Highlight deprecated features
PATCH 1/1 Highlight deprecated features
We have quite a list of deprecated options currently. Ensure this is highlighted both in documentation and code.
This patch builds on the wiki page [1] enlisting all deprecated features and their status. There are also some options not listed here, as there exists patches in release/2.4 which awaits an update for git master.
Signed-off-by David Sommerseth <[email protected]...>
--- Changes.rst | 15 ++++++++++ doc/openvpn.8 | 78 ++++++++++++++++++++++++++++++++++----------------- src/openvpn/options.c | 16 ++++++----- 3 files changed, 77 insertions(+), 32 deletions(-)
Changes.rst +15 -0
@@ -161,6 +161,9 @@ Asynchronous push reply Deprecated features ------------------- +For an up-to-date list of all deprecated options, see this wiki page: +https://community.openvpn.net/openvpn/wiki/DeprecatedOptions + - ``--key-method 1`` is deprecated in 2.4 and will be removed in 2.5. Migrate away from ``--key-method 1`` as soon as possible. The recommended approach is to remove the ``--key-method`` option from the configuration files, OpenVPN
@@ -181,6 +184,18 @@ Deprecated features - ``--keysize`` is deprecated and will be removed in v2.6 together with the support of ciphers with cipher block size less than 128 bits. +- ``--comp-lzo`` is deprecated in OpenVPN 2.4. Use ``--compress`` instead. + +- ``--ifconfig-pool-linear`` has been deprecated since OpenVPN 2.1 and will be + removed in v2.5. Use ``--topology p2p`` instead. + +- ``--client-cert-not-required`` is deprecated in OpenVPN 2.4 and will be removed + in v2.5. Use ``--verify-client-cert none`` for a functional equivalent. + +- ``--ns-cert-type`` is deprecated in OpenVPN 2.3.18 and v2.4. It will be removed + in v2.5. Use the far better ``--remote-cert-tls`` option which replaces this + feature. + User-visible Changes --------------------
doc/openvpn.8 +53 -25
167 lines not on this page · raw message
src/openvpn/options.c +9 -7
@@ -415,8 +415,9 @@ static const char usage_message[] =" client instance.\n" "--ifconfig-pool start-IP end-IP [netmask] : Set aside a pool of subnets\n" " to be dynamically allocated to connecting clients.\n" -"--ifconfig-pool-linear : Use individual addresses rather than /30 subnets\n" -" in tun mode. Not compatible with Windows clients.\n" +"--ifconfig-pool-linear : (DEPRECATED) Use individual addresses rather \n" +" than /30 subnets\n in tun mode. Not compatible with\n" +" Windows clients.\n" "--ifconfig-pool-persist file [seconds] : Persist/unpersist ifconfig-pool\n" " data to file, at seconds intervals (default=600).\n" " If seconds=0, file will be treated as read-only.\n"
@@ -434,7 +435,7 @@ static const char usage_message[] =" Only valid in a client-specific config file.\n" "--disable : Client is disabled.\n" " Only valid in a client-specific config file.\n" -"--client-cert-not-required : Don't require client certificate, client\n" +"--client-cert-not-required : (DEPRECATED) Don't require client certificate, client\n" " will authenticate using username/password.\n" "--verify-client-cert [none|optional|require] : perform no, optional or\n" " mandatory client certificate verification.\n"
@@ -455,7 +456,7 @@ static const char usage_message[] =" with those of the server will be disconnected.\n" "--auth-user-pass-optional : Allow connections by clients that don't\n" " specify a username/password.\n" -"--no-name-remapping : Allow Common Name and X509 Subject to include\n" +"--no-name-remapping : (DEPRECATED) Allow Common Name and X509 Subject to include\n" " any printable character.\n" "--client-to-client : Internally route client-to-client traffic.\n" "--duplicate-cn : Allow multiple clients with the same common name to\n"
@@ -539,13 +540,13 @@ static const char usage_message[] = "--prng alg [nsl] : For PRNG, use digest algorithm alg, and\n" " nonce_secret_len=nsl. Set alg=none to disable PRNG.\n" #ifdef HAVE_EVP_CIPHER_CTX_SET_KEY_LENGTH - "--keysize n : Size of cipher key in bits (optional).\n" + "--keysize n : (DEPRECATED) Size of cipher key in bits (optional).\n" " If unspecified, defaults to cipher-specific default.\n" #endif#ifndef ENABLE_CRYPTO_MBEDTLS "--engine [name] : Enable OpenSSL hardware crypto engine functionality.\n"#endif -"--no-replay : Disable replay protection.\n" +"--no-replay : (DEPRECATED) Disable replay protection.\n" "--mute-replay-warnings : Silence the output of replay warnings to log file.\n" "--replay-window n [t] : Use a replay protection sliding window of size n\n" " and a time window of t seconds.\n"
@@ -563,7 +564,7 @@ static const char usage_message[] ="(These options are meaningful only for TLS-mode)\n" "--tls-server : Enable TLS and assume server role during TLS handshake.\n" "--tls-client : Enable TLS and assume client role during TLS handshake.\n" -"--key-method m : Data channel key exchange method. m should be a method\n" +"--key-method m : (DEPRECATED) Data channel key exchange method. m should be a method\n" " number, such as 1 (default), 2, etc.\n" "--ca file : Certificate authority file in .pem format containing\n" " root certificate.\n"
@@ -6570,6 +6571,7 @@ add_option(struct options *options, {VERIFY_PERMISSION (OPT_P_GENERAL ); options->topology =TOP_P2P ; +msg (M_WARN ,"DEPRECATED OPTION: --ifconfig-pool-linear, use --topology p2p instead" ); } else if (streq(p[0], "ifconfig-ipv6-pool") && p[1] && !p[2]) {
Signature · 1 line
2.11.0
Quoted 8 lines · David Sommerseth
We have quite a list of deprecated options currently. Ensure this is highlighted both in documentation and code.
This patch builds on the wiki page [1] enlisting all deprecated features and their status. There are also some options not listed here, as there exists patches in release/2.4 which awaits an update for git master.
Signed-off-by David Sommerseth <[email protected]...>
Sorry, I forgot the [1] reference in the commit message:
[1] <https://community.openvpn.net/openvpn/wiki/DeprecatedOptions>
Signature · 4 lines
kind regards, David Sommerseth OpenVPN Technologies, Inc
Hi,
Quoted 291 lines · David Sommerseth
We have quite a list of deprecated options currently. Ensure this is highlighted both in documentation and code.
This patch builds on the wiki page [1] enlisting all deprecated features and their status. There are also some options not listed here, as there exists patches in release/2.4 which awaits an update for git master.
Signed-off-by David Sommerseth <[email protected]...>--- Changes.rst | 15 ++++++++++ doc/openvpn.8 | 78 ++++++++++++++++++++++++++++++++++----------------- src/openvpn/options.c | 16 ++++++----- 3 files changed, 77 insertions(+), 32 deletions(-)Changes.rst +15
-0@@ -161,6 +161,9 @@ Asynchronous push reply Deprecated features ------------------- +For an up-to-date list of all deprecated options, see this wiki page: +https://community.openvpn.net/openvpn/wiki/DeprecatedOptions + - ``--key-method 1`` is deprecated in 2.4 and will be removed in 2.5. Migrate away from ``--key-method 1`` as soon as possible. The recommended approach is to remove the ``--key-method`` option from the configuration files, OpenVPN@@ -181,6 +184,18 @@ Deprecated features - ``--keysize`` is deprecated and will be removed in v2.6 together with the support of ciphers with cipher block size less than 128 bits. +- ``--comp-lzo`` is deprecated in OpenVPN 2.4. Use ``--compress`` instead. + +- ``--ifconfig-pool-linear`` has been deprecated since OpenVPN 2.1 and will be + removed in v2.5. Use ``--topology p2p`` instead. + +- ``--client-cert-not-required`` is deprecated in OpenVPN 2.4 and will be removed + in v2.5. Use ``--verify-client-cert none`` for a functional equivalent. + +- ``--ns-cert-type`` is deprecated in OpenVPN 2.3.18 and v2.4. It will be removed + in v2.5. Use the far better ``--remote-cert-tls`` option which replaces this + feature. + User-visible Changes --------------------doc/openvpn.8 +53
-25@@ -769,7 +769,8 @@ Only use when none of the connecting clients are Windows systems. This mode is functionally equivalent to the .B \-\-ifconfig\-pool\-linear -directive which is available in OpenVPN 2.0 and is now deprecated. +directive which is available in OpenVPN 2.0, is deprecated and will be +removed in OpenVPN 2.5 .B subnet \-\- Use a subnet rather than a point-to-point topology by@@ -2485,15 +2486,17 @@ setting to be pushed later. .