diff options
| author | Arne Schwabe | 2021-12-06 16:08:52 +0100 |
|---|---|---|
| committer | Gert Doering | 2022-11-11 14:38:10 +0100 |
| commit | b43a9b9f3324ccd7dffde3048c616aa5becc2b13 (patch) | |
| tree | b355f5740c40cd2aea33163da56069858dc1da7a | |
| parent | abe0bb1a7f727a24e2d7cb7215cb309aea5fcffc (diff) | |
| download | openvpn-b43a9b9f3324ccd7dffde3048c616aa5becc2b13.zip openvpn-b43a9b9f3324ccd7dffde3048c616aa5becc2b13.tar.gz | |
Fix handling an optional invalid cipher at the end of data-ciphers
If an optional cipher was found at the end of --data-cipher that was
not available, it would reset the error and allow non optional ciphers
to be ignored.
Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20211206150852.3142891-1-arne@rfc2549.org>
URL: https://www.mail-archive.com/search?l=mid&q=20211206150852.3142891-1-arne@rfc2549.org
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 868433857fbf8d71515ac0ffecb98eae893515dc)
| -rw-r--r-- | src/openvpn/ssl_ncp.c | 2 | ||||
| -rw-r--r-- | tests/unit_tests/openvpn/test_ncp.c | 3 |
2 files changed, 4 insertions, 1 deletions
diff --git a/src/openvpn/ssl_ncp.c b/src/openvpn/ssl_ncp.c index de7efa4..4ab39a5 100644 --- a/src/openvpn/ssl_ncp.c +++ b/src/openvpn/ssl_ncp.c @@ -133,7 +133,7 @@ mutate_ncp_cipher_list(const char *list, struct gc_arena *gc) { const char* optstr = optional ? "optional ": ""; msg(M_WARN, "Unsupported %scipher in --data-ciphers: %s", optstr, token); - error_found = !optional; + error_found = error_found || !optional; } else { diff --git a/tests/unit_tests/openvpn/test_ncp.c b/tests/unit_tests/openvpn/test_ncp.c index 134a58a..6e1e50a 100644 --- a/tests/unit_tests/openvpn/test_ncp.c +++ b/tests/unit_tests/openvpn/test_ncp.c @@ -85,6 +85,9 @@ test_check_ncp_ciphers_list(void **state) /* All unsupported should still yield an empty list */ assert_ptr_equal(mutate_ncp_cipher_list("?kugelfisch:?grasshopper", &gc), NULL); + /* If the last is optional, previous invalid ciphers should be ignored */ + assert_ptr_equal(mutate_ncp_cipher_list("Vollbit:Littlebit:AES-256-CBC:BF-CBC:?nixbit", &gc), NULL); + /* For testing that with OpenSSL 1.1.0+ that also accepts ciphers in * a different spelling the normalised cipher output is the same */ bool have_chacha_mixed_case = cipher_kt_get("ChaCha20-Poly1305"); |