From patchwork Tue Jan 14 13:49:09 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Frank Lichtenheld X-Patchwork-Id: 4058 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:b7cb:b0:5e7:b9eb:58e8 with SMTP id en11csp2250292mab; Tue, 14 Jan 2025 05:49:31 -0800 (PST) X-Forwarded-Encrypted: i=2; AJvYcCW6THJDM6gexU3TF5/s88GKvRhQp5nTMtnh2yUUe9rccdWlEL7yqj0heL0v+9KHCcnAsZfeMdYNPso=@openvpn.net X-Google-Smtp-Source: AGHT+IG203mNlbhdQ4ukU0jveluiuhjmITby4ln2MNbqvnMcG7br10OGUsDucRw+6bcixnoGtXA4 X-Received: by 2002:a05:6830:698e:b0:71e:93c:53a0 with SMTP id 46e09a7af769-721e2e7e0c2mr14728307a34.17.1736862571083; Tue, 14 Jan 2025 05:49:31 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1736862571; cv=none; d=google.com; s=arc-20240605; b=QLmUQyc8yt5BrTLQPELmlB9C9NM1ESFqcLVjbzp8pIASNnEQGBK9zQ0gzZ7aeZcpVq QwMDGw/d0/ZWfpx0rVfS0bPpRMA0JZ0BVb2JKRWALsdvac3PEdeB9qd82bOMNCH1sULp JqEqrGJ+M/Df4cCbYCpH8JPNPgXoh2TY6dh0tchRNnirwfkX0H3BasXj5yuXd3lMMF2S N6Uh0LBWeWMi9t1srIU8myabvWsCsplMrkEbK0z5Skx1dvHthsNofxSLCw8RJdSHSZHa /qGoMtvACOmsakm3gxqxokI26xvEbsfKO959QmmGZYfRZY0cTlVpTviPtpsun7g0jSjA eS9Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=L9+mkIvusokKyQ+AlQ5JN9ck4hRSTCinQFlbV8IP0NE=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=d6W70o1avLT1yck+hV2lY9acRAK+qmsLRi2oLPf8u+cG+7V4q7wLRrlEMrIkHTg7cf FKrsp3IaMilEbuRaGTN3zRlF1ANAy7vs4zDFVBXoqy45OLD9pOQOZ5QR5RAkOUR1+vnq shAYRGV3gPgoz8wKT8McgrPCEt1qekVa+Gpjwu0ffM+tNjpyIAthLW8QUvwyxKrVdOK0 L3Yp7SnyvABdfdp4E8vYCSQurSgqq3mSIWqdGBia9t6GKJDJlMqNHFFs6gdmxhErukC2 84z8HclEi0Z0uVaaK3bBUFfZ0tzRVROumQsorQFwH1owgqGLq09NQgtGmUVKaaxhoNtb +gvQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=ggIufPW9; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=dSEfu4FQ; dkim=neutral (body hash did not verify) header.i=@lichtenheld.com header.s=MBO0001 header.b=yKWOD10o; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 46e09a7af769-72318649f0fsi9064617a34.163.2025.01.14.05.49.30 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 14 Jan 2025 05:49:31 -0800 (PST) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=ggIufPW9; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=dSEfu4FQ; dkim=neutral (body hash did not verify) header.i=@lichtenheld.com header.s=MBO0001 header.b=yKWOD10o; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from [127.0.0.1] (helo=sfs-ml-2.v29.lw.sourceforge.com) by sfs-ml-2.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1tXhIN-0000Wq-P3; Tue, 14 Jan 2025 13:49:27 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-2.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1tXhIM-0000Wd-Gq for openvpn-devel@lists.sourceforge.net; Tue, 14 Jan 2025 13:49:26 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-Id:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=GN9WhMJBkPc3ZK4Hjz1LBtkreRfRD1CysgWa7MWu4xg=; b=ggIufPW9ppfUArz2jsdU+5aWhW 0a3SLyCLJxp+bYpV5akwyYtD99+HEBDH/xXo5AbHwPQ+2bOy0T5LpChpZEKKTmYx+BgdKGDi6RutV 3CVJ0t3cebDQU8ExOJfBXCrKtc0qNaqYxXyvfuVGhQqavoMAi1Rq9WKTnCpH8+Xt1dag=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-Id: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=GN9WhMJBkPc3ZK4Hjz1LBtkreRfRD1CysgWa7MWu4xg=; b=dSEfu4FQU4gRdzy/2jRFCI+dsz d7CVidQHxn2jGWI1dfEFw0T+XQokHqzBxeMzblOWiYfKEWzCvKGykKUMPtK0BgWQqUqigzeA43Thh yHKoVCblfSwpAZxE372d5wDkMJKOejmN7gijHDS5UEx+AaAf13aEIgad8XU7jy6wHk1I=; Received: from mout-p-102.mailbox.org ([80.241.56.152]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1tXhIL-0005t0-E0 for openvpn-devel@lists.sourceforge.net; Tue, 14 Jan 2025 13:49:26 +0000 Received: from smtp202.mailbox.org (smtp202.mailbox.org [IPv6:2001:67c:2050:b231:465::202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-p-102.mailbox.org (Postfix) with ESMTPS id 4YXVpv6jV4z9vC2; Tue, 14 Jan 2025 14:49:11 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lichtenheld.com; s=MBO0001; t=1736862552; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=GN9WhMJBkPc3ZK4Hjz1LBtkreRfRD1CysgWa7MWu4xg=; b=yKWOD10o5KhZHObTIlNd6ofQiYBQh4i71FYCeim+1dTsLXhNskoL3P0hB19Nk8bd2UhLwE oSlrZJs2KID0t216o0zeGnt3EWR5kh06Kb2jNWo1ewjN98mANjkWUW5GxRxIPqVmNbo5/3 oQ3jYENiRUzaaHBOnGO0cViJubRtr1CJMVdiNvmlf2kqWk4UimAYZ59cJs6mjnPP3DabzA n/SvmuxDFrw01CYWX2Q5LcNqbW+hdFlUe7lTtD4QevX4PSpAWvGtU5rtXULYw4HWQHpRBV tF2LF/llbHocdsL/s6as2Zz/Jl4G7iUAjVNSKJkCLHYgO7YqvRf2pYr0od7wUA== From: Frank Lichtenheld To: openvpn-devel@lists.sourceforge.net Date: Tue, 14 Jan 2025 14:49:09 +0100 Message-Id: <20250114134909.31334-1-frank@lichtenheld.com> In-Reply-To: References: MIME-Version: 1.0 X-Rspamd-Queue-Id: 4YXVpv6jV4z9vC2 X-Spam-Score: -0.9 (/) X-Spam-Report: Spam detection software, running on the system "util-spamd-2.v13.lw.sourceforge.