[Openvpn-devel,v2] Adjust cipher-negotiation.rst with compat-mode changes

Message ID 20211213152529.3995394-1-arne@rfc2549.org
State Accepted
Headers show
Series
  • [Openvpn-devel,v2] Adjust cipher-negotiation.rst with compat-mode changes
Related show

Commit Message

Arne Schwabe Dec. 13, 2021, 3:25 p.m.
This explains that 2.6 will ignore --cipher without --compat-mode and
restructures the whole paragraph to better readable.

Patch V2: Adjust grammar, use consistently "and later"

Signed-off-by: Arne Schwabe <arne@rfc2549.org>
---
 doc/man-sections/cipher-negotiation.rst | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

Comments

Frank Lichtenheld Dec. 13, 2021, 3:57 p.m. | #1
Acked-By: Frank Lichtenheld <frank@lichtenheld.com>

Still think it is a bit clunky, especially the "OpenVPN 2.6 and later with
``--compat-mode 2.4.x`` (or lower)", but I couldn't come up with anything
substantially better.

Regards,
  Frank

> Arne Schwabe <arne@rfc2549.org> hat am 13.12.2021 16:25 geschrieben:
> 
>  
> This explains that 2.6 will ignore --cipher without --compat-mode and
> restructures the whole paragraph to better readable.
> 
> Patch V2: Adjust grammar, use consistently "and later"
> 
> Signed-off-by: Arne Schwabe <arne@rfc2549.org>

--
Frank Lichtenheld
Gert Doering Dec. 13, 2021, 5:51 p.m. | #2
"Documentation good" :-) - we can surely spend more time on this, but it's
already better than before.

Your patch has been applied to the master branch.

commit 985e9dbda4688280014a3ea01ffe99def1ce5be8
Author: Arne Schwabe
Date:   Mon Dec 13 16:25:29 2021 +0100

     Adjust cipher-negotiation.rst with compat-mode changes

     Signed-off-by: Arne Schwabe <arne@rfc2549.org>
     Acked-by: Frank Lichtenheld <frank@lichtenheld.com>
     Message-Id: <20211213152529.3995394-1-arne@rfc2549.org>
     URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23403.html
     Signed-off-by: Gert Doering <gert@greenie.muc.de>


--
kind regards,

Gert Doering

Patch

diff --git a/doc/man-sections/cipher-negotiation.rst b/doc/man-sections/cipher-negotiation.rst
index 423b5ab6a..efa4c6c94 100644
--- a/doc/man-sections/cipher-negotiation.rst
+++ b/doc/man-sections/cipher-negotiation.rst
@@ -5,7 +5,7 @@  OpenVPN 2.4 and higher have the capability to negotiate the data cipher that
 is used to encrypt data packets. This section describes the mechanism in more detail and the
 different backwards compatibility mechanism with older server and clients.
 
-OpenVPN 2.5 and higher behaviour
+OpenVPN 2.5 and later behaviour
 --------------------------------
 When both client and server are at least running OpenVPN 2.5, that the order of
 the ciphers of the server's ``--data-ciphers`` is used to pick the the data cipher.
@@ -15,12 +15,15 @@  with a AUTH_FAILED message (as seen in client log):
 
     AUTH: Received control message: AUTH_FAILED,Data channel cipher negotiation failed (no shared cipher)
 
-OpenVPN 2.5 will only allow the ciphers specified in ``--data-ciphers``. To ensure
-backwards compatibility also if a cipher is specified using the ``--cipher`` option
-it is automatically added to this list. If both options are unset the default is
-:code:`AES-256-GCM:AES-128-GCM`. In 2.6 and later the default is changed to
+OpenVPN 2.5 and later will only allow the ciphers specified in ``--data-ciphers``.
+ If ``--data-ciphers`` is not set the default is :code:`AES-256-GCM:AES-128-GCM`.
+In 2.6 and later the default is changed to
 :code:`AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305` when Chacha20-Poly1305 is available.
 
+For backwards compatibility OpenVPN 2.6 and later with ``--compat-mode 2.4.x``
+(or lower) and OpenVPN 2.5 will automatically add a cipher specified using the
+``--cipher`` option to this list.
+
 OpenVPN 2.4 clients
 -------------------
 The negotiation support in OpenVPN 2.4 was the first iteration of the implementation