From patchwork Mon Oct 9 10:53:36 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Frank Lichtenheld X-Patchwork-Id: 3387 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7300:b412:b0:f2:62eb:61c1 with SMTP id dj18csp1946710dyb; Mon, 9 Oct 2023 03:54:14 -0700 (PDT) X-Google-Smtp-Source: AGHT+IGmdV8oZ7XymFBc/9bjLl9sUaYDfvdxeXRXhlxWZo+uBlhC9Ro66wqb2lIn3Le6DXhWtw5s X-Received: by 2002:a05:6870:a98b:b0:1d0:e371:d7b0 with SMTP id ep11-20020a056870a98b00b001d0e371d7b0mr14994983oab.5.1696848854260; Mon, 09 Oct 2023 03:54:14 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1696848854; cv=none; d=google.com; s=arc-20160816; b=bK6TWnZRw/tg5QiDEfLdrTZMCIg85iVeWIIa397fBPVAhzXCPSkG3P2fQmpjqGfNMa nxDyqp+UsVAuoE+cpLuG5GAiDAlxw3WobWhJWBibZGqmx+uTfdZah4v3GhAtQ6mKkGyV DIsmdwW51xoUZvlemYmc5iKo3w+Ez6QYwPT2dYmu/5AJ/pTbx4SegmaiMysMGuxnfBPr ZeHC2Iz/VdBPoFaJ/mxDZo+KDx4LEe6hvLFcUTDSUhcjqE3CqU4yCxJOLB+/vBxEq+r4 HJEJZ5LpI3T8QEAvF8DKbNRntnliuFvZggXevV4ohxjzmW4MN7uRbYwqYWgYakyK6USK FgDA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=a52LRdTjr3kMD0tfnERqTaN6vkVVvxVQSUpaexOdAsk=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=TdnKxa6YlV6E/AeoeJ/xJ3eYmmdY/GH21C9yN1wpFd7HjftYV3BraGy1bnyc5GjvMc hIdH1dI3Fx0jXTrY/Gz8OhD71g+LPkkrP7pWQ3v4vv9hHrZigEl/tNlOs9egQg23YZzc cUhH2dZnWZfYeF8kNdURCao01aNdX+NmYgIsgTd158isURkx/k3uwyVmQPprf6NYgFwq +wuxLGrJXO6xVnSN6eUZtyPse0L6TSrbPUU7Piibp2xT9PYg3E96N+255SXYXJs0LvTW f1HX8Z93r/jLJIVCItBive0L3GL1mUsqnrEG74gBzjy2HlEVhvue0eIm85b6tkTRT1In lD3A== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b="H/7orEBW"; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=NeAub8M2; dkim=neutral (body hash did not verify) header.i=@lichtenheld.com header.s=MBO0001 header.b=vzVZ8Imv; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id p12-20020a056a000b4c00b0069022a03d42si7459595pfo.283.2023.10.09.03.54.14 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 09 Oct 2023 03:54:14 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b="H/7orEBW"; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=NeAub8M2; dkim=neutral (body hash did not verify) header.i=@lichtenheld.com header.s=MBO0001 header.b=vzVZ8Imv; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from [127.0.0.1] (helo=sfs-ml-3.v29.lw.sourceforge.com) by sfs-ml-3.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1qpntb-0006mn-IO; Mon, 09 Oct 2023 10:53:54 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-3.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1qpnta-0006mg-GK for openvpn-devel@lists.sourceforge.net; Mon, 09 Oct 2023 10:53:53 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-Id:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=ar3O7q2/unifcD9jJD7uUf5vsicEzWgYUxQe/oov+Bc=; b=H/7orEBWEO0YwMKMn1Vk8i6hjD 6UgYwql5x2J8BhcITi6f5NrLLRllQehAEWRA2S0o8ZO1QQ7atbXOKIJdmiWh0v4hufoDUQ3Wabu7Y LTMiwCNeYZrdLYwu0B2teHXYWgNCbGpzRWBtX8I6Zgbx/6vldCGIF6meXXqqvTozNjlk=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-Id: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=ar3O7q2/unifcD9jJD7uUf5vsicEzWgYUxQe/oov+Bc=; b=NeAub8M2LpARJTIns4JhlPxm1/ iPdE9BXfNiHewYvcjs9WZT+dAYOsY+ACGaAmq8WkfC41X6EgG9TTzGL4iliuoDAeeRy+XZ0lcEtKh gItPyI3Yu+JIuirc+yuTt2tEYTTnV+EL81fj5vB8gGs0nl3dkn0uWLAkv64nRfhjhOFs=; Received: from mout-p-103.mailbox.org ([80.241.56.161]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1qpntT-0004jE-JT for openvpn-devel@lists.sourceforge.net; Mon, 09 Oct 2023 10:53:52 +0000 Received: from smtp202.mailbox.org (smtp202.mailbox.org [10.196.197.