From 54567412b55e76f768d928a4eb06aae7ad8ba464 Mon Sep 17 00:00:00 2001 From: wangmy Date: Tue, 16 Nov 2021 09:54:04 +0800 Subject: [PATCH] openvpn: Change the default cipher to AES-256-GCM for server configurations This change makes the server use AES-256-GCM instead of BF-CBC as the default cipher for the VPN tunnel. To avoid breaking existing running configurations defaulting to BF-CBC, the Negotiable Crypto Parameters (NCP) list contains the BF-CBC in addition to AES-CBC. This makes it possible to migrate existing older client configurations one-by-one to use at least AES-CBC unless the client is updated to v2.4 (which defaults to upgrade to AES-GCM automatically) Upstream-Status: Backport [https://src.fedoraproject.org/rpms/openvpn/blob/rawhide/f/0001-Change-the-default-cipher-to-AES-256-GCM-for-server-.patch] Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj --- .../recipes-support/openvpn/openvpn/openvpn@.service | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta-networking/recipes-support/openvpn/openvpn/openvpn@.service b/meta-networking/recipes-support/openvpn/openvpn/openvpn@.service index 358dcb791a..01dd2e8c25 100644 --- a/meta-networking/recipes-support/openvpn/openvpn/openvpn@.service +++ b/meta-networking/recipes-support/openvpn/openvpn/openvpn@.service @@ -6,7 +6,7 @@ After=syslog.target network.target PrivateTmp=true Type=forking PIDFile=/var/run/openvpn/%i.pid -ExecStart=/usr/sbin/openvpn --daemon --writepid /var/run/openvpn/%i.pid --cd /etc/openvpn/ --config %i.conf +ExecStart=/usr/sbin/openvpn --daemon --writepid /var/run/openvpn/%i.pid --cd /etc/openvpn/ --cipher AES-256-GCM --data-ciphers AES-256-GCM:AES-128-GCM:AES-256-CBC:AES-128-CBC:BF-CBC --config %i.conf [Install] WantedBy=multi-user.target