Before diving into TLS mode and eventually tls-crypt-v2 it's worth to briefly discuss why we spend time reimplementing the OpenVPN™ protocol. You may ask yourself: why not just use the existing tried and tested implementation?
OpenVPN™ community edition is implemented in the C programming language. -It heavily uses the OpenSSL library[^mbedtls] which is as well written in C and has in the past had some notable security vulnerabilities. +It heavily uses the OpenSSL library[1] which is as well written in C and has in the past had some notable security vulnerabilities. Many vulnerabilities and bugs in C can be easily avoided in other languages due to bounds checking and stricter and more expressive type systems. The state machine of the protocol can be more easily be expressed in OCaml, and some properties of the protocol can be encoded in the type system.
Another reason is Mirage OS, a library operating system implemented in OCaml. We work on the Mirage project and write applications (unikernels) using Mirage. -In many cases it would be desirable to be able to connect to an existing VPN network[^vpn-network], +In many cases it would be desirable to be able to connect to an existing VPN network[2], or be able to offer a VPN network to clients using OpenVPN™.
Consider a VPN provider: The VPN provider runs many machines that run an operating system in order to run the user-space OpenVPN™ service. @@ -106,8 +106,12 @@ For general instructions on running Mirage unikernels see our GitHub, by mail or me personally on Mastodon if you're stuck.
-[^mbedtls]: It is possible to compile OpenVPN™ community edition with Mbed TLS instead of OpenSSL which is written in C as well.
-[^vpn-network]: I use the term "VPN network" to mean the virtual private network itself. It is a bit odd because the 'N' in 'VPN' is 'Network', but without disambiguation 'VPN' could refer to the network itself, the software or the service.
+It is possible to compile OpenVPN™ community edition with Mbed TLS instead of OpenSSL which is written in C as well.
+↩︎︎I use the term "VPN network" to mean the virtual private network itself. It is a bit odd because the 'N' in 'VPN' is 'Network', but without disambiguation 'VPN' could refer to the network itself, the software or the service.
+↩︎︎