Depreciate IPv4-related options.
PATCH 1/1 Depreciate IPv4-related options.
As discussed in trac #208 and on IRC with Antonio, OpenVPN 2.5 will be IPv6-only. Removal of IPv4-related code and options will dramatically reduce code complexity, confusing options, bugs and user questions.
Add deprecation warnings for IPv4-related config options to 2.4 branch, so users have enough time to move their setups to work on IPv6-only before 2.5 will be released.
This affects:
--ifconfig
--route
--server
--proto udp4/tcp4
--ifconfig-pool
More IPv4-related options will be identified and depreciated later.
Trac: #208
--- src/openvpn/options.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
src/openvpn/options.c +12 -0
@@ -5258,6 +5258,7 @@ add_option(struct options *options,msg (msglevel,"ifconfig parms '%s' and '%s' must be valid addresses" , p[1 ], p[2 ]); goto err; } +msg (M_WARN ,"DEPRECATED OPTION: --ifconfig, please update your configuration to use IPv6 (--ifconfig-ipv6). IPv4 support will be removed in OpenVPN v2.5." ); }else if (streq (p[0 ],"ifconfig-ipv6" ) && p[1 ] && p[2 ] && !p[3 ]) {
@@ -5928,6 +5929,10 @@ add_option(struct options *options, } options->ce.proto = proto; options->ce.af = af; +if (af ==AF_INET ) + { +msg (M_WARN ,"DEPRECATED OPTION: --proto %s, please update your configuration to use IPv6. IPv4 support will be removed in OpenVPN v2.5." , p[1 ]); + } }else if (streq (p[0 ],"proto-force" ) && p[1 ] && !p[2 ]) {
@@ -6151,6 +6156,7 @@ add_option(struct options *options, }else if (streq (p[0 ],"route" ) && p[1 ] && !p[5 ]) { +static int route_warning_printed =0 ;VERIFY_PERMISSION (OPT_P_ROUTE );rol_check_alloc (options);if (pull_mode)
@@ -6172,6 +6178,10 @@ add_option(struct options *options, } }add_route_to_option_list (options->routes, p[1 ], p[2 ], p[3 ], p[4 ]); +if (route_warning_printed++ <1 ) + { +msg (M_WARN ,"DEPRECATED OPTION: --route, please update your configuration to use IPv6 (--route-ipv6). IPv4 support will be removed in OpenVPN v2.5." ); + } }else if (streq (p[0 ],"route-ipv6" ) && p[1 ] && !p[4 ]) {
@@ -6459,6 +6469,7 @@ add_option(struct options *options, goto err; } } +msg (M_WARN ,"DEPRECATED OPTION: --server, please update your configuration to use IPv6 (--server-ipv6). IPv4 support will be removed in OpenVPN v2.5." ); }else if (streq (p[0 ],"server-ipv6" ) && p[1 ] && !p[3 ]) {
@@ -6566,6 +6577,7 @@ add_option(struct options *options, { options->ifconfig_pool_netmask = netmask; } +msg (M_WARN ,"DEPRECATED OPTION: --ifconfig-pool, please update your configuration to use IPv6 (--ifconfig-ipv6-pool). IPv4 support will be removed in OpenVPN v2.5." ); }else if (streq (p[0 ],"ifconfig-pool-persist" ) && p[1 ] && !p[3 ]) {
Signature · 1 line
2.16.1
Hi,
Quoted 7 lines · Gert Doering
As discussed in trac #208 and on IRC with Antonio, OpenVPN 2.5 will be IPv6-only. Removal of IPv4-related code and options will dramatically reduce code complexity, confusing options, bugs and user questions.
Add deprecation warnings for IPv4-related config options to 2.4 branch, so users have enough time to move their setups to work on IPv6-only before 2.5 will be released.
Are you proposing to remove all IPv4 support from OpenVPN 2.5, so that an IPv6 connection will be required and an IPv4-only connection will not work?
Or is this is about removing IPv4-only options and code and leaving options and code that work for either IPv4 or IPv6, so users could continue to have an IPv4-only setup by changing the names of a few options in their configuration files?
Either way, can anyone give an approximate release date for 2.5, so we can have a time frame for the change? (Even a "not before" date would be very helpful in evaluating the impact of these proposed changes.)
Best regards,
Jon Bullard (Tunnelblick developer)
Hello,
Quoted 3 lines · Jonathan K. Bullard, on dim. 01 avril 2018 06:17:55 -0400, wrote:
Either way, can anyone give an approximate release date for 2.5, so we can have a time frame for the change? (Even a "not before" date would be very helpful in evaluating the impact of these proposed changes.)
I guess it'll be "not before" tomorrow.
Samuel
Hi,
Quoted 10 lines · Gert Doering
As discussed in trac #208 and on IRC with Antonio, OpenVPN 2.5 will be IPv6-only. Removal of IPv4-related code and options will dramatically reduce code complexity, confusing options, bugs and user questions.
