Don't issue warning for 'translate to self' tls-ciphers

All cipher suite names supplied through --tls-cipher are translated by OpenVPN to IANA names, to get OpenSSL and PolarSSL configuration files compatible. OpenSSL however supports cipher suite group names, like 'DEFAULT', 'HIGH', or 'ECDH'. To make OpenVPN not complain about these, entries translating these to themselves were added to the translation table. However, to make OpenVPN not still complain, the deprecated-name check has to be reversed from 'if this is a deprecated name then complain' to 'if this is not a iana name, then complain'. Which this commit does.

---
 src/openvpn/ssl_openssl.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

index c9d2d26..adf3ae6 100644
@@ -270,7 +270,8 @@ tls_ctx_restrict_ciphers(struct tls_root_ctx *ctx, const char *ciphers)
           current_cipher_len = strlen(current_cipher);
 
 	  if (end_of_cipher - begin_of_cipher == current_cipher_len &&
-	      0 == memcmp (&ciphers[begin_of_cipher], cipher_pair->openssl_name, end_of_cipher - begin_of_cipher))
+	      0 != memcmp (&ciphers[begin_of_cipher], cipher_pair->iana_name,
+		  end_of_cipher - begin_of_cipher))
 	    {
 	      // Non-IANA name used, show warning
 	      msg (M_WARN, "Deprecated TLS cipher name '%s', please use IANA name '%s'", cipher_pair->openssl_name, cipher_pair->iana_name);

1.9.1

Am 03.07.14 23:47, schrieb Steffan Karger:

ACK

Your patch has been applied to the master branch.

commit 29ed605c2a91e85bc9905cf2968e900cb3969095

Author: Steffan Karger
Date:   Thu Jul 3 23:47:45 2014 +0200

     Don't issue warning for 'translate to self' tls-ciphers

     Signed-off-by: Steffan Karger <[email protected]...>
     Acked-by: Arne Schwabe <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/8824
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering