From: Steffan Karger Date: Thu, 3 Jul 2014 21:47:45 +0000 (+0200) Subject: Don't issue warning for 'translate to self' tls-ciphers X-Git-Tag: v2.4_alpha1~398 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=29ed605c2a91e85bc9905cf2968e900cb3969095;p=thirdparty%2Fopenvpn.git Don't issue warning for 'translate to self' tls-ciphers All cipher suite names supplied through --tls-cipher are translated by OpenVPN to IANA names, to get OpenSSL and PolarSSL configuration files compatible. OpenSSL however supports cipher suite group names, like 'DEFAULT', 'HIGH', or 'ECDH'. To make OpenVPN not complain about these, entries translating these to themselves were added to the translation table. However, to make OpenVPN not still complain, the deprecated-name check has to be reversed from 'if this is a deprecated name then complain' to 'if this is not a iana name, then complain'. Which this commit does. Signed-off-by: Steffan Karger Acked-by: Arne Schwabe Message-Id: <1404424065-24787-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/8824 Signed-off-by: Gert Doering --- diff --git a/src/openvpn/ssl_openssl.c b/src/openvpn/ssl_openssl.c index c9d2d26de..adf3ae6fc 100644 --- a/src/openvpn/ssl_openssl.c +++ b/src/openvpn/ssl_openssl.c @@ -270,7 +270,8 @@ tls_ctx_restrict_ciphers(struct tls_root_ctx *ctx, const char *ciphers) current_cipher_len = strlen(current_cipher); if (end_of_cipher - begin_of_cipher == current_cipher_len && - 0 == memcmp (&ciphers[begin_of_cipher], cipher_pair->openssl_name, end_of_cipher - begin_of_cipher)) + 0 != memcmp (&ciphers[begin_of_cipher], cipher_pair->iana_name, + end_of_cipher - begin_of_cipher)) { // Non-IANA name used, show warning msg (M_WARN, "Deprecated TLS cipher name '%s', please use IANA name '%s'", cipher_pair->openssl_name, cipher_pair->iana_name);