2:18 p.m.
On 26/04/17 17:08, Lee Howard wrote:
On 04/25/2017 01:39 PM, David Sommerseth wrote:
> This is actually just a very late heads-up about challenges with OpenVPN
> in Fedora 26.
>
> Fedora is moving towards OpenSSL v1.1, which is in my opinion a sane and
> good step forward. Unfortunately, that gives OpenVPN a real challenge.
> The OpenSSL v1.1 support is not completed. Patches have been sent to
> the upstream devel mailing list for review, but only half of them have
> been processed and applied so far.
>
> So, to be able to provide OpenVPN in Fedora 26 it was decided to switch
> to mbed TLS instead of OpenSSL (which OpenVPN also supports). That have
> revealed several issues:
>
> - mbed TLS 2.3+ does by default not support certificates hashes
> "older" than SHA1. And RSA keys must be 2048 bits or more.
> This have been fixed by a couple of additional patches on top
> of the upstream OpenVPN code base.
Why is switching to mbed TLS and patching that preferred over just
patching OpenVPN?
Basically, security - as VPNs are by default security sensitive. The
patches on the OpenVPN mailing list which enables OpenSSL 1.1 support
need to be reviewed properly before we can fully trust them. And
considering that the mbed TLS support have been in OpenVPN for several
years and have also been used by OpenVPN-NL [1] for a long time, I
consider that approach more secure.
In addition I don't want to maintain what would in effect be a fork of
OpenVPN (even though only for a while). So I follow the common
Red Hat mantra of "upstream first". One upstream have officially
blessed OpenVPN with OpenSSL 1.1, we will pull in the these patches
unless a new v2.4 release is coming. This makes it easier to get
upstream bugs fixed; we don't need to consider if a potential bug is a
result of the un-reviewed OpenSSL patches or not.
Those two patches I have added are basically based upon other patches
under review [2] (I have been involved in that review too). In addition
a similar approach have been implemented in the OpenVPN 3 core library
[2] (which is being used by the OpenVPN Connect product range) which
uses the same concept. So I consider those patches less security sensitive.
[1] <https://openvpn.fox-it.com/>
[2]
<https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14452...
[3]
<https://github.com/OpenVPN/openvpn3/commit/88ae6eba36e91aa04ad95252456129...
--
kind regards,
David Sommerseth
6:20 p.m.
New subject: OpenVPN, OpenSSL and Fedora 26+
On Wednesday, 26 April 2017 at 21:18, David Sommerseth wrote:
On 26/04/17 17:08, Lee Howard wrote:
> On 04/25/2017 01:39 PM, David Sommerseth wrote:
>> This is actually just a very late heads-up about challenges with OpenVPN
>> in Fedora 26.
>>
>> Fedora is moving towards OpenSSL v1.1, which is in my opinion a sane and
>> good step forward. Unfortunately, that gives OpenVPN a real challenge.
>> The OpenSSL v1.1 support is not completed. Patches have been sent to
>> the upstream devel mailing list for review, but only half of them have
>> been processed and applied so far.
>>
>> So, to be able to provide OpenVPN in Fedora 26 it was decided to switch
>> to mbed TLS instead of OpenSSL (which OpenVPN also supports). That have
>> revealed several issues:
Thanks a lot for the write-up, David. Can you make sure this ends up
in the release notes?
Regards,
Dominik
--
Fedora http://fedoraproject.org/wiki/User:Rathann
RPMFusion http://rpmfusion.org
"Faith manages."
-- Delenn to Lennier in Babylon 5:"Confessions and Lamentations"
6:24 p.m.
New subject: OpenVPN, OpenSSL and Fedora 26+
Software collections for a segregated sane dep chain
On Apr 26, 2017 19:22, "Dominik 'Rathann' Mierzejewski" <
dominik(a)greysector.net> wrote:
On Wednesday, 26 April 2017 at 21:18, David Sommerseth wrote:
On 26/04/17 17:08, Lee Howard wrote:
> On 04/25/2017 01:39 PM, David Sommerseth wrote:
>> This is actually just a very late heads-up about challenges with
OpenVPN
>> in Fedora 26.
>>
>> Fedora is moving towards OpenSSL v1.1, which is in my opinion a sane
and
>> good step forward. Unfortunately, that gives OpenVPN a real
challenge.
>> The OpenSSL v1.1 support is not completed. Patches have been sent to
>> the upstream devel mailing list for review, but only half of them have
>> been processed and applied so far.
