From fd72a3b99dcb110953d8466bfe6c47dab3a29657 Mon Sep 17 00:00:00 2001 From: Arne Schwabe Date: Fri, 5 Nov 2021 16:07:42 +0100 Subject: [PATCH] Default to --cipher BF-CBC if not set and compat-mode < 2.4.0 When we try to make a configuration compatible to a version earlier than 2.4.0 we probably need to have a --cipher configured since NCP is not available. In configuration where --cipher is not specified we default to BF-CBC to support these old clients. Note that with OpenSSL 3.0 you will also need to enable the legacy provider otherwise we bail out since BF-CBC is no longer supported. Also move the condition so BF-CBC gets included in the data-ciphers list. Patch v2: move the comment to a better place. Signed-off-by: Arne Schwabe Acked-by: Antonio Quartulli Message-Id: <20211105150742.2909443-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23100.html Signed-off-by: Gert Doering --- src/openvpn/options.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/src/openvpn/options.c b/src/openvpn/options.c index 392d28964..813d34c9a 100644 --- a/src/openvpn/options.c +++ b/src/openvpn/options.c @@ -3205,6 +3205,19 @@ options_set_backwards_compatible_options(struct options *o) } } + if (need_compatibility_before(o, 20400)) + { + if (!o->ciphername) + { + /* If ciphername is not set default to BF-CBC when targeting these + * old versions that do not have NCP */ + o->ciphername = "BF-CBC"; + } + /* Versions < 2.4.0 additionally might be compiled with --enable-small and + * not have OCC strings required for "poor man's NCP" */ + o->enable_ncp_fallback = true; + } + /* Versions < 2.5.0 do need --cipher in the list of accepted ciphers. * Version 2.4 might probably does not need it but NCP was not so * good with 2.4 and ncp-disable might be more common on 2.4 peers. @@ -3217,13 +3230,6 @@ options_set_backwards_compatible_options(struct options *o) append_cipher_to_ncp_list(o, o->ciphername); } - /* Versions < 2.4.0 additionally might be compiled with --enable-small and - * not have OCC strings required for "poor man's NCP" */ - if (o->ciphername && need_compatibility_before(o, 20400)) - { - o->enable_ncp_fallback = true; - } - #ifdef USE_COMP /* Compression is deprecated and we do not want to announce support for it * by default anymore, additionally DCO breaks with compression. -- 2.47.2