fingerprint
48 The ``--peer-fingerprint`` option has been introduced to give users an
49 easy to use alternative to the ``tls-verify`` for matching the
50 fingerprint of the peer. The option takes use a number of allowed
51 SHA256 certificate fingerprints.
53 See the man page section "Small OpenVPN setup with peer-fingerprint"
54 for a tutorial on how to use this feature. This is also available online
55 under https://github.com/openvpn/openvpn/blob/master/doc/man-sections/example-fingerprint.rst
57 TLS mode with self-signed certificates
58 When ``--peer-fingerprint`` is used, the ``--ca`` and ``--capath`` option
59 become optional. This allows for small OpenVPN setups without setting up
60 a PKI with Easy-RSA or similar software.
62 Deferred auth support for scripts
63 The ``--auth-user-pass-verify`` script supports now deferred authentication.
65 Pending auth support for plugins and scripts
66 Both auth plugin and script can now signal pending authentication to
67 the client when using deferred authentication. The new ``client-crresponse``
68 script option and ``OPENVPN_PLUGIN_CLIENT_CRRESPONSE`` plugin function can
69 be used to parse a client response to a ``CR_TEXT`` two factor challenge.
71 See ``sample/sample-scripts/totpauth.py`` for an example.
73 Compatibility mode (``--compat-mode``)
74 The modernisation of defaults can impact the compatibility of OpenVPN 2.6.0
75 with older peers. The options ``--compat-mode`` allows UIs to provide users
76 with an easy way to still connect to older servers.
79 OpenSSL 3.0 has been added. Most of OpenSSL 3.0 changes are not user visible but
80 improve general compatibility with OpenSSL 3.0. ``--tls-cert-profile insecure``
81 has been added to allow selecting the lowest OpenSSL security level (not
82 recommended, use only if you must). OpenSSL 3.0 no longer supports the Blowfish
83 (and other deprecated) algorithm by default and the new option ``--providers``
84 allows loading the legacy provider to renable these algorithms.
86 Optional ciphers in ``--data-ciphers``
87 Ciphers in ``--data-ciphers`` can now be prefixed with a ``?`` to mark
88 those as optional and only use them if the SSL library supports them.
91 Improved ``--mssfix`` and ``--fragment`` calculation
92 The ``--mssfix`` and ``--fragment`` options now allow an optional :code:`mtu`
93 parameter to specify that different overhead for IPv4/IPv6 should taken into
94 account and the resulting size is specified as the total size of the VPN packets
95 including IP and UDP headers.
97 Cookie based handshake for UDP server
98 Instead of allocating a connection for each client on the initial packet
99 OpenVPN server will now use an HMAC based cookie as its session id. This
100 way the server can verify it on completing the handshake without keeping
101 state. This eliminates the amplification and resource exhaustion attacks.
102 For tls-crypt-v2 clients, this requires OpenVPN 2.6 clients or later
103 because the client needs to resend its client key on completing the hand
104 shake. The tls-crypt-v2 option allows controlling if older clients are
107 By default the rate of initial packet responses is limited to 100 per 10s
108 interval to avoid OpenVPN servers being abused in reflection attacks
109 (see ``--connect-freq-initial``).
111 Data channel offloading with ovpn-dco
112 2.6.0+ implements support for data-channel offloading where the data packets
113 are directly processed and forwarded in kernel space thanks to the ovpn-dco
114 kernel module. The userspace openvpn program acts purely as a control plane
115 application. Note that DCO will use DATA_V2 packets in P2P mode, therefore,
116 this implies that peers must be running 2.6.0+ in order to have P2P-NCP
117 which brings DATA_V2 packet support.
120 It is now possible to terminate a session (or all) after a specified amount
121 of seconds has passed session commencement. This behaviour can be configured
122 using ``--session-timeout``. This option can be configured on the server, on
123 the client or can also be pushed.
125 Inline auth username and password
126 Username and password can now be specified inline in the configuration file
127 within the <auth-user-pass></auth-user-pass> tags. If the password is
128 missing OpenVPN will prompt for input via stdin. This applies to inline'd
129 http-proxy-user-pass too.
131 Tun MTU can be pushed
132 The client can now also dynamically configure its MTU and the server
133 will try to push the client MTU when the client supports it. The
134 directive ``--tun-mtu-max`` has been introduced to increase the maximum
135 pushable MTU size (defaults to 1600).
138 When both peers are OpenVPN 2.6.1+, OpenVPN will dynamically create
139 a tls-crypt key that is used for renegotiation. This ensure that only the
140 previously authenticated peer can do trigger renegotiation and complete
143 Improved control channel packet size control (``max-packet-size``)
144 The size of control channel is no longer tied to
145 ``--link-mtu``/``--tun-mtu`` and can be set using ``--max-packet-size``.
146 Sending large control channel frames is also optimised by allowing 6
147 outstanding packets instead of just 4. ``max-packet-size`` will also set
148 ``mssfix`` to try to limit data-channel packets as well.
152 ``inetd`` has been removed
153 This was a very limited and not-well-tested way to run OpenVPN, on TCP
156 ``verify-hash`` has been deprecated
157 This option has very limited usefulness and should be replaced by either
158 a better ``--ca`` configuration or with a ``--tls-verify`` script.
160 ``secret`` has been deprecated
161 static key mode (non-TLS) is no longer considered "good and secure enough"
162 for today's requirements. Use TLS mode instead. If deploying a PKI CA
163 is considered "too complicated", using ``--peer-fingerprint`` makes
164 TLS mode about as easy as using ``--secret``.
166 ``ncp-disable`` has been removed
167 This option mainly served a role as debug option when NCP was first
168 introduced. It should now no longer be necessary.
170 TLS 1.0 and 1.1 are deprecated
171 ``tls-version-min`` is set to 1.2 by default. OpenVPN 2.6.0 defaults
172 to a minimum TLS version of 1.2 as TLS 1.0 and 1.1 should be generally
173 avoided. Note that OpenVPN versions older than 2.3.7 use TLS 1.0 only.
