From patchwork Sat Jul 1 20:08:40 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Schwabe X-Patchwork-Id: 3266 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7301:3c07:b0:d9:b492:11d6 with SMTP id ki7csp3401922dyb; Sat, 1 Jul 2023 13:09:48 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ4V1mBJaLD7pk0uMCC0iP7TYboqsbNAqQRJBoeTmk073tfHvWRbvet6PUnETrwpAX6QqMvK X-Received: by 2002:a05:6a20:1612:b0:124:eea9:668d with SMTP id l18-20020a056a20161200b00124eea9668dmr5572694pzj.40.1688242188645; Sat, 01 Jul 2023 13:09:48 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1688242188; cv=none; d=google.com; s=arc-20160816; b=W/vHSY0yh8qoxvO+tHeQRHcf0hf3u/8+TNjL4zMOjnewArTUCLl3CKys7/y9Y80FQf yfkCbWyDAGXxvGhGqMbzgtaVbVK7qKXvtX5pbK+3l6XWu7q2Vjs+zfoLLpAXwPraO4v5 bn7ceRz4+zXkGIjGy4iGdwX53DJOfqVrHgQvVF2bEw063jqoSAb5Z+RIp8l12apWUbD8 Nye/m3lVOQq5g2uLR54qhREh50W4nhdEBdDgUUZnEXuWtNga3ZjO9coQOe2nXdH8SibY 2XB5z3w6+MFQrDQ6IC27DVOx5hzIuDiasJJxhpkPXAG1Mgj3DewWlcKGaAuS58ytEN1U 7gzg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature; bh=liIjri1zO/kUxmlpx6tEhLEWth9KofbmmExPqBxH1Qo=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=G+IRnz0bUJXa8EEU5oqEjDidpA3FQQUHUqozdRmxJqMQnicnhDl1YKsRqQLVPmy7gQ JcF9R/tFnkovMpV/NPAMVhD4LiE8V3rG0f9k9/7H35Q+0Ov5VDtHrm5WRG0bX1DpNavP q1ZshvOKH574Y+bIh+9EvGsLTLwWrsAdwZlIWrAvU4/7PMeCjDo9CeB9AVJEaTakDbQf vBED2fDKapseUID835+d1lJ5ov9XRG0gBxzq22Zm5nCaT0JEk685HkfdhdSF0axd842Y cR2fZZZ14YIqi2iVoxOFvdUosgkg/qaOkHQzKLGi1fo7aoKchYn//NKHS+jkvorPn+mH 0svw== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=SB+dUVuu; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=IV5MqWzP; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id c23-20020a63da17000000b005340840c0c8si15171838pgh.327.2023.07.01.13.09.48 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Sat, 01 Jul 2023 13:09:48 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=SB+dUVuu; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=IV5MqWzP; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from [127.0.0.1] (helo=sfs-ml-3.v29.lw.sourceforge.com) by sfs-ml-3.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1qFgtm-0003fm-Ny; Sat, 01 Jul 2023 20:08:51 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-3.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1qFgtk-0003fg-Ul for openvpn-devel@lists.sourceforge.net; Sat, 01 Jul 2023 20:08:49 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=wj2TNNi2HHknCg0In6x/ManrHEGxl6UZjC8cdShzjsw=; b=SB+dUVuurODgTNUNNAH8dKt+gf 7gWaH4AFpa3SPM922nNRjw1N0g96BkO4HPWhH4JOF4uvGV4V+hvNY8rJPpITFa+Eje37Yh+aftN+i TicyB+TOgC4glcd+wdrg4UDh56og17dMnKA1aRIoie/0NnHsb7h2AnrpgYOq23cXmDDE=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-Id: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=wj2TNNi2HHknCg0In6x/ManrHEGxl6UZjC8cdShzjsw=; b=IV5MqWzPteZRGTAPn0oLo6HM3t DOaZQoWpA/djfrKTrpf/fTkBNhyZBIXwAbM7KlX6qHTwHoSMuxRBHMHMc7sijhNO65Cb1fXSp0gep fjvCPAcszR77ls53crMu27HAVzrnVPjYyE454N3tRFpxdSx5AUxPvhirsJoArajqPnBw=; Received: from mail.blinkt.de ([192.26.174.232]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1qFgtk-00004y-4e for openvpn-devel@lists.sourceforge.net; Sat, 01 Jul 2023 20:08:49 +0000 Received: from kamera.blinkt.de ([2001:638:502:390:20c:29ff:fec8:535c]) by mail.blinkt.de with smtp (Exim 4.95 (FreeBSD)) (envelope-from ) id 1qFgtc-000PlV-Pr for openvpn-devel@lists.sourceforge.net; Sat, 01 Jul 2023 22:08:40 +0200 Received: (nullmailer pid 3516367 invoked by uid 10006); Sat, 01 Jul 2023 20:08:40 -0000 From: Arne Schwabe To: openvpn-devel@lists.sourceforge.net Date: Sat, 1 Jul 2023 22:08:40 +0200 Message-Id: <20230701200840.3516314-3-arne@rfc2549.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20230701200840.3516314-1-arne@rfc2549.org> References: <20230701200840.3516314-1-arne@rfc2549.org> MIME-Version: 1.0 X-Spam-Score: 0.3 (/) X-Spam-Report: Spam detection software, running on the system "util-spamd-1.v13.lw.sourceforge.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: OpenSSL has a weird way of only reporting EC curves that are implemented in a certain way in the list of all EC cruves. Note this fact and point out that also the very important curves X448 and X25519 [...] Content analysis details: (0.3 points, 6.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.0 SPF_NONE SPF: sender does not publish an SPF Record 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record X-Headers-End: 1qFgtk-00004y-4e Subject: [Openvpn-devel] [PATCH 3/3] Add warning for the --show-groups command that some groups are missing X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: =?utf-8?q?1770250241048735121?= X-GMAIL-MSGID: =?utf-8?q?1770250241048735121?= OpenSSL has a weird way of only reporting EC curves that are implemented in a certain way in the list of all EC cruves. Note this fact and point out that also the very important curves X448 and X25519 are affected. Change-Id: I86641bf60d62a50e9b2719e809d2429d65c00097 Signed-off-by: Arne Schwabe --- src/openvpn/ssl_openssl.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/openvpn/ssl_openssl.c b/src/openvpn/ssl_openssl.c index 59bbdfc0a..442ae1871 100644 --- a/src/openvpn/ssl_openssl.c +++ b/src/openvpn/ssl_openssl.c @@ -2355,8 +2355,10 @@ show_available_tls_ciphers_list(const char *cipher_list, void show_available_curves(void) { - printf("Consider using openssl 'ecparam -list_curves' as\n" - "alternative to running this command.\n"); + printf("Consider using 'openssl ecparam -list_curves' as alternative to running\n" + "this command.\n" + "Note this output does only list curves/group that OpenSSL considers as\n" + "builtin EC curves. It does not list additional curves nor X448 or X25519\n"); #ifndef OPENSSL_NO_EC EC_builtin_curve *curves = NULL; size_t crv_len = 0;