Send `RESTART,[P]:` instead of bare `RESTART` on server-initiated restart/exit
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 14.6k
- Forks
- 3.4k
- PR merge metrics
- No merged PRs in 30d
Description
Environment
- Debian Trixie
- OpenVPN server version: 2.7.5-1~bpo13+1
- Clients: OpenVPN 2 community (
2.7.2) and OpenVPN Connect 3 (3.11.3) - Plugin: OpenVPN auth oAuth2 plugin version
2.0.1 - Use authentication tokens and persistent HHAC keys (directives
auth-gen-token 86400andauth-gen-token-secret [keyfile]
Description / Problem Statement:
When an OpenVPN server initiates a restart/reset (e.g., via SIGUSR1 or explicit management signals), it currently transmits a bare RESTART control message.
This causes inconsistent behavior across client implementations:
- OpenVPN 2.x (Community): Reuses the active
auth-tokenstored in memory and reconnects transparently. - OpenVPN Connect 3 (OpenVPN 3 Core): Interprets bare
RESTARTas a full session reset, purging ephemeral session tokens. Since the oauth2 plugin is in use, this forces users to re-enter credentials/OTP manually with the SSO server (unless the SSO session is already active) rather than completing a seamless background reconnection.
Proposed Solution / Feature Request:
- Update server restart signal emission to send
RESTART,[P]:by default to preserve pushed authentication tokens across restarts. - Alternatively, provide a configurable server directive to toggle between
RESTARTandRESTART,[P]:/RESTART,[PN]:behavior.
Impact:
Aligns session persistence across both OpenVPN 2.x and OpenVPN 3 core engines, preventing unnecessary authentication during graceful server restarts or maintenance.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the server-initiated restart and exit signal emission and the control-message handling for bare RESTART. Compare the existing restart behavior with the proposed RESTART,[P]: and RESTART,[PN]: forms, then identify the relevant tests or add coverage showing that authentication tokens persist across a server restart without forcing reauthentication.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- authentication, networking
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100