175 ``--cipher`` argument is no longer appended to ``--data-ciphers``
176 by default. Data cipher negotiation has been introduced in 2.4.0
177 and been significantly improved in 2.5.0. The implicit fallback
178 to the cipher specified in ``--cipher`` has been removed.
179 Effectively, ``--cipher`` is a no-op in TLS mode now, and will
180 only have an effect in pre-shared-key mode (``--secret``).
181 From now on ``--cipher`` should not be used in new configurations
183 Should backwards compatibility with older OpenVPN peers be
184 required, please see the ``--compat-mode`` instead.
186 ``--prng`` has beeen removed
187 OpenVPN used to implement its own PRNG based on a hash. However implementing
188 a PRNG is better left to a crypto library. So we use the PRNG
189 mbed TLS or OpenSSL now.
191 ``--keysize`` has been removed
192 The ``--keysize`` option was only useful to change the key length when using the
193 BF, CAST6 or RC2 ciphers. For all other ciphers the key size is fixed with the
194 chosen cipher. As OpenVPN v2.6 no longer supports any of these variable length
195 ciphers, this option was removed as well to avoid confusion.
197 Compression no longer enabled by default
198 Unless an explicit compression option is specified in the configuration,
199 ``--allow-compression`` defaults to ``no`` in OpeNVPN 2.6.0.
200 By default, OpenVPN 2.5 still allowed a server to enable compression by
201 pushing compression related options.
203 PF (Packet Filtering) support has been removed
204 The built-in PF functionality has been removed from the code base. This
205 feature wasn't really easy to use and was long unmaintained.
206 This implies that also ``--management-client-pf`` and any other compile
207 time or run time related option do not exist any longer.
209 Option conflict checking is being deprecated and phased out
210 The static option checking (OCC) is no longer useful in typical setups
211 that negotiate most connection parameters. The ``--opt-verify`` and
212 ``--occ-disable`` options are deprecated, and the configure option
213 ``--enable-strict-options`` has been removed. Logging of mismatched
214 options has been moved to debug logging (verb 7).
218 - CHACHA20-POLY1305 is included in the default of ``--data-ciphers`` when available.
219 - Option ``--prng`` is ignored as we rely on the SSL library random number generator.
220 - Option ``--nobind`` is default when ``--client`` or ``--pull`` is used in the configuration
221 - :code:`link_mtu` parameter is removed from environment or replaced with 0 when scripts are
222 called with parameters. This parameter is unreliable and no longer internally calculated.
224 - control channel packet maximum size is no longer influenced by
225 ``--link-mtu``/``--tun-mtu`` and must be set by ``--max-packet-size`` now.
226 The default is 1250 for the control channel size.
228 - In point-to-point OpenVPN setups (no ``--server``), using
229 ``--explict-exit-notiy`` on one end would terminate the other side at
230 session end. This is considered a no longer useful default and has
231 been changed to "restart on reception of explicit-exit-notify message".
232 If the old behaviour is still desired, ``--remap-usr1 SIGTERM`` can be used.
234 - FreeBSD tun interfaces with ``--topology subnet`` are now put into real
235 subnet mode (IFF_BROADCAST instead of IFF_POINTOPOINT) - this might upset
236 software that enumerates interfaces, looking for "broadcast capable?" and
237 expecting certain results. Normal uses should not see any difference.
239 - The default configurations will no longer allow connections to OpenVPN 2.3.x
240 peer or earlier, use the new ``--compat-mode`` option if you need
241 compatibility with older versions. See the manual page on the
242 ``--compat-mode`` for details.
244 - The ``client-pending-auth`` management command now requires also the
245 key id. The management version has been changed to 5 to indicate this change.
247 - (OpenVPN 2.6.2) A client will now refuse a connection if pushed compression
248 settings will contradict the setting of allow-compression as this almost
249 always results in a non-working connection.
251 Common errors with OpenSSL 3.0 and OpenVPN 2.6
252 ----------------------------------------------
253 Both OpenVPN 2.6 and OpenSSL 3.0 tighten the security considerable, so some
254 configuration will no longer work. This section will cover the most common
255 causes and error message we have seen and explain their reason and temporary
256 workarounds. You should fix the underlying problems as soon as possible since
257 these workaround are not secure and will eventually stop working in a future
260 - weak SHA1 or MD5 signature on certificates
262 This will happen on either loading of certificates or on connection
265 OpenSSL: error:0A00018E:SSL routines::ca md too weak
266 Cannot load certificate file cert.crt
267 Exiting due to fatal error
269 OpenSSL 3.0 no longer allows weak signatures on certificates. You can
270 downgrade your security to allow them by using ``--tls-cert-profile insecure``
271 but should replace/regenerate these certificates as soon as possible.
274 - 1024 bit RSA certificates, 1024 bit DH parameters, other weak keys
276 This happens if you use private keys or other cryptographic material that
277 does not meet today's cryptographic standards anymore. Messages are similar
280 OpenSSL: error:0A00018F:SSL routines::ee key too small
281 OpenSSL: error:1408518A:SSL routines:ssl3_ctx_ctrl:dh key too small
283 DH parameters (``--dh``) can be regenerated with ``openssl dhparam 2048``.
284 For other cryptographic keys, these keys and certificates need to be
285 regenerated. TLS Security level can be temporarily lowered with
286 ``--tls-cert-profile legacy`` or even ``--tls-cert-profile insecure``.
288 - Connecting to a OpenVPN 2.3.x server or allowing OpenVPN 2.3.x or earlier
291 This will normally result in messages like::
293 OPTIONS ERROR: failed to negotiate cipher with server. Add the server's cipher ('AES-128-CBC') to --data-ciphers (currently 'AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305') if you want to connect to this server.
297 client/127.0.0.1:49954 SENT CONTROL [client]: 'AUTH_FAILED,Data channel cipher negotiation failed (no shared cipher)' (status=1)
299 You can manually add the missing cipher to the ``--data-ciphers``. The
300 standard ciphers should be included as well, e.g.
