blog.robur.coop/articles/miragevpn-ncp.html


<!doctype html>
<html lang="en">
  <head>
    <meta charset="utf-8">
    <meta http-equiv="x-ua-compatible" content="ie=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <title>
        Robur's blog - MirageVPN updated (AEAD, NCP)
    </title>
    <meta name="description" content="How we resurrected MirageVPN from its bitrot state">
    <link type="text/css" rel="stylesheet" href="../css/hl.css">
    <link type="text/css" rel="stylesheet" href="../css/style.css">
    <script src="../js/hl.js"></script>
    <link rel="alternate" type="application/rss+xml" href="../feed.xml" title="blog.robur.coop">
  </head>
  <body>
    <header>
      <h1>blog.robur.coop</h1>
      <blockquote>
        The <strong>Robur</strong> cooperative blog.
      </blockquote>
    </header>
    <main><a href="/index.html">Back to index</a>

<article>
    <h1>MirageVPN updated (AEAD, NCP)</h1>
    <ul class="tags-list"><li><a href="/tags/ocaml.html">ocaml</a></li><li><a href="/tags/mirageos.html">mirageos</a></li><li><a href="/tags/vpn.html">vpn</a></li><li><a href="/tags/security.html">security</a></li></ul><h2>Updating MirageVPN</h2>
<p>As announced <a href="https://blog.robur.coop/articles/miragevpn.html">earlier this month</a>, we've been working hard over the last months on MirageVPN (initially developed in 2019, targeting OpenVPN™ 2.4.7, now 2.6.6). We managed to receive funding from <a href="https://www.assure.ngi.eu/">NGI Assure</a> call (via <a href="https://nlnet.nl">NLnet</a>). We've made over 250 commits with more than 10k lines added, and 18k lines removed. We closed nearly all old issues, and opened 100 fresh ones, of which we already closed more than half of them. :D</p>
<h3>Actual bugs fixed (that were leading to non-working MirageVPN applications)</h3>
<p>In more detail, we had a specific configuration running over all the years, namely UDP mode with static keys (no TLS handshake, etc.). There were several issues (bitrot) that we encountered and solved along the path, amongst others:</p>
<ul>
<li>related to the <a href="https://github.com/robur-coop/miragevpn/pull/111">static-key mode and TCP/IP</a>,</li>
<li>the <a href="https://github.com/robur-coop/miragevpn/pull/98">order of ACK between the client and the server</a>,</li>
<li><a href="https://github.com/robur-coop/miragevpn/pull/110">outgoing TLS packets</a>.</li>
</ul>
<p>To avoid any future breakage while revising the code (cleaning it up, extending it), we are now building several unikernels as part of our CI system. We also have setup OpenVPN™ servers with various configurations that we periodically test with our new code (we'll also work on further automation thereof).</p>
<h3>New features: AEAD ciphers, supporting more configuration primitives</h3>
<p>We added various configuration primitives, amongst them configuratble tls ciphersuites, minimal and maximal tls version to use, <a href="https://blog.robur.coop/articles/miragevpn.html">tls-crypt-v2</a>, verify-x509-name, cipher,  remote-random, ...</p>
<p>From a cryptographic point of view, we are now supporting more <a href="https://github.com/robur-coop/miragevpn/pull/108">authentication hashes</a> via the configuration directive <code>auth</code>, namely the SHA2 family - previously, only SHA1 was supported, <a href="https://github.com/robur-coop/miragevpn/pull/125">AEAD ciphers</a> (AES-128-GCM, AES-256-GCM, CHACHA20-POLY1305) - previously only AES-256-CBC was supported.</p>
<h3>NCP - Negotiation of cryptographic parameters</h3>
<p>OpenVPN™ has a way to negotiate cryptographic parameters, instead of hardcoding them in the configuration. The client can propose its supported ciphers, and other features (MTU, directly request a push message for IP configuration, use TLS exporter secret instead of the hand-crafted (TLS 1.0 based PRF), ...) once the TLS handshake has been completed.</p>
<p>We are now supporting this negotiation protocol, and have been working on the different extensions that are useful to us. Namely, transmitting the <a href="https://github.com/robur-coop/miragevpn/pull/121">supported ciphers</a>, <a href="https://github.com/robur-coop/miragevpn/pull/129">request push</a> (which deletes an entire round-trip), <a href="https://github.com/robur-coop/miragevpn/pull/163">TLS-exporter</a>. This will also be part of the <a href="https://git.robur.coop/robur/openvpn-spec">protocol specification</a> that we're working on while finishing our implementation.</p>
<h3>Cleanups and refactorings</h3>
<p>We also took some time to cleanup our code base, removing <code>Lwt.fail</code> (which doesn't produce proper backtraces), using lzo from the decompress package (since that code has been upstreamed a while ago), remove unneeded dependencies (rresult, astring), avoiding <code>assert false</code> in pattern matches by improving types, improve the log output (include a timestamp, show log source, use colors).</p>
<h3>Future</h3>
<p>There is still some work that we want to do, namely a QubesOS client implementation, an operators manual, extending our specification, resurrecting and adapting the server implementation, supporting more NCP features (if appropriate), etc. So stay tuned, we'll also provide reproducible binaries once we're ready.</p>
<p>Don't hesitate to reach out to us on <a href="https://github.com/robur-coop/miragevpn/issues">GitHub</a>, <a href="https://robur.coop/Contact">by mail</a> or me personally <a href="https://mastodon.social/@hannesm">on Mastodon</a> if you're stuck.</p>

