Issue metadata
Sign in to add a comment
|
Feature Request: More robust support for OpenVPN ONC
Reported by
brent.sa...@gmail.com,
Sep 28 2017
|
||||||||||||||||||||||||
Issue description
UserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0
Platform: N/A
Steps to reproduce the problem:
ONC configuration for OpenVPN connections are missing some features supported by OpenVPN upstream that may be helpful.
For example:
--fragment 1200 --mssfix
(and/or --tun-mtu 1200 and --mtu-ping parameters, etc.)
The reason this comes up is a large percentage of e.g. African countries' ISPs (and WIMAX, Satellite ISPs, etc.) tend to modify MTU windows in-transit (or just plain have smaller ones set), so these parameters are requirements to bypass these limitations if crossing intercontinental backbones.
I proposed the following to the authors the spec sheet[0] for ONC:
"...It may be a boon to provide a mechanism to pass an array of
additional OpenVPN parameters in the ONC parsing (e.g.
"AdditionalParams": {"fragment": 1200, "mssfix": true}, etc.)..."
But, as stevenjb pointed out to me, this will not work because "[you] have a configuration layer between Chrome and openvpn ("Shill"), partly for secuity reasons."
However, I do think it'd be sensible to be able to support all client-side options[1]. At the very least for my particular use-case, I need to provide some way to work around the aforementioned MTU issue for my clients.
[0] https://chromium.googlesource.com/chromium/src/+/master/components/onc/docs/onc_spec.md
[1] https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage (relevant man page sections: "Tunnel Options", "Client Mode", "Data Channel Encryption Options", "TLS Mode Options", "IPv6 Related Options")
What is the expected behavior?
What went wrong?
not able to apply additional parameters
Did this work before? N/A
Chrome version: (all) Channel: n/a
OS Version: (all)
Flash Version:
,
Sep 29 2017
,
Nov 21 2017
> However, I do think it'd be sensible to be able to support all client-side options The OpenVPN protocol is highly configurable, so there has always been tension between the Chrome OS philosophy of "keep things simple" and the desire to support the dozens of features built into the OpenVPN client. Maybe try https://play.google.com/store/apps/details?id=de.blinkt.openvpn&hl=en ? |
|||||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||||
Comment 1 by abodenha@chromium.org
, Sep 29 2017Labels: -Type-Bug Type-Feature