Deprecate NTLMv1 proxy auth method.

NTLMv1 is ancient and not considered secure anymore and we are not
aware of any users or software still requiring this feature.

Additionally it currently depends on our "doing single DES using
3DES" workaround for OpenSSL (cipher_des_encrypt_ecb). So removing
NTLMv1 will also allow us to remove that workaround.

Reported-By: Trial of Bits (TOB-OVPN-7)
Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20221215190143.2107896-9-arne@rfc2549.org>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25731.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit e005b8d1fda1ad1e26fe0dbe7e09184a1f19b553)

diff --git a/src/openvpn/proxy.c b/src/openvpn/proxy.c
index ed7201616a466a908e13d88ddd3d7393fe1b04aa..633caee090319106d186dbf3035da0fcee09b8be 100644 (file)
--- a/src/openvpn/proxy.c
+++ b/src/openvpn/proxy.c
@@ -519,6 +519,8 @@ http_proxy_new(const struct http_proxy_options *o)
 #if NTLM
         else if (!strcmp(o->auth_method_string, "ntlm"))
         {
+            msg(M_INFO, "NTLM v1 authentication is deprecated and will be removed in "
+                "OpenVPN 2.7");
             p->auth_method = HTTP_AUTH_NTLM;
         }
         else if (!strcmp(o->auth_method_string, "ntlm2"))