Skip to contentSkip to conversation

Deprecate --no-iv

PATCH In review Steffan Karger 3 participants 4 messages Dec 7, 2016

lore
Share & tools
lore

Steffan Karger

author
#0 lore raw

PATCH 1/1 Deprecate --no-iv

This fixes the bug of supporting --no-iv (since we're only accepting bugfixes in the current release phase ;) ).

The --no-iv function decreases security if used (CBC *requires* unpredictable IVs, other modes don't allow --no-iv at all), and even marginally decreases other user's security by adding unwanted complexity to our code. Let's get rid of this.

Signed-off-by Steffan Karger <[email protected]...>
---
 Changes.rst           | 2 ++
 doc/openvpn.8         | 4 ++++
 src/openvpn/options.c | 4 ++++
 3 files changed, 10 insertions(+)
Changes.rst +2 -0
index 843f2bd..4fb5ab5 100644
@@ -171,6 +171,8 @@ Deprecated features
   X.509 subject formatting must be updated to the standardized formatting.  See
   the man page for more information.
 
+- ``--no-iv`` is deprecated in 2.4 and will be remove in 2.5.
+
 User-visible Changes
 --------------------
 - For certificate DNs with duplicate fields, e.g. "OU=one,OU=two", both fields
doc/openvpn.8 +4 -0
index 290a441..e5619c0 100644
@@ -4399,6 +4399,10 @@ This option only makes sense when replay protection is enabled
 .\"*********************************************************
 .TP
 .B \-\-no\-iv
+
+.B DEPRECATED
+This option will be removed in OpenVPN 2.5.
+
 (Advanced) Disable OpenVPN's use of IV (cipher initialization vector).
 Don't use this option unless you are prepared to make
 a tradeoff of greater efficiency in exchange for less
src/openvpn/options.c +4 -0
index 4c4b160..8961eca 100644
@@ -2238,6 +2238,10 @@ options_postprocess_verify_ce (const struct options *options, const struct conne
     {
       msg (M_USAGE, "--no-iv not allowed when NCP is enabled.");
     }
+  if (!options->use_iv)
+    {
+      msg (M_WARN, "WARNING: --no-iv is deprecated and will be removed in 2.5");
+    }
 
   /*
    * Check consistency of replay options
Signature · 1 line
2.7.4
#1 lore raw

ACK. We have too many options :-) - tested.

Your patch has been applied to the master branch.

commit b5bf19b1579343ddccaddf2bb464ef2a5a09664d

Author: Steffan Karger
Date:   Wed Dec 7 20:20:47 2016 +0100
     Deprecate --no-iv

     Signed-off-by: Steffan Karger <[email protected]...>
     Acked-by: Gert Doering <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://www.mail-archive.com/search?l=mid&[email protected]...
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering

#2 lore raw
In reply to Steffan Karger

Am 07.12.16 um 20:20 schrieb Steffan Karger:

Quoted 20 lines

This fixes the bug of supporting --no-iv (since we're only accepting bugfixes in the current release phase ;) ).

The --no-iv function decreases security if used (CBC *requires* unpredictable IVs, other modes don't allow --no-iv at all), and even marginally decreases other user's security by adding unwanted complexity to our code. Let's get rid of this.

Signed-off-by Steffan Karger <[email protected]...>
---
 Changes.rst           | 2 ++
 doc/openvpn.8         | 4 ++++
 src/openvpn/options.c | 4 ++++
 3 files changed, 10 insertions(+)
Changes.rst +0 -0
index 843f2bd..4fb5ab5 100644

Changes.rst Deprecated features · line 174

Quoted 4 lines
Changes.rst +1 -0
@@ -171,6 +171,8 @@ Deprecated features
   X.509 subject formatting must be updated to the standardized formatting.  See
   the man page for more information.
 
+- ``--no-iv`` is deprecated in 2.4 and will be remove in 2.5.

Typo: removed

Quoted 9 lines
Changes.rst +1 -0
+
 User-visible Changes
 --------------------
 - For certificate DNs with duplicate fields, e.g. "OU=one,OU=two", both fields
doc/openvpn.8 +0 -0
index 290a441..e5619c0 100644

doc/openvpn.8 This option only makes sense when replay protection is enabled · line 4407

Quoted 9 lines
doc/openvpn.8 +4 -0
@@ -4399,6 +4399,10 @@ This option only makes sense when replay protection is enabled
 .\"*********************************************************
 .TP
 .B \-\-no\-iv
+
+.B DEPRECATED
+This option will be removed in OpenVPN 2.5.
+
 (Advanced) Disable OpenVPN's use of IV (cipher initialization vector).
 Don't use this option unless you are prepared to make

We should use long forms, i.e. do not in this case, in our files I think.

Quoted 6 lines
doc/openvpn.8 +0 -0
 a tradeoff of greater efficiency in exchange for less
src/openvpn/options.c +0 -0
index 4c4b160..8961eca 100644

src/openvpn/options.c options_postprocess_verify_ce (const struct options *options, const struct conne · line 2247

Quoted 10 lines
src/openvpn/options.c +4 -0
@@ -2238,6 +2238,10 @@ options_postprocess_verify_ce (const struct options *options, const struct conne
     {
       msg (M_USAGE, "--no-iv not allowed when NCP is enabled.");
     }
+  if (!options->use_iv)
+    {
+      msg (M_WARN, "WARNING: --no-iv is deprecated and will be removed in 2.5");
+    }
 
   /*
    * Check consistency of replay options

ACK

#3 lore raw

Hi,

Quoted 3 lines · Arne Schwabe
Quoted 1 line

+- ``--no-iv`` is deprecated in 2.4 and will be remove in 2.5.

Typo: removed

Since I had not pushed it yet, I've changed Changes.rst to fix that, and added your Acked-By:

The new commitish is now

commit 4969f0d6bba8a82d411f0700c2e8e4efbeccb6c8

Author: Steffan Karger <[email protected]...>
Date:   Wed Dec 7 20:20:47 2016 +0100
    Deprecate --no-iv

no other changes to the original patch.

gert

Signature · 4 lines
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             [email protected]...
fax: +49-89-35655025                        [email protected]...