From: Arne Schwabe Date: Mon, 9 Oct 2023 10:57:14 +0000 (+0200) Subject: Add warning for the --show-groups command that some groups are missing X-Git-Tag: v2.7_alpha1~399 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a840d5099a7d1a5ceb752c481fc345f6385719df;p=thirdparty%2Fopenvpn.git Add warning for the --show-groups command that some groups are missing OpenSSL has a weird way of only reporting EC curves that are implemented in a certain way in the list of all EC curves. Note this fact and point out that also the very important curves X448 and X25519 are affected. Change-Id: I86641bf60d62a50e9b2719e809d2429d65c00097 Acked-by: Frank Lichtenheld Message-Id: <20231009105714.34598-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27193.html Signed-off-by: Gert Doering --- diff --git a/src/openvpn/ssl_openssl.c b/src/openvpn/ssl_openssl.c index b5cc9a7f1..b561e9d6b 100644 --- a/src/openvpn/ssl_openssl.c +++ b/src/openvpn/ssl_openssl.c @@ -2249,8 +2249,10 @@ show_available_tls_ciphers_list(const char *cipher_list, void show_available_curves(void) { - printf("Consider using openssl 'ecparam -list_curves' as\n" - "alternative to running this command.\n"); + printf("Consider using 'openssl ecparam -list_curves' as alternative to running\n" + "this command.\n" + "Note this output does only list curves/groups that OpenSSL considers as\n" + "builtin EC curves. It does not list additional curves nor X448 or X25519\n"); #ifndef OPENSSL_NO_EC EC_builtin_curve *curves = NULL; size_t crv_len = 0;