Introduction
This page shows the high-level status of OpenVPN 2.7 release.
Schedule
Release is roughly planned for two years after OpenVPN 2.6. So end of 2024 or beginning of 2025. Release is currently planned for Summer 2025. First Alpha release is expected in May.
It was discussed that we should provide official preview builds earlier this time to gather more feedback for merged changes. Also, the experience from the 2.6 release was to branch off release/2.7 later, since branching it off too early causes a lot of work for little benefit.
Features/fixes to include
completed/done
| Task description | Assigned to | Status | Ticket | Patchwork / Gerrit |
|---|---|---|---|---|
| Support for multiple-protocol sockets (UDP/TCP) | Giaan | Done | #556 | multisocket topic |
| dco-win multipeer (--server) | lev | Done | - | Change 815 |
| New API for DCO kernel module on Linux | ordex | Done | - | Change 941 |
| Data v3 format with AES rekeying | plaisthos, syzzer | Done | - | Change 806 |
| Switch from MSVC buildsystem to CMake for Windows builds | djpig | Done | - | Change 266 |
--cipher/--data-ciphers add DEFAULT syntax |
plaisthos | Done | - | Change 828 |
| Remove wintun driver support | lev | Done | - | Change 1021 |
| Remove support for compression on send | djpig | Done | - | Change 755 |
Remove deprecated --no-replay |
djpig | Done | Deprecated Options | |
Make it harder to use --secret |
plaisthos | Done | Deprecated Options | |
| Remove deprecated NTLM v1 support | djpig | Done | Deprecated Options | |
| Deprecate NTLM v2 support | djpig | Done | Deprecated Options | |
| Support TLS alerts | plaisthos | Done | - | Change 449 |
Change default for --topology to subnet |
djpig | Done | Deprecated Options | |
| afunix/lwipovpn | plaisthos, cron2 | Done | - | lwipovpn topic |
| Tunnelcrack improvements for Windows | d12fk | Done | - | Change 489 |
| DNS option rework (split DNS) - Windows/Linux/BSD | lev, d12fk | Done | - | "dns option" topic |
| Live route updates / push-update | mrbff | Done | - | push-update-client topic |
should have
| Task description | Assigned to | Status | Ticket | Gerrit / Patchwork |
|---|---|---|---|---|
| Tunnelcrack improvements for Linux | d12fk | TBD | - | - |
nice to have / wild ideas
| Task description | Assigned to | Status | Ticket | Patchwork / Gerrit |
|---|---|---|---|---|
| Bloom-filter DDoS protection | plaisthos | Gerrit | - | bloom topic |
| HAProxy support | ralf_lici | Gerrit | - | proxy-protocol topic |
| Transport plugin (primary use case: obfuscation) | giaan | WIP | - | - |
| Remove deprecated --ns-cert-type | - | - | Deprecated Options | - |
| Remove deprecated --tun-ipv6 | - | - | Deprecated Options | - |
| Remove deprecated --max-routes | - | - | Deprecated Options | - |
| Remove deprecated --dhcp-release | - | - | Deprecated Options | - |
| Properly deprecate _v1 and _v2 plugin functions | - | - | Deprecated Options | - |
| Implement kqueue on MacOS | plaisthos | wip (but slower than poll()) | - | - |
| Sort out multiple-plugin auth mess | dazo, cron2 | on-going | - | RFC patch 2327 |
| Improve NM-OVPN integration | cron2 | trying to establish contact | - | - |
| Make TAP6-Windows Really Fast | lev | not started | - | - |
| SRV patch (set) | ? | patch needs work | - | - |
| Test server that does --auth-user-pass and/or challenge stuff | cron2 (snair) | --auth-user-pass done, challenge missing | - | - |
| syzzer/plaisthos | "done" by moving to EKM | - | - | |
| Maybe: fix radius-plugin - plugin is useful but not maintained very well | ??? | ??? | - | - |
| Test framework improvements (local "make check" crypto tests) | syzzer | - | - | - |
| Inner VRF support? | ?? | ?? | ?? | - |
| Route monitoring (enable clients to react to network changes) | cron2 | not started | - | - |
| - | obsolete | - | - | |
| - | obsolete | - | - | |
| Maybe: add data channel separation (or, move to ovpn3, which already has this?) | ??? | ??? | - | - |
| cron2 | obsolete | - | - | |
| ordex | obsolete | - | - | |
| jjk | patch on list, obsolete | - | - | |
| Support TLS record splitting (like ovpn3) | syzzer | (started, but no patches available yet) | #554 | - |
| Improve control channel performance (further) - redo reliability layer, introduce windowing / scaling | syzzer | ??? | - | - |