Introduction
This page shows the high-level status of OpenVPN 2.7 release. If you want all the details, see the Active Tickets by Milestone report.
Schedule
Release is roughly planned for two years after OpenVPN 2.6. So end of 2024 or beginning of 2025. It was discussed that we should provide official preview builds earlier this time to gather more feedback for merged changes. Also, the experience from the 2.6 release was to branch off release/2.7 later, since branching it off too early causes a lot of work for little benefit.
Features/fixes to include
completed/done
| Task description | Assigned to | Status | Ticket | Patchwork / Gerrit |
|---|---|---|---|---|
| Switch from MSVC buildsystem to CMake for Windows builds | djpig | Done | - | Change 266 |
Remove deprecated --no-replay |
djpig | Done | Deprecated Options | Change 281 |
Make it harder to use --secret |
plaisthos | Done | Deprecated Options | Change 325 |
| Remove deprecated NTLM v1 support | djpig | Done | Deprecated Options | Change 379 Change 500 |
| Support TLS alerts | plaisthos | Done | - | Change 449 |
Change default for --topology to subnet |
djpig | Done | Deprecated Options | Change 421 |
| afunix/lwipovpn | plaisthos, cron2 | Done | - | lwipovpn topic |
| Tunnelcrack improvements for Windows | d12fk | Done | - | Change 489 |
must have (might block the release)
| Task description | Assigned to | Status | Ticket | Gerrit / Patchwork |
|---|---|---|---|---|
| DNS option rework (split DNS) - windows backend | lev, d12fk | WIP | - | - |
| Support for multiple-protocol sockets (UDP/TCP) | Giaan | Gerrit | #556 | multisocket topic |
| New API for DCO kernel module on Linux | ordex | Trying to get in mainline first | - | - |
| Remove wintun driver support | lev | TBD | - | - |
| Remove support for compression on send | djpig | Gerrit | - | Change 755 |
should have
| Task description | Assigned to | Status | Ticket | Gerrit / Patchwork |
|---|---|---|---|---|
| Data v3 format with AES rekeying | plaisthos, syzzer | WIP | - | - |
| Tunnelcrack improvements for Linux | d12fk | TBD | - | - |
--cipher/--data-ciphers add DEFAULT syntax |
plaisthos | TBD | - | - |
nice to have / wild ideas
| Task description | Assigned to | Status | Ticket | Patchwork / Gerrit |
|---|---|---|---|---|
| Bloom-filter DDoS protection | plaisthos | Gerrit | - | bloom topic |
| Live route updates / push-update | mrbff | Gerrit | - | push-update-client topic |
| dco-win multipeer (--server) | lev | WIP | - | - |
| HAProxy support | ralf_lici | Gerrit | - | proxy-protocol topic |
| Transport plugin (primary use case: obfuscation) | giaan | WIP | - | - |
| Remove deprecated --ns-cert-type | - | - | Deprecated Options | - |
| Remove deprecated --tun-ipv6 | - | - | Deprecated Options | - |
| Remove deprecated --max-routes | - | - | Deprecated Options | - |
| Remove deprecated --dhcp-release | - | - | Deprecated Options | - |
| Properly deprecate _v1 and _v2 plugin functions | - | - | Deprecated Options | - |
| Deprecate NTLM v2 support | djpig | - | Deprecated Options | - |
| Implement kqueue on MacOS | plaisthos | wip (but slower than poll()) | - | - |
| Sort out multiple-plugin auth mess | dazo, cron2 | on-going | - | RFC patch 2327 |
| Improve NM-OVPN integration | cron2 | trying to establish contact | - | - |
| Make TAP6-Windows Really Fast | lev | not started | - | - |
| SRV patch (set) | ? | patch needs work | - | - |
| Test server that does --auth-user-pass and/or challenge stuff | cron2 (snair) | --auth-user-pass done, challenge missing | - | - |
| Update OpenVPN PRF (move away from SHA1/MD5) | syzzer/plaisthos | done(?) | - | - |
| Maybe: fix radius-plugin - plugin is useful but not maintained very well | ??? | ??? | - | - |
| Test framework improvements (local "make check" crypto tests) | syzzer | - | - | - |
| Inner VRF support? | ?? | ?? | ?? | - |
| Route monitoring (enable clients to react to network changes) | cron2 | not started | - | - |
| Maybe: add PRF plugin interface | ??? | ??? | - | - |
| Maybe: add key exchange plugin interface (allows easily doing .e.g post quantum kex) | ??? | ??? | - | - |
| Maybe: add data channel separation (or, move to ovpn3, which already has this?) | ??? | ??? | - | - |
| Investigate TUNSLMODE on FreeBSD and NetBSD to get rid of iroute table (iroutes become normal system routes) | cron2 | not started | - | - |
| Dynamic routes ('route in ccd-file'), depends on netlink support | ordex | not started | - | - |
| tftp/wpad patch | jjk | patch on list, needs review and merge | - | - |
| Support TLS record splitting (like ovpn3) | syzzer | (started, but no patches available yet) | #554 | - |
| Improve control channel performance (further) - redo reliability layer, introduce windowing / scaling | syzzer | ??? | - | - |