#1099·openvpn

Send `RESTART,[P]:` instead of bare `RESTART` on server-initiated restart/exit

Author: kkalevCreated Aug 31, 2026Updated Aug 31, 2026

Environment

  • Debian Trixie
  • OpenVPN server version: 2.7.5-1~bpo13+1
  • Clients: OpenVPN 2 community (2.7.2) and OpenVPN Connect 3 (3.11.3)
  • Plugin: OpenVPN auth oAuth2 plugin version 2.0.1
  • Use authentication tokens and persistent HHAC keys (directives auth-gen-token 86400 and auth-gen-token-secret [keyfile]

Description / Problem Statement: When an OpenVPN server initiates a restart/reset (e.g., via SIGUSR1 or explicit management signals), it currently transmits a bare RESTART control message.

This causes inconsistent behavior across client implementations:

  • OpenVPN 2.x (Community): Reuses the active auth-token stored in memory and reconnects transparently.
  • OpenVPN Connect 3 (OpenVPN 3 Core): Interprets bare RESTART as a full session reset, purging ephemeral session tokens. Since the oauth2 plugin is in use, this forces users to re-enter credentials/OTP manually with the SSO server (unless the SSO session is already active) rather than completing a seamless background reconnection.

Proposed Solution / Feature Request:

  1. Update server restart signal emission to send RESTART,[P]: by default to preserve pushed authentication tokens across restarts.
  2. Alternatively, provide a configurable server directive to toggle between RESTART and RESTART,[P]: / RESTART,[PN]: behavior.

Impact: Aligns session persistence across both OpenVPN 2.x and OpenVPN 3 core engines, preventing unnecessary authentication during graceful server restarts or maintenance.