diff options
| author | Arne Schwabe | 2020-08-30 16:07:35 +0200 |
|---|---|---|
| committer | Gert Doering | 2020-11-24 20:08:26 +0100 |
| commit | 7e3cd06d514476658709506c5e8e0703008efc5f (patch) | |
| tree | 0704453c78564a7d1274109d294525bf32868693 /src/openvpn/options.c | |
| parent | f16b4edabab1d24adfe3e8824d26f401f6afde6d (diff) | |
| download | openvpn-7e3cd06d514476658709506c5e8e0703008efc5f.zip openvpn-7e3cd06d514476658709506c5e8e0703008efc5f.tar.gz | |
Normalise ncp-ciphers option and restrict it to 127 bytes
In scenarios of mbed TLS vs OpenSSL we already normalise the ciphers
that are send via the wire protocol via OCC to not have a mismatch
warning between server and client. This is done by
translate_cipher_name_from_openvpn. The same applies also to the
ncp-ciphers list. Specifying non normalised names in ncp-ciphers will
cause negotation not to succeed if ciphers are not in the same form.
Therefore we will normalise the ciphers in options_postmutate.
The alternative and a lot less user friendly alternative would be to
bail if on of the ciphers in ncp-ciphers is not in its normalised form.
Also restrict the ncp-ciphers list to 127. This is somewhat arbitrary
but should prevent too large IV_CIPHER messages and problems sending
those. The server will accept also large IV_CIPHER values from clients.
Cherry picked from be4531564e2be7c8a0222e6923e3f7580b358cab and adjusted
for 2.4 (methods added to ssl.h/ssl.c instead ssl_ncp.c/.h
Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20200830140736.16571-2-arne@rfc2549.org>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg20846.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Diffstat (limited to 'src/openvpn/options.c')
| -rw-r--r-- | src/openvpn/options.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/src/openvpn/options.c b/src/openvpn/options.c index de30fcb..f69bbb2 100644 --- a/src/openvpn/options.c +++ b/src/openvpn/options.c @@ -2982,6 +2982,15 @@ options_postprocess_mutate(struct options *o) options_postprocess_mutate_invariant(o); + if (o->ncp_enabled) + { + o->ncp_ciphers = mutate_ncp_cipher_list(o->ncp_ciphers, &o->gc); + if (o->ncp_ciphers == NULL) + { + msg(M_USAGE, "NCP cipher list contains unsupported ciphers or is too long."); + } + } + if (o->remote_list && !o->connection_list) { /* |