@@ -46,6 +46,12 @@
Support for building with OpenSSL 1.0.2 has been removed. The minimum
supported OpenSSL version is now 1.1.0.
+Compression on send
+ OpenVPN 2.7 will never compress data before sending. Decompression of
+ received data is still supported.
+ ``--allow-compression yes`` is now an alias for
+ ``--allow-compression asym``.
+
Overview of changes in 2.6
==========================
@@ -55,129 +55,11 @@
{
}
-static bool
-do_lz4_compress(struct buffer *buf,
- struct buffer *work,
- struct compress_context *compctx,
- const struct frame *frame)
-{
- /*
- * In order to attempt compression, length must be at least COMPRESS_THRESHOLD.
- * and asymmetric compression must be disabled
- */
- if (buf->len >= COMPRESS_THRESHOLD && (compctx->flags & COMP_F_ALLOW_COMPRESS))
- {
- const size_t ps = frame->buf.payload_size;
- int zlen_max = ps + COMP_EXTRA_BUFFER(ps);
- int zlen;
-
- ASSERT(buf_init(work, frame->buf.headroom));
- ASSERT(buf_safe(work, zlen_max));
-
- if (buf->len > ps)
- {
- dmsg(D_COMP_ERRORS, "LZ4 compression buffer overflow");
- buf->len = 0;
- return false;
- }
-
- zlen = LZ4_compress_default((const char *)BPTR(buf), (char *)BPTR(work), BLEN(buf), zlen_max);
-
- if (zlen <= 0)
- {
- dmsg(D_COMP_ERRORS, "LZ4 compression error");
- buf->len = 0;
- return false;
- }
-
- ASSERT(buf_safe(work, zlen));
- work->len = zlen;
-
-
- dmsg(D_COMP, "LZ4 compress %d -> %d", buf->len, work->len);
- compctx->pre_compress += buf->len;
- compctx->post_compress += work->len;
- return true;
- }
- return false;
-}
-
-
static void
lz4_compress(struct buffer *buf, struct buffer work,
struct compress_context *compctx,
const struct frame *frame)
{
- bool compressed;
- if (buf->len <= 0)
- {
- return;
- }
-
- compressed = do_lz4_compress(buf, &work, compctx, frame);
-
- /* On error do_lz4_compress sets buf len to zero, just return */
- if (buf->len == 0)
- {
- return;
- }
-
- /* did compression save us anything? */
- {
- uint8_t comp_head_byte = NO_COMPRESS_BYTE_SWAP;
- if (compressed && work.len < buf->len)
- {
- *buf = work;
- comp_head_byte = LZ4_COMPRESS_BYTE;
- }
-
- {
- uint8_t *head = BPTR(buf);
- uint8_t *tail = BEND(buf);
- ASSERT(buf_safe(buf, 1));
- ++buf->len;
-
- /* move head byte of payload to tail */
- *tail = *head;
- *head = comp_head_byte;
- }
- }
-}
-
-
-static void
-lz4v2_compress(struct buffer *buf, struct buffer work,
- struct compress_context *compctx,
- const struct frame *frame)
-{
- bool compressed;
- if (buf->len <= 0)
- {
- return;
- }
-
- compressed = do_lz4_compress(buf, &work, compctx, frame);
-
- /* On Error just return */
- if (buf->len == 0)
- {
- return;
- }
-
- /* did compression save us anything? Include 2 byte compression header
- * in calculation */
- if (compressed && work.len + 2 < buf->len)
- {
- ASSERT(buf_prepend(&work, 2));
- uint8_t *head = BPTR(&work);
- head[0] = COMP_ALGV2_INDICATOR_BYTE;
- head[1] = COMP_ALGV2_LZ4_BYTE;
- *buf = work;
- }
- else
- {
- compv2_escape_data_ifneeded(buf);
- }
}
