2015-10-15 16:44:58 +02:00
|
|
|
Version 2.4.0
|
|
|
|
|
=============
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
New features
|
|
|
|
|
------------
|
|
|
|
|
|
2016-06-05 23:41:23 +02:00
|
|
|
pull-filter
|
|
|
|
|
New option to explicitly allow or reject options pushed by the server.
|
|
|
|
|
May be used multiple times and is applied in the order specified.
|
|
|
|
|
|
2016-05-16 12:13:04 +02:00
|
|
|
push-remove
|
|
|
|
|
new option to remove options on a per-client basis from the "push" list
|
|
|
|
|
(more fine-grained than "push-reset")
|
|
|
|
|
|
2015-10-15 16:44:58 +02:00
|
|
|
keying-material-exporter
|
|
|
|
|
Keying Material Exporter [RFC-5705] allow additional keying material to be
|
|
|
|
|
derived from existing TLS channel.
|
|
|
|
|
|
|
|
|
|
redirect-gateway ipv6
|
|
|
|
|
OpenVPN has now feature parity between IPv4 and IPv6 for redirect
|
|
|
|
|
gateway including the handling of overlapping IPv6 routes with
|
|
|
|
|
IPv6 remote VPN server address
|
|
|
|
|
|
|
|
|
|
Mac OS X Keychain management client
|
|
|
|
|
add contrib/keychain-mcd which allows to use Mac OS X keychain
|
|
|
|
|
certificates with OpenVPN
|
|
|
|
|
|
|
|
|
|
Peer ID support
|
|
|
|
|
Added new packet format P_DATA_V2, which includes peer-id. If
|
|
|
|
|
server and client support it, client sends all data packets in
|
|
|
|
|
the new format. When data packet arrives, server identifies peer
|
|
|
|
|
by peer-id. If peer's ip/port has changed, server assumes that
|
|
|
|
|
client has floated, verifies HMAC and updates ip/port in internal structs.
|
|
|
|
|
|
|
|
|
|
Dualstack client connect
|
|
|
|
|
Instead of only using the first address of each --remote OpenVPN
|
|
|
|
|
will now try all addresses (IPv6 and IPv4) of a --remote entry.
|
|
|
|
|
|
|
|
|
|
LZ4 Compression
|
|
|
|
|
Additionally to LZO compression OpenVPN now also supports LZ4
|
|
|
|
|
compression.
|
|
|
|
|
|
2015-12-29 22:02:37 +01:00
|
|
|
Windows version
|
|
|
|
|
Windows version is detected, logged and possibly signalled to server
|
|
|
|
|
(IV_PLAT_VER=<nn> if --push-peer-info is set on client)
|
2015-10-15 16:44:58 +02:00
|
|
|
|
Add AEAD cipher support (GCM)
Add Authenticated Encryption with Additional Data (AEAD) support for
ciphers, which removes the need for a separate HMAC step. The MAC is
integrated into the cipher and the MAC tag is prepended to the payload.
This patch is inspired by the patch originally submitted by Kenny Root
on the openvpn-devel mailinglist, but does a number things differently:
* Don't support XTS (makes no sense for VPN)
* Don't support CCM (needs extra code to make it actually work)
* Don't force the user to specify "auth none" (that would break
tls-auth)
* Add support for PolarSSL (and change internal API for this)
* Update openvpn frame size ('link mtu') calculation for AEAD modes
* Use the HMAC key as an implicit part of the IV to save 8 bytes per
data channel network packet.
* Also authenticate the opcode/peer-id as AD in P_DATA_V2 packets.
By using the negotiated HMAC key as an implicit part of the IV for
AEAD-mode ciphers in TLS mode, we can save (at least) 8 bytes on each
packet sent. This is particularly interesting for connections which
transfer many small packets, such as remote desktop or voip connections.
The current AEAD-mode ciphers (for now GCM) are based on CTR-mode cipher
operation, which requires the IV to be unique (but does not require
unpredictability).
