mirrors/openvpn
0
0
Fork 0
mirror of https://github.com/OpenVPN/openvpn.git synced 2024-11-27 11:43:51 +08:00
Code Issues Packages Projects Releases Wiki Activity

Always use default keysize for NCP'd ciphers

Browse Source 
If a peer has set --keysize, and NCP negotiates a cipher with a different
key size (e.g. --keysize 128 + AES-256-GCM), that peer will exit with a
"invalid key size" error.  To prevent that, always set keysize=0 for NCP'd
ciphers.

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: David Sommerseth <davids@openvpn.net>
Message-Id: <1500573357-20496-1-git-send-email-steffan@karger.me>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15110.html
Signed-off-by: David Sommerseth <davids@openvpn.net>
This commit is contained in:
Steffan Karger 2017-07-20 19:55:57 +02:00 committed by David Sommerseth
parent 72bcdfdc19
commit 956bb1c32f
No known key found for this signature in database
GPG Key ID: 86CF944C9671FDF2
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/openvpn/ssl.c
View File

@ -1978,6 +1978,11 @@ tls_session_update_crypto_params(struct tls_session *session,
{
msg(D_HANDSHAKE, "Data Channel: using negotiated cipher '%s'",
options->ciphername);
if (options->keysize)
{
msg(D_HANDSHAKE, "NCP: overriding user-set keysize with default");
options->keysize = 0;
}
}
init_key_type(&session->opt->key_type, options->ciphername,