From patchwork Tue Sep 22 16:09:07 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gert Doering X-Patchwork-Id: 5404 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:6446:b0:8a0:ea1f:253a with SMTP id n6csp13485174mag; Tue, 22 Sep 2026 09:09:32 -0700 (PDT) X-Forwarded-Encrypted: i=2; AKwUvBxdwtrQDmAHc63Epghm1YVOUZs03z620CrEU1Q9miWiWipL/ORo+HbQz3fjsHor+qXyNgSekssTcww=@openvpn.net X-Received: by 2002:a05:6820:818b:b0:6b1:705d:b29e with SMTP id 006d021491bc7-6ca9aa43d2dmr12907927eaf.26.1790093372796; Tue, 22 Sep 2026 09:09:32 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1790093372; cv=none; d=google.com; s=arc-20260327; b=KCVvLiKcUOlXAh5l4Chk99AG3qkw+k6jqq2r+jJSurZ/jWeoRpvzI2ZyMvm2orKcHY fFELaVXLgJOZceHJ+5oCo6ysH41VJIhT+j6m2XONq3yABfs37TNytR0FAjYrpeGHveQR rnGae8N2fHvnPU1aE35emN/7MApbQwp40saZzRZhWWe6e+ahneelXonJw0I+911mJuHn XdQyk2C3PNw66Lm5cNHAt4C6I5Ynl9UYT2YgoRa1tx3M76h1Fg0aH1Ub8p8djnYGNEqi Fk4cGtAig8e9jkIxDsvRpDm80rsgyfVX1S4JMpgh0tpEKgewtNQ/qC5UvGl5lKYsCB/F x44g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=ZBhiqNZ3aTz3JroC79hTGR7VTZlKhYNUCwSJ+DgMEI4=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=LnDwwC8Xm3Jm+lY9U/yW8TKlQYSAvxQsIdlOjcYb25thT/RY9V543gXLQnn6Qo+r+h OjYmnLwcNI3qN0IT5Ykpd6CsmfKqVyla8skCkQYcSlh5nHbaYH4wwe2M7LTJYmInXT/r xn2fTvJK99bWX31JPtMikmxi2gzszdX+/3XeGibh9TlMrq2G9xL4euUyGH3/kDl5U8WS /jQLuhDOAIM0YSBxu6y7Z2eGIilx94Z5bFqMC1EzjXgViL6a6fYOMlLFyu/vPiaT6ki5 Lk31v15sWvgmm0lvwnwX1CUIP4cIBnLlY1ioA0jv/PIzUHuFVIq+kYGiA7Z5VBHpFU5Q weew==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b="cO2wz/oL"; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b="AEmRv/b7"; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=cVvRSCAA; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 46e09a7af769-814e82acd24si3529809a34.142.2026.09.22.09.09.32 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 22 Sep 2026 09:09:32 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b="cO2wz/oL"; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b="AEmRv/b7"; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=cVvRSCAA; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=ZBhiqNZ3aTz3JroC79hTGR7VTZlKhYNUCwSJ+DgMEI4=; b=cO2wz/oLQ9KRehVKGKW66A5edz jNTM7Cbpjz2Hls3HRoguUejtHAVBp6NJo3iJiw47W3tx+e7BRs/tNkNwpfilLG7BrA6vX+pYcQu4C uixD8JI04ggHtCTLdoFJIWeIw4mYhF4QzUZibC8NhARUwAyoHplRuOImMNNcD4nE6MYQ=; Received: from [127.0.0.1] (helo=sfs-ml-2.v29.lw.sourceforge.com) by sfs-ml-2.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1x933e-0007ld-QI; Tue, 22 Sep 2026 16:09:27 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-2.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1x933b-0007lD-6k for openvpn-devel@lists.sourceforge.net; Tue, 22 Sep 2026 16:09:24 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=X1lVltdfmuoH4RPGRS0G+HAgXtJv7C6QxQM/ApHF2nQ=; b=AEmRv/b7YMsAGPG3S3AqJ30614 FHsMdxiFl0ph2Zd+hJWaAjoZu6RjT1+qxQjgSUykcluxm8Gu53VgDSMKoWcgWjgXzq8o+eGCX8+uT 9KvxkoD3BimNF3ai8G7zMaRTQQp1jh2XzuwLlghRHyrQK656/KmxF4eT/WVCN6LDW+N0=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=X1lVltdfmuoH4RPGRS0G+HAgXtJv7C6QxQM/ApHF2nQ=; b=cVvRSCAA2rXKheYjYUeJeKmNGg OV+xhVZKDzGtDER+nUjabRqs8HFDtF12tiwASjLaf7gxaQQ9Ct5ZpzRbPovrsO0omnbHEz26WyP8S GVTtqqC5J+MrnPijWgh1//Zz+8EhiiJSB0WOStRMlQWkdYQOwsHQ3xmtzL0SnEpIxuiw=; Received: from [193.149.48.129] (helo=blue.greenie.muc.de) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1x933a-0007yi-7T for openvpn-devel@lists.sourceforge.net; Tue, 22 Sep 2026 16:09:23 +0000 Received: from blue.greenie.muc.de (localhost [127.0.0.1]) by blue.greenie.muc.de (8.18.1/8.18.1) with ESMTP id 68MG9DJk020920 for ; Tue, 22 Sep 2026 18:09:13 +0200 Received: (from gert@localhost) by blue.greenie.muc.de (8.18.2/8.18.1/Submit) id 68MG9DAr020919 for openvpn-devel@lists.sourceforge.net; Tue, 22 Sep 2026 18:09:13 +0200 From: Gert Doering To: openvpn-devel@lists.sourceforge.net Date: Tue, 22 Sep 2026 18:09:07 +0200 Message-ID: <20260922160913.20905-1-gert@greenie.muc.de> X-Mailer: git-send-email 2.53.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Arne Schwabe This allows a server to signal a pending authentication that does not require any action from the user or client but can still take a while to complete and enter the auth pending state. Content analysis details: (1.3 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS X-Headers-End: 1x933a-0007yi-7T Subject: [Openvpn-devel] [PATCH v3] Document notify as auth pending method X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1877048948251575850 X-GMAIL-MSGID: 1877048948251575850 From: Arne Schwabe This allows a server to signal a pending authentication that does not require any action from the user or client but can still take a while to complete and enter the auth pending state. Change-Id: I6217c0541bff81eefa63a987db8904b2feda2546 Signed-off-by: Arne Schwabe Acked-by: Razvan Cojocaru Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1919 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1919 This mail reflects revision 3 of this Change. Acked-by according to Gerrit (reflected above): Razvan Cojocaru diff --git a/doc/management-notes.txt b/doc/management-notes.txt index 1126468..efbe757 100644 --- a/doc/management-notes.txt +++ b/doc/management-notes.txt @@ -794,6 +794,36 @@ The client should return the response to the crtext challenge using the cr-response command. +notify +====== +This is notification that there might be some activity that potentially takes +a while to finish is happening beyond the control of the client. This might be +a server side check or an out-of-band authentication like requiring to have +to authorise the connection on a mobile phone app. Beyond the control of +the client is here meant in the strict sense of OpenVPN client program. +This message still might prompt the user to look at their phone for example. + +The syntax of {EXTRA} for notify is: + + NOTIFY:: + +: a series of optional, comma-separated flags. No flags have +been defined yet. + +: The message to show the user to inform them about the +ongoing authentication + +An example for a notify EXTRA of a server that does some checks against +well known list of blacklists could be + + NOTIFY::Please wait while your IP is checked against multiple online abuse databases. + +to inform the user that there is a delay in the connection attempt. + +Since the notify pending auth is not requiring any action on the client side +that is required to continue the connection (unlike MFA or opening a browser) +this message is not negotiated but can just be sent as a gratuitous message. + COMMAND -- client-deny (OpenVPN 2.1 or higher) -----------------------------------------------