robur-coop / miragevpn

An opinionated implementation of the OpenVPN protocol
BSD 2-Clause "Simplified" License
79 stars 9 forks source link

Only send IV_NCP=2 when supporting AES GCM ciphers #154

Closed reynir closed 1 year ago

reynir commented 1 year ago

A quirk from OpenVPN 2.4 is that the peer-info value IV_NCP=2 signals the client supports (and wants to use) AES-128-GCM and AES-256-GCM. Newer openvpn servers (>= 2.5) will look after IV_NCP=2 if IV_CIPHERS is not present.

The IV_NCP=2 value could be removed if we do not desire to support OpenVPN 2.4 (and other implementations with the same quirk).

Addresses #152.