Add deprecation warnings for IPv4-related config options to 2.4 branch, so users have enough time to move their setups to work on IPv6-only before 2.5 will be released.
This affects:
Quoted 8 lines
--ifconfig
--route
--server
--proto udp4/tcp4
--ifconfig-poolMore IPv4-related options will be identified and depreciated later.
Nice try :)
Selva
Hi,
Quoted 5 lines · Selva Nair
Quoted 3 lines · Gert Doering
As discussed in trac #208 and on IRC with Antonio, OpenVPN 2.5 will be IPv6-only. Removal of IPv4-related code and options will dramatically reduce code complexity, confusing options, bugs and user questions.
[..]
Quoted 2 lines
Nice try :)
Hah, caught in the act ;-)
(Apologies to Jonathan for scaring you about new user support issues...)
Trac #208 is really about *enabling* IPv6-only mode (which does not work today), but not about *mandating* IPv6-only / taking away IPv4.
gert
Signature · 6 lines
"If was one thing all people took for granted, was conviction that if you
feed honest figures into a computer, honest figures come out. Never doubted
it myself till I met a computer with a sense of humor."
Robert A. Heinlein, The Moon is a Harsh Mistress
Gert Doering - Munich, Germany [email protected]...Hi,
Quoted 8 lines · Gert Doering
Hi,
Quoted 5 lines · Selva Nair
Quoted 3 lines · Gert Doering
As discussed in trac #208 and on IRC with Antonio, OpenVPN 2.5 will be IPv6-only. Removal of IPv4-related code and options will dramatically reduce code complexity, confusing options, bugs and user questions.
Quoted 7 lines
[..]
Quoted 2 lines
Nice try :)
Hah, caught in the act ;-)
(Apologies to Jonathan for scaring you about new user support issues...)
No apologies necessary! I fell for it completely and have no excuse. I probably laughed as hard as anyone else when I read your private reply that pointed out today's date.
Best regards,
Jon
Think of us poor mail list lurkers. Practically gave this one a heart attack! Not having seen that private reply, I hope that means I can discard the long-ass (and quite irate) reply I was working on?
Marvin
(Sent from an ipv4 address)
Quoted 36 lines · Jonathan K. Bullard
Hi,
Quoted 9 lines · Gert Doering
Hi,
Quoted 6 lines · Selva Nair
Quoted 5 lines · Gert Doering
As discussed in trac #208 and on IRC with Antonio, OpenVPN 2.5 will be IPv6-only. Removal of IPv4-related code and options will dramatically reduce code complexity, confusing options, bugs and user questions.
Quoted 7 lines
[..]
Quoted 2 lines
Nice try :)
Hah, caught in the act ;-)
(Apologies to Jonathan for scaring you about new user support issues...)
No apologies necessary! I fell for it completely and have no excuse. I probably laughed as hard as anyone else when I read your private reply that pointed out today's date.
Best regards,
Jon
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Openvpn-devel mailing list [email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
Hi,
Quoted 1 line · Marvin Adeff
Think of us poor mail list lurkers. Practically gave this one a heart attack! Not having seen that private reply, I hope that means I can discard the long-ass (and quite irate) reply I was working on?
Please share!
Quoted 1 line
(Sent from an ipv4 address)
Whatever journey OpenVPN takes, the Internet as a whole will need to either finish the move to IPv6, or give up and return to IPv4-only - running dual-stack is just too expensive in the long run. Like, twice the amount of code needed for routing, address parsing, firewalling, ...
gert
Signature · 6 lines
"If was one thing all people took for granted, was conviction that if you
feed honest figures into a computer, honest figures come out. Never doubted
it myself till I met a computer with a sense of humor."
Robert A. Heinlein, The Moon is a Harsh Mistress
Gert Doering - Munich, Germany [email protected]...Ok, I’ll only discard the irate part ;-]
I had not considered the extra work and code required to maintain both versions. But I get it now. Here is the unfortunate position this puts us in:
We use OpenVPN for connection from 1000’s of devices located at customer facilities back to us. These devices/software have a lifespan of greater than 10 years and most are extremely expensive (not easily replaced). So a large quantity are incapable of ipv6 (and frankly many customer facility networks are not fully functional with ipv6). Also some of the devices/software at our end that interface with those legacy customer devices are also not ipv6 capable.
So if OpenVPN lost ipv4 support anytime soon, we would be in a world of hurt. There is much more detail about all this, but I wanted to keep this a short email.
Thanks for listening.
Marvin
Quoted 24 lines · Gert Doering
Hi,
Quoted 2 lines · Marvin Adeff
Think of us poor mail list lurkers. Practically gave this one a heart attack! Not having seen that private reply, I hope that means I can discard the long-ass (and quite irate) reply I was working on?
Please share!
Quoted 1 line
(Sent from an ipv4 address)
Whatever journey OpenVPN takes, the Internet as a whole will need to either finish the move to IPv6, or give up and return to IPv4-only - running dual-stack is just too expensive in the long run. Like, twice the amount of code needed for routing, address parsing, firewalling, ...
gert
Signature · 6 lines
"If was one thing all people took for granted, was conviction that if you feed honest figures into a computer, honest figures come out. Never doubted it myself till I met a computer with a sense of humor." Robert A. Heinlein, The Moon is a Harsh Mistress Gert Doering - Munich, Germany [email protected]...
