Set tls-version-max to 1.1 if cryptoapicert is used

OpenVPN's current cryptoapicert implementation does not support TLS 1.2 (and newer). Fixing this requires a rewrite of our cryptoapi code to use Microsofts' "Cryptography API: Next Generation", and several hacks to work around that API. As long as we don't fix that, make openvpn automatically cap the TLS version to 1.1 when using cryptoapi (and tell the user we're doing so). This enables the user to use cryptoapi + TLS version negotiation (upto TLS 1.1) without having to change his configuration.

This patch has been tested on Windows 8.1 for both the master and release/2.3 branches.

---
 src/openvpn/options.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

index 2909c89..4ea03d1 100644
@@ -2508,6 +2508,24 @@ options_postprocess_mutate (struct options *o)
 	options_postprocess_http_proxy_override(o);
 #endif
 
+#ifdef ENABLE_CRYPTOAPI
+  if (o->cryptoapi_cert)
+    {
+      const int tls_version_max =
+	  (o->ssl_flags >> SSLF_TLS_VERSION_MAX_SHIFT) &
+	  SSLF_TLS_VERSION_MAX_MASK;
+
+      if (tls_version_max == TLS_VER_UNSPEC || tls_version_max > TLS_VER_1_1)
+	{
+	  msg(M_WARN, "Warning: cryptapicert used, setting maximum TLS "
+	      "version to 1.1.");
+	  o->ssl_flags &= ~(SSLF_TLS_VERSION_MAX_MASK <<
+	      SSLF_TLS_VERSION_MAX_SHIFT);
+	  o->ssl_flags |= (TLS_VER_1_1 << SSLF_TLS_VERSION_MAX_SHIFT);
+	}
+    }
+#endif /* ENABLE_CRYPTOAPI */
+
 #if P2MP
   /*
    * Save certain parms before modifying options via --pull

2.1.0

ACK. Your patch has been applied to the master and release/2.3 branches.

commit 04dcb96cc1f525afee3f830248ecaa22d1b4a4c2 (master) commit 77f8a56a1acc1d5e7f042c9bc393e83541155483 (release/2.3)

Author: Steffan Karger
Date:   Sun Dec 28 11:25:13 2014 +0100

     Set tls-version-max to 1.1 if cryptoapicert is used

     Signed-off-by: Steffan Karger <[email protected]...>
     Acked-by: Gert Doering <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/9361
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering