Changes between Version 7 and Version 8 of Openvpn24ManPage

Timestamp:

12/27/16 12:42:52 (7 years ago)

Author:

Samuli Seppänen

Comment:

Update man-page to OpenVPN 2.4.0

Openvpn24ManPage

@@ -3659 +3659 @@
 <P>
 IV_LZ4=1 -- if the client supports LZ4 compressions.
-<P>
-IV_RGI6=1 -- if the client supports
-<B>--redirect-gateway</B>
-
-for ipv6
 <P>
 IV_PROTO=2 -- if the client supports peer-id floating mechansim
@@ -5940 +5935 @@
 <B>n</B>
 
-bytes sent or received (disabled by default).
+bytes sent or received (disabled by default with an exception, see below).
 OpenVPN allows the lifetime of a key
-to be expressed as a number of bytes encrypted/decrypted, a number of packets, or
-a number of seconds.  A key renegotiation will be forced
+to be expressed as a number of bytes encrypted/decrypted, a number of packets,
+or a number of seconds.  A key renegotiation will be forced
 if any of these three criteria are met by either peer.
+<P>
+If using ciphers with cipher block sizes less than 128-bits, --reneg-bytes is
+set to 64MB by default, unless it is explicitly disabled by setting the value to
+0, but this is
+<B>HIGHLY DISCOURAGED</B>
+
+as this is designed to add some protection against the SWEET32 attack vector.
+For more information see the --cipher option.
 
 <DT><B>--reneg-pkts n</B>
@@ -6122 +6125 @@
 gives a peer nothing more than the power to initiate a TLS
 handshake.  It is not used to encrypt or authenticate any tunnel data.
+<P>
+Use
+<B>--tls-crypt</B>
+
+instead if you want to use the key file to not only authenticate, but also
+encrypt the TLS control channel.
 
 <DT><B>--tls-crypt keyfile</B>
@@ -8961 +8970 @@
 <A HREF="/cgi-bin/man/man2html">man2html</A>,
 using the manual pages.<BR>
-Time: 12:29:11 GMT, December 16, 2016
+Time: 12:41:06 GMT, December 27, 2016
 }}}