Attention is currently required from: flichtenheld.
Hello flichtenheld,
I'd like you to reexamine a change. Please visit
http://gerrit.openvpn.net/c/openvpn/+/1719?usp=email
to look at the new patch set (#3).
The following approvals got outdated and were removed:
Code-Review-1 by flichtenheld
Change subject: Support p2p NCP negotiation in p2mp mode
......................................................................
Support p2p NCP negotiation in p2mp mode
This sends the peer info of the server to a p2p mode client if it is
detected. This currently makes little difference as peer-id/DATAv2 does
not work without asymmetric peer-id support of the p2p mode client but
prepares for mesh/multipeer support.
Change-Id: I8f3545f703126dbe96f809e69ad351749b14b1e1
Signed-off-by: Arne Schwabe <[email protected]>
---
M src/openvpn/multi.c
M src/openvpn/ssl.c
M src/openvpn/ssl_ncp.c
3 files changed, 51 insertions(+), 7 deletions(-)
git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/19/1719/3
diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c
index b870d89..3cc53bc 100644
--- a/src/openvpn/multi.c
+++ b/src/openvpn/multi.c
@@ -1723,6 +1723,43 @@
gc_free(&gc);
}
+
+/**
+ * Generates warning for p2p mode peers.
+ */
+static void
+multi_client_set_protocol_warnings_p2p(struct context *c)
+{
+ struct tls_multi *multi = c->c2.tls_multi;
+ const struct tls_session *session = &multi->session[TM_ACTIVE];
+
+ /* we can support p2p clients but only if we and the other side
+ * support asymmetric peer-id */
+ msg(D_TLS_DEBUG_LOW, "Note: peer reports running in P2P mode "
+ "(no --pull/--client option). This will "
+ "probably not work as expected.");
+
+ /* Figure out which side is lacking asymmetric peer-id support and
+ * print appropriate warnings */
+ if (!multi->use_asymmetric_peer_id)
+ {
+ if (session->opt->dco_enabled)
+ {
+ msg(D_TLS_DEBUG_LOW, "Note: Supporting P2P mode peers requires "
+ "support of asymmetric peer-id which the "
+ "current DCO module does not support. Disable
"
+ "DCO or upgrade to a version of OpenVPN and "
+ "DCO that support asymmetric peer-id.");
+ }
+ if (extract_asymmetric_peer_id(multi->peer_info) == MAX_PEER_ID)
+ {
+ msg(D_TLS_DEBUG_LOW, "Note: Supporting P2P mode peers requires "
+ "support of asymmetric peer-id. The peer does
not "
+ "indicate it supports this.");
+ }
+ }
+}
+
/**
* Calculates the options that depend on the client capabilities
* based on local options and available peer info
@@ -1753,13 +1790,11 @@
return false;
}
- /* Print a warning if we detect the client being in P2P mode and will
- * not accept our pushed ciphers */
+ /* Print a warning if we detect the client being in P2P mode. The
+ * negotiations will be otherwise compatible */
if (proto & IV_PROTO_NCP_P2P)
{
- msg(M_WARN, "Note: peer reports running in P2P mode (no
--pull/--client "
- "option). It will not negotiate ciphers with this server. "
- "Expect this connection to fail.");
+ multi_client_set_protocol_warnings_p2p(c);
}
if (proto & IV_PROTO_REQUEST_PUSH)
diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c
index 0e8b4bd..7499628 100644
--- a/src/openvpn/ssl.c
+++ b/src/openvpn/ssl.c
@@ -1883,7 +1883,8 @@
/* In server mode we only add this when the client has announced its
* support for the feature */
- if (session->opt->mode != MODE_SERVER || multi->use_asymmetric_peer_id)
+ if (session->opt->mode != MODE_SERVER || multi->use_asymmetric_peer_id
+ || !session->opt->server)
{
return buf_printf(out, "ID=%x\n", multi->rx_peer_id);
}
@@ -2331,6 +2332,14 @@
/* With DCO we don't need the tx_peer_id atm */
multi->tx_peer_id = multi->rx_peer_id;
}
+ unsigned int iv_proto = extract_iv_proto(multi->peer_info);
+
+ if (iv_proto & IV_PROTO_NCP_P2P &&
multi->session->opt->push_peer_info_detail < 1)
+ {
+ /* If the peer is using NCP P2P we also enable p2p NCP allow
+ * peers in p2p mode to connect */
+ multi->session->opt->push_peer_info_detail = 1;
+ }
}
}
else
diff --git a/src/openvpn/ssl_ncp.c b/src/openvpn/ssl_ncp.c
index e860f6d..003b77e 100644
--- a/src/openvpn/ssl_ncp.c
+++ b/src/openvpn/ssl_ncp.c
@@ -515,7 +515,7 @@
}
msg(D_TLS_DEBUG_LOW, "P2P mode NCP negotiation result: "
- "TLS_export=%d, DATA_v2=%d, rx-peer-id %d, tx-peer-id
%d, epoch=%d, cipher=%s",
+ "TLS_EKM=%d, DATA_v2=%d, rx-peer-id %d, tx-peer-id
%d, epoch=%d, cipher=%s",
(bool)(session->opt->crypto_flags & CO_USE_TLS_KEY_MATERIAL_EXPORT),
multi->use_peer_id,
multi->rx_peer_id,
--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1719?usp=email
To unsubscribe, or for help writing mail filters, visit
http://gerrit.openvpn.net/settings?usp=email
Gerrit-MessageType: newpatchset
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: I8f3545f703126dbe96f809e69ad351749b14b1e1
Gerrit-Change-Number: 1719
Gerrit-PatchSet: 3
Gerrit-Owner: plaisthos <[email protected]>
Gerrit-Reviewer: flichtenheld <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>
Gerrit-Attention: flichtenheld <[email protected]>
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