    </article>

        </main>
    <footer>
        <a href="https://github.com/xhtmlboi/yocaml">Powered by <strong>YOCaml</strong></a>
        <br />
    </footer>
    <script>hljs.highlightAll();</script>
  </body>
</html>
Built from 8f26c5fa8f9328e4a0b2c550380b888d9ce641e3 2023-11-20 14:06:31 +00:00
			`<!doctype html>`
			`<html lang="en">`
			`<head>`
			`<meta charset="utf-8">`
			`<meta http-equiv="x-ua-compatible" content="ie=edge">`
			`<meta name="viewport" content="width=device-width, initial-scale=1">`
			`<title>`
			`Robur's blog - MirageVPN updated (AEAD, NCP)`
			`</title>`
			`<meta name="description" content="How we resurrected MirageVPN from its bitrot state">`
			`<link type="text/css" rel="stylesheet" href="../css/hl.css">`
			`<link type="text/css" rel="stylesheet" href="../css/style.css">`
			`<script src="../js/hl.js"></script>`
			`<link rel="alternate" type="application/rss+xml" href="../feed.xml" title="blog.robur.coop">`
			`</head>`
			`<body>`
			`<header>`
			`<h1>blog.robur.coop</h1>`
			`<blockquote>`
			`The <strong>Robur</strong> cooperative blog.`
			`</blockquote>`
			`</header>`
			`<main><a href="/index.html">Back to index</a>`

