Skip to content

service: fix automatically adding "cipher" to "data-ciphers""

Thomas Haller requested to merge th/cipher2 into main

First, the "data-ciphers" in openvpn defaults (depending on version and compile time configuration) to "AES-256-GCM:AES-128-GCM" or "AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305". So taking "cipher" and just set it as "--data-ciphers $CIPHER" is wrong. When doing this compat work, we will now set "--data-ciphers" to "X:AES-256-GCM:AES-128-GCM". This should work, and if it's not suitable to the user, they still can set "data-ciphers" explicitly.

Also, when we do the compat works, it's wrong to still set "--cipher" to whatever it was. Instead, only set "--data-ciphers" for 2.5 and newer.

#112 (closed)

Fixes: 020ab0c4 ('service: automatically add the "cipher" to the "data-ciphers"')

This is an alternative to !64 (merged)

Merge request reports