From: Arne Schwabe Date: Fri, 14 Aug 2020 08:06:19 +0000 (+0200) Subject: Fix client's poor man NCP fallback X-Git-Tag: v2.6_beta1~718 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2ab0a92442dce1d82fcb9e2b305313ef668d40bf;p=thirdparty%2Fopenvpn.git Fix client's poor man NCP fallback This commit fixes two separate issues which are closely linked. First, a 2.5 client cannot connect to a server which does not support NCP and is not using one of the default --data-ciphers (AES-*-GCM). This is because the 2.5 client does not use its configured --data-ciphers cipher in the "fall back to OCC based cipher negotiation" case. Fix this. Second, do not allow the 2.5 client to use --data-ciphers-fallback in the above situation because that is not it's intended use (only to be used if there is no pushed cipher [NCP] and no OCC provided cipher). To reproduce the error use a client with only --data-ciphers set against a server without NCP. OPTIONS ERROR: failed to negotiate cipher with server. Add the server's cipher ('AES-256-CBC') to --data-ciphers (currently 'AES-256-CBC') if you want to connect to this server. Reported by: Richard Bonhomme Signed-off-by: Arne Schwabe Acked-by: Steffan Karger Message-Id: <20200814080619.2108-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg20734.html Signed-off-by: Gert Doering --- diff --git a/src/openvpn/ssl_ncp.c b/src/openvpn/ssl_ncp.c index f522b8f0c..c9ab85ce2 100644 --- a/src/openvpn/ssl_ncp.c +++ b/src/openvpn/ssl_ncp.c @@ -296,13 +296,14 @@ check_pull_client_ncp(struct context *c, const int found) } /* If the server did not push a --cipher, we will switch to the * remote cipher if it is in our ncp-ciphers list */ - bool useremotecipher = tls_poor_mans_ncp(&c->options, - c->c2.tls_multi->remote_ciphername); - + if(tls_poor_mans_ncp(&c->options, c->c2.tls_multi->remote_ciphername)) + { + return true; + } /* We could not figure out the peer's cipher but we have fallback * enabled */ - if (!useremotecipher && c->options.enable_ncp_fallback) + if (!c->c2.tls_multi->remote_ciphername && c->options.enable_ncp_fallback) { return true; }