options: Remove --tls-remote

In OpenVPN 2.3 --tls-remote got deprecated in favour of --verify-x509-name. The new option solves the same task as --tls-remote but in a more flexible and improved way. This new option was introduced in commit 9f0fc745664fd0 (release/2.3: f6e12862cefd054eb1). Removing --tls-remote will only require a minor configuration file change.

The removal of this option has been documented in the man pages since the release of OpenVPN v2.3, where also the deprecation of --compat-names and --no-name-remapping was included. However, those two will first be removed in OpenVPN v2.5.

The reason not to remove --compat-names and --no-name-remapping now is that such a change will require TLS verification scripts and plug-ins to be updated to support the new X.509 subject formatting; which --verify-x509-name already uses.

---
 Changes.rst              |  8 ++++++++
 doc/openvpn.8            | 53 +++---------------------------------------------
 src/openvpn/options.c    | 49 ++++----------------------------------------
 src/openvpn/ssl_verify.h |  2 --
 4 files changed, 15 insertions(+), 97 deletions(-)

index 2b99a1d..d900f81 100644
@@ -120,6 +120,14 @@ Deprecated features
   will then use ``--key-method 2`` by default.  Note that this requires changing
   the option in both the client and server side configs.
 
+- ``--tls-remote`` is removed in 2.4, as indicated in the 2.3 man-pages.  A similar
+  functionality is provided via ``--verify-x509-name`` which does the same job in
+  a better way.
+
+- ``--compat-names`` and ``--no-name-remapping`` was deprecated in 2.3 and will
+  be removed in 2.5.  All scripts and plug-ins depending on the old non-standard
+  X.509 subject formatting must be updated to the standardized formatting.  See
+  the man page for more information.
 
 User-visible Changes
 --------------------

index e5b5950..98312fd 100644
@@ -67,8 +67,6 @@ struct cert_hash_set {
 #define VERIFY_X509_SUBJECT_DN          1
 #define VERIFY_X509_SUBJECT_RDN         2
 #define VERIFY_X509_SUBJECT_RDN_PREFIX  3
-#define TLS_REMOTE_SUBJECT_DN           1 + 0x100
-#define TLS_REMOTE_SUBJECT_RDN_PREFIX   3 + 0x100
 
 #define TLS_AUTHENTICATION_SUCCEEDED  0
 #define TLS_AUTHENTICATION_FAILED     1

1.8.3.1

ACK - does what it says on the lid (plus remove all cross-checks for options that could have been set by --tls-remote)

Your patch has been applied to the master branch.

commit 10ce637066f44e8ad9f4af000b8d0c2a4012236d

Author: David Sommerseth
Date:   Tue Nov 15 14:40:56 2016 +0100

     options: Remove --tls-remote

     Signed-off-by: David Sommerseth <[email protected]...>
     Acked-by: Gert Doering <[email protected]...>
     Message-Id: <[email protected]...>
     URL: https://www.mail-archive.com/[email protected]/msg13070.html
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering