openvpn: disable LZO support by default

OpenVPN recommends disabling compression, as it may weaken the security
of the connection. For users who need compression, we build with LZ4
support by default. LZO in OpenVPN pulls in liblzo at approx. 32 kB.

OpenWrt users will no longer be able to connect to OpenVPN peers that
require LZO compression, unless they build the OpenVPN package themselves.

Signed-off-by: Magnus Kroken <mkroken@gmail.com>

diff --git a/net/openvpn/Config-mbedtls.in b/net/openvpn/Config-mbedtls.in
index 2a2f303c48ebfb956c588d91fe2b70a8fb378d9f..3cf233b8f7b39a12f7230dc5890dc4d35a3df357 100644 (file)
--- a/net/openvpn/Config-mbedtls.in
+++ b/net/openvpn/Config-mbedtls.in
@@ -2,7 +2,7 @@ if PACKAGE_openvpn-mbedtls
 
 config OPENVPN_mbedtls_ENABLE_LZO
        bool "Enable LZO compression support"
-       default y
+       default n
 
 config OPENVPN_mbedtls_ENABLE_LZ4
        bool "Enable LZ4 compression support"

diff --git a/net/openvpn/Config-openssl.in b/net/openvpn/Config-openssl.in
index 7a7be74db9b1515ad83cac42d40a6f71eb4e39a8..335bbaa2c41d94747312f8516e3ed928077d0682 100644 (file)
--- a/net/openvpn/Config-openssl.in
+++ b/net/openvpn/Config-openssl.in
@@ -2,7 +2,7 @@ if PACKAGE_openvpn-openssl
 
 config OPENVPN_openssl_ENABLE_LZO
        bool "Enable LZO compression support"
-       default y
+       default n
 
 config OPENVPN_openssl_ENABLE_LZ4
        bool "Enable LZ4 compression support"

diff --git a/net/openvpn/files/openvpn.config b/net/openvpn/files/openvpn.config
index f6278836e75fddbf8b4314a7c16f1a76aef4d4bd..09d504da28970164a518cf6798d02603b0207461 100644 (file)
--- a/net/openvpn/files/openvpn.config
+++ b/net/openvpn/files/openvpn.config
@@ -293,9 +293,7 @@ config openvpn sample_server
        #
        # LZ4 requires OpenVPN 2.4+ client and server
 #      option compress lz4
-       # LZO is compatible with most OpenVPN versions
-       # (set "compress lzo" on 2.4+ clients, and "comp-lzo yes" on older clients)
-#      option compress lzo
+       
        # Control how OpenVPN handles peers using compression
        #
        # Do not allow any connections using compression
@@ -487,8 +485,6 @@ config openvpn sample_client
        #
        # LZ4 requires OpenVPN 2.4+ on server and client
 #      option compress lz4
-       # LZO is compatible with most OpenVPN versions
-#      option compress lzo
 
        # Set log file verbosity.
        option verb 3