Deprecate --no-replay

Following the removal of --no-iv, and as suggested by both recent audits (and done by OpenVPN-NL for 7 years now), it's time to get rid of the --no-replay option.

The only valid use case I can imagine is to slightly reduce the per-packet overhead for setups that do not use any authentication mechanism, but I do not believe that warrants keeping an option around that generally reduces security and makes our code more complex.

(If this patch is accepted, I'll send a follow-up patch to remove the option from the master branch.)

---
 Changes.rst           | 8 ++++++++
 doc/openvpn.8         | 4 ++++
 src/openvpn/options.c | 7 ++++++-
 3 files changed, 18 insertions(+), 1 deletion(-)

index 0b2b04dd..39d83a2d 100644
@@ -306,6 +306,14 @@ Maintainer-visible changes
   i386/i686 builds on RHEL5.
 
 
+Version 2.4.4
+=============
+
+Deprecated features
+-------------------
+- ``--no-replay`` is deprecated and will be removed in OpenVPN 2.5.
+
+
 Version 2.4.3
 =============
 

index 20bdd91b..3600b8fa 100644
@@ -4257,6 +4257,10 @@ supported by OpenSSL.
 .\"*********************************************************
 .TP
 .B \-\-no\-replay
+
+.B DEPRECATED
+This option will be removed in OpenVPN 2.5.
+
 (Advanced) Disable OpenVPN's protection against replay attacks.
 Don't use this option unless you are prepared to make
 a tradeoff of greater efficiency in exchange for less

index a84878ef..5246cb5a 100644
@@ -545,7 +545,7 @@ static const char usage_message[] =
 #ifndef ENABLE_CRYPTO_MBEDTLS
     "--engine [name] : Enable OpenSSL hardware crypto engine functionality.\n"
 #endif
-    "--no-replay     : Disable replay protection.\n"
+    "--no-replay     : (DEPRECATED) Disable replay protection.\n"
     "--mute-replay-warnings : Silence the output of replay warnings to log file.\n"
     "--replay-window n [t]  : Use a replay protection sliding window of size n\n"
     "                         and a time window of t seconds.\n"

@@ -2484,6 +2484,11 @@ options_postprocess_verify_ce(const struct options *options, const struct connec
         msg(M_USAGE, "NCP cipher list contains unsupported ciphers.");
     }
 
+    if (!options->replay)
+    {
+        msg(M_WARN, "WARNING: --no-replay is DEPRECATED and will be removed in 2.5");
+    }
+
     /*
      * Check consistency of replay options
      */

2.11.0

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

ACK. Please send patch for git master removing this feature. I considered applying it to git master, as a way to track it. But decided not to do that now.

Your patch has been applied to the release/2.4 branch.

commit e3da00918d2dd99c116f6da1a14a2a73b72829f4

Author: Steffan Karger
Date:   Sat Jul 1 13:22:08 2017 +0200

Deprecate --no-replay

Signed-off-by: Steffan Karger
Acked-by: David Sommerseth
Message-Id: <[email protected]...>
URL: https://www.mail-archive.com/[email protected]/msg15003.html
Signed-off-by: David Sommerseth

- --
kind regards,

David Sommerseth

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)

iQIcBAEBCgAGBQJZk01dAAoJEIbPlEyWcf3yTzoQAKR5rlvu5wf+TtXjluxO9CNx q9Ausjy8C8C87ltHEPm2CgNcq3BywqCyaxxoy+yox97PGeCgQ1EBRkOtlnwBdrZi 9Ad3gnyNlYw0iX/oZ3A7MH1dr6jH8f2gTLcxdwcyvacmeDpS0Y2R31VFKJbYHMKX 9afXWqxkpkFhVvi1Mwph3RR+dTO8OSxmVExGKM1E1q5aSB3Vfsp2vk2qtlUyaij7 uOAS/TaBole5k2VUnwfMH5fdw6fBnosc2eRw+kqY3NdjQKE3TiH5MuwqnsP5tsbt eW4Do5xT2kU+XgY2jp0dPI4ImD8aUfVYg0Ud54A4n0E0uf6KCkGCPkDBr5KhObiP if+Yl5Zv3W2W5ZsN7tbB+IyZGJMoqghqG0a/fw8Ef4A6ZsH+aSCtgQyE/CoTvFA/ 5I6q97EFQIiLsbyMAnk2Wb1IC1nxgO1HcHudOcGOtqLwz+ungHcdZQv6H5xecDDi 0YLteRG5sxM7CBxjOD3gs1nk+BbbtSp/DAFe3VNw+F0EVOCcmcuSGdBvW5ZwZcq8 FIrm6znVgvOklO+a0/jm0lYLSSiJmvhDh2zEK5ovFOD+Rw6KAodDoyz3d84oyRJG A9mb+v/3WgqxDRuM+O173Hti9pHcv3zXmmF5e9tuQIOEQdXSliGG+UV7fRvhW9up BemIFv02Qac9uW9yKFjJ
=HIXh
-----END PGP SIGNATURE-----