Attention is currently required from: flichtenheld, plaisthos.
Hello flichtenheld,
I'd like you to reexamine a change. Please visit
http://gerrit.openvpn.net/c/openvpn/+/323?usp=email
to look at the new patch set (#2).
The following approvals got outdated and were removed:
Code-Review-1 by flichtenheld
Change subject: Add warning if a p2p NCP client connects to a p2mp server
......................................................................
Add warning if a p2p NCP client connects to a p2mp server
Change-Id: I85ae4e1167e1395b4f59d5d0ecf6c38befcaa8a7
---
M src/openvpn/multi.c
M src/openvpn/ssl_ncp.c
M src/openvpn/ssl_ncp.h
3 files changed, 13 insertions(+), 4 deletions(-)
git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/23/323/2
diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c
index 0d4e6f9..c38aa67 100644
--- a/src/openvpn/multi.c
+++ b/src/openvpn/multi.c
@@ -1811,6 +1811,15 @@
return false;
}
+ /* Print a warning if we detect the client being in P2P mode and will
+ * not accept our pushed ciphers */
+ if (extract_iv_proto(peer_info) & IV_PROTO_NCP_P2P)
+ {
+ msg(M_WARN, "Note: peer reports running in P2P mode (no
--pull/--client"
+ "option). It will not negotiate ciphers with this server. "
+ "Expect this connection to fail.");
+ }
+
if (proto & IV_PROTO_REQUEST_PUSH)
{
c->c2.push_request_received = true;
diff --git a/src/openvpn/ssl_ncp.c b/src/openvpn/ssl_ncp.c
index dafaef1..0ca6d42 100644
--- a/src/openvpn/ssl_ncp.c
+++ b/src/openvpn/ssl_ncp.c
@@ -24,7 +24,7 @@
*/
/**
- * @file Control Channel SSL/Data dynamic negotion Module
+ * @file Control Channel SSL/Data dynamic negotiation Module
* This file is split from ssl.c to be able to unit test it.
*/
@@ -258,8 +258,8 @@
const char *peer_ncp_list = tls_peer_ncp_list(peer_info, &gc_tmp);
- /* non-NCP client without OCC? "assume nothing" */
- /* For client doing the newer version of NCP (that send IV_CIPHER)
+ /* non-NCP clients without OCC? "assume nothing" */
+ /* For client doing the newer version of NCP (that send IV_CIPHERS)
* we cannot assume that they will accept remote_cipher */
if (remote_cipher == NULL
|| (peer_info && strstr(peer_info, "IV_CIPHERS=")))
diff --git a/src/openvpn/ssl_ncp.h b/src/openvpn/ssl_ncp.h
index d27ed24..de7a0e4 100644
--- a/src/openvpn/ssl_ncp.h
+++ b/src/openvpn/ssl_ncp.h
@@ -23,7 +23,7 @@
*/
/**
- * @file Control Channel SSL/Data dynamic negotion Module
+ * @file Control Channel SSL/Data dynamic negotiation Module
* This file is split from ssl.h to be able to unit test it.
*/
--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/323?usp=email
To unsubscribe, or for help writing mail filters, visit
http://gerrit.openvpn.net/settings
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: I85ae4e1167e1395b4f59d5d0ecf6c38befcaa8a7
Gerrit-Change-Number: 323
Gerrit-PatchSet: 2
Gerrit-Owner: plaisthos <arne-open...@rfc2549.org>
Gerrit-Reviewer: flichtenheld <fr...@lichtenheld.com>
Gerrit-CC: openvpn-devel <openvpn-devel@lists.sourceforge.net>
Gerrit-Attention: plaisthos <arne-open...@rfc2549.org>
Gerrit-Attention: flichtenheld <fr...@lichtenheld.com>
Gerrit-MessageType: newpatchset
_______________________________________________
Openvpn-devel mailing list
Openvpn-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
