Re: [Openvpn-devel] [PATCH v4] Remove tun-ipv6 Option. Instead assume that IPv6 is always supported.

2016-10-13 Thread David Sommerseth
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 12/10/16 11:13, Arne Schwabe wrote: > This option was useful when Ipv6 tun support was non standard and > was an internal/user specified flag that tracked the Ipv6 > capability of the tun device. > > All supported OS support IPv6. Also tun-ipv6 is

Re: [Openvpn-devel] [PATCH v4] Remove tun-ipv6 Option. Instead assume that IPv6 is always supported.

2016-10-13 Thread David Sommerseth
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Please disregard this mail. I will resent it again without getting it destroyed by Engimail's text wrapping. David S. On 13/10/16 17:52, David Sommerseth wrote: > On 12/10/16 11:13, Arne Schwabe wrote: >> This option was useful when Ipv6 tun supp

Re: [Openvpn-devel] [PATCH v4] Remove tun-ipv6 Option. Instead assume that IPv6 is always supported.

2016-10-13 Thread David Sommerseth
On 12/10/16 11:13, Arne Schwabe wrote: > This option was useful when Ipv6 tun support was non standard and was > an internal/user specified flag that tracked the Ipv6 capability of > the tun device. > > All supported OS support IPv6. Also tun-ipv6 is pushable by the > remote so not putting tun-ip

Re: [Openvpn-devel] [PATCH applied] Change the hold command to communicate the time that OpenVPN would wait to the UI.

2016-10-13 Thread David Sommerseth
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Your patch has been applied to the master branch commit 396d30c264e6cb6b9f57c3e566f3b7187662 Author: Arne Schwabe Date: Wed Oct 12 12:47:07 2016 +0200 Change the hold command to communicate the time that OpenVPN would wait to the UI.

Re: [Openvpn-devel] [PATCH applied] Check --ncp-ciphers list on startup

2016-10-13 Thread David Sommerseth
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Your patch has been applied to the master branch commit dc4fa3c4656b92aff3f26d4134c509410add142e Author: Steffan Karger Date: Wed Oct 12 09:32:49 2016 +0200 Check --ncp-ciphers list on startup Signed-off-by: Steffan Karger Acked-by

[Openvpn-devel] [Patch v5] Remove tun-ipv6 Option. Instead assume that IPv6 is always supported.

2016-10-13 Thread Arne Schwabe
This option was useful when Ipv6 tun support was non standard and was an internal/user specified flag that tracked the Ipv6 capability of the tun device. All supported OS support IPv6. Also tun-ipv6 is pushable by the remote so not putting tun-ipv6 does not forbid ipv6 addresses. This commit al

[Openvpn-devel] [PATCH 5/5] auth-gen-token: Authenticate generated auth-tokens when client re-authenticates

2016-10-13 Thread David Sommerseth
On a server with --auth-gen-token enabled, the server will have created a random token and pushed it to the client. When the client needs to renegotiate the connection or otherwise reconnect, it will at this point use the auth-token as password. Here we check if we have a token generated and that

[Openvpn-devel] [PATCH 2/5] auth-gen-token: Add --auth-gen-token option

2016-10-13 Thread David Sommerseth
This sets the flag if the OpenVPN server should create authentication tokens on-the-fly on successful --auth-user-pass-verify or --plugin with OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY processing. If an OpenVPN server is running without this option, it should behave as before. Next patches will implem

[Openvpn-devel] [PATCH 1/5] Move memcmp_constant_time() to crypto.h

2016-10-13 Thread David Sommerseth
This function is quite useful other places, so make it generally accessible. Signed-off-by: David Sommerseth --- src/openvpn/crypto.c | 18 -- src/openvpn/crypto.h | 18 ++ 2 files changed, 18 insertions(+), 18 deletions(-) diff --git a/src/openvpn/crypto.c b/src

[Openvpn-devel] [PATCH 4/5] auth-gen-token: Push generated auth-tokens to the client

2016-10-13 Thread David Sommerseth
If --auth-gen-token has been enabled and a token has been generated, ensure this token is pushed to the client using the 'auth-token' option. Signed-off-by: David Sommerseth --- src/openvpn/misc.c | 5 + src/openvpn/push.c | 9 - src/openvpn/ssl_common.h | 2 ++ 3 files c

[Openvpn-devel] [PATCH 3/5] auth-gen-token: Generate an auth-token per client

2016-10-13 Thread David Sommerseth
When --auth-gen-token is used a random token key is generated for each client after a successful user/password authentication. This token is expected to be returned in the password field on the following authentications. The token is 256 bits long and BASE64 encoded before it is stored. Signed-o

[Openvpn-devel] [PATCH 0/5] New feature: --auth-gen-token

2016-10-13 Thread David Sommerseth
This new feature enables re-authentication of on-going sessions without asking the user for a new password. This is in particular useful when the authentication scheme is based on One Time Passwords (OTP). When OTP is used and without auth-token support in the authentication module OpenVPN is con