Re: [Openvpn-devel] OpenVPN Connect App on IOS // Support for IPv6-only networks with DNS64/NAT64

2018-07-07 Thread Gert Doering
Hi, On Sat, Jul 07, 2018 at 01:27:23AM +, Kristian McColm wrote: > Is anyone aware of whether the developers of this application > have any experience testing the IOS version of the app on IOS devices > on IPv6-only networks, and moreover are the developers aware of and > ensuring the app is c

[Openvpn-devel] [PATCH v4 1/2] crypto: always reload tls-auth/crypt key contexts

2018-07-07 Thread Antonio Quartulli
In preparation to having tls-auth/crypt keys per connection block, it is important to ensure that such material is always reloaded upon SIGUSR1, no matter if `persist-key` was specified or not. This is required because when moving from one remote to the other the key may change and thus the key co

[Openvpn-devel] [PATCH v4 2/2] make tls-auth and tls-crypt per-connection-block options

2018-07-07 Thread Antonio Quartulli
Different VPN servers may use different tls-auth/crypt keys. For this reason it is convenient to make tls-auth/crypt per-connection-block options so that the user is allowed to specify one key per remote. If no tls-auth/crypt option is specified in a given connection block, the global settings, if

Re: [Openvpn-devel] [PATCH v4 1/2] crypto: always reload tls-auth/crypt key contexts

2018-07-07 Thread Steffan Karger
Hi, On 07-07-18 11:04, Antonio Quartulli wrote: > In preparation to having tls-auth/crypt keys per connection > block, it is important to ensure that such material is always > reloaded upon SIGUSR1, no matter if `persist-key` was specified > or not. > > This is required because when moving from o

Re: [Openvpn-devel] [PATCH v4 2/2] make tls-auth and tls-crypt per-connection-block options

2018-07-07 Thread Steffan Karger
Hi, On 07-07-18 11:04, Antonio Quartulli wrote: > Different VPN servers may use different tls-auth/crypt keys. > For this reason it is convenient to make tls-auth/crypt > per-connection-block options so that the user is allowed to > specify one key per remote. > > If no tls-auth/crypt option is s

Re: [Openvpn-devel] OpenVPN Connect App on IOS // Support for IPv6-only networks with DNS64/NAT64

2018-07-07 Thread Arne Schwabe
Am 07.07.18 um 03:27 schrieb Kristian McColm: > Hello List, > > As you may be aware, the Internet is running/has run out of IPv4 address > space. To that end, I am a part of a team at a national mobile network > operator who are working on deploying IPv6-only mode to our Android and > iPhone ha

Re: [Openvpn-devel] [PATCH v4 1/2] crypto: always reload tls-auth/crypt key contexts

2018-07-07 Thread Antonio Quartulli
Hi, On 07/07/18 20:45, Steffan Karger wrote: > Hi, [cut] >> +static void >> +free_buf_gc(struct buffer *buf, struct gc_arena *gc) >> +{ >> +if (gc) >> +{ >> +struct gc_entry **e = &gc->list; >> + >> +while (*e) >> +{ >> +/* check if this object is the

[Openvpn-devel] [PATCH v5 1/2] crypto: always reload tls-auth/crypt key contexts

2018-07-07 Thread Antonio Quartulli
In preparation to having tls-auth/crypt keys per connection block, it is important to ensure that such material is always reloaded upon SIGUSR1, no matter if `persist-key` was specified or not. This is required because when moving from one remote to the other the key may change and thus the key co

Re: [Openvpn-devel] [PATCH v5 1/2] crypto: always reload tls-auth/crypt key contexts

2018-07-07 Thread Steffan Karger
Hi, Thanks! Great to see the unit tests payed off. Two minor remarks still: On 07-07-18 19:13, Antonio Quartulli wrote: > In preparation to having tls-auth/crypt keys per connection > block, it is important to ensure that such material is always > reloaded upon SIGUSR1, no matter if `persist-ke

Re: [Openvpn-devel] OpenVPN Connect App on IOS // Support for IPv6-only networks with DNS64/NAT64

2018-07-07 Thread Kristian McColm
> -Original Message- > From: Arne Schwabe > Sent: July 7, 2018 09:34 > To: Kristian McColm ; openvpn- > de...@lists.sourceforge.net > Subject: Re: [Openvpn-devel] OpenVPN Connect App on IOS // Support for > IPv6-only networks with DNS64/NAT64 > > Am 07.07.18 um 03:27 schrieb Kristian McCo

Re: [Openvpn-devel] OpenVPN Connect App on IOS // Support for IPv6-only networks with DNS64/NAT64

2018-07-07 Thread Gert Doering
Hi, On Sat, Jul 07, 2018 at 06:55:44PM +, Kristian McColm wrote: > I tried setting "mtu-disc yes" in the VPN server but it didn???t appear to > have any affect. Do you have any advice on how to handle this scenario? mssfix 1300 (won't do anything for large UDP packets inside the tunnel, but

Re: [Openvpn-devel] OpenVPN Connect App on IOS // Support for IPv6-only networks with DNS64/NAT64

2018-07-07 Thread Kristian McColm
> mssfix 1300 > > (won't do anything for large UDP packets inside the tunnel, but will > fix TCP. If you really need large UDP, try --fragment 1400 - but this > needs to be turned on on both sides, OpenVPN server and client, and will > cause some overhead) > Setting link-mtu 1440 fixes it for a

Re: [Openvpn-devel] OpenVPN Connect App on IOS // Support for IPv6-only networks with DNS64/NAT64

2018-07-07 Thread Gert Doering
Hi, On Sat, Jul 07, 2018 at 07:47:36PM +, Kristian McColm wrote: > > mssfix 1300 > > > > (won't do anything for large UDP packets inside the tunnel, but will > > fix TCP. If you really need large UDP, try --fragment 1400 - but this > > needs to be turned on on both sides, OpenVPN server and

[Openvpn-devel] [PATCH v6 1/2] crypto: always reload tls-auth/crypt key contexts

2018-07-07 Thread Antonio Quartulli
In preparation to having tls-auth/crypt keys per connection block, it is important to ensure that such material is always reloaded upon SIGUSR1, no matter if `persist-key` was specified or not. This is required because when moving from one remote to the other the key may change and thus the key co