diff options
| author | Steffan Karger <steffan@karger.me> | 2014-12-28 11:25:13 +0100 |
|---|---|---|
| committer | Gert Doering <gert@greenie.muc.de> | 2014-12-28 19:21:10 +0100 |
| commit | 04dcb96cc1f525afee3f830248ecaa22d1b4a4c2 (patch) | |
| tree | 64b789c31c3e515c1437a66c38d443f4bf1804a6 /src/openvpn/options.c | |
| parent | 7c1d614c5c5282a73cb799f919eac6750363783a (diff) | |
| download | openvpn-04dcb96cc1f525afee3f830248ecaa22d1b4a4c2.tar.gz openvpn-04dcb96cc1f525afee3f830248ecaa22d1b4a4c2.tar.xz openvpn-04dcb96cc1f525afee3f830248ecaa22d1b4a4c2.zip | |
Set tls-version-max to 1.1 if cryptoapicert is used
OpenVPN's current cryptoapicert implementation does not support TLS 1.2
(and newer). Fixing this requires a rewrite of our cryptoapi code to use
Microsofts' "Cryptography API: Next Generation", and several hacks to work
around that API. As long as we don't fix that, make openvpn automatically
cap the TLS version to 1.1 when using cryptoapi (and tell the user we're
doing so). This enables the user to use cryptoapi + TLS version
negotiation (upto TLS 1.1) without having to change his configuration.
This patch has been tested on Windows 8.1 for both the master and
release/2.3 branches.
Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1419762313-31233-1-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9361
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Diffstat (limited to 'src/openvpn/options.c')
| -rw-r--r-- | src/openvpn/options.c | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/src/openvpn/options.c b/src/openvpn/options.c index 5e8d9dc..1e0284e 100644 --- a/src/openvpn/options.c +++ b/src/openvpn/options.c @@ -2525,6 +2525,24 @@ options_postprocess_mutate (struct options *o) options_postprocess_http_proxy_override(o); #endif +#ifdef ENABLE_CRYPTOAPI + if (o->cryptoapi_cert) + { + const int tls_version_max = + (o->ssl_flags >> SSLF_TLS_VERSION_MAX_SHIFT) & + SSLF_TLS_VERSION_MAX_MASK; + + if (tls_version_max == TLS_VER_UNSPEC || tls_version_max > TLS_VER_1_1) + { + msg(M_WARN, "Warning: cryptapicert used, setting maximum TLS " + "version to 1.1."); + o->ssl_flags &= ~(SSLF_TLS_VERSION_MAX_MASK << + SSLF_TLS_VERSION_MAX_SHIFT); + o->ssl_flags |= (TLS_VER_1_1 << SSLF_TLS_VERSION_MAX_SHIFT); + } + } +#endif /* ENABLE_CRYPTOAPI */ + #if P2MP /* * Save certain parms before modifying options via --pull |