OpenVPN / OpenVPN/openvpn

Send `RESTART,[P]:` instead of bare `RESTART` on server-initiated restart/exit

Open
#1,099 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
14.6k
Forks
3.4k
PR merge metrics
No merged PRs in 30d

Description

Environment

  • Debian Trixie
  • OpenVPN server version: 2.7.5-1~bpo13+1
  • Clients: OpenVPN 2 community (2.7.2) and OpenVPN Connect 3 (3.11.3)
  • Plugin: OpenVPN auth oAuth2 plugin version 2.0.1
  • Use authentication tokens and persistent HHAC keys (directives auth-gen-token 86400 and auth-gen-token-secret [keyfile]

Description / Problem Statement:
When an OpenVPN server initiates a restart/reset (e.g., via SIGUSR1 or explicit management signals), it currently transmits a bare RESTART control message.

This causes inconsistent behavior across client implementations:

  • OpenVPN 2.x (Community): Reuses the active auth-token stored in memory and reconnects transparently.
  • OpenVPN Connect 3 (OpenVPN 3 Core): Interprets bare RESTART as a full session reset, purging ephemeral session tokens. Since the oauth2 plugin is in use, this forces users to re-enter credentials/OTP manually with the SSO server (unless the SSO session is already active) rather than completing a seamless background reconnection.

Proposed Solution / Feature Request:

  1. Update server restart signal emission to send RESTART,[P]: by default to preserve pushed authentication tokens across restarts.
  2. Alternatively, provide a configurable server directive to toggle between RESTART and RESTART,[P]: / RESTART,[PN]: behavior.

Impact:
Aligns session persistence across both OpenVPN 2.x and OpenVPN 3 core engines, preventing unnecessary authentication during graceful server restarts or maintenance.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing the server-initiated restart and exit signal emission and the control-message handling for bare RESTART. Compare the existing restart behavior with the proposed RESTART,[P]: and RESTART,[PN]: forms, then identify the relevant tests or add coverage showing that authentication tokens persist across a server restart without forcing reauthentication.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
authentication, networking
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.