Hi,
Quoted 1 line · Marvin Adeff
I had not considered the extra work and code required to maintain both versions. But I get it now. Here is the unfortunate position this puts us in:
[..]
Well, that part of my e-mail was a bit of frustration speaking - I've been advocating IPv6 for over 20 years now, and while large parts of the access networks are offering IPv6 now, other parts are still being *built* with IPv4 only, or stubbornly stick to IPv4 only... thus, double work everywhere, not only in OpenVPN, seemingly for a lifetime.
Quoted 1 line
So if OpenVPN lost ipv4 support anytime soon, we would be in a world of hurt.
As far as OpenVPN is concerned, I am not aware of any plans to remove IPv4 support.
The extra code adds some maintenance and testing effort, but since this is all in place now (especially the test setups with "connect over IPv4 or IPv6" and "send IPv4 and IPv6 packets through the test VPN") it would be more work to rip out IPv4 now... :-)
gert
Signature · 6 lines
"If was one thing all people took for granted, was conviction that if you
feed honest figures into a computer, honest figures come out. Never doubted
it myself till I met a computer with a sense of humor."
Robert A. Heinlein, The Moon is a Harsh Mistress
Gert Doering - Munich, Germany [email protected]...Gert,
Without invalidating the reason for your frustration, I am breathing a sigh of relief.
As a complete aside, in some ways ipv4 is actually more useful to me in my work. In a private network I can tell where in the network the traffic is coming from. Even on the internet I can tell country, ISP etc. Very useful for security ACLs etc. Unless I’m completely mistaken, I don’t believe this is easily done in ipv6.
BTW, a big thank-you to you and all the devs in the OpenVPN project!
Marvin
Quoted 32 lines · Gert Doering
Hi,
Quoted 2 lines · Marvin Adeff
I had not considered the extra work and code required to maintain both versions. But I get it now. Here is the unfortunate position this puts us in:
[..]
Well, that part of my e-mail was a bit of frustration speaking - I've been advocating IPv6 for over 20 years now, and while large parts of the access networks are offering IPv6 now, other parts are still being *built* with IPv4 only, or stubbornly stick to IPv4 only... thus, double work everywhere, not only in OpenVPN, seemingly for a lifetime.
Quoted 1 line
So if OpenVPN lost ipv4 support anytime soon, we would be in a world of hurt.
As far as OpenVPN is concerned, I am not aware of any plans to remove IPv4 support.
The extra code adds some maintenance and testing effort, but since this is all in place now (especially the test setups with "connect over IPv4 or IPv6" and "send IPv4 and IPv6 packets through the test VPN") it would be more work to rip out IPv4 now... :-)
gert
Signature · 6 lines
"If was one thing all people took for granted, was conviction that if you feed honest figures into a computer, honest figures come out. Never doubted it myself till I met a computer with a sense of humor." Robert A. Heinlein, The Moon is a Harsh Mistress Gert Doering - Munich, Germany [email protected]...
Quoted 1 line · Marvin Adeff
Even on the internet I can tell country, ISP etc. Very useful for security ACLs etc. Unless I’m completely mistaken, I don’t believe this is easily done in ipv6.
mostly because at this very moment Tunnel Brokers are widely used and they act as a "proxy", effectively covering the real location of the client host.
Many websites just show you (client) as connecting from the country where your Tunnel Broker is located.
When using native IPv6 this problem does not exists anymore.
Therefore, the proper way to get over this "limitation" (even though I don't think is a real problem, but this is of course my perspective) is to speed up the transition and move everybody over native IPv6 (which is something we can't achieve if we continue to be "afraid" of using IPv6 in our everyday life).
Cheers,
Signature · 1 line
Antonio Quartulli
Antonio,
I certainly don’t disagree with you.
However I think I’ve taken up enough bandwidth over this topic on Openvpn-devel. Thank you all.
Marvin
Quoted 32 lines · Antonio Quartulli
Quoted 3 lines · Marvin Adeff
Even on the internet I can tell country, ISP etc. Very useful for security ACLs etc. Unless I’m completely mistaken, I don’t believe this is easily done in ipv6.
mostly because at this very moment Tunnel Brokers are widely used and they act as a "proxy", effectively covering the real location of the client host.
Many websites just show you (client) as connecting from the country where your Tunnel Broker is located.
When using native IPv6 this problem does not exists anymore.
Therefore, the proper way to get over this "limitation" (even though I don't think is a real problem, but this is of course my perspective) is to speed up the transition and move everybody over native IPv6 (which is something we can't achieve if we continue to be "afraid" of using IPv6 in our everyday life).
Cheers,
Signature · 9 lines
Antonio Quartulli ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot _______________________________________________ Openvpn-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-devel