301 ``--data-ciphers AES-256-GCM:AES-128-GCM:?Chacha20-Poly1305:?AES-128-CBC``.
302 You can also use the ``--compat-mode`` option. Note that these message may
303 also indicate other cipher configuration problems. See the data channel
304 cipher negotiation manual section for more details. (Available online under
305 https://github.com/OpenVPN/openvpn/blob/master/doc/man-sections/cipher-negotiation.rst)
307 - Use of a legacy or deprecated cipher (e.g. 64bit block ciphers)
309 OpenSSL 3.0 no longer supports a number of insecure and outdated ciphers in
310 its default configuration. Some of these ciphers are known to be vulnerable (SWEET32 attack).
312 This will typically manifest itself in messages like::
314 OpenSSL: error:0308010C:digital envelope routines::unsupported
315 Cipher algorithm 'BF-CBC' not found
316 Unsupported cipher in --data-ciphers: BF-CBC
318 If your OpenSSL distribution comes with the legacy provider (see
319 also ``man OSSL_PROVIDER-legacy``), you can load it with
320 ``--providers legacy default``. This will re-enable the old algorithms.
322 - OpenVPN version not supporting TLS 1.2 or later
324 The default in OpenVPN 2.6 and also in many distributions is now TLS 1.2 or
325 later. Connecting to a peer that does not support this will results in
328 TLS error: Unsupported protocol. This typically indicates that client and
329 server have no common TLS version enabled. This can be caused by mismatched
330 tls-version-min and tls-version-max options on client and server. If your
331 OpenVPN client is between v2.3.6 and v2.3.2 try adding tls-version-min 1.0
332 to the client configuration to use TLS 1.0+ instead of TLS 1.0 only
333 OpenSSL: error:0A000102:SSL routines::unsupported protocol
335 This can be an OpenVPN 2.3.6 or earlier version. ``compat-version 2.3.0`` will
336 enable TLS 1.0 support if supported by the OpenSSL distribution. Note that
337 on some Linux distributions enabling TLS 1.1 or 1.0 is not possible.
341 Overview of changes in 2.5
342 ==========================
346 Client-specific tls-crypt keys (``--tls-crypt-v2``)
347 ``tls-crypt-v2`` adds the ability to supply each client with a unique
348 tls-crypt key. This allows large organisations and VPN providers to profit
349 from the same DoS and TLS stack protection that small deployments can
350 already achieve using ``tls-auth`` or ``tls-crypt``.
352 ChaCha20-Poly1305 cipher support
353 Added support for using the ChaCha20-Poly1305 cipher in the OpenVPN data
356 Improved Data channel cipher negotiation
357 The option ``ncp-ciphers`` has been renamed to ``data-ciphers``.
358 The old name is still accepted. The change in name signals that
359 ``data-ciphers`` is the preferred way to configure data channel
360 ciphers and the data prefix is chosen to avoid the ambiguity that
361 exists with ``--cipher`` for the data cipher and ``tls-cipher``
364 OpenVPN clients will now signal all supported ciphers from the
365 ``data-ciphers`` option to the server via ``IV_CIPHERS``. OpenVPN
366 servers will select the first common cipher from the ``data-ciphers``
367 list instead of blindly pushing the first cipher of the list. This
368 allows to use a configuration like
369 ``data-ciphers ChaCha20-Poly1305:AES-256-GCM`` on the server that
370 prefers ChaCha20-Poly1305 but uses it only if the client supports it.
372 See the data channel negotiation section in the manual for more details.
374 Removal of BF-CBC support in default configuration:
375 By default OpenVPN 2.5 will only accept AES-256-GCM and AES-128-GCM as
376 data ciphers. OpenVPN 2.4 allows AES-256-GCM,AES-128-GCM and BF-CBC when
377 no --cipher and --ncp-ciphers options are present. Accepting BF-CBC can be
380 data-ciphers AES-256-GCM:AES-128-GCM:BF-CBC
382 and when you need to support very old peers also
384 data-ciphers-fallback BF-CBC
386 To offer backwards compatibility with older configs an *explicit*
390 in the configuration will be automatically translated into adding BF-CBC
391 to the data-ciphers option and setting data-ciphers-fallback to BF-CBC
392 (as in the example commands above). We strongly recommend to switching
393 away from BF-CBC to a more secure cipher.
395 Asynchronous (deferred) authentication support for auth-pam plugin.
396 See src/plugins/auth-pam/README.auth-pam for details.
398 Deferred client-connect
399 The ``--client-connect`` option and the connect plugin API allow
400 asynchronous/deferred return of the configuration file in the same way
403 Faster connection setup
404 A client will signal in the ``IV_PROTO`` variable that it is in pull
405 mode. This allows the server to push the configuration options to
406 the client without waiting for a ``PULL_REQUEST`` message. The feature
407 is automatically enabled if both client and server support it and
408 significantly reduces the connection setup time by avoiding one
409 extra packet round-trip and 1s of internal event delays.
412 On Linux, if configured without ``--enable-iproute2``, configuring IP
413 addresses and adding/removing routes is now done via the netlink(3)
414 kernel interface. This is much faster than calling ``ifconfig`` or
415 ``route`` and also enables OpenVPN to run with less privileges.
417 If configured with --enable-iproute2, the ``ip`` command is used
418 (as in 2.4). Support for ``ifconfig`` and ``route`` is gone.
421 On Windows, OpenVPN can now use ``wintun`` devices. They are faster
422 than the traditional ``tap9`` tun/tap devices, but do not provide
423 ``--dev tap`` mode - so the official installers contain both. To use
424 a wintun device, add ``--windows-driver wintun`` to your config
425 (and use of the interactive service is required as wintun needs
426 SYSTEM privileges to enable access).
429 It is now possible to have only IPv6 addresses inside the VPN tunnel,
430 and IPv6-only address pools (2.4 always required IPv4 config/pools
431 and IPv6 was the "optional extra").
