mirrors/openvpn
0
0
Fork 0
mirror of https://github.com/OpenVPN/openvpn.git synced 2024-11-23 17:53:49 +08:00
Code Issues Packages Projects Releases Wiki Activity

Deprecate --keysize

Browse Source 
The --keysize option can only be used with already deprecated ciphers,
such as CAST5, RC2 or BF.  Deviating from the default keysize is
generally not a good idea (see man page text), and otherwise only
complicates our code.

Since we will also remove the support for weak ciphers (ciphers with
cipher block length less than 128 bits) in OpenVPN 2.6 as well, we
start the deprecation of this option instantly.

[DS: Slightly amended the patch, referencing OpenVPN 2.6 and added
     a few more details to Changes.rst and the commit message]

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: David Sommerseth <davids@openvpn.net>
Message-Id: <20170701112951.19119-1-steffan@karger.me>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15004.html
Signed-off-by: David Sommerseth <davids@openvpn.net>
This commit is contained in:
Steffan Karger 2017-07-01 13:29:51 +02:00 committed by David Sommerseth
parent cbeff7b1b3
commit ad178f0144
No known key found for this signature in database
GPG Key ID: 86CF944C9671FDF2
3 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
Changes.rst
View File

@ -178,6 +178,9 @@ Deprecated features
- ``--no-iv`` is deprecated in 2.4 and will be removed in 2.5. - ``--no-iv`` is deprecated in 2.4 and will be removed in 2.5.
- ``--keysize`` is deprecated and will be removed in v2.6 together
with the support of ciphers with cipher block size less than 128 bits.
User-visible Changes User-visible Changes
-------------------- --------------------

3
doc/openvpn.8
View File

@ -4217,6 +4217,9 @@ negotiation.
.\"********************************************************* .\"*********************************************************
.TP .TP
.B \-\-keysize n .B \-\-keysize n
.B DEPRECATED
This option will be removed in OpenVPN 2.6.
Size of cipher key in bits (optional). Size of cipher key in bits (optional).
If unspecified, defaults to cipher-specific default. The If unspecified, defaults to cipher-specific default. The
.B \-\-show\-ciphers .B \-\-show\-ciphers

5
src/openvpn/options.c
View File

@ -2484,6 +2484,11 @@ options_postprocess_verify_ce(const struct options *options, const struct connec
msg(M_USAGE, "NCP cipher list contains unsupported ciphers."); msg(M_USAGE, "NCP cipher list contains unsupported ciphers.");
} }
if (options->keysize)
{
msg(M_WARN, "WARNING: --keysize is DEPRECATED and will be removed in OpenVPN 2.6");
}
/* /*
* Check consistency of replay options * Check consistency of replay options
*/ */