Current Gluetun with OpenVPN 2.4 and OpenSSL 1.1

Dockerfile

@@ -85,7 +85,7 @@ ENV VPN_SERVICE_PROVIDER=pia \
     OPENVPN_PASSWORD= \
     OPENVPN_USER_SECRETFILE=/run/secrets/openvpn_user \
     OPENVPN_PASSWORD_SECRETFILE=/run/secrets/openvpn_password \
-    OPENVPN_VERSION=2.6 \
+    OPENVPN_VERSION=2.4 \
     OPENVPN_VERBOSITY=1 \
     OPENVPN_FLAGS= \
     OPENVPN_CIPHERS= \
@@ -224,6 +224,9 @@ EXPOSE 8000/tcp 8888/tcp 8388/tcp 8388/udp
 HEALTHCHECK --interval=5s --timeout=5s --start-period=10s --retries=3 CMD /gluetun-entrypoint healthcheck
 ARG TARGETPLATFORM
 RUN apk add --no-cache --update -l wget && \
+    apk add --no-cache --update -X "https://dl-cdn.alpinelinux.org/alpine/v3.12/main" openvpn\~2.4 && \
+    apk add --no-cache --update -X "https://dl-cdn.alpinelinux.org/alpine/v3.16/main" openssl\~1.1 && \
+    mv /usr/sbin/openvpn /usr/sbin/openvpn2.4 && \
     apk add --no-cache --update -X "https://dl-cdn.alpinelinux.org/alpine/v3.17/main" openvpn\~2.5 && \
     mv /usr/sbin/openvpn /usr/sbin/openvpn2.5 && \
     apk del openvpn && \

cmd/gluetun/main.go

@@ -270,6 +270,7 @@ func _main(ctx context.Context, buildInfo models.BuildInformation,
 
 	err = printVersions(ctx, logger, []printVersionElement{
 		{name: "Alpine", getVersion: alpineConf.Version},
+		{name: "OpenVPN 2.4", getVersion: ovpnConf.Version24},
 		{name: "OpenVPN 2.5", getVersion: ovpnConf.Version25},
 		{name: "OpenVPN 2.6", getVersion: ovpnConf.Version26},
 		{name: "IPtables", getVersion: firewallConf.Version},

internal/configuration/settings/openvpn.go

@@ -19,7 +19,7 @@ import (
 // OpenVPN contains settings to configure the OpenVPN client.
 type OpenVPN struct {
 	// Version is the OpenVPN version to run.
-	// It can only be "2.5" or "2.6".
+	// It can only be "2.4".
 	Version string `json:"version"`
 	// User is the OpenVPN authentication username.
 	// It cannot be nil in the internal state if OpenVPN is used.
@@ -90,7 +90,7 @@ var ivpnAccountID = regexp.MustCompile(`^(i|ivpn)\-[a-zA-Z0-9]{4}\-[a-zA-Z0-9]{4
 
 func (o OpenVPN) validate(vpnProvider string) (err error) {
 	// Validate version
-	validVersions := []string{openvpn.Openvpn25, openvpn.Openvpn26}
+	validVersions := []string{openvpn.Openvpn24}
 	if err = validate.IsOneOf(o.Version, validVersions...); err != nil {
 		return fmt.Errorf("%w: %w", ErrOpenVPNVersionIsNotValid, err)
 	}
@@ -289,7 +289,7 @@ func (o *OpenVPN) overrideWith(other OpenVPN) {
 }
 
 func (o *OpenVPN) setDefaults(vpnProvider string) {
-	o.Version = gosettings.DefaultComparable(o.Version, openvpn.Openvpn26)
+	o.Version = gosettings.DefaultComparable(o.Version, openvpn.Openvpn24)
 	o.User = gosettings.DefaultPointer(o.User, "")
 	if vpnProvider == providers.Mullvad {
 		o.Password = gosettings.DefaultPointer(o.Password, "m")

internal/configuration/settings/settings.go

@@ -4,9 +4,7 @@ import (
 	"fmt"
 	"net/netip"
 
-	"github.com/qdm12/gluetun/internal/configuration/settings/helpers"
 	"github.com/qdm12/gluetun/internal/constants/providers"
-	"github.com/qdm12/gluetun/internal/constants/vpn"
 	"github.com/qdm12/gluetun/internal/models"
 	"github.com/qdm12/gluetun/internal/pprof"
 	"github.com/qdm12/gosettings/reader"
@@ -162,18 +160,6 @@ func (s Settings) Warnings() (warnings []string) {
 			" so this will likely not work anymore. See https://github.com/qdm12/gluetun/issues/1498.")
 	}
 