433 Improved Windows 10 detection
434 Correctly log OS on Windows 10 now.
437 Using the new ``--bind-dev`` option, the OpenVPN outside socket can
438 now be put into a Linux VRF. See the "Virtual Routing and Forwarding"
439 documentation in the man page.
442 TLS 1.3 support has been added to OpenVPN. Currently, this requires
444 The options ``--tls-ciphersuites`` and ``--tls-groups`` have been
445 added to fine tune TLS protocol options. Most of the improvements
446 were also backported to OpenVPN 2.4 as part of the maintainance
449 Support setting DHCP search domain
450 A new option ``--dhcp-option DOMAIN-SEARCH my.example.com`` has been
451 defined, and Windows support for it is implemented (tun/tap only, no
452 wintun support yet). Other platforms need to support this via ``--up``
453 script (Linux) or GUI (OSX/Tunnelblick).
455 per-client changing of ``--data-ciphers`` or ``data-ciphers-fallback``
456 from client-connect script/dir (NOTE: this only changes preference of
457 ciphers for NCP, but can not override what the client announces as
460 Handle setting of tun/tap interface MTU on Windows
461 If IPv6 is in use, MTU must be >= 1280 (Windows enforces IETF requirements)
463 Add support for OpenSSL engines to access private key material (like TPM).
465 HMAC based auth-token support
466 The ``--auth-gen-token`` support has been improved and now generates HMAC
467 based user token. If the optional ``--auth-gen-token-secret`` option is
468 used clients will be able to seamlessly reconnect to a different server
469 using the same secret file or to the same server after a server restart.
471 Improved support for pending authentication
472 The protocol has been enhanced to be able to signal that
473 the authentication should use a secondary authentication
474 via web (like SAML) or a two factor authentication without
475 disconnecting the OpenVPN session with AUTH_FAILED. The
476 session will instead be stay in a authenticated state and
477 wait for the second factor authentication to complete.
479 This feature currently requires usage of the managent interface
480 on both client and server side. See the `management-notes.txt`
481 ``client-pending-auth`` and ``cr-response`` commands for more
485 OpenVPN servers in TAP mode can now use 802.1q tagged VLANs
486 on the TAP interface to separate clients into different groups
487 that can then be handled differently (different subnets / DHCP,
488 firewall zones, ...) further down the network. See the new
489 options ``--vlan-tagging``, ``--vlan-accept``, ``--vlan-pvid``.
491 802.1q tagging on the client side TAP interface is not handled
492 today (= tags are just forwarded transparently to the server).
494 Support building of .msi installers for Windows
496 Allow unicode search string in ``--cryptoapicert`` option (Windows)
498 Support IPv4 configs with /31 netmasks now
499 (By no longer trying to configure ``broadcast x.x.x.x'' in
500 ifconfig calls, /31 support "just works")
502 New option ``--block-ipv6`` to reject all IPv6 packets (ICMPv6)
503 this is useful if the VPN service has no IPv6, but the clients
504 might have (LAN), to avoid client connections to IPv6-enabled
505 servers leaking "around" the IPv4-only VPN.
507 ``--ifconfig-ipv6`` and ``--ifconfig-ipv6-push`` will now accept
508 hostnames and do a DNS lookup to get the IPv6 address to use
513 For an up-to-date list of all deprecated options, see this wiki page:
514 https://community.openvpn.net/openvpn/wiki/DeprecatedOptions
516 - ``ncp-disable`` has been deprecated
517 With the improved and matured data channel cipher negotiation, the use
518 of ``ncp-disable`` should not be necessary anymore.
520 - ``inetd`` has been deprecated
521 This is a very limited and not-well-tested way to run OpenVPN, on TCP
522 and TAP mode only, which complicates the code quite a bit for little gain.
523 To be removed in OpenVPN 2.6 (unless users protest).
525 - ``no-iv`` has been removed
526 This option was made into a NOOP option with OpenVPN 2.4. This has now
527 been completely removed.
529 - ``--client-cert-not-required`` has been removed
530 This option will now cause server configurations to not start. Use
531 ``--verify-client-cert none`` instead.
533 - ``--ifconfig-pool-linear`` has been removed
534 This option is removed. Use ``--topology p2p`` or ``--topology subnet``
537 - ``--compress xxx`` is considered risky and is warned against, see below.
539 - ``--key-method 1`` has been removed
544 - If multiple connect handlers are used (client-connect, ccd, connect
545 plugin) and one of the handler succeeds but a subsequent fails, the
546 client-disconnect-script is now called immediately. Previously it
547 was called, when the VPN session was terminated.
549 - Support for building with OpenSSL 1.0.1 has been removed. The minimum
550 supported OpenSSL version is now 1.0.2.
552 - The GET_CONFIG management state is omitted if the server pushes
553 the client configuration almost immediately as result of the
554 faster connection setup feature.
556 - ``--compress`` is nowadays considered risky, because attacks exist
557 leveraging compression-inside-crypto to reveal plaintext (VORACLE). So
558 by default, ``--compress xxx`` will now accept incoming compressed
559 packets (for compatibility with peers that have not been upgraded yet),
560 but will not use compression outgoing packets. This can be controlled with
561 the new option ``--allow-compression yes|no|asym``.
563 - Stop changing ``--txlen`` aways from OS defaults unless explicitly specified
564 in config file. OS defaults nowadays are actually larger then what we used
565 to configure, so our defaults sometimes caused packet drops = bad performance.
567 - remove ``--writepid`` pid file on exit now
569 - plugin-auth-pam now logs via OpenVPN logging method, no longer to stderr
570 (this means you'll have log messages in syslog or openvpn log file now)
572 - use ISO 8601 time format for file based logging now (YYYY-MM-DD hh:mm:dd)
573 (syslog is not affected, nor is ``--machine-readable-output``)
575 - ``--clr-verify`` now loads all CRLs if more than one CRL is in the same
576 file (OpenSSL backend only, mbedTLS always did that)
578 - when ``--auth-user-pass file`` has no password, and the management interface
579 is active, query management interface (instead of trying console query,
580 which does not work on windows)
582 - skip expired certificates in Windows certificate store (``--cryptoapicert``)
584 - ``--socks-proxy`` + ``--proto udp*`` will now allways use IPv4, even if
585 IPv6 is requested and available. Our SOCKS code does not handle IPv6+UDP,
586 and before that change it would just fail in non-obvious ways.
