1 Overview of changes in 2.7
2 ==========================
5 ``secret`` support has been removed by default.
6 static key mode (non-TLS) is no longer considered "good and secure enough"
7 for today's requirements. Use TLS mode instead. If deploying a PKI CA
8 is considered "too complicated", using ``--peer-fingerprint`` makes
9 TLS mode about as easy as using ``--secret``.
11 This mode can still be enabled by using
12 ``--allow-deprecated-insecure-static-crypto`` but will be removed in
15 NTLMv1 support has been removed because it is completely insecure.
16 NTLMv2 support is still available, but will removed in a future release.
19 Overview of changes in 2.6
20 ==========================
25 We want to deprecate our old Trac bug tracking system.
26 Please report any issues with this release in GitHub
27 instead: https://github.com/OpenVPN/openvpn/issues
31 Support unlimited number of connection entries and remote entries
33 New management commands to enumerate and list remote entries
34 Use ``remote-entry-count`` and ``remote-entry-get``
35 commands from the management interface to get the number of
36 remote entries and the entries themselves.
38 Keying Material Exporters (RFC 5705) based key generation
39 As part of the cipher negotiation OpenVPN will automatically prefer
40 the RFC5705 based key material generation to the current custom
41 OpenVPN PRF. This feature requires OpenSSL or mbed TLS 2.18+.
43 Compatibility with OpenSSL in FIPS mode
44 OpenVPN will now work with OpenSSL in FIPS mode. Note, no effort
45 has been made to check or implement all the
46 requirements/recommendation of FIPS 140-2. This just allows OpenVPN
47 to be run on a system that be configured OpenSSL in FIPS mode.
49 ``mlock`` will now check if enough memlock-able memory has been reserved,
50 and if less than 100MB RAM are available, use setrlimit() to upgrade
51 the limit. See Trac #1390. Not available on OpenSolaris.
53 Certificate pinning/verify peer fingerprint
54 The ``--peer-fingerprint`` option has been introduced to give users an
55 easy to use alternative to the ``tls-verify`` for matching the
56 fingerprint of the peer. The option takes use a number of allowed
57 SHA256 certificate fingerprints.
59 See the man page section "Small OpenVPN setup with peer-fingerprint"
60 for a tutorial on how to use this feature. This is also available online
61 under https://github.com/openvpn/openvpn/blob/master/doc/man-sections/example-fingerprint.rst
63 TLS mode with self-signed certificates
64 When ``--peer-fingerprint`` is used, the ``--ca`` and ``--capath`` option
65 become optional. This allows for small OpenVPN setups without setting up
66 a PKI with Easy-RSA or similar software.
68 Deferred auth support for scripts
69 The ``--auth-user-pass-verify`` script supports now deferred authentication.
71 Pending auth support for plugins and scripts
72 Both auth plugin and script can now signal pending authentication to
73 the client when using deferred authentication. The new ``client-crresponse``
74 script option and ``OPENVPN_PLUGIN_CLIENT_CRRESPONSE`` plugin function can
75 be used to parse a client response to a ``CR_TEXT`` two factor challenge.
77 See ``sample/sample-scripts/totpauth.py`` for an example.
79 Compatibility mode (``--compat-mode``)
80 The modernisation of defaults can impact the compatibility of OpenVPN 2.6.0
81 with older peers. The options ``--compat-mode`` allows UIs to provide users
82 with an easy way to still connect to older servers.
85 OpenSSL 3.0 has been added. Most of OpenSSL 3.0 changes are not user visible but
86 improve general compatibility with OpenSSL 3.0. ``--tls-cert-profile insecure``
87 has been added to allow selecting the lowest OpenSSL security level (not
88 recommended, use only if you must). OpenSSL 3.0 no longer supports the Blowfish
89 (and other deprecated) algorithm by default and the new option ``--providers``
90 allows loading the legacy provider to renable these algorithms.
92 Optional ciphers in ``--data-ciphers``
93 Ciphers in ``--data-ciphers`` can now be prefixed with a ``?`` to mark
94 those as optional and only use them if the SSL library supports them.
97 Improved ``--mssfix`` and ``--fragment`` calculation
98 The ``--mssfix`` and ``--fragment`` options now allow an optional :code:`mtu`
99 parameter to specify that different overhead for IPv4/IPv6 should taken into
100 account and the resulting size is specified as the total size of the VPN packets
101 including IP and UDP headers.
103 Cookie based handshake for UDP server
104 Instead of allocating a connection for each client on the initial packet
105 OpenVPN server will now use an HMAC based cookie as its session id. This
106 way the server can verify it on completing the handshake without keeping
107 state. This eliminates the amplification and resource exhaustion attacks.
108 For tls-crypt-v2 clients, this requires OpenVPN 2.6 clients or later
109 because the client needs to resend its client key on completing the hand
110 shake. The tls-crypt-v2 option allows controlling if older clients are
113 By default the rate of initial packet responses is limited to 100 per 10s
114 interval to avoid OpenVPN servers being abused in reflection attacks
115 (see ``--connect-freq-initial``).
117 Data channel offloading with ovpn-dco
118 2.6.0+ implements support for data-channel offloading where the data packets
119 are directly processed and forwarded in kernel space thanks to the ovpn-dco
120 kernel module. The userspace openvpn program acts purely as a control plane
121 application. Note that DCO will use DATA_V2 packets in P2P mode, therefore,
122 this implies that peers must be running 2.6.0+ in order to have P2P-NCP
123 which brings DATA_V2 packet support.
126 It is now possible to terminate a session (or all) after a specified amount
127 of seconds has passed session commencement. This behaviour can be configured
128 using ``--session-timeout``. This option can be configured on the server, on
129 the client or can also be pushed.
131 Inline auth username and password
132 Username and password can now be specified inline in the configuration file
133 within the <auth-user-pass></auth-user-pass> tags. If the password is
134 missing OpenVPN will prompt for input via stdin. This applies to inline'd
135 http-proxy-user-pass too.
137 Tun MTU can be pushed
138 The client can now also dynamically configure its MTU and the server
139 will try to push the client MTU when the client supports it. The
140 directive ``--tun-mtu-max`` has been introduced to increase the maximum
141 pushable MTU size (defaults to 1600).