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Arne Schwabe - fix typo in peer-fingerprint - use ec_paramgen_curve instead of requiring a subshell Note: we still use -nodes instead of -noenc as it is more compatible. Content analysis details: (-0.9 points, 6.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at https://www.dnswl.org/, low trust [80.241.56.152 listed in list.dnswl.org] 0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. [80.241.56.152 listed in bl.score.senderscore.com] 0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. [80.241.56.152 listed in sa-accredit.habeas.com] 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record -0.0 SPF_PASS SPF: sender matches SPF record -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain X-Headers-End: 1tXhIL-0005t0-E0 Subject: [Openvpn-devel] [PATCH v1] Improve peer fingerpint documentation X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: =?utf-8?q?1821232407557780630?= X-GMAIL-MSGID: =?utf-8?q?1821232407557780630?= From: Arne Schwabe - fix typo in peer-fingerprint - use ec_paramgen_curve instead of requiring a subshell Note: we still use -nodes instead of -noenc as it is more compatible. closes: issue #666 Change-Id: I9a12a0c127908af9f09d88fb3a493df3763d0cc5 Signed-off-by: Arne Schwabe Acked-by: Frank Lichtenheld --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/859 This mail reflects revision 1 of this Change. Acked-by according to Gerrit (reflected above): Frank Lichtenheld diff --git a/doc/man-sections/example-fingerprint.rst b/doc/man-sections/example-fingerprint.rst index 7cdda19..31ca0c1 100644 --- a/doc/man-sections/example-fingerprint.rst +++ b/doc/man-sections/example-fingerprint.rst @@ -18,7 +18,7 @@ 2. Generate a self-signed certificate for the server: :: - openssl req -x509 -newkey ec:<(openssl ecparam -name secp384r1) -keyout server.key -out server.crt -nodes -sha256 -days 3650 -subj '/CN=server' + openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:secp384r1 -keyout server.key -out server.crt -nodes -sha256 -days 3650 -subj '/CN=server' 3. Generate SHA256 fingerprint of the server certificate @@ -28,7 +28,7 @@ openssl x509 -fingerprint -sha256 -in server.crt -noout - This output something similar to: + This outputs something similar to: :: SHA256 Fingerprint=00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff @@ -64,6 +64,12 @@ # Ping every 60s, restart if no data received for 5 minutes keepalive 60 300 + # Uncomment the line below if you want to have persistent IP addresses + # ifconfig-pool-persist /etc/openvpn/server/ipp.txt + + # Uncomment the line below to push a DNS server to clients + # push "dhcp-option DNS 1.1.1.1" + 5. Add at least one client as described in the client section. 6. Start the server. @@ -85,7 +91,7 @@ different name for each client. :: - openssl req -x509 -newkey ec:<(openssl ecparam -name secp384r1) -nodes -sha256 -days 3650 -subj '/CN=alice' + openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:secp384r1 -keyout - -nodes -sha256 -days 3650 -subj '/CN=alice' This generate a certificate and a key for the client. The output of the command will look something like this: @@ -162,7 +168,7 @@ ff:ee:dd:cc:bb:aa:99:88:77:66:55:44:33:22:11:00:ff:ee:dd:cc:bb:aa:99:88:77:66:55:44:33:22:11:00 99:88:77:66:55:44:33:22:11:00:ff:ee:dd:cc:bb:aa:99:88:77:66:55:44:33:22:11:00:88:77:66:55:44:33 - + 6. (optional) if the client is an older client that does not support the :code:`peer-fingerprint` (e.g. OpenVPN 2.5 and older, OpenVPN Connect 3.3