reject compression by default

With this change the value of '--allow-compression' is set to 'no'.
Therefore compression is not enabled by default and cannot be enabled
by the server either.

This change is in line with the current trend of not recommending
compression over VPN tunnels for security reasons (check Voracle).

Of top of that compression is mostly useless nowadays, therefore
there is not real reason to enable it.

Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Signed-off-by: Antonio Quartulli <a@unstable.cc>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <20210904095629.6273-4-a@unstable.cc>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22797.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>

diff --git a/Changes.rst b/Changes.rst
index 7efb34934f950a5ed4af48b4c9340a278a738087..eeceefb6b443525ae4c2e69684bca582de37d9e9 100644 (file)
--- a/Changes.rst
+++ b/Changes.rst
@@ -71,6 +71,12 @@ Deprecated features
     This option mainly served a role as debug option when NCP was first
     introduced. It should now no longer be necessary.
 
+Compression no longer enabled by default
+    Unless an explicit compression option is specified in the configuration,
+    ``--allow-compression`` defaults to ``no`` in OpeNVPN 2.6.0.
+    By default, OpenVPN 2.5 still allowed a server to enable compression by
+    pushing compression related options.
+
 
 User-visible Changes
 --------------------

diff --git a/doc/man-sections/generic-options.rst b/doc/man-sections/generic-options.rst
index c746e2323c2c81ad277a2486234557c8a09f42a6..114faa4bcfe87531b2777782d9960eaeb31970ba 100644 (file)
--- a/doc/man-sections/generic-options.rst
+++ b/doc/man-sections/generic-options.rst
@@ -61,6 +61,12 @@ which mode OpenVPN is configured as.
   Note: Using this option reverts defaults to no longer recommended
   values and should be avoided if possible.
 
+  The following table details what defaults are changed depending on the
+  version specified.
+
+  - 2.5.x or lower: ``--allow-compression asym`` is automatically added
+    to the configuration if no other compression options are present.
+
 --config file
   Load additional config options from ``file`` where each line corresponds
   to one command line option, but with the leading '--' removed.

diff --git a/src/openvpn/comp.h b/src/openvpn/comp.h
index cd4f0e1a2873e1f74aacfc577e742b41b811da10..0d284e274e46d0f0b4eb229bb6f9982fd76b45dd 100644 (file)
--- a/src/openvpn/comp.h
+++ b/src/openvpn/comp.h
@@ -59,6 +59,7 @@
 #define COMP_F_ALLOW_STUB_ONLY      (1<<4) /* Only accept stub compression, even with COMP_F_ADVERTISE_STUBS_ONLY
                                             * we still accept other compressions to be pushed */
 #define COMP_F_MIGRATE              (1<<5) /* push stub-v2 or comp-lzo no when we see a client with comp-lzo in occ */
+#define COMP_F_ALLOW_ASYM           (1<<6) /* Compression was explicitly set to allow asymetric compression */
 
 
 /*

diff --git a/src/openvpn/options.c b/src/openvpn/options.c
index 1f0f87839687f3a6e7b5a4bda82ee41deb62e153..21979785c5a8e1d80567d489f692ac8046c3cec1 100644 (file)
--- a/src/openvpn/options.c
+++ b/src/openvpn/options.c
@@ -3174,6 +3174,16 @@ need_compatibility_before(const struct options *o, unsigned int version)
 static void
 options_set_backwards_compatible_options(struct options *o)
 {
+    /* Compression is deprecated and we do not want to announce support for it
+     * by default anymore, additionally DCO breaks with compression.
+     *
+     * Disable compression by default starting with 2.6.0 if no other
+     * compression related option has been explicitly set */
+    if (!comp_non_stub_enabled(&o->comp) && !need_compatibility_before(o, 20600)
+        && (o->comp.flags == 0))
+    {
+        o->comp.flags = COMP_F_ALLOW_STUB_ONLY|COMP_F_ADVERTISE_STUBS_ONLY;
+    }
 }
 
 static void
@@ -7768,6 +7778,7 @@ add_option(struct options *options,
         else if (streq(p[1], "asym"))
         {
             options->comp.flags &= ~COMP_F_ALLOW_COMPRESS;
+            options->comp.flags |= COMP_F_ALLOW_ASYM;
         }
         else if (streq(p[1], "yes"))
         {