144 When both peers are OpenVPN 2.6.1+, OpenVPN will dynamically create
145 a tls-crypt key that is used for renegotiation. This ensure that only the
146 previously authenticated peer can do trigger renegotiation and complete
149 Improved control channel packet size control (``max-packet-size``)
150 The size of control channel is no longer tied to
151 ``--link-mtu``/``--tun-mtu`` and can be set using ``--max-packet-size``.
152 Sending large control channel frames is also optimised by allowing 6
153 outstanding packets instead of just 4. ``max-packet-size`` will also set
154 ``mssfix`` to try to limit data-channel packets as well.
158 ``inetd`` has been removed
159 This was a very limited and not-well-tested way to run OpenVPN, on TCP
162 ``verify-hash`` has been deprecated
163 This option has very limited usefulness and should be replaced by either
164 a better ``--ca`` configuration or with a ``--tls-verify`` script.
166 ``secret`` has been deprecated
167 static key mode (non-TLS) is no longer considered "good and secure enough"
168 for today's requirements. Use TLS mode instead. If deploying a PKI CA
169 is considered "too complicated", using ``--peer-fingerprint`` makes
170 TLS mode about as easy as using ``--secret``.
172 ``ncp-disable`` has been removed
173 This option mainly served a role as debug option when NCP was first
174 introduced. It should now no longer be necessary.
176 TLS 1.0 and 1.1 are deprecated
177 ``tls-version-min`` is set to 1.2 by default. OpenVPN 2.6.0 defaults
178 to a minimum TLS version of 1.2 as TLS 1.0 and 1.1 should be generally
179 avoided. Note that OpenVPN versions older than 2.3.7 use TLS 1.0 only.
181 ``--cipher`` argument is no longer appended to ``--data-ciphers``
182 by default. Data cipher negotiation has been introduced in 2.4.0
183 and been significantly improved in 2.5.0. The implicit fallback
184 to the cipher specified in ``--cipher`` has been removed.
185 Effectively, ``--cipher`` is a no-op in TLS mode now, and will
186 only have an effect in pre-shared-key mode (``--secret``).
187 From now on ``--cipher`` should not be used in new configurations
189 Should backwards compatibility with older OpenVPN peers be
190 required, please see the ``--compat-mode`` instead.
192 ``--prng`` has beeen removed
193 OpenVPN used to implement its own PRNG based on a hash. However implementing
194 a PRNG is better left to a crypto library. So we use the PRNG
195 mbed TLS or OpenSSL now.
197 ``--keysize`` has been removed
198 The ``--keysize`` option was only useful to change the key length when using the
199 BF, CAST6 or RC2 ciphers. For all other ciphers the key size is fixed with the
200 chosen cipher. As OpenVPN v2.6 no longer supports any of these variable length
201 ciphers, this option was removed as well to avoid confusion.
203 Compression no longer enabled by default
204 Unless an explicit compression option is specified in the configuration,
205 ``--allow-compression`` defaults to ``no`` in OpeNVPN 2.6.0.
206 By default, OpenVPN 2.5 still allowed a server to enable compression by
207 pushing compression related options.
209 PF (Packet Filtering) support has been removed
210 The built-in PF functionality has been removed from the code base. This
211 feature wasn't really easy to use and was long unmaintained.
212 This implies that also ``--management-client-pf`` and any other compile
213 time or run time related option do not exist any longer.
215 Option conflict checking is being deprecated and phased out
216 The static option checking (OCC) is no longer useful in typical setups
217 that negotiate most connection parameters. The ``--opt-verify`` and
218 ``--occ-disable`` options are deprecated, and the configure option
219 ``--enable-strict-options`` has been removed. Logging of mismatched
220 options has been moved to debug logging (verb 7).
224 - CHACHA20-POLY1305 is included in the default of ``--data-ciphers`` when available.
225 - Option ``--prng`` is ignored as we rely on the SSL library random number generator.
226 - Option ``--nobind`` is default when ``--client`` or ``--pull`` is used in the configuration
227 - :code:`link_mtu` parameter is removed from environment or replaced with 0 when scripts are
228 called with parameters. This parameter is unreliable and no longer internally calculated.
230 - control channel packet maximum size is no longer influenced by
231 ``--link-mtu``/``--tun-mtu`` and must be set by ``--max-packet-size`` now.
232 The default is 1250 for the control channel size.
234 - In point-to-point OpenVPN setups (no ``--server``), using
235 ``--explict-exit-notiy`` on one end would terminate the other side at
236 session end. This is considered a no longer useful default and has
237 been changed to "restart on reception of explicit-exit-notify message".
238 If the old behaviour is still desired, ``--remap-usr1 SIGTERM`` can be used.
240 - FreeBSD tun interfaces with ``--topology subnet`` are now put into real
241 subnet mode (IFF_BROADCAST instead of IFF_POINTOPOINT) - this might upset
242 software that enumerates interfaces, looking for "broadcast capable?" and
243 expecting certain results. Normal uses should not see any difference.
245 - The default configurations will no longer allow connections to OpenVPN 2.3.x
246 peer or earlier, use the new ``--compat-mode`` option if you need
247 compatibility with older versions. See the manual page on the
248 ``--compat-mode`` for details.
250 - The ``client-pending-auth`` management command now requires also the
251 key id. The management version has been changed to 5 to indicate this change.
253 - (OpenVPN 2.6.2) A client will now refuse a connection if pushed compression
254 settings will contradict the setting of allow-compression as this almost
255 always results in a non-working connection.
257 Common errors with OpenSSL 3.0 and OpenVPN 2.6
258 ----------------------------------------------
259 Both OpenVPN 2.6 and OpenSSL 3.0 tighten the security considerable, so some
260 configuration will no longer work. This section will cover the most common
261 causes and error message we have seen and explain their reason and temporary
262 workarounds. You should fix the underlying problems as soon as possible since
263 these workaround are not secure and will eventually stop working in a future
266 - weak SHA1 or MD5 signature on certificates
268 This will happen on either loading of certificates or on connection
271 OpenSSL: error:0A00018E:SSL routines::ca md too weak
272 Cannot load certificate file cert.crt
273 Exiting due to fatal error
275 OpenSSL 3.0 no longer allows weak signatures on certificates. You can
276 downgrade your security to allow them by using ``--tls-cert-profile insecure``
277 but should replace/regenerate these certificates as soon as possible.
