diff mbox series

[Openvpn-devel,v6] Only announce support push updates/IV_NCP when actually supporting it

Message ID 20260708153512.61577-1-frank@lichtenheld.com
State New
Headers
Series [Openvpn-devel,v6] Only announce support push updates/IV_NCP when actually supporting it |

Commit Message

Frank Lichtenheld July 8, 2026, 3:35 p.m. UTC 
  From: Arne Schwabe <arne@rfc2549.org>

Currently even p2p clients that do not accept push message, so announcing
PUSH UPDATE or DNSv2 is not very useful.

The change for IV_NCP is more a documentation bugfix as in mode server
we currently never have push_peer_info_detail > 0.

But change the message to indicate that IV_NCP nowadays is more a
legacy variable and replaced by IV_CIPHERS.

Change-Id: I0737b769e78e6d271ec874cadb9fbd81bfefdec1
Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: Frank Lichtenheld <frank@lichtenheld.com>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1634
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1634
This mail reflects revision 6 of this Change.

Acked-by according to Gerrit (reflected above):
Frank Lichtenheld <frank@lichtenheld.com>
diff mbox series

Patch

diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c
index 044e852..b95a84f 100644
--- a/src/openvpn/ssl.c
+++ b/src/openvpn/ssl.c
@@ -1961,21 +1961,21 @@ 
         /* support for P_DATA_V2 */
         int iv_proto = IV_PROTO_DATA_V2;
 
-        /* support for the latest --dns option */
-        iv_proto |= IV_PROTO_DNS_OPTION_V2;
-
         /* support for exit notify via control channel */
         iv_proto |= IV_PROTO_CC_EXIT_NOTIFY;
 
-        /* currently push-update is not supported when DCO is enabled */
-        if (!session->opt->dco_enabled)
-        {
-            /* support push-updates */
-            iv_proto |= IV_PROTO_PUSH_UPDATE;
-        }
-
         if (session->opt->pull)
         {
+            /* support for the latest --dns option */
+            iv_proto |= IV_PROTO_DNS_OPTION_V2;
+
+            /* currently push-update is not supported when DCO is enabled */
+            if (!session->opt->dco_enabled)
+            {
+                /* support push-updates */
+                iv_proto |= IV_PROTO_PUSH_UPDATE;
+            }
+
             /* support for receiving push_reply before sending
              * push request, also signal that the client wants
              * to get push-reply messages without requiring a round
@@ -1990,11 +1990,9 @@ 
 
             /* support for tun-mtu as part of the push message */
             buf_printf(&out, "IV_MTU=%d\n", session->opt->frame.tun_max_mtu);
-        }
 
-        /* support for Negotiable Crypto Parameters */
-        if (session->opt->mode == MODE_SERVER || session->opt->pull)
-        {
+            /* legacy support for Negotiable Crypto Parameters (deprecated in
+             * favour of IV_CIPHERS) */
             if (tls_item_in_cipher_list("AES-128-GCM", session->opt->config_ncp_ciphers)
                 && tls_item_in_cipher_list("AES-256-GCM", session->opt->config_ncp_ciphers))
             {
@@ -2003,7 +2001,7 @@ 
         }
         else
         {
-            /* We are not using pull or p2mp server, instead do P2P NCP */
+            /* If we are not using pull we announce P2P NCP support */
             iv_proto |= IV_PROTO_NCP_P2P;
         }