Changes between Version 12 and Version 13 of OpenVPN2.4

Timestamp:

12/19/16 13:30:03 (8 years ago)

Author:

David Sommerseth

Comment:

--

OpenVPN2.4

@@ -22 +22 @@
  * --preresolve patch
  * ~~utun on mac os x~~ **done*
-  * native tun, no need for extra tun.kext
-  * Supported for all OS X >= 10.6.8 (latest PPC version)
-   * Unfortunatly requires root
+  * ~~native tun, no need for extra tun.kext~~
+  * ~~Supported for all OS X >= 10.6.8 (latest PPC version)~~
+   * ~~Unfortunatly requires root~~
    * Real question: Drop tun.kext support and support only utun or "try utun first, fall back to tun.kext if it fails"
- * svn 2.1 patchset (snappy support, push-peer-info changes, see trac#268-273)
+ * ~~svn 2.1 patchset (snappy support, push-peer-info changes, see trac#268-273)~~ **cancelled** (LZ4 support came instead, which is slicker and faster)
  * ~~management interface changes (status 2/3)~~ **done*
- * Formatting and whitespace fixes (just before 2.4 release)
+ * ~~Formatting and whitespace fixes (just before 2.4 release)~~ **done**
  * ~~--version to include git commit id and branch?~~ **yes, done**
  * OpenVPN-GUI installer from mattock
@@ -42 +42 @@
 = Windows Interactive Service =
 
- * d12fk's new windows privilege separation scheme, permitting fully unprivileged users to safely run OpenVPN (described and agreed-upon at the [wiki:MunichHackathon2013])
+ * ~~ d12fk's new windows privilege separation scheme, permitting fully unprivileged users to safely run OpenVPN (described and agreed-upon at the [wiki:MunichHackathon2013]) ~~ **done**
 
 = new frame format for data packets =
 
- * fix alignment performance penalty (byte-swap control byte with last byte of payload)
- * enable DoS-safe --float in TLS mode by transmitting session ID in data frames "ever so often" (like "when not having seen a packet from the server since more than 500 milliseconds" or whatever)
- * agreed-upon at the [wiki:MunichHackathon2013] (last section), nothing implemented yet
+ * ~~ fix alignment performance penalty (byte-swap control byte with last byte of payload) ~~ **done** DATA_V2 packet format is in v2.4
+ * ~~ enable DoS-safe --float in TLS mode by transmitting session ID in data frames "ever so often" (like "when not having seen a packet from the server since more than 500 milliseconds" or whatever) ~~ **done** --peer-id support
+ * ~~ agreed-upon at the [wiki:MunichHackathon2013] (last section), nothing implemented yet ~~
 
 = cipher negotiation for data packets =
 
- * make cipher a per-client setting in the server, and pushable on the client (right now it's a "global" thing, set once and valid forever)
+ * ~~ make cipher a per-client setting in the server, and pushable on the client (right now it's a "global" thing, set once and valid forever) ~~ **done** --ncp-cipher with negotiation implemented in v2.4 and a simpler approach (poor-mans NCP) implemented in v2.3.
  * then add dynamic negotiation based on client/server capabilities
 
@@ -62 +62 @@
 
 = IPv6 payload / payload/routing integration =
- * implement "redirect-gateway ipv6" in 2.x code base as well (3 has it)
+ * ~~ implement "redirect-gateway ipv6" in 2.x code base as well ~~ (3 has it) **done**
  * add --block-ipv6
  * handle ipv6 payload over ipv6 transport, when the VPN server is inside the pushed IPv6 routes
@@ -69 +69 @@
   * cleanup afterwards
  * handle iroute-ipv6 and pushed route-ipv6 consistently with IPv4: do not send pushed routes to the very client that the iroute-ipv6 points to (local route confusion at client), also trac#354.
- * have a way to signal IPv6 DNS (and other "DHCP") information to client, as currently "dhcp-option DNS ..." is IPv4-only (as is using DHCPv4 to signal this).  See trac#243
+ * have a way to signal IPv6 DNS (and other "DHCP") information to client, as currently "dhcp-option DNS ..." is IPv4-only (as is using DHCPv4 to signal this).  See trac#243 **in progress, partially implemented**