IV uniqueness is guaranteed by using a combination of at least 64-bits
of the HMAC key (unique per TLS session), and a 32-bit packet counter.
The last 32-bit word of the 128-bit cipher block is not part of the IV,
but is used as a block counter.
AEAD cipher mode is not available for static key mode, since IV
uniqueness is harder the guarantee over sessions, and I believe
supporting AEAD in static key mode too is not worth the extra
complexity. Modern setups should simply use TLS mode.
OpenSSL 1.0.1-1.0.1c will not work with AEAD mode, because those
versions have an unnecessary check that fails to update the cipher if
the tag was not already set. 1.0.1d, which fixes that, was released in
February 2013. People should have updated, and distros should have
backported the fix by now.
Changes in v2:
* Remove extra code that was just for making OpenSSL 1.0.1-1.0.1c work
in AEAD mode.
* Do not make AEAD support configurable in ./configure.
* Get rid of '12' magic constant in openvpn_encrypt_aead().
* Update manpage to explain that --auth is ignored for the data channel
when using an AEAD cipher.
* Move setting the IV in AEAD cipher modes to the IV generation code.
This is a more natural place and now we can pull iv[] into the IV
generation scope.
* Read packet ID directly from packet buffer instead of from iv buffer,
to remove the need for an extra buffer.
Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <CAA1AbxL_S4umZr5Nd0VTvUvXEHjoWmji18GqM6FgmWqntOKqaA@mail.gmail.com>
URL: http://article.gmane.org/gmane.network.openvpn.devel/11162
Signed-off-by: Gert Doering <gert@greenie.muc.de>
2015-10-24 16:44:09 +02:00
|
|
|
AEAD (GCM) data channel cipher support
|
|
|
|
|
The data channel now supports AEAD ciphers (currently only GCM). The AEAD
|
|
|
|
|
packet format has a smaller overhead than the CBC packet format, (e.g. 20
|
|
|
|
|
bytes per packet for AES-128-GCM instead of 36 bytes per packet for
|
|
|
|
|
AES-128-CBC + HMAC-SHA1).
|
|
|
|
|
|
2016-06-17 14:49:46 +02:00
|
|
|
Http proxy password inside config file
|
|
|
|
|
Http proxy passwords can be specified with the inline file option
|
|
|
|
|
http-proxy-user-pass
|
|
|
|
|
|
2016-06-28 23:36:11 +02:00
|
|
|
Cipher negotiation
|
|
|
|
|
Data channel ciphers are now by default negotiated. If a client advertises
|
|
|
|
|
support for Negotiable Crypto Parameters (NCP), the server will choose a
|
|
|
|
|
cipher (by default AES-256-GCM) for the data channel, and tell the client
|
|
|
|
|
to use that cipher. Data channel cipher negotiation can be controlled
|
|
|
|
|
using --ncp-ciphers and --ncp-disable.
|
|
|
|
|
|
Add AEAD cipher support (GCM)
Add Authenticated Encryption with Additional Data (AEAD) support for
ciphers, which removes the need for a separate HMAC step. The MAC is
integrated into the cipher and the MAC tag is prepended to the payload.
This patch is inspired by the patch originally submitted by Kenny Root
on the openvpn-devel mailinglist, but does a number things differently:
* Don't support XTS (makes no sense for VPN)
* Don't support CCM (needs extra code to make it actually work)
* Don't force the user to specify "auth none" (that would break
tls-auth)
* Add support for PolarSSL (and change internal API for this)
* Update openvpn frame size ('link mtu') calculation for AEAD modes
* Use the HMAC key as an implicit part of the IV to save 8 bytes per
data channel network packet.
* Also authenticate the opcode/peer-id as AD in P_DATA_V2 packets.
By using the negotiated HMAC key as an implicit part of the IV for
AEAD-mode ciphers in TLS mode, we can save (at least) 8 bytes on each
packet sent. This is particularly interesting for connections which
transfer many small packets, such as remote desktop or voip connections.
