OpenVPN / OpenVPN/openvpn3

Extend `--static-challenge` to support concat mode like OpenVPN

Open
#428 2 comments 3 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
C++
Stars
1.2k
Forks
467
PR merge metrics
No merged PRs in 30d

Description

OpenVPN 2.x recently added support for extending the --static-challenge option with a third argument (scrv1 or concat) to specify whether the password and response should be concatenated or use the SCRV1 protocol (default: scrv1).

This allows simpler handling of password+response in some server-side scripts/plugins that expect plain concatenation instead of the SCRV1-formatted string.

OpenVPN3 currently supports --static-challenge with only two arguments (challenge text and echo flag), but lacks this third argument for format selection.

https://github.com/OpenVPN/openvpn/commit/6f6a0f362f845f042a965f797b731f8931310372
https://gerrit.openvpn.net/c/openvpn/+/665
https://patchwork.openvpn.net/project/openvpn2/patch/20240719131407.75746-1-frank@lichtenheld.com/#6530
https://github.com/OpenVPN/openvpn-gui/issues/663

Example Usage

--static-challenge "Enter OTP:" 0 concat

This would prompt for the challenge response without echo and concatenate it directly with the password.

Why Needed

  • Compatibility with servers expecting concatenation behavior.
  • Parity with upstream OpenVPN features for easier migration.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the OpenVPN3 entry point that parses and handles --static-challenge, then compare its current two-argument behavior with the linked OpenVPN 2.x changes. Support the documented scrv1 default and concat form while preserving existing usage; done means the three-argument example works with the expected password and response format.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
networking, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.