@@ -45,6 +45,12 @@ Pending auth support for plugins and scripts
See ``sample/sample-scripts/totpauth.py`` for an example.
+Compatibility mode (``--compat-mode``)
+ The modernisation of defaults can impact the compatibility of OpenVPN 2.6.0
+ with older peers. The options ``--compat-mode`` allows UIs to provide users
+ with an easy way to still connect to older servers.
+
+
Deprecated features
-------------------
``inetd`` has been removed
@@ -52,6 +52,15 @@ which mode OpenVPN is configured as.
BSDs implement a getrandom() or getentropy() syscall that removes the
need for /dev/urandom to be available.
+--compat-mode version
+ This option provides a way to alter the default of OpenVPN to be more
+ compatible with the version ``version`` specified. All of the changes
+ this option does can also be achieved using individual configuration
+ options.
+
+ Note: Using this option reverts defaults to no longer recommended
+ values and should be avoided if possible.
+
--config file
Load additional config options from ``file`` where each line corresponds
to one command line option, but with the leading '--' removed.
@@ -3147,6 +3147,29 @@ options_postprocess_cipher(struct options *o)
}
}
+/**
+ * Returns if we want 'backwards-compatibility' up to (but not included) a
+ * certain version
+ *
+ * @param version the oldest version that does not requires compatibility
+ * e.g. 20400 requires compatibility for all versions < 2.4.0
+ * @return whether compatibility should be enabled
+ */
+static bool
+need_compatibility_before(const struct options *o, unsigned int version)
+{
+ return o->backwards_compatible != 0 && o->backwards_compatible < version;
+}
+
+/**
+ * Changes default values so that OpenVPN can be compatible with the user
+ * specified version
+ */
+static void
+options_set_backwards_compatible_options(struct options *o)
+{
+}
+
static void
options_postprocess_mutate(struct options *o)
{
@@ -3160,6 +3183,8 @@ options_postprocess_mutate(struct options *o)
helper_tcp_nodelay(o);
options_postprocess_setdefault_ncpciphers(o);
+ options_set_backwards_compatible_options(o);
+
options_postprocess_cipher(o);
options_postprocess_mutate_invariant(o);
@@ -6721,6 +6746,18 @@ add_option(struct options *options,
setenv_str(es, p[1], p[2] ? p[2] : "");
}
}
+ else if (streq(p[0], "compat-mode") && p[1] && !p[3])
+ {
+ unsigned int major, minor, patch;
+ if (!(sscanf(p[1], "%u.%u.%u", &major, &minor, &patch) == 3))
+ {
+ msg(msglevel, "cannot parse version number for --compat-mode: %s",
+ p[1]);
+ goto err;
+ }
+
+ options->backwards_compatible = major * 10000 + minor * 100 + patch;
+ }
else if (streq(p[0], "setenv-safe") && p[1] && !p[3])
{
VERIFY_PERMISSION(OPT_P_SETENV);
@@ -225,6 +225,10 @@ struct options
/* enable forward compatibility for post-2.1 features */
bool forward_compatible;
+ /** What version we should try to be compatible with as major * 10000 +
+ * minor * 100 + patch, e.g. 2.4.7 => 20407 */
+ unsigned int backwards_compatible;
+
/* list of options that should be ignored even if unknown */
const char **ignore_unknown_option;