280 - 1024 bit RSA certificates, 1024 bit DH parameters, other weak keys
282 This happens if you use private keys or other cryptographic material that
283 does not meet today's cryptographic standards anymore. Messages are similar
286 OpenSSL: error:0A00018F:SSL routines::ee key too small
287 OpenSSL: error:1408518A:SSL routines:ssl3_ctx_ctrl:dh key too small
289 DH parameters (``--dh``) can be regenerated with ``openssl dhparam 2048``.
290 For other cryptographic keys, these keys and certificates need to be
291 regenerated. TLS Security level can be temporarily lowered with
292 ``--tls-cert-profile legacy`` or even ``--tls-cert-profile insecure``.
294 - Connecting to a OpenVPN 2.3.x server or allowing OpenVPN 2.3.x or earlier
297 This will normally result in messages like::
299 OPTIONS ERROR: failed to negotiate cipher with server. Add the server's cipher ('AES-128-CBC') to --data-ciphers (currently 'AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305') if you want to connect to this server.
303 client/127.0.0.1:49954 SENT CONTROL [client]: 'AUTH_FAILED,Data channel cipher negotiation failed (no shared cipher)' (status=1)
305 You can manually add the missing cipher to the ``--data-ciphers``. The
306 standard ciphers should be included as well, e.g.
307 ``--data-ciphers AES-256-GCM:AES-128-GCM:?Chacha20-Poly1305:?AES-128-CBC``.
308 You can also use the ``--compat-mode`` option. Note that these message may
309 also indicate other cipher configuration problems. See the data channel
310 cipher negotiation manual section for more details. (Available online under
311 https://github.com/OpenVPN/openvpn/blob/master/doc/man-sections/cipher-negotiation.rst)
313 - Use of a legacy or deprecated cipher (e.g. 64bit block ciphers)
315 OpenSSL 3.0 no longer supports a number of insecure and outdated ciphers in
316 its default configuration. Some of these ciphers are known to be vulnerable (SWEET32 attack).
318 This will typically manifest itself in messages like::
320 OpenSSL: error:0308010C:digital envelope routines::unsupported
321 Cipher algorithm 'BF-CBC' not found
322 Unsupported cipher in --data-ciphers: BF-CBC
324 If your OpenSSL distribution comes with the legacy provider (see
325 also ``man OSSL_PROVIDER-legacy``), you can load it with
326 ``--providers legacy default``. This will re-enable the old algorithms.
328 - OpenVPN version not supporting TLS 1.2 or later
330 The default in OpenVPN 2.6 and also in many distributions is now TLS 1.2 or
331 later. Connecting to a peer that does not support this will results in
334 TLS error: Unsupported protocol. This typically indicates that client and
335 server have no common TLS version enabled. This can be caused by mismatched
336 tls-version-min and tls-version-max options on client and server. If your
337 OpenVPN client is between v2.3.6 and v2.3.2 try adding tls-version-min 1.0
338 to the client configuration to use TLS 1.0+ instead of TLS 1.0 only
339 OpenSSL: error:0A000102:SSL routines::unsupported protocol
341 This can be an OpenVPN 2.3.6 or earlier version. ``compat-version 2.3.0`` will
342 enable TLS 1.0 support if supported by the OpenSSL distribution. Note that
343 on some Linux distributions enabling TLS 1.1 or 1.0 is not possible.
347 Overview of changes in 2.5
348 ==========================
352 Client-specific tls-crypt keys (``--tls-crypt-v2``)
353 ``tls-crypt-v2`` adds the ability to supply each client with a unique
354 tls-crypt key. This allows large organisations and VPN providers to profit
355 from the same DoS and TLS stack protection that small deployments can
356 already achieve using ``tls-auth`` or ``tls-crypt``.
358 ChaCha20-Poly1305 cipher support
359 Added support for using the ChaCha20-Poly1305 cipher in the OpenVPN data
362 Improved Data channel cipher negotiation
363 The option ``ncp-ciphers`` has been renamed to ``data-ciphers``.
364 The old name is still accepted. The change in name signals that
365 ``data-ciphers`` is the preferred way to configure data channel
366 ciphers and the data prefix is chosen to avoid the ambiguity that
367 exists with ``--cipher`` for the data cipher and ``tls-cipher``
370 OpenVPN clients will now signal all supported ciphers from the
371 ``data-ciphers`` option to the server via ``IV_CIPHERS``. OpenVPN
372 servers will select the first common cipher from the ``data-ciphers``
373 list instead of blindly pushing the first cipher of the list. This
374 allows to use a configuration like
375 ``data-ciphers ChaCha20-Poly1305:AES-256-GCM`` on the server that
376 prefers ChaCha20-Poly1305 but uses it only if the client supports it.
378 See the data channel negotiation section in the manual for more details.
380 Removal of BF-CBC support in default configuration:
381 By default OpenVPN 2.5 will only accept AES-256-GCM and AES-128-GCM as
382 data ciphers. OpenVPN 2.4 allows AES-256-GCM,AES-128-GCM and BF-CBC when
383 no --cipher and --ncp-ciphers options are present. Accepting BF-CBC can be
386 data-ciphers AES-256-GCM:AES-128-GCM:BF-CBC
388 and when you need to support very old peers also
390 data-ciphers-fallback BF-CBC
392 To offer backwards compatibility with older configs an *explicit*
396 in the configuration will be automatically translated into adding BF-CBC
397 to the data-ciphers option and setting data-ciphers-fallback to BF-CBC
398 (as in the example commands above). We strongly recommend to switching
399 away from BF-CBC to a more secure cipher.
401 Asynchronous (deferred) authentication support for auth-pam plugin.
402 See src/plugins/auth-pam/README.auth-pam for details.
404 Deferred client-connect
405 The ``--client-connect`` option and the connect plugin API allow
406 asynchronous/deferred return of the configuration file in the same way
409 Faster connection setup
410 A client will signal in the ``IV_PROTO`` variable that it is in pull
411 mode. This allows the server to push the configuration options to
412 the client without waiting for a ``PULL_REQUEST`` message. The feature
413 is automatically enabled if both client and server support it and
414 significantly reduces the connection setup time by avoiding one
415 extra packet round-trip and 1s of internal event delays.