>>
>> So, to be able to provide OpenVPN in Fedora 26 it was decided to switch
>> to mbed TLS instead of OpenSSL (which OpenVPN also supports). That
have
>> revealed several issues:
Thanks a lot for the write-up, David. Can you make sure this ends up
in the release notes?
Regards,
Dominik
--
Fedora http://fedoraproject.org/wiki/User:Rathann
RPMFusion http://rpmfusion.org
"Faith manages."
-- Delenn to Lennier in Babylon 5:"Confessions and Lamentations"
_______________________________________________
devel mailing list -- devel(a)lists.fedoraproject.org
To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org
3:12 p.m.
New subject: OpenVPN, OpenSSL and Fedora 26+
On 27/04/17 01:20, Dominik 'Rathann' Mierzejewski wrote:
On Wednesday, 26 April 2017 at 21:18, David Sommerseth wrote:
> On 26/04/17 17:08, Lee Howard wrote:
>> On 04/25/2017 01:39 PM, David Sommerseth wrote:
>>> This is actually just a very late heads-up about challenges with OpenVPN
>>> in Fedora 26.
>>>
>>> Fedora is moving towards OpenSSL v1.1, which is in my opinion a sane and
>>> good step forward. Unfortunately, that gives OpenVPN a real challenge.
>>> The OpenSSL v1.1 support is not completed. Patches have been sent to
>>> the upstream devel mailing list for review, but only half of them have
>>> been processed and applied so far.
>>>
>>> So, to be able to provide OpenVPN in Fedora 26 it was decided to switch
>>> to mbed TLS instead of OpenSSL (which OpenVPN also supports). That have
>>> revealed several issues:
Thanks a lot for the write-up, David. Can you make sure this ends up
in the release notes?
Sure ... I've never done that before, any pointers to how I can make
that happen?
--
kind regards,
David Sommerseth
4:15 p.m.
New subject: OpenVPN, OpenSSL and Fedora 26+
On Apr 27, 2017 3:13 PM, "David Sommerseth" <dazo(a)eurephia.org> wrote:
On 27/04/17 01:20, Dominik 'Rathann' Mierzejewski wrote:
On Wednesday, 26 April 2017 at 21:18, David Sommerseth wrote:
> On 26/04/17 17:08, Lee Howard wrote:
>> On 04/25/2017 01:39 PM, David Sommerseth wrote:
>>> This is actually just a very late heads-up about challenges with
OpenVPN
>>> in Fedora 26.
>>>
>>> Fedora is moving towards OpenSSL v1.1, which is in my opinion a sane
and
>>> good step forward. Unfortunately, that gives OpenVPN a
real challenge.
>>> The OpenSSL v1.1 support is not completed. Patches have been sent to
>>> the upstream devel mailing list for review, but only half of them have
>>> been processed and applied so far.
>>>
>>> So, to be able to provide OpenVPN in Fedora 26 it was decided to switch
>>> to mbed TLS instead of OpenSSL (which OpenVPN also supports). That
have
>>> revealed several issues:
Thanks a lot for the write-up, David. Can you make sure this ends up
in the release notes?
Sure ... I've never done that before, any pointers to how I can make
that happen?
--
kind regards,
David Sommerseth
File a PR or issue at https://pagure.io/release-notes and I'll follow up on
it. An issue would be best at the moment, there's a bit of prep work to do
for the F26 branch.
-- Pete
6:19 p.m.
New subject: OpenVPN, OpenSSL and Fedora 26+
On 27/04/17 23:15, Pete Travis wrote:
On Apr 27, 2017 3:13 PM, "David Sommerseth" <dazo(a)eurephia.org
<mailto:dazo@eurephia.org>> wrote:
On 27/04/17 01:20, Dominik 'Rathann' Mierzejewski wrote:
> Thanks a lot for the write-up, David. Can you make sure this ends up
> in the release notes?
Sure ... I've never done that before, any pointers to how I can make
that happen?
--
kind regards,
David Sommerseth
File a PR or issue at https://pagure.io/release-notes and I'll follow up
on it. An issue would be best at the moment, there's a bit of prep work
to do for the F26 branch.
Thanks a lot, Pete!
An issue have been created: https://pagure.io/release-notes/issue/36
--
kind regards,
David Sommerseth
2568
days inactive
2570
days old
5 comments
4 participants
participants (4)
-
David Sommerseth -
Dominik 'Rathann' Mierzejewski -
Pete Travis -
Subhendu Ghosh