From patchwork Sun Aug 30 04:07:36 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Schwabe X-Patchwork-Id: 1408 Return-Path: Delivered-To: patchwork@openvpn.net Delivered-To: patchwork@openvpn.net Received: from director11.mail.ord1d.rsapps.net ([172.30.191.6]) by backend41.mail.ord1d.rsapps.net with LMTP id cEJDBSm4S18fHQAAqwncew for ; Sun, 30 Aug 2020 10:31:05 -0400 Received: from proxy16.mail.ord1d.rsapps.net ([172.30.191.6]) by director11.mail.ord1d.rsapps.net with LMTP id EPonBSm4S199fgAAvGGmqA (envelope-from ) for ; Sun, 30 Aug 2020 10:31:05 -0400 Received: from smtp9.gate.ord1d ([172.30.191.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by proxy16.mail.ord1d.rsapps.net with LMTPS id CCjpBCm4S19wBQAAetu3IA (envelope-from ) for ; Sun, 30 Aug 2020 10:31:05 -0400 X-Spam-Threshold: 95 X-Spam-Score: 0 X-Spam-Flag: NO X-Virus-Scanned: OK X-Orig-To: openvpnslackdevel@openvpn.net X-Originating-Ip: [216.105.38.7] Authentication-Results: smtp9.gate.ord1d.rsapps.net; iprev=pass policy.iprev="216.105.38.7"; spf=pass smtp.mailfrom="openvpn-devel-bounces@lists.sourceforge.net" smtp.helo="lists.sourceforge.net"; dkim=fail (signature verification failed) header.d=sourceforge.net; dkim=fail (signature verification failed) header.d=sf.net; dmarc=none (p=nil; dis=none) header.from=rfc2549.org X-Suspicious-Flag: YES X-Classification-ID: 6ea251a8-eacd-11ea-ba63-525400bd3b1f-1-1 Received: from [216.105.38.7] ([216.105.38.7:60384] helo=lists.sourceforge.net) by smtp9.gate.ord1d.rsapps.net (envelope-from ) (ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id 88/3B-22284-728BB4F5; Sun, 30 Aug 2020 10:31:04 -0400 Received: from [127.0.0.1] (helo=sfs-ml-1.v29.lw.sourceforge.com) by sfs-ml-1.v29.lw.sourceforge.com with esmtp (Exim 4.90_1) (envelope-from ) id 1kCOLd-0004Vf-Jo; Sun, 30 Aug 2020 14:30:21 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-1.v29.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kCOLc-0004VP-Ec for openvpn-devel@lists.sourceforge.net; Sun, 30 Aug 2020 14:30:20 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=References:In-Reply-To:Message-Id:Date:Subject:To: From:Sender:Reply-To:Cc:MIME-Version:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=Y1tSQachRPwGfy3muaoAr84EmQMEfOAcjnt3E5mA4XE=; b=fZD7+F74CS/+H+uP0bvwDxQhIy utMeSWfDGy5ZRS4IUZ+qc5nZO0wbIhhu+362irSF9oGze3cDpXLwIM3nE2sS+GIhvtNPr+nWp9pje RwiVKRfeu3E01zIsSm9p0+i81RxyeIMWWTC9MzPOclu6CRIru/y4ShcUbDAPneyHXs9A=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=References:In-Reply-To:Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc :MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=Y1tSQachRPwGfy3muaoAr84EmQMEfOAcjnt3E5mA4XE=; b=fFYenmpfR0/ui/+A1d8l8LrXjd vJTPUy9AK1Dvni2/hf6CFN54yv/UNOiswOV+uN4eoSA8oRWcTHIhLDTlxYTm76EigTWPGglzJE93G 46gRLdxnmdcVmptUWF+YYstivCwDOIDbdTbnVtj1wgCGIGqEEuuOakfe642x7U7jorEY=; Received: from [192.26.174.232] (helo=mail.blinkt.de) by sfi-mx-3.v28.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.92.2) id 1kCOLa-007B7B-3q for openvpn-devel@lists.sourceforge.net; Sun, 30 Aug 2020 14:30:20 +0000 Received: from kamera.blinkt.de ([2001:638:502:390:20c:29ff:fec8:535c]) by mail.blinkt.de with smtp (Exim 4.94 (FreeBSD)) (envelope-from ) id 1kCNzd-000Jhy-2N for openvpn-devel@lists.sourceforge.net; Sun, 30 Aug 2020 16:07:37 +0200 Received: (nullmailer pid 16624 invoked by uid 10006); Sun, 30 Aug 2020 14:07:36 -0000 From: Arne Schwabe To: openvpn-devel@lists.sourceforge.net Date: Sun, 30 Aug 2020 16:07:36 +0200 Message-Id: <20200830140736.16571-3-arne@rfc2549.