From 573ccf82e90f03de3d65fb26aac9310a25c3e4ec Mon Sep 17 00:00:00 2001 From: Max Fillinger Date: Tue, 21 Apr 2026 07:53:50 +0200 Subject: [PATCH] Mbed TLS: Error out if we have no valid tls-groups Previously, when no valid groups were specified with the tls-groups option, the Mbed TLS build of OpenVPN would start up and run, but fail to complete a handshake, while the OpenSSL build would exit with an error. This commit changes the behavior of the Mbed TLS build to match the OpenSSL version. Change-Id: Ica5f37e525c3812609021750ecd3986c1420e2a4 Signed-off-by: Max Fillinger Acked-by: Arne Schwabe Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1633 Message-Id: <20260421055357.21708-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg36699.html Signed-off-by: Gert Doering (cherry picked from commit b2e3e0f0cf21a712b96efb8c053b740ca1947f54) --- src/openvpn/ssl_mbedtls.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/openvpn/ssl_mbedtls.c b/src/openvpn/ssl_mbedtls.c index 5227eb84..3313eddb 100644 --- a/src/openvpn/ssl_mbedtls.c +++ b/src/openvpn/ssl_mbedtls.c @@ -450,6 +450,12 @@ tls_ctx_set_tls_groups(struct tls_root_ctx *ctx, const char *groups) } } + /* Check if any groups were valid. */ + if (i == 0) + { + msg(M_FATAL, "Error: All groups in \"%s\" are invalid or unsupported.", groups); + } + /* Recent mbedtls versions state that the list of groups must be terminated * with 0. Older versions state that it must be terminated with MBEDTLS_ECP_DP_NONE * which is also 0, so this works either way. */