588 - TCP listen() backlog queue is now set to 32 - this helps TCP servers that
589 receive lots of "invalid" connects by TCP port scanners
591 - do no longer print OCC warnings ("option mismatch") about ``key-method``,
592 ``keydir``, ``tls-auth`` and ``cipher`` - these are either gone now, or
593 negotiated, and the warnings do not serve a useful purpose.
595 - ``dhcp-option DNS`` and ``dhcp-option DNS6`` are now treated identically
596 (= both accept an IPv4 or IPv6 address for the nameserver)
599 Maintainer-visible changes
600 --------------------------
601 - the man page is now in maintained in .rst format, so building the openvpn.8
602 manpage from a git checkout now requires python-docutils (if this is missing,
603 the manpage will not be built - which is not considered an error generally,
604 but for package builders or ``make distcheck`` it is). Release tarballs
605 contain the openvpn.8 file, so unless some .rst is changed, doc-utils are
606 not needed for building.
608 - OCC support can no longer be disabled
610 - AEAD support is now required in the crypto library
612 - ``--disable-server`` has been removed from configure (so it is no longer
613 possible to build a client-/p2p-only OpenVPN binary) - the saving in code
614 size no longer outweighs the extra maintenance effort.
616 - ``--enable-iproute2`` will disable netlink(3) support, so maybe remove
617 that from package building configs (see above)
619 - support building with MSVC 2019
621 - cmocka based unit tests are now only run if cmocka is installed externally
622 (2.4 used to ship a local git submodule which was painful to maintain)
624 - ``--disable-crypto`` configure option has been removed. OpenVPN is now always
625 built with crypto support, which makes the code much easier to maintain.
626 This does not affect ``--cipher none`` to do a tunnel without encryption.
628 - ``--disable-multi`` configure option has been removed
632 Overview of changes in 2.4
633 ==========================
638 Seamless client IP/port floating
639 Added new packet format P_DATA_V2, which includes peer-id. If both the
640 server and client support it, the client sends all data packets in
641 the new format. When a data packet arrives, the server identifies peer
642 by peer-id. If peer's ip/port has changed, server assumes that
643 client has floated, verifies HMAC and updates ip/port in internal structs.
644 This allows the connection to be immediately restored, instead of requiring
645 a TLS handshake before the server accepts packets from the new client
648 Data channel cipher negotiation
649 Data channel ciphers (``--cipher``) are now by default negotiated. If a
650 client advertises support for Negotiable Crypto Parameters (NCP), the
651 server will choose a cipher (by default AES-256-GCM) for the data channel,
652 and tell the client to use that cipher. Data channel cipher negotiation
653 can be controlled using ``--ncp-ciphers`` and ``--ncp-disable``.
655 A more limited version also works in client-to-server and server-to-client
656 scenarios where one of the end points uses a v2.4 client or server and the
657 other side uses an older version. In such scenarios the v2.4 side will
658 change to the ``--cipher`` set by the remote side, if permitted by by
659 ``--ncp-ciphers``. For example, a v2.4 client with ``--cipher BF-CBC``
660 and ``ncp-ciphers AES-256-GCM:AES-256-CBC`` can connect to both a v2.3
661 server with ``cipher BF-CBC`` as well as a server with
662 ``cipher AES-256-CBC`` in its config. The other way around, a v2.3 client
663 with either ``cipher BF-CBC`` or ``cipher AES-256-CBC`` can connect to a
664 v2.4 server with e.g. ``cipher BF-CBC`` and
665 ``ncp-ciphers AES-256-GCM:AES-256-CBC`` in its config. For this to work
666 it requires that OpenVPN was built without disabling OCC support.
668 AEAD (GCM) data channel cipher support
669 The data channel now supports AEAD ciphers (currently only GCM). The AEAD
670 packet format has a smaller crypto overhead than the CBC packet format,
671 (e.g. 20 bytes per packet for AES-128-GCM instead of 36 bytes per packet
672 for AES-128-CBC + HMAC-SHA1).
675 The TLS control channel now supports for elliptic curve diffie-hellmann
678 Improved Certificate Revocation List (CRL) processing
679 CRLs are now handled by the crypto library (OpenSSL or mbed TLS), instead
680 of inside OpenVPN itself. The crypto library implementations are more
681 strict than the OpenVPN implementation was. This might reject peer
682 certificates that would previously be accepted. If this occurs, OpenVPN
683 will log the crypto library's error description.
685 Dualstack round-robin DNS client connect
686 Instead of only using the first address of each ``--remote`` OpenVPN
687 will now try all addresses (IPv6 and IPv4) of a ``--remote`` entry.
689 Support for providing IPv6 DNS servers
690 A new DHCP sub-option ``DNS6`` is added alongside with the already existing
691 ``DNS`` sub-option. This is used to provide DNS resolvers available over
692 IPv6. This may be pushed to clients where `` --up`` scripts and ``--plugin``
693 can act upon it through the ``foreign_option_<n>`` environment variables.
695 Support for the Windows client picking up this new sub-option is added,
696 however IPv6 DNS resolvers need to be configured via ``netsh`` which requires
697 administrator privileges unless the new interactive services on Windows is
698 being used. If the interactive service is used, this service will execute
699 ``netsh`` in the background with the proper privileges.
701 New improved Windows Background service
702 The new OpenVPNService is based on openvpnserv2, a complete rewrite of the OpenVPN
703 service wrapper. It is intended for launching OpenVPN instances that should be
704 up at all times, instead of being manually launched by a user. OpenVPNService is
705 able to restart individual OpenVPN processes if they crash, and it also works
706 properly on recent Windows versions. OpenVPNServiceLegacy tends to work poorly,
707 if at all, on newer Windows versions (8+) and its use is not recommended.