static void
@@ -305,7 +187,7 @@
"lz4v2",
lz4v2_compress_init,
lz4_compress_uninit,
- lz4v2_compress,
+ lz4_compress,
lz4v2_decompress
};
#endif /* ENABLE_LZ4 */
@@ -33,7 +33,8 @@
/* Compression flags */
#define COMP_F_ADAPTIVE (1<<0) /* COMP_ALG_LZO only */
-#define COMP_F_ALLOW_COMPRESS (1<<1) /* not only downlink is compressed but also uplink */
+/*Removed */
+/*#define COMP_F_ALLOW_COMPRESS (1<<1) / * not only downlink is compressed but also uplink * / */
#define COMP_F_SWAP (1<<2) /* initial command byte is swapped with last byte in buffer to preserve payload alignment */
#define COMP_F_ADVERTISE_STUBS_ONLY (1<<3) /* tell server that we only support compression stubs */
#define COMP_F_ALLOW_STUB_ONLY (1<<4) /* Only accept stub compression, even with COMP_F_ADVERTISE_STUBS_ONLY
@@ -413,8 +413,7 @@
#if defined(USE_COMP)
if (o->comp.alg != COMP_ALG_UNDEF
- || o->comp.flags & COMP_F_ALLOW_ASYM
- || o->comp.flags & COMP_F_ALLOW_COMPRESS)
+ || o->comp.flags & COMP_F_ALLOW_ASYM)
{
msg(msglevel, "Note: '--allow-compression' is not set to 'no', disabling data channel offload.");
@@ -39,54 +39,6 @@
#include "memdbg.h"
-/**
- * Perform adaptive compression housekeeping.
- *
- * @param ac the adaptive compression state structure.
- *
- * @return
- */
-static bool
-lzo_adaptive_compress_test(struct lzo_adaptive_compress *ac)
-{
- const bool save = ac->compress_state;
- const time_t local_now = now;
-
- if (!ac->compress_state)
- {
- if (local_now >= ac->next)
- {
- if (ac->n_total > AC_MIN_BYTES
- && (ac->n_total - ac->n_comp) < (ac->n_total / (100 / AC_SAVE_PCT)))
- {
- ac->compress_state = true;
- ac->next = local_now + AC_OFF_SEC;
- }
- else
- {
- ac->next = local_now + AC_SAMP_SEC;
- }
- dmsg(D_COMP, "lzo_adaptive_compress_test: comp=%d total=%d", ac->n_comp, ac->n_total);
- ac->n_total = ac->n_comp = 0;
- }
- }
- else
- {
- if (local_now >= ac->next)
- {
- ac->next = local_now + AC_SAMP_SEC;
- ac->n_total = ac->n_comp = 0;
- ac->compress_state = false;
- }
- }
-
- if (ac->compress_state != save)
- {
- dmsg(D_COMP_LOW, "Adaptive compression state %s", (ac->compress_state ? "OFF" : "ON"));
- }
-
- return !ac->compress_state;
-}
static inline void
lzo_adaptive_compress_data(struct lzo_adaptive_compress *ac, int n_total, int n_comp)
@@ -118,92 +70,13 @@
compctx->wu.lzo.wmem = NULL;
}
-static inline bool
-lzo_compression_enabled(struct compress_context *compctx)
-{
- if (!(compctx->flags & COMP_F_ALLOW_COMPRESS))
- {
- return false;
- }
- else
- {
- if (compctx->flags & COMP_F_ADAPTIVE)
- {
- return lzo_adaptive_compress_test(&compctx->wu.lzo.ac);
- }
- else
- {
- return true;
- }
- }
-}
-
static void
lzo_compress(struct buffer *buf, struct buffer work,
struct compress_context *compctx,
const struct frame *frame)
{
- lzo_uint zlen = 0;
- int err;
- bool compressed = false;
-
- if (buf->len <= 0)
- {
- return;
- }
-
- /*
- * In order to attempt compression, length must be at least COMPRESS_THRESHOLD,
- * and our adaptive level must give the OK.
