Ticket #737: 0001-Check-ncp-ciphers-list-on-startup.patch

src/openvpn/crypto.c

@@ -763 +763 @@
   if (ciphername)
     {
       kt->cipher = cipher_kt_get (translate_cipher_name_from_openvpn(ciphername));
+      if (!kt->cipher)
+        {
+          msg (M_FATAL, "Cipher %s not supported", ciphername);
+        }
+
       kt->cipher_length = cipher_kt_key_size (kt->cipher);
       if (keysize > 0 && keysize <= MAX_CIPHER_KEY_LENGTH)
         kt->cipher_length = keysize;

src/openvpn/crypto_backend.h

@@ -195 +195 @@
  *                      \c AES-128-CBC).
  *
  * @return              A statically allocated structure containing parameters
- *                      for the given cipher.
+ *                      for the given cipher, or NULL if no matching parameters
+ *                      were found.
  */
 const cipher_kt_t * cipher_kt_get (const char *ciphername);
 

src/openvpn/crypto_mbedtls.c

@@ -384 +384 @@
   cipher = mbedtls_cipher_info_from_string(ciphername);
 
   if (NULL == cipher)
-    msg (M_FATAL, "Cipher algorithm '%s' not found", ciphername);
+    {
+      msg (D_LOW, "Cipher algorithm '%s' not found", ciphername);
+      return NULL;
+    }
 
   if (cipher->key_bitlen/8 > MAX_CIPHER_KEY_LENGTH)
-    msg (M_FATAL, "Cipher algorithm '%s' uses a default key size (%d bytes) which is larger than " PACKAGE_NAME "'s current maximum key size (%d bytes)",
-         ciphername,
-         cipher->key_bitlen/8,
-         MAX_CIPHER_KEY_LENGTH);
+    {
+      msg (D_LOW, "Cipher algorithm '%s' uses a default key size (%d bytes) "
+          "which is larger than " PACKAGE_NAME "'s current maximum key size "
+          "(%d bytes)", ciphername, cipher->key_bitlen/8, MAX_CIPHER_KEY_LENGTH);
+      return NULL;
+    }
 
   return cipher;
 }

src/openvpn/crypto_openssl.c

@@ -504 +504 @@
   cipher = EVP_get_cipherbyname (ciphername);
 
   if (NULL == cipher)
-    crypto_msg (M_FATAL, "Cipher algorithm '%s' not found", ciphername);
+    {
+      crypto_msg (D_LOW, "Cipher algorithm '%s' not found", ciphername);
+      return NULL;
+    }
+
 
   if (EVP_CIPHER_key_length (cipher) > MAX_CIPHER_KEY_LENGTH)
-    msg (M_FATAL, "Cipher algorithm '%s' uses a default key size (%d bytes) which is larger than " PACKAGE_NAME "'s current maximum key size (%d bytes)",
-         ciphername,
-         EVP_CIPHER_key_length (cipher),
-         MAX_CIPHER_KEY_LENGTH);
+    {
+      msg (D_LOW, "Cipher algorithm '%s' uses a default key size (%d bytes) "
+          "which is larger than " PACKAGE_NAME "'s current maximum key size "
+          "(%d bytes)", ciphername, EVP_CIPHER_key_length (cipher),
+          MAX_CIPHER_KEY_LENGTH);
+      return NULL;
+    }
 
   return cipher;
 }

src/openvpn/options.c

@@ -2208 +2208 @@
 
 #ifdef ENABLE_CRYPTO
 
+  if (options->ncp_enabled && !tls_check_ncp_cipher_list(options->ncp_ciphers))
+    {
+      msg (M_USAGE, "NCP cipher list contains unsupported ciphers.");
+    }
+
   /*
    * Check consistency of replay options
    */

src/openvpn/ssl.c

@@ -3715 +3715 @@
   return 0;
 }
 
+bool
+tls_check_ncp_cipher_list(const char *list) {
+  char *tmp_ciphers = string_alloc (list, NULL);
+  char *tmp_ciphers_orig = tmp_ciphers;
+  bool unsupported_cipher_found = false;
+
+  const char *token = strtok (tmp_ciphers, ":");
+  while (token)
+    {
+      if (!cipher_kt_get (translate_cipher_name_from_openvpn (token)))
+        {
+          msg (M_WARN, "Unsupported cipher in --ncp-ciphers: %s", token);
+          unsupported_cipher_found = true;
+        }
+      token = strtok (NULL, ":");
+    }
+  free (tmp_ciphers_orig);
+
+  return list && 0 < strlen(list) && !unsupported_cipher_found;
+}
+
 /*
  * Dump a human-readable rendition of an openvpn packet
  * into a garbage collectable string which is returned.

src/openvpn/ssl.h

@@ -503 +503 @@
  */
 int tls_peer_info_ncp_ver(const char *peer_info);
 
+/**
+ * Check whether the ciphers in the supplied list are supported.
+ *
+ * @param list          Colon-separated list of ciphers
+ *
+ * @returns true iff all ciphers in list are supported.
+ */
+bool tls_check_ncp_cipher_list(const char *list);
+
 /*
  * inline functions
  */