Warn that DH config option is only meaningful in a tls-server context
PATCH 1/1 Warn that DH config option is only meaningful in a tls-server context
If specified in a tls-client context, don't try to open the file as it's not used. Worse even, if 'none' was specified to disable explicitly, it complained that the file 'none' could not be found.
--- src/openvpn/options.c | 7 +++++++ 1 file changed, 7 insertions(+)
src/openvpn/options.c +7 -0
@@ -3011,6 +3011,13 @@ options_postprocess_mutate(struct options *o) o->dh_file =NULL ; } } +else if (o->dh_file) + { +/* DH file is only meaningful in a tls-server context. */ +msg (M_WARN ,"ignoring option 'dh' in tls-client mode, please only " +"include this in your server configuration" ); + o->dh_file =NULL ; + }/* cipher negotiation (NCP) currently assumes --pull or --mode server */ if (o->ncp_enabled
Signature · 1 line
2.14.1
Hi,
Quoted 16 lines · Gert van Dijk
If specified in a tls-client context, don't try to open the file as it's not used. Worse even, if 'none' was specified to disable explicitly, it complained that the file 'none' could not be found.
--- src/openvpn/options.c | 7 +++++++ 1 file changed, 7 insertions(+)src/openvpn/options.c +0
-0@@ -3011,6 +3011,13 @@ options_postprocess_mutate(struct options *o) o->dh_file =NULL ; } }
src/openvpn/options.c options_postprocess_mutate(struct options *o) · line 3023
Quoted 10 lines
src/openvpn/options.c +7
-0+else if (o->dh_file) + { +/* DH file is only meaningful in a tls-server context. */ +msg (M_WARN ,"ignoring option 'dh' in tls-client mode, please only " +"include this in your server configuration" ); + o->dh_file =NULL ; + }/* cipher negotiation (NCP) currently assumes --pull or --mode server */ if (o->ncp_enabled
ACK. Ideally, we would have never excepted the --dh option for clients.
But since we for some reason did, I agree that warning and explicitly
ignoring the option is the best approach (because it will not break existing client configs that do have the --dh option in there).
But: Gert is a colleague of mine at Fox-IT, so it would be good to have some non-fox eyes look at this patch too.
-Steffan
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
ACK. Glared at code and tested a simple client config. Works as expected.
I did one simple on-the-fly update, prefixing the message with 'WARNING: ', which is what we do other places where M_WARN is used.
Your patch has been applied to the following branches
commit 47a0a80b7718fe88451c82bdfe838e5a6e3c4248 (master) commit b1298bbb2be73e978bb5b555d1bd8722cf9b28b0 (release/2.4)
Author: Gert van Dijk Date: Sun Aug 27 18:15:15 2017 +0200
Warn that DH config option is only meaningful in a tls-server context
Signed-off-by: Gert van Dijk <[email protected]...>
Acked-by: Steffan Karger <[email protected]...>
Acked-by: David Sommerseth <[email protected]...>
Message-Id: <[email protected]...>
URL: https://www.mail-archive.com/[email protected]/msg15332.html
Signed-off-by: David Sommerseth <[email protected]...>- --
kind regards,
David Sommerseth
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
iQIcBAEBCgAGBQJZsIGVAAoJEIbPlEyWcf3yTjUP/2aub3MTttpcfCDw4t+zjrH/ oKkvQvpEdH7+ynec0o7GJOw9eZ3/ejSIiZ4EMPFTCyUes/Bd+zfgM2RWvnJd7Jxe D7TbSOj0nF56Ywn8rlVh9dM4BsS34yte4cpYnWLf3JJ3tzzihiAA2CQOxP0V95PE Lqesq2rXbxvjV05fjvjSHxsgC6fHZO8zR/1aBKBeghD3rB67iKnjGcNZxnqULIop e/20EcTlzyXOtqcWQnqqmdY1umNYbrNurBBxI8WcpDK3i9cRGjnc9+pEqkmfAHEE DzAKnpThDhoSvJo/wpvMJmBQUm741I0SQdasGB9lNFNyzjcvOuxt8oXR9rcp+FZX vnKZnfV1haA9pgyuJERUt/EIkvQP3QvRKqfvZpJy4fioaWZav/uOsRaXWc8z11HB okUV6CfwnpB7ltEKkrYm3xabiQE0OvAKVkZNVK1vfdKI0O9Qm9E1z8rwmCMnAfQv YLJ95cYHVS2U9ch9dP148/AXa9d+HKeg6Xh/FS2OD92jtBlZI374QKhbERmhaE1q YeIPqMc2sulSVOUTx2IXRKCFlZhr6LwYtDWtm0PeZraom4iyXIf6b8Aq8LwfeU6d cp44vk/Ob8Zz9Vk26Tf3zgRzn1RV378HipKXn3w0wNmmLYAO0jox+IvO97rXfKaL kWmHx5qUQ4wnMo6dBL74
=aY2R
-----END PGP SIGNATURE-----