search

OpenVPN / openvpn

OpenVPN is an open source VPN daemon
http://openvpn.net
Other
10.25k stars 2.92k forks source link

Rejection of non-printable characters in server response vs newlines #568

Open yourealwaysbe opened 1 week ago

yourealwaysbe commented 1 week ago

Recently for OpenVPN 2.6.11 server responses containing non-printable characters (including new lines) have been rejected by OpenVPN.

I have to connect to a Watchguard VPN server, which appears to add a newline to the AUTH_FAILED challenge response message. Our IT team have configured the message, but did not add the newline character. This must be being added by Watchguard.

AUTH_FAILED,CRV1:R,E:292:dXhhYzAwOQ==:Please enter the code from your authenticator [newline]

I notice that the new line characters were explicitly rejected by the recent update. I expect this is deliberate and Watchguard will need to change, but thought i would flag it here in case newlines can be permitted.

schwabe commented 1 week ago

Do you know how Watchguard does this on the server side to include the newlines? Is that a custom OpenVPN implementation or something that uses OpenVPN 2.x?

yourealwaysbe commented 1 week ago

Sorry, i don't know much about Wireguard -- i'm just connecting to it via OpenVPN. This is their recommended method on Linux, but i don't see anything about versions on the help pages. It looks like it's closed source (or at least i didn't find any sources).