]> git.ipfire.org Git - thirdparty/openvpn.git/commit
Fix client NCP OCC fallback when server and client cipher are identical
authorArne Schwabe <arne@rfc2549.org>
Sun, 30 Aug 2020 13:14:40 +0000 (15:14 +0200)
committerGert Doering <gert@greenie.muc.de>
Sun, 30 Aug 2020 20:06:08 +0000 (22:06 +0200)
commitea3c0ecc11f64fe4a58441c6d9c889472f6ed606
tree5cdc2424d288eab8d0018ea321fa2bf6289c0914
parent5ec42591063fba4a4c5bf1d7d8d55a323165de4f
Fix client NCP OCC fallback when server and client cipher are identical

If we do not get a cipher pushed we call tls_poor_mans_ncp to determine
whether we can use the server's cipher. Inherited from OpenVPN
2.4's code we only did this check when the ciphers were different.
Since OpenVPN 2.5 does not assume that our cipher we report in OCC
(options->ciphername) is always a valid cipher we always need to perform
this check.

V2: Only call tls_item_in_cipher_list if remote_cipher is non-null to
    avoid calling strcmp with NULL.

Reported-By: Rafael Gava <gava100@gmail.com>
Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20200830131440.10933-1-arne@rfc2549.org>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg20843.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 6ffe64e34004967a96514cc55abb22215fbe5640)
src/openvpn/ssl_ncp.c