Has OpenVPN-NL been looked at?

[SnakeByte]

RMerlin,

A more secure fork(?) for OpenVPN was created a while back:
https://openvpn.fox-it.com/about.html

That, besides have more secure defaults set, uses the PolarSSL lib instead of OpenSSL.

OpenVPN and OpenVPN-NL are compatible with each other, and are under the same GPL licensing. (All of this is mentioned in that link above).

Have you seen this? It seems like it would work better for something like a router since it uses more code used by mobile (read: power/cpu constrained) devices.

 

[SnakeByte]

Barring that, have you looked at compiling OpenVPN against the PolarSSL (Now known as mbed TLS) lib instead of openssl?
https://community.openvpn.net/openvpn/wiki/UsingPolarSSL

It should be a drop in replacement.

Reasons to use PolarSSL over OpenSSL:
https://tls.mbed.org/openssl-alternative

Core Features:
https://tls.mbed.org/core-features

 

[RMerlin]

No, and no. No interest in either of these, for multiple reasons.

 

[lancethepants]

And not necessarily more secure.

https://guidovranken.wordpress.com/2015/10/07/cve-2015-5291/

 

[RMerlin]

And performance-wise, OpenSSL has the edge thanks to its ASM optimizations on the ARMv7 architecture.

 

[RMerlin]

I've taken a look at OpenVPN-NL.

https://openvpn.fox-it.com/about.html

It is NOT fully compatible with OpenVPN. They stripped away many options in the name of security. OpenVPN-NL for instance is unable to connect to anything BUT endpoints running AES-256-CBC with SHA256. They don't support any other cipher suite.

OpenVPN-NL should only be deployed in an environment where you control both the client and the server. It's unusable for many applications where one of the two endpoints are not under your control (for instance, when connecting to a third party tunnel provider). That makes it useless for a project such as this firmware.