The current AEAD-mode ciphers (for now GCM) are based on CTR-mode cipher
operation, which requires the IV to be unique (but does not require
unpredictability).
IV uniqueness is guaranteed by using a combination of at least 64-bits
of the HMAC key (unique per TLS session), and a 32-bit packet counter.
The last 32-bit word of the 128-bit cipher block is not part of the IV,
but is used as a block counter.
AEAD cipher mode is not available for static key mode, since IV
uniqueness is harder the guarantee over sessions, and I believe
supporting AEAD in static key mode too is not worth the extra
complexity. Modern setups should simply use TLS mode.
OpenSSL 1.0.1-1.0.1c will not work with AEAD mode, because those
versions have an unnecessary check that fails to update the cipher if
the tag was not already set. 1.0.1d, which fixes that, was released in
February 2013. People should have updated, and distros should have
backported the fix by now.
Changes in v2:
* Remove extra code that was just for making OpenSSL 1.0.1-1.0.1c work
in AEAD mode.
* Do not make AEAD support configurable in ./configure.
* Get rid of '12' magic constant in openvpn_encrypt_aead().
* Update manpage to explain that --auth is ignored for the data channel
when using an AEAD cipher.
* Move setting the IV in AEAD cipher modes to the IV generation code.
This is a more natural place and now we can pull iv[] into the IV
generation scope.
* Read packet ID directly from packet buffer instead of from iv buffer,
to remove the need for an extra buffer.
Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <CAA1AbxL_S4umZr5Nd0VTvUvXEHjoWmji18GqM6FgmWqntOKqaA@mail.gmail.com>
URL: http://article.gmane.org/gmane.network.openvpn.devel/11162
Signed-off-by: Gert Doering <gert@greenie.muc.de>
2015-10-24 16:44:09 +02:00
|
|
|
|
2015-10-15 16:44:58 +02:00
|
|
|
User-visible Changes
|
|
|
|
|
--------------------
|
2015-11-29 10:39:24 +01:00
|
|
|
- For certificate DNs with duplicate fields, e.g. "OU=one,OU=two", both fields
|
|
|
|
|
are now exported to the environment, where each second and later occurrence
|
|
|
|
|
of a field get _$N appended to it's field name, starting at N=1. For the
|
|
|
|
|
example above, that would result in e.g. X509_0_OU=one, X509_0_OU_1=two.
|
|
|
|
|
Note that this breaks setups that rely on the fact that OpenVPN would
|
|
|
|
|
previously (incorrectly) only export the last occurence of a field.
|
|
|
|
|
|
2015-10-15 16:44:58 +02:00
|
|
|
- proto udp and proto tcp specify to use IPv4 and IPv6. The new
|
|
|
|
|
options proto udp4 and tcp4 specify to use IPv4 only.
|
|
|
|
|
|
|
|
|
|
- connect-timeout specifies now the timeout until the first TLS packet
|
|
|
|
|
is received (identical to server-poll-timeout) and this timeout now
|
|
|
|
|
includes the removed socks proxy timeout and http proxy timeout.
|
|
|
|
|
|
|
|
|
|
In --static mode connect-timeout specifies the timeout for TCP and
|
|
|
|
|
proxy connection establishment
|
|
|
|
|
|
2016-07-05 17:32:50 +02:00
|
|
|
- connect-retry-max now specifies the maximum number of unsuccessful
|
|
|
|
|
attempts of each remote/connection entry before exiting.