-	if helpers.IsOneOf(s.VPN.Provider.Name, providers.SlickVPN) &&
-		s.VPN.Type == vpn.OpenVPN {
-		warnings = append(warnings, "OpenVPN 2.5 and 2.6 use OpenSSL 3 "+
-			"which prohibits the usage of weak security in today's standards. "+
-			s.VPN.Provider.Name+" uses weak security which is out "+
-			"of Gluetun's control so the only workaround is to allow such weaknesses "+
-			`using the OpenVPN option tls-cipher "DEFAULT:@SECLEVEL=0". `+
-			"You might want to reach to your provider so they upgrade their certificates. "+
-			"Once this is done, you will have to let the Gluetun maintainers know "+
-			"by creating an issue, attaching the new certificate and we will update Gluetun.")
-	}
-
 	// TODO remove in v4
 	if s.DNS.ServerAddress.Unmap().Compare(netip.AddrFrom4([4]byte{127, 0, 0, 1})) != 0 {
 		warnings = append(warnings, "DNS address is set to "+s.DNS.ServerAddress.String()+

internal/configuration/settings/settings_test.go

@@ -30,7 +30,7 @@ func Test_Settings_String(t *testing.T) {
 |   |           ├── Protocol: UDP
 |   |           └── Private Internet Access encryption preset: strong
 |   └── OpenVPN settings:
-|       ├── OpenVPN version: 2.6
+|       ├── OpenVPN version: 2.4
 |       ├── User: [not set]
 |       ├── Password: [not set]
 |       ├── Private Internet Access encryption preset: strong

internal/constants/openvpn/versions.go

@@ -1,6 +1,5 @@
 package openvpn
 
 const (
-	Openvpn25 = "2.5"
-	Openvpn26 = "2.6"
+	Openvpn24 = "2.4"
 )

internal/openvpn/start.go

@@ -13,19 +13,16 @@ import (
 var ErrVersionUnknown = errors.New("OpenVPN version is unknown")
 
 const (
-	binOpenvpn25 = "openvpn2.5"
-	binOpenvpn26 = "openvpn2.6"
+	binOpenvpn24 = "openvpn2.4"
 )
 
 func start(ctx context.Context, starter CmdStarter, version string, flags []string) (
 	stdoutLines, stderrLines <-chan string, waitError <-chan error, err error,
 ) {
 	var bin string
 	switch version {
-	case openvpn.Openvpn25:
-		bin = binOpenvpn25
-	case openvpn.Openvpn26:
-		bin = binOpenvpn26
+	case openvpn.Openvpn24:
+		bin = binOpenvpn24
 	default:
 		return nil, nil, nil, fmt.Errorf("%w: %s", ErrVersionUnknown, version)
 	}

internal/openvpn/version.go

@@ -8,12 +8,8 @@ import (
 	"strings"
 )
 
-func (c *Configurator) Version25(ctx context.Context) (version string, err error) {
-	return c.version(ctx, binOpenvpn25)
-}
-
-func (c *Configurator) Version26(ctx context.Context) (version string, err error) {
-	return c.version(ctx, binOpenvpn26)
+func (c *Configurator) Version24(ctx context.Context) (version string, err error) {
+	return c.version(ctx, binOpenvpn24)
 }
 
 var ErrVersionTooShort = errors.New("version output is too short")

internal/provider/airvpn/openvpnconf.go

@@ -28,6 +28,8 @@ func (p *Provider) OpenVPNConfig(connection models.Connection,
 	}
 
 	switch settings.Version {
+	case openvpn.Openvpn24:
+		providerSettings.Ciphers = []string{openvpn.AES256cbc}
 	case openvpn.Openvpn25, openvpn.Openvpn26:
 		providerSettings.Ciphers = []string{
 			openvpn.AES256gcm, openvpn.AES256cbc, openvpn.AES192gcm,

internal/provider/custom/openvpnconf_test.go

@@ -64,8 +64,8 @@ func Test_modifyConfig(t *testing.T) {
 				"suppress-timestamps",
 				"auth-user-pass /etc/openvpn/auth.conf",
 				"verb 0",
-				"data-ciphers-fallback cipher",
-				"data-ciphers cipher",
+				"cipher cipher", //nolint:dupword
+				"ncp-ciphers cipher",
 				"auth sha512",
 				"mssfix 1000",
 				"pull-filter ignore \"route-ipv6\"",

internal/provider/slickvpn/openvpnconf.go

@@ -31,11 +31,5 @@ func (p *Provider) OpenVPNConfig(connection models.Connection,
 		},
 	}
 
-	// SlickVPN's certificate is sha1WithRSAEncryption and sha1 is now
-	// rejected by openssl 3.x.x which is used by OpenVPN >= 2.5.
-	// We lower the security level to 3 to allow this algorithm,
-	// see https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_set_security_level.html
-	providerSettings.TLSCipher = "DEFAULT:@SECLEVEL=0"
-
 	return utils.OpenVPNConfig(providerSettings, connection, settings, ipv6Supported)
 }

internal/provider/utils/cipher.go

@@ -10,7 +10,7 @@ func CipherLines(ciphers []string) (lines []string) {
 	}
 
 	return []string{
-		"data-ciphers-fallback " + ciphers[0],
-		"data-ciphers " + strings.Join(ciphers, ":"),
+		"cipher " + ciphers[0],
+		"ncp-ciphers " + strings.Join(ciphers, ":"),
 	}
 }

internal/provider/utils/cipher_test.go

@@ -16,16 +16,16 @@ func Test_CipherLines(t *testing.T) {
 		"empty version": {
 			ciphers: []string{"AES"},
 			lines: []string{
-				"data-ciphers-fallback AES",
-				"data-ciphers AES",
+				"cipher AES",
+				"ncp-ciphers AES",
 			},
 		},
-		"2.5": {
+		"2.4": {
 			ciphers: []string{"AES", "CBC"},
-			version: "2.5",
+			version: "2.4",
 			lines: []string{
-				"data-ciphers-fallback AES",
-				"data-ciphers AES:CBC",
+				"cipher AES",
+				"ncp-ciphers AES:CBC",
 			},
 		},
 	}