\"********************************************************* .TP .B \-\-comp\-lzo [mode] +.B DEPRECATED +This option will be removed in a future OpenVPN release. Use the +newer +.B \-\-compress +instead. + Use LZO compression -- may add up to 1 byte per packet for incompressible data. .B mode may be "yes", "no", or "adaptive" (default). -This option is deprecated in favor of the newer -.B --compress -option. - In a server mode setup, it is possible to selectively turn compression on or off for individual clients.@@ -3106,9 +3109,13 @@ a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, use .B \-\-ifconfig\-push + .\"********************************************************* .TP .B \-\-ifconfig\-pool\-linear +.B DEPRECATED +This option will be removed in OpenVPN 2.5 + Modifies the .B \-\-ifconfig\-pool directive to@@ -3671,15 +3678,16 @@ to empty strings (""). The authentication module/script MUST have logic to detect this condition and respond accordingly. .\"********************************************************* .TP -.B \-\-client\-cert\-not\-required (DEPRECATED) +.B \-\-client\-cert\-not\-required +.B DEPRECATED +This option will be removed in OpenVPN 2.5 + Don't require client certificate, client will authenticate using username/password only. Be aware that using this directive is less secure than requiring certificates from all clients. - .B Please note: -This option is now deprecated and will be removed in OpenVPN v2.5. -It is replaced by +This is replaced by .B \-\-verify\-client\-cert which allows for more flexibility. The option .B \-\-verify\-client\-cert none@@ -3744,7 +3752,10 @@ the authenticated username as the common name, rather than the common name from the client cert. .\"********************************************************* .TP -.B \-\-compat\-names [no\-remapping] (DEPRECATED) +.B \-\-compat\-names [no\-remapping] +.B DEPRECATED +This option will be removed in OpenVPN 2.5 + Until OpenVPN v2.3 the format of the X.509 Subject fields was formatted like this: .IP@@ -3792,7 +3803,10 @@ to make the transition to the new formatting less intrusive. It will be removed in OpenVPN v2.5. So please update your scripts/plug-ins where necessary. .\"********************************************************* .TP -.B \-\-no\-name\-remapping (DEPRECATED) +.B \-\-no\-name\-remapping +.B DEPRECATED +This option will be removed in OpenVPN 2.5 + The .B \-\-no\-name\-remapping option is an alias for@@ -4150,13 +4164,29 @@ For more information on HMAC see .B \-\-cipher alg Encrypt data channel packets with cipher algorithm .B alg. + The default is .B BF-CBC, -an abbreviation for Blowfish in Cipher Block Chaining mode. +an abbreviation for Blowfish in Cipher Block Chaining mode. When cipher +negotiation (NCP) is allowed, OpenVPN 2.4 and newer on both client and server +side will automatically upgrade to +.B AES-256-GCM. +See +.B \-\-ncp\-ciphers +and +.B \-\-ncp\-disable +for more details on NCP. -Using BF-CBC is no longer recommended, because of it's 64-bit block size. This +Using +.B BF-CBC +is no longer recommended, because of its 64-bit block size. This small block size allows attacks based on collisions, as demonstrated by SWEET32. -See https://community.openvpn.net/openvpn/wiki/SWEET32 for details. +See https://community.openvpn.net/openvpn/wiki/SWEET32 for details. Due to +this, support for +.B BF-CBC, DES, CAST5, IDEA +and +.B RC2 +ciphers will be removed in OpenVPN 2.6. To see other ciphers that are available with OpenVPN, use the .B \-\-show\-ciphers@@ -4166,14 +4196,6 @@ Set .B alg=none to disable encryption. -As of OpenVPN 2.4, cipher negotiation (NCP) can override the cipher specified by -.B \-\-cipher\fR. -See -.B \-\-ncp\-ciphers -and -.B \-\-ncp\-disable -for more on NCP. - .\"********************************************************* .TP .B \-\-ncp\-ciphers cipher_list@@ -4260,6 +4282,9 @@ supported by OpenSSL. .\"********************************************************* .TP .B \-\-no\-replay +.B DEPRECATED +This option will be removed in OpenVPN 2.5. + (Advanced) Disable OpenVPN's protection against replay attacks. Don't use this option unless you are prepared to make a tradeoff of greater efficiency in exchange for less@@ -4423,7 +4448,6 @@ This option only makes sense when replay protection is enabled .\"********************************************************* .TP .B \-\-no\-iv - .B DEPRECATED This option will be removed in OpenVPN 2.5.@@ -4823,6 +4847,9 @@ Certificate Store GUI. .