709 New interactive Windows service
710 The installer starts OpenVPNServiceInteractive automatically and configures
711 it to start at system startup.
713 The interactive Windows service allows unprivileged users to start
714 OpenVPN connections in the global config directory (usually
715 C:\\Program Files\\OpenVPN\\config) using OpenVPN GUI without any
718 Users who belong to the built-in Administrator group or to the
719 local "OpenVPN Administrator" group can also store configuration
720 files under %USERPROFILE%\\OpenVPN\\config for use with the
723 redirect-gateway ipv6
724 OpenVPN has now feature parity between IPv4 and IPv6 for redirect
725 gateway including the handling of overlapping IPv6 routes with
726 IPv6 remote VPN server address.
728 LZ4 Compression and pushable compression
729 Additionally to LZO compression OpenVPN now also supports LZ4 compression.
730 Compression options are now pushable from the server.
732 Filter pulled options client-side: pull-filter
733 New option to explicitly allow or reject options pushed by the server.
734 May be used multiple times and is applied in the order specified.
736 Per-client remove push options: push-remove
737 New option to remove options on a per-client basis from the "push" list
738 (more fine-grained than ``--push-reset``).
740 Http proxy password inside config file
741 Http proxy passwords can be specified with the inline file option
742 ``<http-proxy-user-pass>`` .. ``</http-proxy-user-pass>``
744 Windows version detection
745 Windows version is detected, logged and possibly signalled to server
746 (IV_PLAT_VER=<nn> if ``--push-peer-info`` is set on client).
748 Authentication tokens
749 In situations where it is not suitable to save user passwords on the client,
750 OpenVPN has support for pushing a --auth-token since v2.3. This option is
751 pushed from the server to the client with a token value to be used instead
752 of the users password. For this to work, the authentication plug-in would
753 need to implement this support as well. In OpenVPN 2.4 --auth-gen-token
754 is introduced, which will allow the OpenVPN server to generate a random
755 token and push it to the client without any changes to the authentication
756 modules. When the clients need to re-authenticate the OpenVPN server will
757 do the authentication internally, instead of sending the re-authentication
758 request to the authentication module . This feature is especially
759 useful in configurations which use One Time Password (OTP) authentication
760 schemes, as this allows the tunnel keys to be renegotiated regularly without
761 any need to supply new OTP codes.
763 keying-material-exporter
764 Keying Material Exporter [RFC-5705] allow additional keying material to be
765 derived from existing TLS channel.
767 Android platform support
768 Support for running on Android using Android's VPNService API has been added.
769 See doc/android.txt for more details. This support is primarily used in
770 the OpenVPN for Android app (https://github.com/schwabe/ics-openvpn)
773 AIX platform support has been added. The support only includes tap
774 devices since AIX does not provide tun interface.
776 Control channel encryption (``--tls-crypt``)
777 Use a pre-shared static key (like the ``--tls-auth`` key) to encrypt control
778 channel packets. Provides more privacy, some obfuscation and poor-man's
779 post-quantum security.
781 Asynchronous push reply
782 Plug-ins providing support for deferred authentication can benefit from a more
783 responsive authentication where the server sends PUSH_REPLY immediately once
784 the authentication result is ready, instead of waiting for the the client to
785 to send PUSH_REQUEST once more. This requires OpenVPN to be built with
786 ``./configure --enable-async-push``. This is a compile-time only switch.
791 For an up-to-date list of all deprecated options, see this wiki page:
792 https://community.openvpn.net/openvpn/wiki/DeprecatedOptions
794 - ``--key-method 1`` is deprecated in OpenVPN 2.4 and will be removed in v2.5.
795 Migrate away from ``--key-method 1`` as soon as possible. The recommended
796 approach is to remove the ``--key-method`` option from the configuration
797 files, OpenVPN will then use ``--key-method 2`` by default. Note that this
798 requires changing the option in both the client and server side configs.
800 - ``--tls-remote`` is removed in OpenVPN 2.4, as indicated in the v2.3
801 man-pages. Similar functionality is provided via ``--verify-x509-name``,
802 which does the same job in a better way.
804 - ``--compat-names`` and ``--no-name-remapping`` were deprecated in OpenVPN 2.3
805 and will be removed in v2.5. All scripts and plug-ins depending on the old
806 non-standard X.509 subject formatting must be updated to the standardized
807 formatting. See the man page for more information.
809 - ``--no-iv`` is deprecated in OpenVPN 2.4 and will be removed in v2.5.
811 - ``--keysize`` is deprecated in OpenVPN 2.4 and will be removed in v2.6
812 together with the support of ciphers with cipher block size less than
815 - ``--comp-lzo`` is deprecated in OpenVPN 2.4. Use ``--compress`` instead.
817 - ``--ifconfig-pool-linear`` has been deprecated since OpenVPN 2.1 and will be
818 removed in v2.5. Use ``--topology p2p`` instead.
820 - ``--client-cert-not-required`` is deprecated in OpenVPN 2.4 and will be removed
821 in v2.5. Use ``--verify-client-cert none`` for a functional equivalent.
823 - ``--ns-cert-type`` is deprecated in OpenVPN 2.3.18 and v2.4. It will be removed
824 in v2.5. Use the far better ``--remote-cert-tls`` option which replaces this
830 - When using ciphers with cipher blocks less than 128-bits,
831 OpenVPN will complain loudly if the configuration uses ciphers considered
832 weak, such as the SWEET32 attack vector. In such scenarios, OpenVPN will by
833 default renegotiate for each 64MB of transported data (``--reneg-bytes``).