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20200830140736.16571-1-arne@rfc2549.org> References: <20200830140736.16571-1-arne@rfc2549.org> X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: rfc2549.org] 0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.0 SPF_NONE SPF: sender does not publish an SPF Record 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record 1.0 RDNS_NONE Delivered to internal network by a host with no rDNS -0.3 AWL AWL: Adjusted score from AWL reputation of From: address X-Headers-End: 1kCOLa-007B7B-3q Subject: [Openvpn-devel] [PATCH 2/2] Also announce IV_CIPHERS as client in OpenVPN 2.4 X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox This improves compatbility to a OpenVPN 2.5 server and allows to negotiate a different cipher than AES-128/256-GCM without abusing the poor man's NCP support with --cipher. We keep the IV_NCP=2 flag logic as broken as it is since 2.5 server ignore the flag if IV_CIPHERS is set and this might break existing 2.4 setups. Server support for IV_CIPHERS is not added since it would be quite intrusive and users should rather upgrade to 2.5 on the server if they want the full benefits. This commit cherry picks a few parts of 868b200c3aef6ee5acfdf679770832018ebc7b70 Signed-off-by: Arne Schwabe Acked-by: Gert Doering --- src/openvpn/init.c | 1 + src/openvpn/ssl.c | 11 +++++++++++ src/openvpn/ssl_common.h | 1 + 3 files changed, 13 insertions(+) diff --git a/src/openvpn/init.c b/src/openvpn/init.c index e153682e..7ce6dd97 100644 --- a/src/openvpn/init.c +++ b/src/openvpn/init.c @@ -2734,6 +2734,7 @@ do_init_crypto_tls(struct context *c, const unsigned int flags) to.tcp_mode = link_socket_proto_connection_oriented(options->ce.proto); to.config_ciphername = c->c1.ciphername; to.config_authname = c->c1.authname; + to.config_ncp_ciphers = options->ncp_ciphers; to.ncp_enabled = options->ncp_enabled; to.transition_window = options->transition_window; to.handshake_window = options->handshake_window; diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c index dd9c52fb..d70dcb46 100644 --- a/src/openvpn/ssl.c +++ b/src/openvpn/ssl.c @@ -2311,7 +2311,18 @@ push_peer_info(struct buffer *buf, struct tls_session *session) if (session->opt->ncp_enabled && (session->opt->mode == MODE_SERVER || session->opt->pull)) { + /* We keep announcing IV_NCP=2 in OpenVPN 2.4 even though it is + * technically wrong to ensure not to break 2.4 setups on a + * minor release */ buf_printf(&out, "IV_NCP=2\n"); + buf_printf(&out, "IV_CIPHERS=%s", session->opt->config_ncp_ciphers); + if (!tls_item_in_cipher_list(session->opt->config_ciphername, + session->opt->config_ncp_ciphers)) + { + buf_printf(&out, ":%s", session->opt->config_ciphername); + } + buf_printf(&out, "\n") + } /* push compression status */ diff --git a/src/openvpn/ssl_common.h b/src/openvpn/ssl_common.h index ac25ffa7..378b81fd 100644 --- a/src/openvpn/ssl_common.h +++ b/src/openvpn/ssl_common.h @@ -286,6 +286,7 @@ struct tls_options const char *config_ciphername; const char *config_authname; + const char *config_ncp_ciphers; bool ncp_enabled; /** TLS handshake wrapping state */