\"********************************************************* .TP .B \-\-key\-method m +.B DEPRECATED +This option will be removed in OpenVPN 2.5 + Use data channel key negotiation method .B m. The key method must match on both sides of the connection.@@ -5379,8 +5406,9 @@ as X509_<depth>_<attribute>=<value>. Multiple options can be defined to track multiple attributes. .\"********************************************************* .TP -.B \-\-ns\-cert\-type client|server (DEPRECATED) -This option is deprecated. Use the more modern equivalent +.B \-\-ns\-cert\-type client|server +.B DEPRECATED +This option will be removed in OpenVPN 2.5. Use the more modern equivalent .B \-\-remote\-cert\-tls instead. This option will be removed in OpenVPN 2.5.src/openvpn/options.c +8
-7@@ -415,8 +415,9 @@ static const char usage_message[] =" client instance.\n" "--ifconfig-pool start-IP end-IP [netmask] : Set aside a pool of subnets\n" " to be dynamically allocated to connecting clients.\n" -"--ifconfig-pool-linear : Use individual addresses rather than /30 subnets\n" -" in tun mode. Not compatible with Windows clients.\n" +"--ifconfig-pool-linear : (DEPRECATED) Use individual addresses rather \n" +" than /30 subnets\n in tun mode. Not compatible with\n" +" Windows clients.\n" "--ifconfig-pool-persist file [seconds] : Persist/unpersist ifconfig-pool\n" " data to file, at seconds intervals (default=600).\n" " If seconds=0, file will be treated as read-only.\n" @@ -434,7 +435,7 @@ static const char usage_message[] =" Only valid in a client-specific config file.\n" "--disable : Client is disabled.\n" " Only valid in a client-specific config file.\n" -"--client-cert-not-required : Don't require client certificate, client\n" +"--client-cert-not-required : (DEPRECATED) Don't require client certificate, client\n" " will authenticate using username/password.\n" "--verify-client-cert [none|optional|require] : perform no, optional or\n" " mandatory client certificate verification.\n" @@ -455,7 +456,7 @@ static const char usage_message[] =" with those of the server will be disconnected.\n" "--auth-user-pass-optional : Allow connections by clients that don't\n" " specify a username/password.\n" -"--no-name-remapping : Allow Common Name and X509 Subject to include\n" +"--no-name-remapping : (DEPRECATED) Allow Common Name and X509 Subject to include\n" " any printable character.\n" "--client-to-client : Internally route client-to-client traffic.\n" "--duplicate-cn : Allow multiple clients with the same common name to\n" @@ -539,13 +540,13 @@ static const char usage_message[] = "--prng alg [nsl] : For PRNG, use digest algorithm alg, and\n" " nonce_secret_len=nsl. Set alg=none to disable PRNG.\n" #ifdef HAVE_EVP_CIPHER_CTX_SET_KEY_LENGTH - "--keysize n : Size of cipher key in bits (optional).\n" + "--keysize n : (DEPRECATED) Size of cipher key in bits (optional).\n" " If unspecified, defaults to cipher-specific default.\n" #endif#ifndef ENABLE_CRYPTO_MBEDTLS "--engine [name] : Enable OpenSSL hardware crypto engine functionality.\n"#endif -"--no-replay : Disable replay protection.\n" +"--no-replay : (DEPRECATED) Disable replay protection.\n" "--mute-replay-warnings : Silence the output of replay warnings to log file.\n" "--replay-window n [t] : Use a replay protection sliding window of size n\n" " and a time window of t seconds.\n" @@ -563,7 +564,7 @@ static const char usage_message[] ="(These options are meaningful only for TLS-mode)\n" "--tls-server : Enable TLS and assume server role during TLS handshake.\n" "--tls-client : Enable TLS and assume client role during TLS handshake.\n" -"--key-method m : Data channel key exchange method. m should be a method\n" +"--key-method m : (DEPRECATED) Data channel key exchange method. m should be a method\n" " number, such as 1 (default), 2, etc.\n" "--ca file : Certificate authority file in .pem format containing\n" " root certificate.\n"
src/openvpn/options.c add_option(struct options *options, · line 6577
Quoted 7 lines
src/openvpn/options.c +1
-0@@ -6570,6 +6571,7 @@ add_option(struct options *options, {VERIFY_PERMISSION (OPT_P_GENERAL ); options->topology =TOP_P2P ; +msg (M_WARN ,"DEPRECATED OPTION: --ifconfig-pool-linear, use --topology p2p instead" ); } else if (streq(p[0], "ifconfig-ipv6-pool") && p[1] && !p[2]) {
Better documentation and more consistency, nice! ACK.