418 On Linux, if configured without ``--enable-iproute2``, configuring IP
419 addresses and adding/removing routes is now done via the netlink(3)
420 kernel interface. This is much faster than calling ``ifconfig`` or
421 ``route`` and also enables OpenVPN to run with less privileges.
423 If configured with --enable-iproute2, the ``ip`` command is used
424 (as in 2.4). Support for ``ifconfig`` and ``route`` is gone.
427 On Windows, OpenVPN can now use ``wintun`` devices. They are faster
428 than the traditional ``tap9`` tun/tap devices, but do not provide
429 ``--dev tap`` mode - so the official installers contain both. To use
430 a wintun device, add ``--windows-driver wintun`` to your config
431 (and use of the interactive service is required as wintun needs
432 SYSTEM privileges to enable access).
435 It is now possible to have only IPv6 addresses inside the VPN tunnel,
436 and IPv6-only address pools (2.4 always required IPv4 config/pools
437 and IPv6 was the "optional extra").
439 Improved Windows 10 detection
440 Correctly log OS on Windows 10 now.
443 Using the new ``--bind-dev`` option, the OpenVPN outside socket can
444 now be put into a Linux VRF. See the "Virtual Routing and Forwarding"
445 documentation in the man page.
448 TLS 1.3 support has been added to OpenVPN. Currently, this requires
450 The options ``--tls-ciphersuites`` and ``--tls-groups`` have been
451 added to fine tune TLS protocol options. Most of the improvements
452 were also backported to OpenVPN 2.4 as part of the maintainance
455 Support setting DHCP search domain
456 A new option ``--dhcp-option DOMAIN-SEARCH my.example.com`` has been
457 defined, and Windows support for it is implemented (tun/tap only, no
458 wintun support yet). Other platforms need to support this via ``--up``
459 script (Linux) or GUI (OSX/Tunnelblick).
461 per-client changing of ``--data-ciphers`` or ``data-ciphers-fallback``
462 from client-connect script/dir (NOTE: this only changes preference of
463 ciphers for NCP, but can not override what the client announces as
466 Handle setting of tun/tap interface MTU on Windows
467 If IPv6 is in use, MTU must be >= 1280 (Windows enforces IETF requirements)
469 Add support for OpenSSL engines to access private key material (like TPM).
471 HMAC based auth-token support
472 The ``--auth-gen-token`` support has been improved and now generates HMAC
473 based user token. If the optional ``--auth-gen-token-secret`` option is
474 used clients will be able to seamlessly reconnect to a different server
475 using the same secret file or to the same server after a server restart.
477 Improved support for pending authentication
478 The protocol has been enhanced to be able to signal that
479 the authentication should use a secondary authentication
480 via web (like SAML) or a two factor authentication without
481 disconnecting the OpenVPN session with AUTH_FAILED. The
482 session will instead be stay in a authenticated state and
483 wait for the second factor authentication to complete.
485 This feature currently requires usage of the managent interface
486 on both client and server side. See the `management-notes.txt`
487 ``client-pending-auth`` and ``cr-response`` commands for more
491 OpenVPN servers in TAP mode can now use 802.1q tagged VLANs
492 on the TAP interface to separate clients into different groups
493 that can then be handled differently (different subnets / DHCP,
494 firewall zones, ...) further down the network. See the new
495 options ``--vlan-tagging``, ``--vlan-accept``, ``--vlan-pvid``.
497 802.1q tagging on the client side TAP interface is not handled
498 today (= tags are just forwarded transparently to the server).
500 Support building of .msi installers for Windows
502 Allow unicode search string in ``--cryptoapicert`` option (Windows)
504 Support IPv4 configs with /31 netmasks now
505 (By no longer trying to configure ``broadcast x.x.x.x'' in
506 ifconfig calls, /31 support "just works")
508 New option ``--block-ipv6`` to reject all IPv6 packets (ICMPv6)
509 this is useful if the VPN service has no IPv6, but the clients
510 might have (LAN), to avoid client connections to IPv6-enabled
511 servers leaking "around" the IPv4-only VPN.
513 ``--ifconfig-ipv6`` and ``--ifconfig-ipv6-push`` will now accept
514 hostnames and do a DNS lookup to get the IPv6 address to use
519 For an up-to-date list of all deprecated options, see this wiki page:
520 https://community.openvpn.net/openvpn/wiki/DeprecatedOptions
522 - ``ncp-disable`` has been deprecated
523 With the improved and matured data channel cipher negotiation, the use
524 of ``ncp-disable`` should not be necessary anymore.
526 - ``inetd`` has been deprecated
527 This is a very limited and not-well-tested way to run OpenVPN, on TCP
528 and TAP mode only, which complicates the code quite a bit for little gain.
529 To be removed in OpenVPN 2.6 (unless users protest).
531 - ``no-iv`` has been removed
532 This option was made into a NOOP option with OpenVPN 2.4. This has now
533 been completely removed.
535 - ``--client-cert-not-required`` has been removed
536 This option will now cause server configurations to not start. Use
537 ``--verify-client-cert none`` instead.
539 - ``--ifconfig-pool-linear`` has been removed
540 This option is removed. Use ``--topology p2p`` or ``--topology subnet``
543 - ``--compress xxx`` is considered risky and is warned against, see below.
545 - ``--key-method 1`` has been removed
550 - If multiple connect handlers are used (client-connect, ccd, connect
551 plugin) and one of the handler succeeds but a subsequent fails, the
552 client-disconnect-script is now called immediately. Previously it
553 was called, when the VPN session was terminated.
555 - Support for building with OpenSSL 1.0.1 has been removed. The minimum
556 supported OpenSSL version is now 1.0.2.
558 - The GET_CONFIG management state is omitted if the server pushes
559 the client configuration almost immediately as result of the
560 faster connection setup feature.
