Deprecate --keysize

The --keysize option can only be used with already deprecated ciphers,
such as CAST5, RC2 or BF.  Deviating from the default keysize is
generally not a good idea (see man page text), and otherwise only
complicates our code.

Since we will also remove the support for weak ciphers (ciphers with
cipher block length less than 128 bits) in OpenVPN 2.6 as well, we
start the deprecation of this option instantly.

[DS: Slightly amended the patch, referencing OpenVPN 2.6 and added
     a few more details to Changes.rst and the commit message]

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: David Sommerseth <davids@openvpn.net>
Message-Id: <20170701112951.19119-1-steffan@karger.me>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15004.html
Signed-off-by: David Sommerseth <davids@openvpn.net>
(cherry picked from commit ad178f01444d61e48fca83c4f0bc5d82270cee87)

diff --git a/Changes.rst b/Changes.rst
index d94b3fbff649bca39bd84de6ecf9d2e016b95f41..3d758f2ea80c647966bbeae95cca92fd9c361a2b 100644 (file)
--- a/Changes.rst
+++ b/Changes.rst
@@ -178,6 +178,9 @@ Deprecated features
 
 - ``--no-iv`` is deprecated in 2.4 and will be removed in 2.5.
 
+- ``--keysize`` is deprecated and will be removed in v2.6 together
+  with the support of ciphers with cipher block size less than 128 bits.
+
 
 User-visible Changes
 --------------------

diff --git a/doc/openvpn.8 b/doc/openvpn.8
index 56c0f7a6943a7bf1fab3afd69853281fb5d09b80..8170164b02e4238b2e6870f0be48530de76abcd2 100644 (file)
--- a/doc/openvpn.8
+++ b/doc/openvpn.8
@@ -4218,6 +4218,9 @@ negotiation.
 .\"*********************************************************
 .TP
 .B \-\-keysize n
+.B DEPRECATED
+This option will be removed in OpenVPN 2.6.
+
 Size of cipher key in bits (optional).
 If unspecified, defaults to cipher-specific default.  The
 .B \-\-show\-ciphers

diff --git a/src/openvpn/options.c b/src/openvpn/options.c
index 6191e488883161baa6347b5a3cf85713bfed6424..2b096eb036d104b30951db9aa8edc46ff15e9278 100644 (file)
--- a/src/openvpn/options.c
+++ b/src/openvpn/options.c
@@ -2495,6 +2495,11 @@ options_postprocess_verify_ce(const struct options *options, const struct connec
         msg(M_WARN, "WARNING: --no-iv is deprecated and will be removed in 2.5");
     }
 
+    if (options->keysize)
+    {
+        msg(M_WARN, "WARNING: --keysize is DEPRECATED and will be removed in OpenVPN 2.6");
+    }
+
     /*
      * Check consistency of replay options
      */