> > I'm not exactly sure what the code *does*, TBH, but de-fusing the check > into > > if (remote_cipher == NULL > || (peer_info && strstr(peer_info, "IV_CIPHERS=") )) > > makes it no longer crash (and also pass the unit test).
Yes that is the right fix. My test client client had a push-peer-info in
it so I didn't catch this. :(
>
> This patch also breaks connections from "default 2.3" clients, though in a
> different way:
>
> Aug 4 21:56:25 gentoo tun-udp-p2mp-112-mask[25184]:
> cron2-freebsd-tc-amd64-23/194.97.140.21:48168 PUSH: No common cipher between
> server and client. Server data-ciphers: 'AES-256-GCM:AES-128-GCM', client
> supports cipher 'BF-CBC'
> ug 4 21:56:27 gentoo tun-udp-p2mp-112-mask[25184]:
> cron2-freebsd-tc-amd64-23/194.97.140.21:48168 SENT CONTROL
> [cron2-freebsd-tc-amd64-23]: 'AUTH_FAILED,Data channel cipher negotiation
> failed (no shared cipher)' (status=1)
>
> this is a server that has *no* "--cipher" in its config, and a client
> that has nothing either and no NCP - so it advertises "OCC cipher bf-cbc",
> which is no longer accepted on the server.
>
> Is that intentional?
Yes. That is intentional. If you do not have any cipher option in the
config, there is nowadays a very high change that you allow BF-CBC by
"accident". I encountered this first-hand ("I do want to put as few
option in a config as possible").
Since 2.4 only warns about SWEET32/BF-CBC being if you actually
negotiate it (i.e. talking to a 2.3 client/server), many of these
probably were not even aware that they allowed BF-CBC.
If you really want BF-CBC with the new patch you need to either add it
to data-ciphers or explicitly set --cipher BF-CBC (that adds it to
data-cipher and data-ciphers-fallback).
When I am back from vacation, I can send a patch with better wording to
Changes.rst:
Removal of BF-CBC support in default configuratio:
- By default OpenVPN 2.5 will only accept AES-256-GCM and AES-128-GCM as
data ciphers. OpenVPN 2.4 allows AES-256-GCM,AES-128-GCM and BF-CBC when
no --cipher and --ncp-ption were present. Accepting BF-CBC can be
enabled by adding
data-ciphers AES-256-GCM:AES-128-GCM:BF-CBC
for very old peers also
data-ciphers-fallback BF-CBC
to offer backwards compatiblity with older config an *explicit*
cipher BF-CBC
in the configuration will be automatically translated in the two
commands above. We strongly recommend to switching away from BF-CBC to a
more secure cipher.
Arne
signature.asc
Description: OpenPGP digital signature
_______________________________________________ Openvpn-devel mailing list Openvpn-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-devel