562 - ``--compress`` is nowadays considered risky, because attacks exist
563 leveraging compression-inside-crypto to reveal plaintext (VORACLE). So
564 by default, ``--compress xxx`` will now accept incoming compressed
565 packets (for compatibility with peers that have not been upgraded yet),
566 but will not use compression outgoing packets. This can be controlled with
567 the new option ``--allow-compression yes|no|asym``.
569 - Stop changing ``--txlen`` aways from OS defaults unless explicitly specified
570 in config file. OS defaults nowadays are actually larger then what we used
571 to configure, so our defaults sometimes caused packet drops = bad performance.
573 - remove ``--writepid`` pid file on exit now
575 - plugin-auth-pam now logs via OpenVPN logging method, no longer to stderr
576 (this means you'll have log messages in syslog or openvpn log file now)
578 - use ISO 8601 time format for file based logging now (YYYY-MM-DD hh:mm:dd)
579 (syslog is not affected, nor is ``--machine-readable-output``)
581 - ``--clr-verify`` now loads all CRLs if more than one CRL is in the same
582 file (OpenSSL backend only, mbedTLS always did that)
584 - when ``--auth-user-pass file`` has no password, and the management interface
585 is active, query management interface (instead of trying console query,
586 which does not work on windows)
588 - skip expired certificates in Windows certificate store (``--cryptoapicert``)
590 - ``--socks-proxy`` + ``--proto udp*`` will now allways use IPv4, even if
591 IPv6 is requested and available. Our SOCKS code does not handle IPv6+UDP,
592 and before that change it would just fail in non-obvious ways.
594 - TCP listen() backlog queue is now set to 32 - this helps TCP servers that
595 receive lots of "invalid" connects by TCP port scanners
597 - do no longer print OCC warnings ("option mismatch") about ``key-method``,
598 ``keydir``, ``tls-auth`` and ``cipher`` - these are either gone now, or
599 negotiated, and the warnings do not serve a useful purpose.
601 - ``dhcp-option DNS`` and ``dhcp-option DNS6`` are now treated identically
602 (= both accept an IPv4 or IPv6 address for the nameserver)
605 Maintainer-visible changes
606 --------------------------
607 - the man page is now in maintained in .rst format, so building the openvpn.8
608 manpage from a git checkout now requires python-docutils (if this is missing,
609 the manpage will not be built - which is not considered an error generally,
610 but for package builders or ``make distcheck`` it is). Release tarballs
611 contain the openvpn.8 file, so unless some .rst is changed, doc-utils are
612 not needed for building.
614 - OCC support can no longer be disabled
616 - AEAD support is now required in the crypto library
618 - ``--disable-server`` has been removed from configure (so it is no longer
619 possible to build a client-/p2p-only OpenVPN binary) - the saving in code
620 size no longer outweighs the extra maintenance effort.
622 - ``--enable-iproute2`` will disable netlink(3) support, so maybe remove
623 that from package building configs (see above)
625 - support building with MSVC 2019
627 - cmocka based unit tests are now only run if cmocka is installed externally
628 (2.4 used to ship a local git submodule which was painful to maintain)
630 - ``--disable-crypto`` configure option has been removed. OpenVPN is now always
631 built with crypto support, which makes the code much easier to maintain.
632 This does not affect ``--cipher none`` to do a tunnel without encryption.
634 - ``--disable-multi`` configure option has been removed
638 Overview of changes in 2.4
639 ==========================
644 Seamless client IP/port floating
645 Added new packet format P_DATA_V2, which includes peer-id. If both the
646 server and client support it, the client sends all data packets in
647 the new format. When a data packet arrives, the server identifies peer
648 by peer-id. If peer's ip/port has changed, server assumes that
649 client has floated, verifies HMAC and updates ip/port in internal structs.
650 This allows the connection to be immediately restored, instead of requiring
651 a TLS handshake before the server accepts packets from the new client
654 Data channel cipher negotiation
655 Data channel ciphers (``--cipher``) are now by default negotiated. If a
656 client advertises support for Negotiable Crypto Parameters (NCP), the
657 server will choose a cipher (by default AES-256-GCM) for the data channel,
658 and tell the client to use that cipher. Data channel cipher negotiation
659 can be controlled using ``--ncp-ciphers`` and ``--ncp-disable``.
661 A more limited version also works in client-to-server and server-to-client
662 scenarios where one of the end points uses a v2.4 client or server and the
663 other side uses an older version. In such scenarios the v2.4 side will
664 change to the ``--cipher`` set by the remote side, if permitted by by
665 ``--ncp-ciphers``. For example, a v2.4 client with ``--cipher BF-CBC``
666 and ``ncp-ciphers AES-256-GCM:AES-256-CBC`` can connect to both a v2.3
667 server with ``cipher BF-CBC`` as well as a server with
668 ``cipher AES-256-CBC`` in its config. The other way around, a v2.3 client
669 with either ``cipher BF-CBC`` or ``cipher AES-256-CBC`` can connect to a
670 v2.4 server with e.g. ``cipher BF-CBC`` and
671 ``ncp-ciphers AES-256-GCM:AES-256-CBC`` in its config. For this to work
672 it requires that OpenVPN was built without disabling OCC support.
674 AEAD (GCM) data channel cipher support
675 The data channel now supports AEAD ciphers (currently only GCM). The AEAD
676 packet format has a smaller crypto overhead than the CBC packet format,
677 (e.g. 20 bytes per packet for AES-128-GCM instead of 36 bytes per packet
678 for AES-128-CBC + HMAC-SHA1).
681 The TLS control channel now supports for elliptic curve diffie-hellmann
684 Improved Certificate Revocation List (CRL) processing
685 CRLs are now handled by the crypto library (OpenSSL or mbed TLS), instead
686 of inside OpenVPN itself. The crypto library implementations are more
687 strict than the OpenVPN implementation was. This might reject peer
688 certificates that would previously be accepted. If this occurs, OpenVPN
689 will log the crypto library's error description.
691 Dualstack round-robin DNS client connect
692 Instead of only using the first address of each ``--remote`` OpenVPN
693 will now try all addresses (IPv6 and IPv4) of a ``--remote`` entry.
695 Support for providing IPv6 DNS servers
696 A new DHCP sub-option ``DNS6`` is added alongside with the already existing
697 ``DNS`` sub-option. This is used to provide DNS resolvers available over
698 IPv6. This may be pushed to clients where `` --up`` scripts and ``--plugin``
699 can act upon it through the ``foreign_option_<n>`` environment variables.
