upstream/openvpn
1
0
Fork 0
mirror of https://github.com/OpenVPN/openvpn.git synced 2026-06-09 00:42:51 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Deprecate --no-iv

Browse source 
This fixes the bug of supporting --no-iv (since we're only accepting
bugfixes in the current release phase ;) ).

The --no-iv function decreases security if used (CBC *requires*
unpredictable IVs, other modes don't allow --no-iv at all), and even
marginally decreases other user's security by adding unwanted
complexity to our code.

Let's get rid of this.

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <1481138447-6292-1-git-send-email-steffan@karger.me>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg13430.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>
This commit is contained in:
Steffan Karger 2016-12-07 20:20:47 +01:00 committed by Gert Doering
parent 84f88ca4d5
commit 4969f0d6bb
3 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
Changes.rst
View file

@ -177,6 +177,8 @@ Deprecated features
X.509 subject formatting must be updated to the standardized formatting. See X.509 subject formatting must be updated to the standardized formatting. See
the man page for more information. the man page for more information.
- ``--no-iv`` is deprecated in 2.4 and will be remove in 2.5.
User-visible Changes User-visible Changes
-------------------- --------------------
- For certificate DNs with duplicate fields, e.g. "OU=one,OU=two", both fields - For certificate DNs with duplicate fields, e.g. "OU=one,OU=two", both fields

4
doc/openvpn.8
View file

@ -4399,6 +4399,10 @@ This option only makes sense when replay protection is enabled
.\"********************************************************* .\"*********************************************************
.TP .TP
.B \-\-no\-iv .B \-\-no\-iv
.B DEPRECATED
This option will be removed in OpenVPN 2.5.
(Advanced) Disable OpenVPN's use of IV (cipher initialization vector). (Advanced) Disable OpenVPN's use of IV (cipher initialization vector).
Don't use this option unless you are prepared to make Don't use this option unless you are prepared to make
a tradeoff of greater efficiency in exchange for less a tradeoff of greater efficiency in exchange for less

4
src/openvpn/options.c
View file

@ -2238,6 +2238,10 @@ options_postprocess_verify_ce (const struct options *options, const struct conne
{ {
msg (M_USAGE, "--no-iv not allowed when NCP is enabled."); msg (M_USAGE, "--no-iv not allowed when NCP is enabled.");
} }
if (!options->use_iv)
{
msg (M_WARN, "WARNING: --no-iv is deprecated and will be removed in 2.5");
}
/* /*
* Check consistency of replay options * Check consistency of replay options