834 This renegotiation can be disabled, but is HIGHLY DISCOURAGED.
836 - For certificate DNs with duplicate fields, e.g. "OU=one,OU=two", both fields
837 are now exported to the environment, where each second and later occurrence
838 of a field get _$N appended to it's field name, starting at N=1. For the
839 example above, that would result in e.g. X509_0_OU=one, X509_0_OU_1=two.
840 Note that this breaks setups that rely on the fact that OpenVPN would
841 previously (incorrectly) only export the last occurrence of a field.
843 - ``proto udp`` and ``proto tcp`` now use both IPv4 and IPv6. The new
844 options ``proto udp4`` and ``proto tcp4`` use IPv4 only.
846 - ``--sndbuf`` and ``--recvbuf`` default now to OS defaults instead of 64k
848 - OpenVPN exits with an error if an option has extra parameters;
849 previously they were silently ignored
851 - ``--tls-auth`` always requires OpenVPN static key files and will no
852 longer work with free form files
854 - ``--proto udp6/tcp6`` in server mode will now try to always listen to
855 both IPv4 and IPv6 on platforms that allow it. Use ``--bind ipv6only``
856 to explicitly listen only on IPv6.
858 - Removed ``--enable-password-save`` from configure. This option is now
861 - Stricter default TLS cipher list (override with ``--tls-cipher``), that now
864 * Non-ephemeral key exchange using static (EC)DH keys
867 - mbed TLS builds: changed the tls_digest_N values exported to the script
868 environment to be equal to the ones exported by OpenSSL builds, namely
869 the certificate fingerprint (was the hash of the 'to be signed' data).
871 - mbed TLS builds: minimum RSA key size is now 2048 bits. Shorter keys will
872 not be accepted, both local and from the peer.
874 - ``--connect-timeout`` now specifies the timeout until the first TLS packet
875 is received (identical to ``--server-poll-timeout``) and this timeout now
876 includes the removed socks proxy timeout and http proxy timeout.
878 In ``--static`` mode ``connect-timeout`` specifies the timeout for TCP and
879 proxy connection establishment
881 - ``--connect-retry-max`` now specifies the maximum number of unsuccessful
882 attempts of each remote/connection entry before exiting.
884 - ``--http-proxy-timeout`` and the static non-changeable socks timeout (5s)
885 have been folded into a "unified" ``--connect-timeout`` which covers all
886 steps needed to connect to the server, up to the start of the TLS exchange.
887 The default value has been raised to 120s, to handle slow http/socks
888 proxies graciously. The old "fail TCP fast" behaviour can be achieved by
889 adding "``--connect-timeout 10``" to the client config.
891 - ``--http-proxy-retry`` and ``--sock-proxy-retry`` have been removed. Proxy connections
892 will now behave like regular connection entries and generate a USR1 on failure.
894 - ``--connect-retry`` gets an optional second argument that specifies the maximum
895 time in seconds to wait between reconnection attempts when an exponential
896 backoff is triggered due to repeated retries. Default = 300 seconds.
898 - Data channel cipher negotiation (see New features section) can override
899 ciphers configured in the config file. Use ``--ncp-disable`` if you do not want
902 - All tun devices on all platforms are always considered to be IPv6
903 capable. The ``--tun-ipv6`` option is ignored (behaves like it is always
906 - On the client side recursively routed packets, which have the same destination
907 as the VPN server, are dropped. This can be disabled with
908 --allow-recursive-routing option.
910 - On Windows, when the ``--register-dns`` option is set, OpenVPN no longer
911 restarts the ``dnscache`` service - this had unwanted side effects, and
912 seems to be no longer necessary with currently supported Windows versions.
914 - If no flags are given, and the interactive Windows service is used, "def1"
915 is implicitly set (because "delete and later reinstall the existing
916 default route" does not work well here). If not using the service,
917 the old behaviour is kept.
919 - OpenVPN now reloads a CRL only if the modication time or file size has
920 changed, instead of for each new connection. This reduces the connection
921 setup time, in particular when using large CRLs.
923 - OpenVPN now ships with more up-to-date systemd unit files which take advantage
924 of the improved service management as well as some hardening steps. The
925 configuration files are picked up from the /etc/openvpn/server/ and
926 /etc/openvpn/client/ directories (depending on unit file). This also avoids
927 these new unit files and how they work to collide with older pre-existing
930 - Using ``--no-iv`` (which is generally not a recommended setup) will
931 require explicitly disabling NCP with ``--disable-ncp``. This is
932 intentional because NCP will by default use AES-GCM, which requires
933 an IV - so we want users of that option to consciously reconsider.
936 Maintainer-visible changes
937 --------------------------
938 - OpenVPN no longer supports building with crypto support, but without TLS
939 support. As a consequence, OPENSSL_CRYPTO_{CFLAGS,LIBS} and
940 OPENSSL_SSL_{CFLAGS,LIBS} have been merged into OPENSSL_{CFLAGS,LIBS}. This
941 is particularly relevant for maintainers who build their own OpenSSL library,
942 e.g. when cross-compiling.
944 - Linux distributions using systemd is highly encouraged to ship these new unit
945 files instead of older ones, to provide a unified behaviour across systemd
946 based Linux distributions.
948 - With OpenVPN 2.4, the project has moved over to depend on and actively use
949 the official C99 standard (-std=c99). This may fail on some older compiler/libc
950 header combinations. In most of these situations it is recommended to
951 use -std=gnu99 in CFLAGS. This is known to be needed when doing
952 i386/i686 builds on RHEL5.
960 - The new option ``--tls-cert-profile`` can be used to restrict the set of
961 allowed crypto algorithms in TLS certificates in mbed TLS builds. The
962 default profile is 'legacy' for now, which allows SHA1+, RSA-1024+ and any
963 elliptic curve certificates. The default will be changed to the 'preferred'
964 profile in the future, which requires SHA2+, RSA-2048+ and any curve.
