upstream/openvpn
1
0
Fork 0
mirror of https://github.com/OpenVPN/openvpn.git synced 2026-04-15 22:20:38 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
openvpn/doc
History
Steffan Karger 752caece99 Limit --reneg-bytes to 64MB when using small block ciphers 
Following the earlier warning about small block ciphers, now limit the
--reneg-bytes value when using a cipher that susceptible to SWEET32-like
attacks.  The 64 MB value has been selected with the researchers who
published the SWEET32 paper.

Note that this will not change a user-set --reneg-bytes value, to allow a
user to align a gun with his feet^w^w^w^w^w^w override this behaviour if
really needed.

v2: obey user-set --reneg-bytes 0 to revert to old behaviour, use more firm
    language in warning message, and add URL to man page.

Signed-off-by: Steffan Karger <steffan.karger@fox-it.com>
Acked-by: David Sommerseth <davids@openvpn.net>
Message-Id: <1477655821-6711-1-git-send-email-steffan.karger@fox-it.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg12798.html
Signed-off-by: David Sommerseth <davids@openvpn.net>
2016-10-28 14:40:15 +02:00
..
doxygen Remove ENABLE_SSL define (and --disable-ssl configure option) 2014-12-31 17:36:54 +01:00
android.txt Update android documentation to match source code 2016-07-11 20:54:23 +02:00
keying-material-exporter.txt Added document for TLS Keying Material Exporters [RFC-5705] 2015-10-10 00:03:07 +02:00
Makefile.am build: integrate plugins build into core build 2012-06-26 11:29:02 +02:00
management-notes.txt Change the hold command to communicate the time that OpenVPN would wait to the UI. 2016-10-13 17:19:48 +02:00
openvpn.8 Limit --reneg-bytes to 64MB when using small block ciphers 2016-10-28 14:40:15 +02:00
README.plugins build: integrate plugins build into core build 2012-06-26 11:29:02 +02:00

README.plugins 

OpenVPN Plugins
---------------

Starting with OpenVPN 2.0-beta17, compiled plugin modules are
supported on any *nix OS which includes libdl or on Windows.
One or more modules may be loaded into OpenVPN using
the --plugin directive, and each plugin module is capable of
intercepting any of the script callbacks which OpenVPN supports:

(1) up
(2) down
(3) route-up
(4) ipchange
(5) tls-verify
(6) auth-user-pass-verify
(7) client-connect
(8) client-disconnect
(9) learn-address

See the openvpn-plugin.h file in the top-level directory of the
OpenVPN source distribution for more detailed information
on the plugin interface.

Included Plugins
----------------

auth-pam -- Authenticate using PAM and a split privilege
            execution model which functions even if
            root privileges or the execution environment
            have been altered with --user/--group/--chroot.
            Tested on Linux only.

down-root -- Enable the running of down scripts with root privileges
             even if --user/--group/--chroot have been used
             to drop root privileges or change the execution
             environment.  Not applicable on Windows.

examples -- A simple example that demonstrates a portable
            plugin, i.e. one which can be built for *nix
            or Windows from the same source.

Building Plugins
----------------

cd to the top-level directory of a plugin, and use the
"make" command to build it.  The examples plugin is
built using a build script, not a makefile.