]> git.ipfire.org Git - thirdparty/openvpn.git/commit
Fix edge case with clients failing to set up cipher on empty PUSH_REPLY.
authorGert Doering <gert@greenie.muc.de>
Sun, 18 Jun 2017 09:22:44 +0000 (11:22 +0200)
committerGert Doering <gert@greenie.muc.de>
Sun, 18 Jun 2017 09:47:38 +0000 (11:47 +0200)
commite82f7005256f77a63a3191ab7fef67e0cf0a9d02
tree01ab5d8ca9efe269c52795e6eefef70b59c532bf
parentb11f646ebfd148de807ca8744040397c5e4b47de
Fix edge case with clients failing to set up cipher on empty PUSH_REPLY.

The NCP (data channel crypto negotiation) code on the client side waits
for an incoming PUSH_REPLY before setting up the data channel crypto
parameters, because the PUSH_REPLY could contain a "cipher xxx" setting.

In the particular case of a empty PUSH_REPLY message, the relevant code
bits was not called because "we have not received any options, do not
bother to look into it in more detail" - so, ciphers were not set up,
resulting in an error message like this:

    Key [AF_INET]... [0] not initialized (yet), dropping packet.

Remove that check, always init the crypto layer on PUSH_REPLY.

Trac: #903

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <20170618092244.8801-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14856.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit bd230079d98bfe6aec70b7aedefdffcdbd0e56da)
src/openvpn/init.c