diff options
| -rw-r--r-- | doc/openvpn.8 | 2 | ||||
| -rw-r--r-- | src/openvpn/init.c | 1 | ||||
| -rw-r--r-- | src/openvpn/ssl.c | 4 | ||||
| -rw-r--r-- | src/openvpn/ssl_common.h | 1 |
4 files changed, 7 insertions, 1 deletions
diff --git a/doc/openvpn.8 b/doc/openvpn.8 index 8feb3b9..b8f2f04 100644 --- a/doc/openvpn.8 +++ b/doc/openvpn.8 @@ -4398,6 +4398,8 @@ NCP server (v2.4+) with "\-\-cipher BF\-CBC" and "\-\-ncp\-ciphers AES\-256\-GCM:AES\-256\-CBC" set can either specify "\-\-cipher BF\-CBC" or "\-\-cipher AES\-256\-CBC" and both will work. +Note, for using NCP with a OpenVPN 2.4 server this list must include +the AES\-256\-GCM and AES\-128\-GCM ciphers. .\"********************************************************* .TP .B \-\-ncp\-disable diff --git a/src/openvpn/init.c b/src/openvpn/init.c index 04207b6..5c2f801 100644 --- a/src/openvpn/init.c +++ b/src/openvpn/init.c @@ -2827,6 +2827,7 @@ do_init_crypto_tls(struct context *c, const unsigned int flags) to.tcp_mode = link_socket_proto_connection_oriented(options->ce.proto); to.config_ciphername = c->c1.ciphername; to.config_authname = c->c1.authname; + to.config_ncp_ciphers = options->ncp_ciphers; to.ncp_enabled = options->ncp_enabled; to.transition_window = options->transition_window; to.handshake_window = options->handshake_window; diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c index e708fc9..b835173 100644 --- a/src/openvpn/ssl.c +++ b/src/openvpn/ssl.c @@ -2322,7 +2322,9 @@ push_peer_info(struct buffer *buf, struct tls_session *session) /* support for Negotiable Crypto Parameters */ if (session->opt->ncp_enabled - && (session->opt->mode == MODE_SERVER || session->opt->pull)) + && (session->opt->mode == MODE_SERVER || session->opt->pull) + && tls_item_in_cipher_list("AES-128-GCM", session->opt->config_ncp_ciphers) + && tls_item_in_cipher_list("AES-256-GCM", session->opt->config_ncp_ciphers)) { buf_printf(&out, "IV_NCP=2\n"); } diff --git a/src/openvpn/ssl_common.h b/src/openvpn/ssl_common.h index 8dd0886..fb82f61 100644 --- a/src/openvpn/ssl_common.h +++ b/src/openvpn/ssl_common.h @@ -290,6 +290,7 @@ struct tls_options const char *config_ciphername; const char *config_authname; + const char *config_ncp_ciphers; bool ncp_enabled; bool tls_crypt_v2; |