701 Support for the Windows client picking up this new sub-option is added,
702 however IPv6 DNS resolvers need to be configured via ``netsh`` which requires
703 administrator privileges unless the new interactive services on Windows is
704 being used. If the interactive service is used, this service will execute
705 ``netsh`` in the background with the proper privileges.
707 New improved Windows Background service
708 The new OpenVPNService is based on openvpnserv2, a complete rewrite of the OpenVPN
709 service wrapper. It is intended for launching OpenVPN instances that should be
710 up at all times, instead of being manually launched by a user. OpenVPNService is
711 able to restart individual OpenVPN processes if they crash, and it also works
712 properly on recent Windows versions. OpenVPNServiceLegacy tends to work poorly,
713 if at all, on newer Windows versions (8+) and its use is not recommended.
715 New interactive Windows service
716 The installer starts OpenVPNServiceInteractive automatically and configures
717 it to start at system startup.
719 The interactive Windows service allows unprivileged users to start
720 OpenVPN connections in the global config directory (usually
721 C:\\Program Files\\OpenVPN\\config) using OpenVPN GUI without any
724 Users who belong to the built-in Administrator group or to the
725 local "OpenVPN Administrator" group can also store configuration
726 files under %USERPROFILE%\\OpenVPN\\config for use with the
729 redirect-gateway ipv6
730 OpenVPN has now feature parity between IPv4 and IPv6 for redirect
731 gateway including the handling of overlapping IPv6 routes with
732 IPv6 remote VPN server address.
734 LZ4 Compression and pushable compression
735 Additionally to LZO compression OpenVPN now also supports LZ4 compression.
736 Compression options are now pushable from the server.
738 Filter pulled options client-side: pull-filter
739 New option to explicitly allow or reject options pushed by the server.
740 May be used multiple times and is applied in the order specified.
742 Per-client remove push options: push-remove
743 New option to remove options on a per-client basis from the "push" list
744 (more fine-grained than ``--push-reset``).
746 Http proxy password inside config file
747 Http proxy passwords can be specified with the inline file option
748 ``<http-proxy-user-pass>`` .. ``</http-proxy-user-pass>``
750 Windows version detection
751 Windows version is detected, logged and possibly signalled to server
752 (IV_PLAT_VER=<nn> if ``--push-peer-info`` is set on client).
754 Authentication tokens
755 In situations where it is not suitable to save user passwords on the client,
756 OpenVPN has support for pushing a --auth-token since v2.3. This option is
757 pushed from the server to the client with a token value to be used instead
758 of the users password. For this to work, the authentication plug-in would
759 need to implement this support as well. In OpenVPN 2.4 --auth-gen-token
760 is introduced, which will allow the OpenVPN server to generate a random
761 token and push it to the client without any changes to the authentication
762 modules. When the clients need to re-authenticate the OpenVPN server will
763 do the authentication internally, instead of sending the re-authentication
764 request to the authentication module . This feature is especially
765 useful in configurations which use One Time Password (OTP) authentication
766 schemes, as this allows the tunnel keys to be renegotiated regularly without
767 any need to supply new OTP codes.
769 keying-material-exporter
770 Keying Material Exporter [RFC-5705] allow additional keying material to be
771 derived from existing TLS channel.
773 Android platform support
774 Support for running on Android using Android's VPNService API has been added.
775 See doc/android.txt for more details. This support is primarily used in
776 the OpenVPN for Android app (https://github.com/schwabe/ics-openvpn)
779 AIX platform support has been added. The support only includes tap
780 devices since AIX does not provide tun interface.
782 Control channel encryption (``--tls-crypt``)
783 Use a pre-shared static key (like the ``--tls-auth`` key) to encrypt control
784 channel packets. Provides more privacy, some obfuscation and poor-man's
785 post-quantum security.
787 Asynchronous push reply
788 Plug-ins providing support for deferred authentication can benefit from a more
789 responsive authentication where the server sends PUSH_REPLY immediately once
790 the authentication result is ready, instead of waiting for the the client to
791 to send PUSH_REQUEST once more. This requires OpenVPN to be built with
792 ``./configure --enable-async-push``. This is a compile-time only switch.
797 For an up-to-date list of all deprecated options, see this wiki page:
798 https://community.openvpn.net/openvpn/wiki/DeprecatedOptions
800 - ``--key-method 1`` is deprecated in OpenVPN 2.4 and will be removed in v2.5.
801 Migrate away from ``--key-method 1`` as soon as possible. The recommended
802 approach is to remove the ``--key-method`` option from the configuration
803 files, OpenVPN will then use ``--key-method 2`` by default. Note that this
804 requires changing the option in both the client and server side configs.
806 - ``--tls-remote`` is removed in OpenVPN 2.4, as indicated in the v2.3
807 man-pages. Similar functionality is provided via ``--verify-x509-name``,
808 which does the same job in a better way.
810 - ``--compat-names`` and ``--no-name-remapping`` were deprecated in OpenVPN 2.3
811 and will be removed in v2.5. All scripts and plug-ins depending on the old
812 non-standard X.509 subject formatting must be updated to the standardized
813 formatting. See the man page for more information.
815 - ``--no-iv`` is deprecated in OpenVPN 2.4 and will be removed in v2.5.
817 - ``--keysize`` is deprecated in OpenVPN 2.4 and will be removed in v2.6
818 together with the support of ciphers with cipher block size less than
821 - ``--comp-lzo`` is deprecated in OpenVPN 2.4. Use ``--compress`` instead.
823 - ``--ifconfig-pool-linear`` has been deprecated since OpenVPN 2.1 and will be
824 removed in v2.5. Use ``--topology p2p`` instead.
826 - ``--client-cert-not-required`` is deprecated in OpenVPN 2.4 and will be removed
827 in v2.5. Use ``--verify-client-cert none`` for a functional equivalent.
