Make compression asymmetric by default and add warnings

doc/openvpn.8 +1 -2

@@ -2508,26 +2508,54 @@ Enable a compression algorithm.
 
  The
  .B algorithm
-parameter may be "lzo", "lz4", or empty.  LZO and LZ4
-are different compression algorithms, with LZ4 generally
+parameter may be "lzo", "lz4", "lz4-v2", "stub", "stub-v2" or empty.

doc/openvpn.8 +4 -0

+LZO and LZ4 are different compression algorithms, with LZ4 generally
  offering the best performance with least CPU usage.
  For backwards compatibility with OpenVPN versions before v2.4, use "lzo"
  (which is identical to the older option "\-\-comp\-lzo yes").
 
+The "lz4-v2" and "stub-v2" variants implement a better framing that does not add
+overhead when packets cannot compressed. All other variants always add one extra
+compared to no compression framing.

doc/openvpn.8 +5 -3

+
  If the
  .B algorithm
-parameter is empty, compression will be turned off, but the packet
-framing for compression will still be enabled, allowing a different
-setting to be pushed later.
+parameter is "stub", "stubv2", or empty, compression will be turned off, but
+the packet framing for compression will still be enabled, allowing a different
+setting to be pushed later. Additionally, "stub" and "stub-v2" will disable
+announcing lzo and lz4 compression support for via "IV_" variables to the server.

doc/openvpn.8 +10 -0

+compression to break encryption.  If you are not entirely sure that the above does
+not apply to your traffic, you are advised to *not* enable compression.
+
+.\"*********************************************************
+.TP
+.B \-\-allow-compression [mode]
+As described in
+\.B \-\-compress
+option, compression is potentially dangerous option. This option allows
+control the behaviour of OpenVPN when compression is used and allowed.

doc/openvpn.8 +4 -0

+.B mode
+may be "yes", "no", or "asym" (default).
+
+With allow-compression set to "no", OpenVPN will refuse any non stub

doc/openvpn.8 +5 -0

+compression. With "yes" OpenVPN will send and receive compressed packets.
+With "asym", the default, OpenVPN will only decompress (downlink) packets but
+not compress (uplink) packets. This also allows migrating to disable compression
+when changing both server and client configurations to remove compression at the
+same time options is not feasible.

doc/openvpn.8 +3 -0

+
+The default of asym has been chosen to maximise compatibility with existing
+configuration while at the same time phasing phasing out compression in existing

doc/openvpn.8 +2 -0

+deployment by disabling compression on the uplink, effectively completely disabling
+compression if both client and server are upgraded.
 
  .\"*********************************************************
  .TP

src/openvpn/options.c +1 -0

index 61fa9833..8b5c96c8 100644
@@ -349,6 +349,7 @@ static const char usage_message[] =
  #endif
  #if defined(USE_COMP)
      "--compress alg  : Use compression algorithm alg\n"
+    "--allow-compression: Specify wether compression should be allowed\n"
  #if defined(ENABLE_LZO)
      "--comp-lzo      : Use LZO compression -- may add up to 1 byte per\n"
      "                  packet for uncompressible data.\n"

src/openvpn/options.c +9 -0

  #if defined(USE_COMP)
+    else if (streq(p[0], "allow-compression") && p[1] && !p[2])
+    {
+        VERIFY_PERMISSION(OPT_P_COMP);
+
+        if (streq(p[1], "no"))
+        {
+            options->comp.flags = COMP_F_ALLOW_STUB_ONLY;
+            if (comp_non_stub_enabled(&options->comp)) {
+                msg(msglevel, "allow-compression no conflicts with enabling compression");

src/openvpn/options.c +10 -0

+        }
+        else if (streq(p[1], "asym"))
+        {
+            options->comp.flags &= ~COMP_F_NO_ASYM;
+        }
+        else if (streq(p[1], "yes"))
+        {
+            msg(M_WARN, "WARNING: Allowing compression allows attacks that break encryption. "
+                "Using allow-compression yes is strongly discouraged for common usage. "
+                "See --compress in the manual page for more information");

src/openvpn/options.c +4 -1

  #endif
          {
              options->comp.alg = COMP_ALG_STUB;
-            options->comp.flags = 0;
+            options->comp.flags &= ~COMP_F_ADAPTIVE;
          }
  #if defined(ENABLE_LZO)
+        else if (options->comp.flags & COMP_F_ALLOW_STUB_ONLY)
+        {
+            msg(msglevel, "Cannot set comp-lzo to '%s', allow-compression is set to  'no'", p[1]);

src/openvpn/options.c +5 -1

              }
              else if (streq(p[1], "stub-v2"))
              {
                  options->comp.alg = COMP_ALGV2_UNCOMPRESSED;
-                options->comp.flags = COMP_F_ADVERTISE_STUBS_ONLY;
+                options->comp.flags |= COMP_F_ADVERTISE_STUBS_ONLY;
+            }
+            else if (options->comp.flags & COMP_F_ALLOW_STUB_ONLY)
+            {
+              msg(msglevel, "Cannot set compress to '%s', allow-compression is set to  'no'", p[1]);