- */
- if (buf->len >= COMPRESS_THRESHOLD && lzo_compression_enabled(compctx))
- {
- const size_t ps = frame->buf.payload_size;
- ASSERT(buf_init(&work, frame->buf.headroom));
- ASSERT(buf_safe(&work, ps + COMP_EXTRA_BUFFER(ps)));
-
- if (buf->len > ps)
- {
- dmsg(D_COMP_ERRORS, "LZO compression buffer overflow");
- buf->len = 0;
- return;
- }
-
- err = LZO_COMPRESS(BPTR(buf), BLEN(buf), BPTR(&work), &zlen, compctx->wu.lzo.wmem);
- if (err != LZO_E_OK)
- {
- dmsg(D_COMP_ERRORS, "LZO compression error: %d", err);
- buf->len = 0;
- return;
- }
-
- ASSERT(buf_safe(&work, zlen));
- work.len = zlen;
- compressed = true;
-
- dmsg(D_COMP, "LZO compress %d -> %d", buf->len, work.len);
- compctx->pre_compress += buf->len;
- compctx->post_compress += work.len;
-
- /* tell adaptive level about our success or lack thereof in getting any size reduction */
- if (compctx->flags & COMP_F_ADAPTIVE)
- {
- lzo_adaptive_compress_data(&compctx->wu.lzo.ac, buf->len, work.len);
- }
- }
-
- /* did compression save us anything ? */
- if (compressed && work.len < buf->len)
- {
- uint8_t *header = buf_prepend(&work, 1);
- *header = LZO_COMPRESS_BYTE;
- *buf = work;
- }
- else
- {
- uint8_t *header = buf_prepend(buf, 1);
- *header = NO_COMPRESS_BYTE;
- }
+ uint8_t *header = buf_prepend(buf, 1);
+ *header = NO_COMPRESS_BYTE;
}
static void
@@ -5715,17 +5715,10 @@
{
if (comp_non_stub_enabled(info))
{
- /*
- * Check if already displayed the strong warning and enabled full
- * compression
- */
- if (!(info->flags & COMP_F_ALLOW_COMPRESS))
- {
- msg(M_WARN, "WARNING: Compression for receiving enabled. "
- "Compression has been used in the past to break encryption. "
- "Sent packets are not compressed unless \"allow-compression yes\" "
- "is also set.");
- }
+ msg(M_WARN, "WARNING: Compression for receiving enabled. "
+ "Compression has been used in the past to break encryption. "
+ "Compression support is deprecated and we recommend to disable "
+ "it completely.");
}
}
@@ -8435,18 +8428,14 @@
}
else if (streq(p[1], "asym"))
{
- options->comp.flags &= ~COMP_F_ALLOW_COMPRESS;
options->comp.flags |= COMP_F_ALLOW_ASYM;
}
else if (streq(p[1], "yes"))
{
- msg(M_WARN, "WARNING: Compression for sending and receiving enabled. Compression has "
- "been used in the past to break encryption. Allowing compression allows "
- "attacks that break encryption. Using \"--allow-compression yes\" is "
- "strongly discouraged for common usage. See --compress in the manual "
- "page for more information ");
+ msg(M_WARN, "DEPRECATED OPTION: \"--allow-compression yes\" has been removed. "
+ "We will use \"asym\" mode instead. See the manual page for more information.");
- options->comp.flags |= COMP_F_ALLOW_COMPRESS;
+ options->comp.flags |= COMP_F_ALLOW_ASYM;
}
else
{
Attention is currently required from: plaisthos. Hello plaisthos, I'd like you to do a code review. Please visit http://gerrit.openvpn.net/c/openvpn/+/755?usp=email to review the following change. Change subject: Remove support for compression on send ...................................................................... Remove support for compression on send We can't disable compression support on receive because that would break too many configurations out there. But we can remove the support for compressing outgoing traffic, it was disabled by default anyway. Makes --allow-compression yes is an alias for --allow-compression asym and removes all resulting dead code. Change-Id: I402ba016b75cfcfec4fc8b2b01cc4eca7e2bcc60 Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> --- M Changes.rst M src/openvpn/comp-lz4.c M src/openvpn/comp.h M src/openvpn/dco.c M src/openvpn/lzo.c M src/openvpn/options.c 6 files changed, 19 insertions(+), 269 deletions(-) git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/55/755/1