After three years since the release of version 2.6, OpenVPN 2.7.0 is ready. This package creates virtual private networks, allowing for encrypted connections between two client machines or providing a centralized VPN server for multiple clients to operate simultaneously. The OpenVPN code is distributed under the GPLv2 license, with pre-built binary packages available for Debian, Ubuntu, CentOS, RHEL, and Windows.
Key innovations:
- At VPNOn servers, it is now possible to open multiple listening sockets, for example, to accept connections simultaneously over UDP and TCP or through different network ports.
- The transition to the new version of the DCO module has been implemented, included in the main Linux kernel 6.16. The module in the main kernel has a modified API and is provided under the name 'ovpn'. Support for the old ovpn-dco module has been discontinued. The module offloads encryption, packet processing, and channel management to the Linux kernel, eliminating context-switching overhead, enabling optimization through direct access to the kernel's internal APIs, and avoiding slow data transfer between the kernel and user space (encryption, decryption, and routing are performed by the module without sending traffic to a user-space handler).
- In the Windows version: the block-local flag has been activated in the WFP filters; additional network interfaces are generated as needed; automatic services are started under non-privileged users; the NRPT (Name Resolution Policy Table) is used for DNS settings; the win-dco driver is allowed to accelerate VPN servers.
- A new format for keys and packets called 'epoch' has been introduced, which, unlike the standard 'DATA_V2' format, adds an AEAD tag to the end of the packet, automatically updates keys upon reaching their usage limit, has 64-bit packet identifiers, and uses XOR operation when forming the initialization vector.
- Support for lwipovpn has been added — an emulator for tun/tap network interfaces in user space, based on the TCP/IP lwIP stack. Using the option "--dev-node unix:/path/to/lwipovpn", a full-fledged VPN client can be emulated on the same system for testing and debugging OpenVPN.
- The ability to update part of the client settings (IP, routing, MTU, DNS) via sending proxy server control messages PUSH_UPDATE has been added.
- The OpenVPN client for Linux, BSD, and macOS has added the option "--dns-updown" for running a script to apply DNS settings provided by the server. The script supports configuration via /etc/resolv.conf, systemd, or resolveconf.
- For the Linux platform, the option "--route-table" has been added for using user-defined routing tables.
- Support for the mbedTLS 4 branch has been implemented. TLS 1.3 support has been added in configurations with the mbedTLS cryptographic library.
- Support for the Haiku operating system has been added.
- Support for static key mode has been discontinued (TLS mode should be used), NTLMv1, Windows driver wintun, OpenSSL 1.0.2, mbedTLS 2.x, data compression before sending, and the options "--memstats" and "--opt-verify".
Source: opennet.ru
