cron2 has submitted this change. ( http://gerrit.openvpn.net/c/openvpn/+/684?usp=email )
Change subject: mbedtls: Warn if --tls-version-min is too low ...................................................................... mbedtls: Warn if --tls-version-min is too low Recent versions of mbedtls only support TLS 1.2. When the minimum version is set to TLS 1.0 or 1.1, log a warning and use 1.2 as the actual minimum version. Change-Id: Ibc641388d8016533c94dfef3618376f6dfa91f4e Signed-off-by: Max Fillinger <maximilian.fillin...@foxcrypto.com> Acked-by: Arne Schwabe <arne-open...@rfc2549.org> Message-Id: <20240703174158.7137-1-g...@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28865.html Signed-off-by: Gert Doering <g...@greenie.muc.de> --- M src/openvpn/options.c 1 file changed, 9 insertions(+), 0 deletions(-) diff --git a/src/openvpn/options.c b/src/openvpn/options.c index dbe1425..64e67aa 100644 --- a/src/openvpn/options.c +++ b/src/openvpn/options.c @@ -8942,6 +8942,15 @@ msg(msglevel, "unknown tls-version-min parameter: %s", p[1]); goto err; } + +#ifdef ENABLE_CRYPTO_MBEDTLS + if (ver < TLS_VER_1_2) + { + msg(M_WARN, "--tls-version-min %s is not supported by mbedtls, using 1.2", p[1]); + ver = TLS_VER_1_2; + } +#endif + options->ssl_flags &= ~(SSLF_TLS_VERSION_MIN_MASK << SSLF_TLS_VERSION_MIN_SHIFT); options->ssl_flags |= (ver << SSLF_TLS_VERSION_MIN_SHIFT); -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/684?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: Ibc641388d8016533c94dfef3618376f6dfa91f4e Gerrit-Change-Number: 684 Gerrit-PatchSet: 2 Gerrit-Owner: MaxF <m...@max-fillinger.net> Gerrit-Reviewer: flichtenheld <fr...@lichtenheld.com> Gerrit-Reviewer: plaisthos <arne-open...@rfc2549.org> Gerrit-CC: openvpn-devel <openvpn-devel@lists.sourceforge.net> Gerrit-MessageType: merged
_______________________________________________ Openvpn-devel mailing list Openvpn-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-devel
