The OpenVPN-NL lifecycle

Current release

The current release of OpenVPN-NL is based on:

• OpenVPN 2.5.11
• mbed TLS 2.28.8
• PKCS11-helper 1.25.1
• LibLZO v2.10

Required cryptographic options:

• OpenVPN ciphers and cipher modes: AES-256-CBC, AES-256-GCM
  
• OpenVPN message digest/HMAC: SHA256
• TLS Cipher: TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384, TLS-DHE-RSA-WITH-AES-256-GCM-SHA384, TLS-DHE-RSA-WITH-AES-256-CBC-SHA256 or TLS-DHE-RSA-WITH-AES-256-CBC-SHA, with 2048 bit moduli for EDH or P-256 of P-384 for ECDH

OpenVPN-NL is available as compiled installable packages for the following platforms:

• Debian Linux
• Red Hat Enterprise Linux Server
• SUSE Linux Enterprise Server
• Ubuntu Linux LTS
• Microsoft Windows

The source code is available as a tarball as well, but not supported.

The current release of the Deployment Advisory is Version 2.5

Releases

New releases

The following events can trigger new releases:

• A new release of one of the packages on which OpenVPN-NL is based
• A new release of one of the platforms for which OpenVPN-NL is packaged

Releases which address security issues will be released as quickly as possible, other releases will be dealt with at a more planned pace.

In line with the upstream OpenVPN policy, new releases of OpenVPN-NL will if possible, be backwards compatible in the sense that two different OpenVPN(-NL) releases can connect to one another (they do not break the protocol), and that new OpenVPN(-NL) releases can read the configuration files of older versions of OpenVPN(-NL).

Announcements

When a new release of OpenVPN-NL is available, this will always be announced through the OpenVPN-NL mailing list. This is a low-volume read-only mailing list for this purpose only. Announcements include a statement on whether the new release addresses security issues.

The information below is outdated in parts and will be updated in the near future.

New upstream OpenVPN releases

New upstream OpenVPN releases may add new functionality. While the basic attitude is to adopt these new functions into OpenVPN-NL, this is not guaranteed. Some new functionality may not be adopted for practical or security reasons.

• A note on practical reasons: Version 2.3 of OpenVPN includes most of the improvements that defined the difference between OpenVPN 2.1.4 and OpenVPN-NL. This means that from version 2.3 of OpenVPN and onwards, adopting new features of the main OpenVPN branch can and will be rather generously adopted into OpenVPN-NL.
• A note on security reasons: OpenVPN-NL is packaged in such a way that many configurations the NBV advises against are not supported. This means for example that various older cryptographic functions are not supported, and that null-encryption is also not supported. Should a new version of the OpenVPN branch include functionality that NBV advises against, it is very likely that those functions will not be adopted into OpenVPN-NL.

New and old releases of a Linux platform

If one of the supported Linux platforms has a new release, the following will happen:

• The next release of OpenVPN-NL will include support for the new version of that platform. If the time between the platform release and the next OpenVPN-NL release is expected to be more than three months, an extra release of OpenVPN-NL for that platform only will be made.
• In the first six months after the new release of the platform, new releases of OpenVPN-NL will also be packaged for the old release of that Linux platform. After those six months, new OpenVPN-NL releases will no longer be packaged for the old release of that Linux platform.
  
  Given the way that OpenVPN-NL is compiled and packaged, it is not unlikely that the package of a newer platform release will work on the older release of that platform.

Windows: special notes on XP, Vista, 10 and future versions

Compared to Linux, Windows is a rather complicated platform to build packages for. Counted in man-hours of work, the majority of time is dedicated to supporting the Windows platform. The Windows release of OpenVPN will be tested against 7, 2008 Server, and 8.1.

• XP: It should be noted that XP has reached its end of support by April 8, 2014. OpenVPN-NL 2.3.9-nl4 is the last version to run on Windows XP.
• Vista: The releases will not be tested against Vista, but are not unlikely to work. However, no effort will be taken to solve any problems which are specific to Vista.
• 10: Not supported yet.
• Future Windows versions: Whether a new Windows version will result in actions to ensure that OpenVPN-NL will work on that version of Windows, will be decided on a case-by-case basis.

Source code

The source code of OpenVPN-NL finds its way to the public via two channels:

• All modifications of OpenVPN-NL to upstream OpenVPN are submitted to the open source OpenVPN community. Most of the bigger patches have found their way into the upstream OpenVPN 2.3 branch. Some smaller patches, typically those that reduce functionality (e.g. reduce the available cryptographic algorithms) will at most find their way to the "contrib" repositories.
• For all OpenVPN-NL releases which are available for download, the source code of that version will be made available. The positive evaluation of the NBV applies only to the binaries which are distributed via the OpenVPN-NL website. One may choose to compile OpenVPN-NL oneself, but the assessment of the NBV is not warranted for any self-compiled version. The source code of OpenVPN-NL is distributed in this manner as a courtesy to the professional who really knows what he is doing, and also to comply with the copyright licence which applies to the source code (GPLv2).

Old releases

A specific release for a platform is always in one of the following three states:

• Current: this release is up-to-date. This one is the recommended release for that platform.
• Deprecated: this is an old version of OpenVPN-NL for that platform, which is not up-to-date, but has no known security issues. If a current version exists for the platform, that version is recommended for general reasons. There are no security-related reasons to advise against using an deprecated version.
• Untrusted/insecure: this is an old release of OpenVPN-NL, for which reasons exist to very strongly advise against using it. There are two typical cases:
  • The release has become that much different from the current version of OpenVPN-NL, that it is no longer practical to determine whether a vulnerability found in a current (or deprecated) release applies to the old release.
  • The version has known vulnerabilities or is for other reasons sufficiently suspect to very strongly advise against using it.

The state of a release always moves down, and may skip the deprecated state. For example, a current release might directly become untrusted/insecure, skipping the deprecated state. A release in the deprecated state may quickly advance into the untrusted/insecure state.

On the OpenVPN-NL website, current and deprecated releases will be available for download, but untrusted/insecure versions and their corresponding source code will never be available for download. Untrusted/insecure versions or corresponding source code will also not be available via other channels from NBV or Fox-IT.

System administrators that for some reason are dependent on a specific release of OpenVPN should be aware that it may become untrusted/insecure at some time in the future. Workarounds might exist which mitigate the vulnerabilities in a specific context to some extent. However, such an untrusted/insecure release will no longer be available for download, so the administrator that heavily depends on such a particular release might choose to pre-emptively hold a backup of the OpenVPN-NL release. Nevertheless, under all circumstances, NBV advises to use a current OpenVPN-NL release.

When an OpenVPN-NL release moves into the untrusted/insecure state, this will be announced on the OpenVPN-NL mailing list. This announcement will typically be complemented with the announcement of a new release.