(Given that you add that reference to the commit message ;-) )
-Steffan
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Your patch has been applied to the following branches
commit 6e4a817589de85481a5cbfe5bcae4fa872c9fb5d (master) commit e710d709b7e604abd1e86b6fc04695a472aed977 (release/2.4)
Author: David Sommerseth Date: Tue Aug 15 23:54:51 2017 +0200
Highlight deprecated features
Signed-off-by: David Sommerseth <[email protected]...>
Acked-by: Steffan Karger <[email protected]...>
Message-Id: <[email protected]...>
URL: https://www.mail-archive.com/[email protected]/msg15261.html
Signed-off-by: David Sommerseth <[email protected]...>- --
kind regards,
David Sommerseth
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
iQIcBAEBCgAGBQJZla0NAAoJEIbPlEyWcf3yaZYQAKQn0znvqxKGoX3E8/HT87u9 sC/mOsmlAmtDh0nJ1gZxeEv2BkLTzek5kyJNUnrGA6WYwDpf+hHJ/jY3/ZY86Zaf w8rj0gUl+4smDDbndGhtAwBKbdQtN0o43X+W1udbuNe1rDjSnAzI6HCZrxB5Yv0/ 70gpRyLdW9mrIxN8I5UDETEw4W6y+t5AoHuWvZIoLpEc0gncenIjbRHIAa4oB1lP VmvH10O8culiFYChg7ZuWX7yhc3YDCtNxjfCNu2APp7qP8eatHvnGtRn2LE1Cl/1 LwvgP6jREJhWvIy22bCbpIc2evkLJR67rpkUoBLg1M6oNemR3VdzXnouhg8DArhX iMXZZYAA2BlmYa06CiyK00kppHI6wMBlbaSt+KJD6+/t0KOsJxO2r/aw51TL6dfL Pq8+po2KAspDO8CYlohPjdX7NyWwnLHbOr/iTT3Hrx5+U2IkhHM66SIkNY9LmnP7 UVPWOum96nO0TmlQ/9TWdJqWG2IOTBUegqrZKKmooE7RW6opvHsjnMjhN7JrvC76 ZdjGJaUFvH4Ce45Z3DzVzaBv6CSlVqgzv3m4ldm/erWylsUHRM1Wpi09B77sSuyx JFWlgQT4RSE7I5tZmxhsOfWYp3ed/FxvEElQDPr0saZbM5pjGHpeHSdU0RN3ze4V 8h6fJe5igLTy5raXvPLT
=7lpX
-----END PGP SIGNATURE-----
Am 15.08.17 um 23:54 schrieb David Sommerseth:
Quoted 7 lines
We have quite a list of deprecated options currently. Ensure this is highlighted both in documentation and code.
This patch builds on the wiki page [1] enlisting all deprecated features and their status. There are also some options not listed here, as there exists patches in release/2.4 which awaits an update for git master.
I think tls-remote-name (or what was it called?) which has been replaced by verify-x509-name should be in the list. It has already been removed from master and is deprecated since 2.3?
Arne
Quoted 11 lines · Arne Schwabe
Am 15.08.17 um 23:54 schrieb David Sommerseth:
Quoted 6 lines
We have quite a list of deprecated options currently. Ensure this is highlighted both in documentation and code.
This patch builds on the wiki page [1] enlisting all deprecated features and their status. There are also some options not listed here, as there exists patches in release/2.4 which awaits an update for git master.
I think tls-remote-name (or what was it called?) which has been replaced by verify-x509-name should be in the list. It has already been removed from master and is deprecated since 2.3?