After two and a half years since the release of version 2.5, OpenVPN 2.6.0 has been released. This package allows the creation of virtual private networks, enabling encrypted connections between two client machines or facilitating the operation of a centralized VPN server for simultaneous use by multiple clients. The OpenVPN code is distributed under the GPLv2 license, with pre-built binary packages available for Debian, Ubuntu, CentOS, RHEL, and Windows.
Key innovations:
- Support for an unlimited number of connections has been provided.
- Included is the ovpn-dco kernel module, which significantly enhances performance. VPNThe performance improvement is achieved by offloading all encryption operations, packet processing, and channel management to the Linux kernel, eliminating overhead associated with context switching, optimizing operation through direct access to kernel's internal APIs, and avoiding slow data transfer between the kernel and user space (encryption, decryption, and routing are handled by the module without sending traffic to the user space handler).
In tests comparing the configuration based on the tun interface, using the module on both the client and server side with the AES-256-GCM cipher achieved an 8-fold increase in throughput (from 370 Mbit/s to 2950 Mbit/s). When applying the module only on the client side, outbound traffic throughput increased threefold while inbound traffic remained unchanged. When implementing the module only on the server side, inbound traffic throughput increased fourfold and outbound traffic increased by 35%.
- It is now possible to use TLS mode with self-signed certificates (using the '--peer-fingerprint' option allows you to omit the parameters '--ca' and '--capath' and avoid launching a PKI server based on Easy-RSA or similar software).
- A connection negotiation mode based on Cookie has been implemented in the UDP server, where a Cookie based on HMAC is used as the session identifier, allowing the server to perform verification without maintaining state.
- Support for building with OpenSSL 3.0 has been added. The parameter '--tls-cert-profile insecure' has been introduced to select the minimum security level for OpenSSL.
- New management commands remote-entry-count and remote-entry-get have been added to count the number of external connections and display their list.
- During the key agreement process, the more prioritized method for obtaining material for key generation is now the EKM (Exported Keying Material, RFC 5705) mechanism, instead of the specific OpenVPN PRF mechanism. EKM requires the OpenSSL or mbed TLS 2.18+ library.
- Compatibility with OpenSSL in FIPS mode has been ensured, allowing OpenVPN to run on systems that meet FIPS 140-2 security requirements.
- The mlock feature has implemented checks for reserving sufficient memory size. If less than 100 MB of RAM is available, a call to setrlimit() is made to increase the limit.
- The ‘--peer-fingerprint’ option has been added for verifying the correctness or binding of the certificate based on the SHA256 hash fingerprint, without using tls-verify.
- A deferred authentication option has been provided for scripts, implemented using the ‘--auth-user-pass-verify’ option. In scripts and plugins, support has been added to notify the client of pending authentication when using deferred authentication.
- A compatibility mode (‘--compat-mode’) has been added, allowing connections to old servers using OpenVPN 2.3.x or older versions.
- In the list passed via the ‘--data-ciphers’ parameter, the ‘?’ prefix is allowed to specify optional ciphers that will be employed only if supported by SSL-the library.
- The ‘--session-timeout’ option has been added, which allows limiting the maximum session duration.
- It is allowed to specify the username and password in the configuration file using the tag.
- Dynamic client MTU adjustment based on MTU data provided by the server has been made possible. An option ‘--tun-mtu-max’ has been added to change the maximum MTU size (default 1600).
- The ‘--max-packet-size’ parameter has been added to specify the maximum control packet size.
- Support for the OpenVPN startup mode via inetd has been removed. The option ncp-disable has been eliminated. The verify-hash option and static key mode have been marked as deprecated (only TLS is retained). TLS 1.0 and 1.1 protocols have also been deprecated (the tls-version-min parameter is set to 1.2 by default). The built-in pseudorandom number generator implementation (—prng) has been removed; users should utilize PRNG implementations from the mbed TLS or OpenSSL cryptographic libraries. Support for Packet Filtering has been discontinued. Compression is disabled by default (—allow-compression=no).
- CHACHA20-POLY1305 has been added to the default cipher list.
Source: opennet.ru