972 - Support building with OpenSSL 1.1 now (in addition to older versions)
974 - On Win10, set low interface metric for TAP adapter when block-outside-dns
975 is in use, to make Windows prefer the TAP adapter for DNS queries
976 (avoiding large delays)
981 - CVE-2017-7522: Fix ``--x509-track`` post-authentication remote DoS
982 A client could crash a v2.4+ mbedtls server, if that server uses the
983 ``--x509-track`` option and the client has a correct, signed and unrevoked
984 certificate that contains an embedded NUL in the certificate subject.
985 Discovered and reported to the OpenVPN security team by Guido Vranken.
987 - CVE-2017-7521: Fix post-authentication remote-triggerable memory leaks
988 A client could cause a server to leak a few bytes each time it connects to the
989 server. That can eventually cause the server to run out of memory, and thereby
990 causing the server process to terminate. Discovered and reported to the
991 OpenVPN security team by Guido Vranken. (OpenSSL builds only.)
993 - CVE-2017-7521: Fix a potential post-authentication remote code execution
994 attack on servers that use the ``--x509-username-field`` option with an X.509
995 extension field (option argument prefixed with ``ext:``). A client that can
996 cause a server to run out-of-memory (see above) might be able to cause the
997 server to double free, which in turn might lead to remote code execution.
998 Discovered and reported to the OpenVPN security team by Guido Vranken.
999 (OpenSSL builds only.)
1001 - CVE-2017-7520: Pre-authentication remote crash/information disclosure for
1002 clients. If clients use a HTTP proxy with NTLM authentication (i.e.
1003 ``--http-proxy <server> <port> [<authfile>|'auto'|'auto-nct'] ntlm2``),
1004 a man-in-the-middle attacker between the client and the proxy can cause
1005 the client to crash or disclose at most 96 bytes of stack memory. The
1006 disclosed stack memory is likely to contain the proxy password. If the
1007 proxy password is not reused, this is unlikely to compromise the security
1008 of the OpenVPN tunnel itself. Clients who do not use the ``--http-proxy``
1009 option with ntlm2 authentication are not affected.
1011 - CVE-2017-7508: Fix remotely-triggerable ASSERT() on malformed IPv6 packet.
1012 This can be used to remotely shutdown an openvpn server or client, if
1013 IPv6 and ``--mssfix`` are enabled and the IPv6 networks used inside the VPN
1016 - Fix null-pointer dereference when talking to a malicious http proxy
1017 that returns a malformed ``Proxy-Authenticate:`` headers for digest auth.
1019 - Fix overflow check for long ``--tls-cipher`` option
1021 - Windows: Pass correct buffer size to ``GetModuleFileNameW()``
1022 (OSTIF/Quarkslabs audit, finding 5.6)
1025 User-visible Changes
1026 --------------------
1027 - ``--verify-hash`` can now take an optional flag which changes the hashing
1028 algorithm. It can be either SHA1 or SHA256. The default if not provided is
1029 SHA1 to preserve backwards compatibility with existing configurations.
1031 - Restrict the supported ``--x509-username-field`` extension fields to subjectAltName
1032 and issuerAltName. Other extensions probably didn't work anyway, and would
1033 cause OpenVPN to crash when a client connects.
1038 - Fix fingerprint calculation in mbed TLS builds. This means that mbed TLS users
1039 of OpenVPN 2.4.0, v2.4.1 and v2.4.2 that rely on the values of the
1040 ``tls_digest_*`` env vars, or that use ``--verify-hash`` will have to change
1041 the fingerprint values they check against. The security impact of the
1042 incorrect calculation is very minimal; the last few bytes (max 4, typically
1043 4) are not verified by the fingerprint. We expect no real-world impact,
1044 because users that used this feature before will notice that it has suddenly
1045 stopped working, and users that didn't will notice that connection setup
1046 fails if they specify correct fingerprints.
1048 - Fix edge case with NCP when the server sends an empty PUSH_REPLY message
1049 back, and the client would not initialize it's data channel crypto layer
1050 properly (trac #903)
1052 - Fix SIGSEGV on unaligned buffer access on OpenBSD/Sparc64
1054 - Fix TCP_NODELAY on OpenBSD
1056 - Remove erroneous limitation on max number of args for ``--plugin``
1058 - Fix NCP behaviour on TLS reconnect (Server would not send a proper
1059 "cipher ..." message back to the client, leading to client and server
1060 using different ciphers) (trac #887)
1068 - Fix memory leak introduced in OpenVPN 2.4.1: if ``--remote-cert-tls`` is
1069 used, we leaked some memory on each TLS (re)negotiation.
1074 - Fix a pre-authentication denial-of-service attack on both clients and
1075 servers. By sending a too-large control packet, OpenVPN 2.4.0 or v2.4.1 can
1076 be forced to hit an ASSERT() and stop the process. If ``--tls-auth`` or
1077 ``--tls-crypt`` is used, only attackers that have the ``--tls-auth`` or
1078 ``--tls-crypt`` key can mount an attack.
1079 (OSTIF/Quarkslab audit finding 5.1, CVE-2017-7478)
1081 - Fix an authenticated remote DoS vulnerability that could be triggered by
1082 causing a packet id roll over. An attack is rather inefficient; a peer
1083 would need to get us to send at least about 196 GB of data.
1084 (OSTIF/Quarkslab audit finding 5.2, CVE-2017-7479)
1089 - ``--remote-cert-ku`` now only requires the certificate to have at least the
1090 bits set of one of the values in the supplied list, instead of requiring an
1091 exact match to one of the values in the list.
1092 - ``--remote-cert-tls`` now only requires that a keyUsage is present in the
1093 certificate, and leaves the verification of the value up to the crypto
1094 library, which has more information (i.e. the key exchange method in use)
1095 to verify that the keyUsage is correct.
1096 - ``--ns-cert-type`` is deprecated. Use ``--remote-cert-tls`` instead.
1097 The nsCertType x509 extension is very old, and barely used.
1098 ``--remote-cert-tls`` uses the far more common keyUsage and extendedKeyUsage
1099 extension instead. Make sure your certificates carry these to be able to
1100 use ``--remote-cert-tls``.
projects / thirdparty / openvpn.git / blob