Avoid sending --cipher to clients not supporting NCP

The NCP rework introduced a regression of sending a --cipher
command as part of the push message when the client does not
support NCP. This is is more a cosmetic issue since the client
will log that as warning in the log and ignore it.

Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20200717134739.21168-7-arne@rfc2549.org>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg20437.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>

diff --git a/src/openvpn/push.c b/src/openvpn/push.c
index 2183b74a03f263d0a2982fbea0ba6708066d60ff..1c4f2033bb9ba71560641d3880dc8966f2ca3530 100644 (file)
--- a/src/openvpn/push.c
+++ b/src/openvpn/push.c
@@ -472,9 +472,15 @@ prepare_push_reply(struct context *c, struct gc_arena *gc,
 
     /*
      * Push the selected cipher, at this point the cipher has been
-     * already negotiated and been fixed
+     * already negotiated and been fixed.
+     *
+     * We avoid pushing the cipher to clients not supporting NCP
+     * to avoid error messages in their logs
      */
-    push_option_fmt(gc, push_list, M_USAGE, "cipher %s", o->ciphername);
+    if (tls_peer_supports_ncp(c->c2.tls_multi->peer_info))
+    {
+        push_option_fmt(gc, push_list, M_USAGE, "cipher %s", o->ciphername);
+    }
 
     return true;
 }