			`<article>`
			`<h1>MirageVPN updated (AEAD, NCP)</h1>`
			`<ul class="tags-list"><li><a href="/tags/ocaml.html">ocaml</a></li><li><a href="/tags/mirageos.html">mirageos</a></li><li><a href="/tags/vpn.html">vpn</a></li><li><a href="/tags/security.html">security</a></li></ul><h2>Updating MirageVPN</h2>`
			<p>As announced <a href="https://blog.robur.coop/articles/miragevpn.html">earlier this month</a>, we've been working hard over the last months on MirageVPN (initially developed in 2019, targeting OpenVPN™ 2.4.7, now 2.6.6). We managed to receive funding from <a href="https://www.assure.ngi.eu/">NGI Assure</a> call (via <a href="https://nlnet.nl">NLnet</a>). We've made over 250 commits with more than 10k lines added, and 18k lines removed. We closed nearly all old issues, and opened 100 fresh ones, of which we already closed more than half of them. :D</p>
			`<h3>Actual bugs fixed (that were leading to non-working MirageVPN applications)</h3>`
			`<p>In more detail, we had a specific configuration running over all the years, namely UDP mode with static keys (no TLS handshake, etc.). There were several issues (bitrot) that we encountered and solved along the path, amongst others:</p>`
			`<ul>`
			`<li>related to the <a href="https://github.com/robur-coop/miragevpn/pull/111">static-key mode and TCP/IP</a>,</li>`
			`<li>the <a href="https://github.com/robur-coop/miragevpn/pull/98">order of ACK between the client and the server</a>,</li>`
			`<li><a href="https://github.com/robur-coop/miragevpn/pull/110">outgoing TLS packets</a>.</li>`
			`</ul>`
			`<p>To avoid any future breakage while revising the code (cleaning it up, extending it), we are now building several unikernels as part of our CI system. We also have setup OpenVPN™ servers with various configurations that we periodically test with our new code (we'll also work on further automation thereof).</p>`
			`<h3>New features: AEAD ciphers, supporting more configuration primitives</h3>`
			`<p>We added various configuration primitives, amongst them configuratble tls ciphersuites, minimal and maximal tls version to use, <a href="https://blog.robur.coop/articles/miragevpn.html">tls-crypt-v2</a>, verify-x509-name, cipher, remote-random, ...</p>`
			`<p>From a cryptographic point of view, we are now supporting more <a href="https://github.com/robur-coop/miragevpn/pull/108">authentication hashes</a> via the configuration directive <code>auth</code>, namely the SHA2 family - previously, only SHA1 was supported, <a href="https://github.com/robur-coop/miragevpn/pull/125">AEAD ciphers</a> (AES-128-GCM, AES-256-GCM, CHACHA20-POLY1305) - previously only AES-256-CBC was supported.</p>`
			`<h3>NCP - Negotiation of cryptographic parameters</h3>`
			`<p>OpenVPN™ has a way to negotiate cryptographic parameters, instead of hardcoding them in the configuration. The client can propose its supported ciphers, and other features (MTU, directly request a push message for IP configuration, use TLS exporter secret instead of the hand-crafted (TLS 1.0 based PRF), ...) once the TLS handshake has been completed.</p>`
			<p>We are now supporting this negotiation protocol, and have been working on the different extensions that are useful to us. Namely, transmitting the <a href="https://github.com/robur-coop/miragevpn/pull/121">supported ciphers</a>, <a href="https://github.com/robur-coop/miragevpn/pull/129">request push</a> (which deletes an entire round-trip), <a href="https://github.com/robur-coop/miragevpn/pull/163">TLS-exporter</a>. This will also be part of the <a href="https://git.robur.coop/robur/openvpn-spec">protocol specification</a> that we're working on while finishing our implementation.</p>
			`<h3>Cleanups and refactorings</h3>`
			`<p>We also took some time to cleanup our code base, removing <code>Lwt.fail</code> (which doesn't produce proper backtraces), using lzo from the decompress package (since that code has been upstreamed a while ago), remove unneeded dependencies (rresult, astring), avoiding <code>assert false</code> in pattern matches by improving types, improve the log output (include a timestamp, show log source, use colors).</p>`
			`<h3>Future</h3>`
			`<p>There is still some work that we want to do, namely a QubesOS client implementation, an operators manual, extending our specification, resurrecting and adapting the server implementation, supporting more NCP features (if appropriate), etc. So stay tuned, we'll also provide reproducible binaries once we're ready.</p>`
			`<p>Don't hesitate to reach out to us on <a href="https://github.com/robur-coop/miragevpn/issues">GitHub</a>, <a href="https://robur.coop/Contact">by mail</a> or me personally <a href="https://mastodon.social/@hannesm">on Mastodon</a> if you're stuck.</p>`

			`</article>`

			`</main>`
			`<footer>`
			`<a href="https://github.com/xhtmlboi/yocaml">Powered by <strong>YOCaml</strong></a>`
			`<br />`
			`</footer>`
			`<script>hljs.highlightAll();</script>`
			`</body>`
			`</html>`