Re: [Openvpn-devel] [PATCH 0/5] Implement additional two step authentication methods

2019-06-14 Thread Arne Schwabe
> I haven't looked at the patches, but a quick question. I haven't come across > any > 2FA mechanisms that cannot be handled (in principle) by the current static an > dynamic CR in OpenVPN. Except that some dynamic CR (e.g, U2F) will require > the possibility to transmit larger messages than cur

Re: [Openvpn-devel] [PATCH] configure.ac: add lzo CFLAGS/LIBS to the test flags

2019-06-14 Thread Arne Schwabe
Am 02.06.19 um 12:18 schrieb Steffan Karger: > This fixes "make check" builds on systems with lzo on a non-standard > location. Does what it says and does not break on my system. Acked-By: Arne Schwabe ___ Openvpn-devel mailing list Openvpn-devel@lis

Re: [Openvpn-devel] [PATCH v2 1/2] Send auth fail to client on reneg failure

2019-06-14 Thread Arne Schwabe
Am 11.04.19 um 04:07 schrieb Eric Thorpe: > Hi All, > > This patch relies on Arne's "Add send_control_channel_string_dowork > variant" patch. > > This patch modifies auth so that on a renegotiation the client is > informed of a SESSION re-auth failure during a renegotiation if either > their auth

Re: [Openvpn-devel] [PATCH v2 2/2] Support client reason from auth plugin

2019-06-14 Thread Arne Schwabe
Am 11.04.19 um 04:07 schrieb Eric Thorpe: > Hi All, > > This patch allows for a client reason to be returned from an auth plugin > and sent to the connecting client on an auth fail. This change is > backwards compatible with existing plugins and hasn't caused issues with > existing plugins like th

Re: [Openvpn-devel] [PATCH 1/1] man: correct the description of --capath and --crl-verify regarding CRLs

2019-06-14 Thread Arne Schwabe
Am 09.04.19 um 16:34 schrieb Michal Soltys: > The man page states that when using --capath, the user is required to > provide CRLs for CAs. This is not true and providing CRLs is optional - > both in case of --capath as well as --crl-verify options. When relevant > CRL is not found OpenVPN simply l

Re: [Openvpn-devel] [PATCHv2] openssl: Fix compilation without deprecated OpenSSL 1.1 APIs

2019-06-14 Thread Arne Schwabe
Am 04.04.19 um 00:56 schrieb Rosen Penev: > EVP_CIPHER_CTX_init and _cleanup were deprecated in 1.1 and both were > replaced with _reset. > > Also removed initialization with OpenSSL 1.1 as it is no longer needed and > causes compilation errors when disabling deprecated APIs. > > Same with SSL_CT

[Openvpn-devel] [PATCH v2] Wintun - experimental support

2019-06-14 Thread Lev Stipakov
From: Lev Stipakov This adds experimental support for Wintun, an alternative to tap-windows6 on Windows. To use wintun, specify --windows-driver wintun as config option. Default value is "tap-windows6". Unlike tap-windows6, Wintun returns up to 256 packets, which have to be decapsulated and

Re: [Openvpn-devel] Wintun performance results

2019-06-14 Thread Lev Stipakov
Hi, I got some new Wintun (I used version 0.2) performance stats I would like to share. I have tested openvpn2 and openvpn3 (both with openssl) on the client against openvpn2 and proprietary openvpn3 server (which is openvpn3 with kernel acceleration). Cipher AES-256-GCM. Server - proprietary ope

Re: [Openvpn-devel] Wintun performance results

2019-06-14 Thread Gert Doering
Hi, On Fri, Jun 14, 2019 at 06:56:56PM +0300, Lev Stipakov wrote: > ovpn3 wintun 1.90 Gbit/s > ovpn3 tap6 890 Mbit/s This is amazing indeed. Now, if you do readmmsg() in openvpn3 for the tap6 case - will that also speed up things significantly? gert -- "If was one thing all people too