829 - ``--ns-cert-type`` is deprecated in OpenVPN 2.3.18 and v2.4. It will be removed
830 in v2.5. Use the far better ``--remote-cert-tls`` option which replaces this
836 - When using ciphers with cipher blocks less than 128-bits,
837 OpenVPN will complain loudly if the configuration uses ciphers considered
838 weak, such as the SWEET32 attack vector. In such scenarios, OpenVPN will by
839 default renegotiate for each 64MB of transported data (``--reneg-bytes``).
840 This renegotiation can be disabled, but is HIGHLY DISCOURAGED.
842 - For certificate DNs with duplicate fields, e.g. "OU=one,OU=two", both fields
843 are now exported to the environment, where each second and later occurrence
844 of a field get _$N appended to it's field name, starting at N=1. For the
845 example above, that would result in e.g. X509_0_OU=one, X509_0_OU_1=two.
846 Note that this breaks setups that rely on the fact that OpenVPN would
847 previously (incorrectly) only export the last occurrence of a field.
849 - ``proto udp`` and ``proto tcp`` now use both IPv4 and IPv6. The new
850 options ``proto udp4`` and ``proto tcp4`` use IPv4 only.
852 - ``--sndbuf`` and ``--recvbuf`` default now to OS defaults instead of 64k
854 - OpenVPN exits with an error if an option has extra parameters;
855 previously they were silently ignored
857 - ``--tls-auth`` always requires OpenVPN static key files and will no
858 longer work with free form files
860 - ``--proto udp6/tcp6`` in server mode will now try to always listen to
861 both IPv4 and IPv6 on platforms that allow it. Use ``--bind ipv6only``
862 to explicitly listen only on IPv6.
864 - Removed ``--enable-password-save`` from configure. This option is now
867 - Stricter default TLS cipher list (override with ``--tls-cipher``), that now
870 * Non-ephemeral key exchange using static (EC)DH keys
873 - mbed TLS builds: changed the tls_digest_N values exported to the script
874 environment to be equal to the ones exported by OpenSSL builds, namely
875 the certificate fingerprint (was the hash of the 'to be signed' data).
877 - mbed TLS builds: minimum RSA key size is now 2048 bits. Shorter keys will
878 not be accepted, both local and from the peer.
880 - ``--connect-timeout`` now specifies the timeout until the first TLS packet
881 is received (identical to ``--server-poll-timeout``) and this timeout now
882 includes the removed socks proxy timeout and http proxy timeout.
884 In ``--static`` mode ``connect-timeout`` specifies the timeout for TCP and
885 proxy connection establishment
887 - ``--connect-retry-max`` now specifies the maximum number of unsuccessful
888 attempts of each remote/connection entry before exiting.
890 - ``--http-proxy-timeout`` and the static non-changeable socks timeout (5s)
891 have been folded into a "unified" ``--connect-timeout`` which covers all
892 steps needed to connect to the server, up to the start of the TLS exchange.
893 The default value has been raised to 120s, to handle slow http/socks
894 proxies graciously. The old "fail TCP fast" behaviour can be achieved by
895 adding "``--connect-timeout 10``" to the client config.
897 - ``--http-proxy-retry`` and ``--sock-proxy-retry`` have been removed. Proxy connections
898 will now behave like regular connection entries and generate a USR1 on failure.
900 - ``--connect-retry`` gets an optional second argument that specifies the maximum
901 time in seconds to wait between reconnection attempts when an exponential
902 backoff is triggered due to repeated retries. Default = 300 seconds.
904 - Data channel cipher negotiation (see New features section) can override
905 ciphers configured in the config file. Use ``--ncp-disable`` if you do not want
908 - All tun devices on all platforms are always considered to be IPv6
909 capable. The ``--tun-ipv6`` option is ignored (behaves like it is always
912 - On the client side recursively routed packets, which have the same destination
913 as the VPN server, are dropped. This can be disabled with
914 --allow-recursive-routing option.
916 - On Windows, when the ``--register-dns`` option is set, OpenVPN no longer
917 restarts the ``dnscache`` service - this had unwanted side effects, and
918 seems to be no longer necessary with currently supported Windows versions.
920 - If no flags are given, and the interactive Windows service is used, "def1"
921 is implicitly set (because "delete and later reinstall the existing
922 default route" does not work well here). If not using the service,
923 the old behaviour is kept.
925 - OpenVPN now reloads a CRL only if the modication time or file size has
926 changed, instead of for each new connection. This reduces the connection
927 setup time, in particular when using large CRLs.
929 - OpenVPN now ships with more up-to-date systemd unit files which take advantage
930 of the improved service management as well as some hardening steps. The
931 configuration files are picked up from the /etc/openvpn/server/ and
932 /etc/openvpn/client/ directories (depending on unit file). This also avoids
933 these new unit files and how they work to collide with older pre-existing
936 - Using ``--no-iv`` (which is generally not a recommended setup) will
937 require explicitly disabling NCP with ``--disable-ncp``. This is
938 intentional because NCP will by default use AES-GCM, which requires
939 an IV - so we want users of that option to consciously reconsider.
942 Maintainer-visible changes
943 --------------------------
944 - OpenVPN no longer supports building with crypto support, but without TLS
945 support. As a consequence, OPENSSL_CRYPTO_{CFLAGS,LIBS} and
946 OPENSSL_SSL_{CFLAGS,LIBS} have been merged into OPENSSL_{CFLAGS,LIBS}. This
947 is particularly relevant for maintainers who build their own OpenSSL library,
948 e.g. when cross-compiling.
950 - Linux distributions using systemd is highly encouraged to ship these new unit
951 files instead of older ones, to provide a unified behaviour across systemd
952 based Linux distributions.
954 - With OpenVPN 2.4, the project has moved over to depend on and actively use
955 the official C99 standard (-std=c99). This may fail on some older compiler/libc
956 header combinations. In most of these situations it is recommended to
957 use -std=gnu99 in CFLAGS. This is known to be needed when doing
958 i386/i686 builds on RHEL5.
966 - The new option ``--tls-cert-profile`` can be used to restrict the set of
967 allowed crypto algorithms in TLS certificates in mbed TLS builds. The
968 default profile is 'legacy' for now, which allows SHA1+, RSA-1024+ and any
969 elliptic curve certificates. The default will be changed to the 'preferred'
970 profile in the future, which requires SHA2+, RSA-2048+ and any curve.