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-p-103.mailbox.org (Postfix) with ESMTPS id 4S3wr150lFz9ssw; Mon, 9 Oct 2023 12:53:37 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lichtenheld.com; s=MBO0001; t=1696848817; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ar3O7q2/unifcD9jJD7uUf5vsicEzWgYUxQe/oov+Bc=; b=vzVZ8ImvxzkhUELUocxk326zVH/NBVr1zpfNrOyspFmh70nSmYIx+q/K4C6EST+mAcZPO7 Cvi1Bk8xqSxbavyQG+dFvJcAaBmuCQ6EKuyI3Hn/7SpyG3WeayVdAydUvgOytJRz7ZPFM1 DBxHqZDjpiBdSRUgPGSzIMv6vr32Ijei71Y1xdVjyfo+3LT7WIj8mgDSUqBZlqxzLfjlQQ lurifWDjaKd2cRzwtu6ocB+LcNrce2N6JqEAjK+EoI0m1I6nXP7LFZa/WoNGZK6VBzEZf6 IBk3epx8QMJXmVRmuu1niwRfyicLnG7vDfTQU/1YPbKDQfJG12TtkWYtZj+MSw== From: Frank Lichtenheld To: openvpn-devel@lists.sourceforge.net Date: Mon, 9 Oct 2023 12:53:36 +0200 Message-Id: <20231009105336.34267-1-frank@lichtenheld.com> In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: -0.9 (/) X-Spam-Report: Spam detection software, running on the system "util-spamd-1.v13.lw.sourceforge.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Arne Schwabe Change-Id: I85ae4e1167e1395b4f59d5d0ecf6c38befcaa8a7 Acked-by: Frank Lichtenheld --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Content analysis details: (-0.9 points, 6.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at https://www.dnswl.org/, low trust [80.241.56.161 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid X-Headers-End: 1qpntT-0004jE-JT Subject: [Openvpn-devel] [PATCH] Add warning if a p2p NCP client connects to a p2mp server X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: =?utf-8?q?1779274984415438860?= X-GMAIL-MSGID: =?utf-8?q?1779274984415438860?= From: Arne Schwabe Change-Id: I85ae4e1167e1395b4f59d5d0ecf6c38befcaa8a7 Acked-by: Frank Lichtenheld --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/323 This mail reflects revision 3 of this Change. Acked-by according to Gerrit (reflected above): Frank Lichtenheld diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c index 0d4e6f9..8b490ed 100644 --- a/src/openvpn/multi.c +++ b/src/openvpn/multi.c @@ -1811,6 +1811,15 @@ return false; } + /* Print a warning if we detect the client being in P2P mode and will + * not accept our pushed ciphers */ + if (proto & IV_PROTO_NCP_P2P) + { + msg(M_WARN, "Note: peer reports running in P2P mode (no --pull/--client" + "option). It will not negotiate ciphers with this server. " + "Expect this connection to fail."); + } + if (proto & IV_PROTO_REQUEST_PUSH) { c->c2.push_request_received = true; diff --git a/src/openvpn/ssl_ncp.c b/src/openvpn/ssl_ncp.c index dafaef1..0ca6d42 100644 --- a/src/openvpn/ssl_ncp.c +++ b/src/openvpn/ssl_ncp.c @@ -24,7 +24,7 @@ */ /** - * @file Control Channel SSL/Data dynamic negotion Module + * @file Control Channel SSL/Data dynamic negotiation Module * This file is split from ssl.c to be able to unit test it. */ @@ -258,8 +258,8 @@ const char *peer_ncp_list = tls_peer_ncp_list(peer_info, &gc_tmp); - /* non-NCP client without OCC? "assume nothing" */ - /* For client doing the newer version of NCP (that send IV_CIPHER) + /* non-NCP clients without OCC? "assume nothing" */ + /* For client doing the newer version of NCP (that send IV_CIPHERS) * we cannot assume that they will accept remote_cipher */ if (remote_cipher == NULL || (peer_info && strstr(peer_info, "IV_CIPHERS="))) diff --git a/src/openvpn/ssl_ncp.h b/src/openvpn/ssl_ncp.h index d27ed24..de7a0e4 100644 --- a/src/openvpn/ssl_ncp.h +++ b/src/openvpn/ssl_ncp.h @@ -23,7 +23,7 @@ */ /** - * @file Control Channel SSL/Data dynamic negotion Module + * @file Control Channel SSL/Data dynamic negotiation Module * This file is split from ssl.h to be able to unit test it. */