Attention is currently required from: flichtenheld, plaisthos.
Hello flichtenheld,
I'd like you to reexamine a change. Please visit
http://gerrit.openvpn.net/c/openvpn/+/1634?usp=email
to look at the new patch set (#3).
The following approvals got outdated and were removed:
Code-Review-1 by flichtenheld
Change subject: Only announce support push updates/IV_NCP when actually
supporting it
......................................................................
Only announce support push updates/IV_NCP when actually supporting it
Currently even p2p clients that do not accept push message, so announcing
PUSH UPDATE or DNSv2 is not very useful.
The change for IV_NCP is more a documentation bugfix as in mode server
we currently never have push_peer_info_detail > 0.
But change the message to indicate that IV_NCP nowadays is more a
legacy variable and replaced by IV_CIPHERS.
Change-Id: I0737b769e78e6d271ec874cadb9fbd81bfefdec1
Signed-off-by: Arne Schwabe <[email protected]>
---
M src/openvpn/ssl.c
1 file changed, 13 insertions(+), 15 deletions(-)
git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/34/1634/3
diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c
index 0998bd6..9d461e7 100644
--- a/src/openvpn/ssl.c
+++ b/src/openvpn/ssl.c
@@ -1914,21 +1914,21 @@
/* support for P_DATA_V2 */
int iv_proto = IV_PROTO_DATA_V2;
- /* support for the latest --dns option */
- iv_proto |= IV_PROTO_DNS_OPTION_V2;
-
/* support for exit notify via control channel */
iv_proto |= IV_PROTO_CC_EXIT_NOTIFY;
- /* currently push-update is not supported when DCO is enabled */
- if (!session->opt->dco_enabled)
- {
- /* support push-updates */
- iv_proto |= IV_PROTO_PUSH_UPDATE;
- }
-
if (session->opt->pull)
{
+ /* support for the latest --dns option */
+ iv_proto |= IV_PROTO_DNS_OPTION_V2;
+
+ /* currently push-update is not supported when DCO is enabled */
+ if (!session->opt->dco_enabled)
+ {
+ /* support push-updates */
+ iv_proto |= IV_PROTO_PUSH_UPDATE;
+ }
+
/* support for receiving push_reply before sending
* push request, also signal that the client wants
* to get push-reply messages without requiring a round
@@ -1943,11 +1943,9 @@
/* support for tun-mtu as part of the push message */
buf_printf(&out, "IV_MTU=%d\n", session->opt->frame.tun_max_mtu);
- }
- /* support for Negotiable Crypto Parameters */
- if (session->opt->mode == MODE_SERVER || session->opt->pull)
- {
+ /* legacy support for Negotiable Crypto Parameters (deprecated in
+ * favour of IV_CIPHERS) */
if (tls_item_in_cipher_list("AES-128-GCM",
session->opt->config_ncp_ciphers)
&& tls_item_in_cipher_list("AES-256-GCM",
session->opt->config_ncp_ciphers))
{
@@ -1956,7 +1954,7 @@
}
else
{
- /* We are not using pull or p2mp server, instead do P2P NCP */
+ /* If we are not using pull we announce P2P NCP support */
iv_proto |= IV_PROTO_NCP_P2P;
}
--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1634?usp=email
To unsubscribe, or for help writing mail filters, visit
http://gerrit.openvpn.net/settings?usp=email
Gerrit-MessageType: newpatchset
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: I0737b769e78e6d271ec874cadb9fbd81bfefdec1
Gerrit-Change-Number: 1634
Gerrit-PatchSet: 3
Gerrit-Owner: plaisthos <[email protected]>
Gerrit-Reviewer: flichtenheld <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>
Gerrit-Attention: plaisthos <[email protected]>
Gerrit-Attention: flichtenheld <[email protected]>
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