978 - Support building with OpenSSL 1.1 now (in addition to older versions)
980 - On Win10, set low interface metric for TAP adapter when block-outside-dns
981 is in use, to make Windows prefer the TAP adapter for DNS queries
982 (avoiding large delays)
987 - CVE-2017-7522: Fix ``--x509-track`` post-authentication remote DoS
988 A client could crash a v2.4+ mbedtls server, if that server uses the
989 ``--x509-track`` option and the client has a correct, signed and unrevoked
990 certificate that contains an embedded NUL in the certificate subject.
991 Discovered and reported to the OpenVPN security team by Guido Vranken.
993 - CVE-2017-7521: Fix post-authentication remote-triggerable memory leaks
994 A client could cause a server to leak a few bytes each time it connects to the
995 server. That can eventually cause the server to run out of memory, and thereby
996 causing the server process to terminate. Discovered and reported to the
997 OpenVPN security team by Guido Vranken. (OpenSSL builds only.)
999 - CVE-2017-7521: Fix a potential post-authentication remote code execution
1000 attack on servers that use the ``--x509-username-field`` option with an X.509
1001 extension field (option argument prefixed with ``ext:``). A client that can
1002 cause a server to run out-of-memory (see above) might be able to cause the
1003 server to double free, which in turn might lead to remote code execution.
1004 Discovered and reported to the OpenVPN security team by Guido Vranken.
1005 (OpenSSL builds only.)
1007 - CVE-2017-7520: Pre-authentication remote crash/information disclosure for
1008 clients. If clients use a HTTP proxy with NTLM authentication (i.e.
1009 ``--http-proxy <server> <port> [<authfile>|'auto'|'auto-nct'] ntlm2``),
1010 a man-in-the-middle attacker between the client and the proxy can cause
1011 the client to crash or disclose at most 96 bytes of stack memory. The
1012 disclosed stack memory is likely to contain the proxy password. If the
1013 proxy password is not reused, this is unlikely to compromise the security
1014 of the OpenVPN tunnel itself. Clients who do not use the ``--http-proxy``
1015 option with ntlm2 authentication are not affected.
1017 - CVE-2017-7508: Fix remotely-triggerable ASSERT() on malformed IPv6 packet.
1018 This can be used to remotely shutdown an openvpn server or client, if
1019 IPv6 and ``--mssfix`` are enabled and the IPv6 networks used inside the VPN
1022 - Fix null-pointer dereference when talking to a malicious http proxy
1023 that returns a malformed ``Proxy-Authenticate:`` headers for digest auth.
1025 - Fix overflow check for long ``--tls-cipher`` option
1027 - Windows: Pass correct buffer size to ``GetModuleFileNameW()``
1028 (OSTIF/Quarkslabs audit, finding 5.6)
1031 User-visible Changes
1032 --------------------
1033 - ``--verify-hash`` can now take an optional flag which changes the hashing
1034 algorithm. It can be either SHA1 or SHA256. The default if not provided is
1035 SHA1 to preserve backwards compatibility with existing configurations.
1037 - Restrict the supported ``--x509-username-field`` extension fields to subjectAltName
1038 and issuerAltName. Other extensions probably didn't work anyway, and would
1039 cause OpenVPN to crash when a client connects.
1044 - Fix fingerprint calculation in mbed TLS builds. This means that mbed TLS users
1045 of OpenVPN 2.4.0, v2.4.1 and v2.4.2 that rely on the values of the
1046 ``tls_digest_*`` env vars, or that use ``--verify-hash`` will have to change
1047 the fingerprint values they check against. The security impact of the
1048 incorrect calculation is very minimal; the last few bytes (max 4, typically
1049 4) are not verified by the fingerprint. We expect no real-world impact,
1050 because users that used this feature before will notice that it has suddenly
1051 stopped working, and users that didn't will notice that connection setup
1052 fails if they specify correct fingerprints.
1054 - Fix edge case with NCP when the server sends an empty PUSH_REPLY message
1055 back, and the client would not initialize it's data channel crypto layer
1056 properly (trac #903)
1058 - Fix SIGSEGV on unaligned buffer access on OpenBSD/Sparc64
1060 - Fix TCP_NODELAY on OpenBSD
1062 - Remove erroneous limitation on max number of args for ``--plugin``
1064 - Fix NCP behaviour on TLS reconnect (Server would not send a proper
1065 "cipher ..." message back to the client, leading to client and server
1066 using different ciphers) (trac #887)
1074 - Fix memory leak introduced in OpenVPN 2.4.1: if ``--remote-cert-tls`` is
1075 used, we leaked some memory on each TLS (re)negotiation.
1080 - Fix a pre-authentication denial-of-service attack on both clients and
1081 servers. By sending a too-large control packet, OpenVPN 2.4.0 or v2.4.1 can
1082 be forced to hit an ASSERT() and stop the process. If ``--tls-auth`` or
1083 ``--tls-crypt`` is used, only attackers that have the ``--tls-auth`` or
1084 ``--tls-crypt`` key can mount an attack.
1085 (OSTIF/Quarkslab audit finding 5.1, CVE-2017-7478)
1087 - Fix an authenticated remote DoS vulnerability that could be triggered by
1088 causing a packet id roll over. An attack is rather inefficient; a peer
1089 would need to get us to send at least about 196 GB of data.
1090 (OSTIF/Quarkslab audit finding 5.2, CVE-2017-7479)
1095 - ``--remote-cert-ku`` now only requires the certificate to have at least the
1096 bits set of one of the values in the supplied list, instead of requiring an
1097 exact match to one of the values in the list.
1098 - ``--remote-cert-tls`` now only requires that a keyUsage is present in the
1099 certificate, and leaves the verification of the value up to the crypto
1100 library, which has more information (i.e. the key exchange method in use)
1101 to verify that the keyUsage is correct.
1102 - ``--ns-cert-type`` is deprecated. Use ``--remote-cert-tls`` instead.
1103 The nsCertType x509 extension is very old, and barely used.
1104 ``--remote-cert-tls`` uses the far more common keyUsage and extendedKeyUsage
1105 extension instead. Make sure your certificates carry these to be able to
1106 use ``--remote-cert-tls``.
projects / thirdparty / openvpn.git / blob