|
2015-10-15 16:44:58 +02:00
|
|
|
|
|
|
|
|
- sndbuf and recvbuf default now to OS default instead of 64k
|
|
|
|
|
|
|
|
|
|
- OpenVPN exits with an error if an option has extra parameters;
|
|
|
|
|
previously they were silently ignored
|
|
|
|
|
|
|
|
|
|
- The default of tls-cipher is now "DEFAULT:!EXP:!PSK:!SRP:!kRSA"
|
|
|
|
|
instead of "DEFAULT" to always select perfect forward security
|
|
|
|
|
cipher suites
|
|
|
|
|
|
|
|
|
|
- --tls-auth always requires OpenVPN static key files and will no
|
|
|
|
|
longer work with free form files
|
|
|
|
|
|
|
|
|
|
- proto udp6/tcp6 in server mode will now try to always listen to
|
|
|
|
|
both IPv4 and IPv6 on platforms that allow it. Use bind ipv6only
|
|
|
|
|
to explicitly listen only on IPv6.
|
2015-11-29 19:52:24 +01:00
|
|
|
|
|
|
|
|
- Removed --enable-password-save from configure. This option is now
|
|
|
|
|
always enabled.
|
2016-01-10 15:37:19 +01:00
|
|
|
|
2016-04-17 20:32:07 +02:00
|
|
|
- Stricter default TLS cipher list (override with ``--tls-cipher``), that now
|
|
|
|
|
also disables:
|
|
|
|
|
|
|
|
|
|
* Non-ephemeral key exchange using static (EC)DH keys
|
|
|
|
|
* DSS private keys
|
|
|
|
|
|
2016-05-03 22:14:38 +02:00
|
|
|
- mbed TLS builds: changed the tls_digest_N values exported to the script
|
2016-04-04 21:59:38 +02:00
|
|
|
environment to be equal to the ones exported by OpenSSL builds, namely
|
|
|
|
|
the certificate fingerprint (was the hash of the 'to be signed' data).
|
|
|
|
|
|
2016-05-03 22:14:38 +02:00
|
|
|
- mbed TLS builds: minimum RSA key size is now 2048 bits. Shorter keys will
|
|
|
|
|
not be accepted, both local and from the peer.
|
|
|
|
|
|
2016-06-11 16:43:15 +02:00
|
|
|
- --http-proxy-timeout and the static non-changeable socks timeout (5s)
|
|
|
|
|
have been folded into a "unified" --connect-timeout which covers all
|
|
|
|
|
steps needed to connect to the server, up to the start of the TLS exchange.
|
|
|
|
|
The default value has been raised to 120s, to handle slow http/socks
|
|
|
|
|
proxies graciously. The old "fail TCP fast" behaviour can be achieved by
|
|
|
|
|
adding "--connect-timeout 10" to the client config.
|
|
|
|
|
|
2016-06-24 14:27:10 +02:00
|
|
|
- --http-proxy-retry and --sock-proxy-retry have been removed. Proxy connections
|
|
|
|
|
will now behave like regular connection entries and generate a USR1 on failure.
|
2016-04-17 20:32:07 +02:00
|
|
|
|
2016-07-05 17:32:50 +02:00
|
|
|
- --connect-retry gets an optional second argument that specifies the maximum
|
|
|
|
|
time in seconds to wait between reconnection attempts when an exponential
|
|
|
|
|
backoff is triggered due to repeated retries. Default = 300 seconds.
|
|
|
|
|
|
2016-06-28 23:36:11 +02:00
|
|
|
- Data channel cipher negotiation (see New features section) can override
|
|
|
|
|
ciphers configured in the config file. Use --ncp-disable if you don't want
|
|
|
|
|
that.
|
|
|
|
|
|
|
|
|
|
|
2016-01-10 15:37:19 +01:00
|
|
|
Maintainer-visible changes
|
|
|
|
|
--------------------------
|
|
|
|
|
- OpenVPN no longer supports building with crypto support, but without TLS
|
|
|
|
|
support. As a consequence, OPENSSL_CRYPTO_{CFLAGS,LIBS} and
|
|
|
|
|
OPENSSL_SSL_{CFLAGS,LIBS} have been merged into OPENSSL_{CFLAGS,LIBS}. This
|
|
|
|
|
is particularly relevant for maintainers who build their own OpenSSL library,
|
|
|
|
|
e.g. when cross-compiling.
|