55846 2025-09-03 10:11:50 +0300 Не работает алгоритм шифрования по ГОСТ'у 2026-05-05 16:27:27 +0300 1 1 4 Development Sisyphus alterator-openvpn-server unstable x86_64 Linux NEW P5 normal --- 1 lepata sem qualimock sem qa-sisyphus oldest_to_newest 271899 0 lepata 2025-09-03 10:11:50 +0300 Установлен пакет openssl-gost-engine, выполнена команда: control openssl-gost all Шаги воспроизведения: 1. В настройках OpenVPN в списке "Алгоритм шифрования" выбрать алгоритм kuznyechik-cbc (+произвести остальные настройки для запуска сервера). 2. Запустить OpenVPN-сервер Результат: DEPRECATED OPTION: --cipher set to 'kuznyechik-cbc' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305). OpenVPN ignores --cipher for cipher negotiations. Ожидаемый результат: Используется выбранный алгоритм шифрования (в конфигурационном файле используется опция --data-ciphers, а не --cipher) man openvpn --cipher alg This option should not be used any longer in TLS mode and still exists for two reasons: · compatibility with old configurations still carrying it around; · allow users connecting to OpenVPN peers older than 2.6.0 to have --cipher configured the same way as the remote counterpart. This can avoid MTU/frame size warnings. Before 2.4.0, this option was used to select the cipher to be configured on the data channel, however, later versions usually ignored this directive in favour of a negotiated cipher. Starting with 2.6.0, this option is always ignored in TLS mode when it comes to configuring the cipher and will only control the cipher for --secret pre-shared-key mode (note: this mode is deprecated and strictly not recommended). If you wish to specify the cipher to use on the data channel, please see --data-ciphers (for regular negotiation) and --data-ciphers-fallback (for a fallback option when the negotiation cannot take place because the other peer is old or has negotiation disabled) см. также https://community.openvpn.net/Pages/CipherNegotiation 286823 1 21259 qualimock 2026-05-05 16:26:22 +0300 Created attachment 21259 Поддержка data-ciphers 286824 2 qualimock 2026-05-05 16:27:27 +0300 Добавлена поддержка параметра data-ciphers В интерфейс добавлен многострочный список выбранных шифров с возможностью добавления и удаления отдельных алгоритмов Исправлено переопределение ГОСТ-параметров: ранее при обнаружении ГОСТ-сертификата модули принудительно записывали в конфигурацию жестко заданные алгоритмы, полностью игнорируя выбор пользователя. Теперь записывается только директива подключения ГОСТ-движка (engine gost), а алгоритмы шифрования, аутентификации и TLS-шифра берутся из настроек, заданных пользователем в интерфейсе. Прилагаю патч с изменениями. Пакет пересобран с патчем в таске: https://packages.altlinux.org/ru/tasks/417214/ 21259 2026-05-05 16:26:22 +0300 2026-05-05 16:26:22 +0300 Поддержка data-ciphers alterator-openvpn-server-0.8.8-alt-data-ciphers.patch text/plain 6530 qualimock ZGlmZiAtLWdpdCBhL2JhY2tlbmQzL29wZW52cG4tc2VydmVyIGIvYmFja2VuZDMvb3BlbnZwbi1z ZXJ2ZXIKaW5kZXggMDZhNGNiMC4uYjVmY2M5NSAxMDA3NTUKLS0tIGEvYmFja2VuZDMvb3BlbnZw bi1zZXJ2ZXIKKysrIGIvYmFja2VuZDMvb3BlbnZwbi1zZXJ2ZXIKQEAgLTI0LDYgKzI0LDcgQEAg Q0FDSEVESVI9Ii92YXIvY2FjaGUvYWx0ZXJhdG9yL29wZW52cG4tc2VydmVyIgogQ0NERElSPSIk Q0hST09URElSLyRDT05GRElSL2NjZCIKIElGQUNFU0RJUj0iJEVUQ05FVF9JRkFDRVNESVIiCiBT RVJWRVJfTkVUV09SS1NfVE1QPSIkQ0FDSEVESVIvc2VydmVyX25ldHdvcmtzLnRtcCIKK0NJUEhF UlNfVE1QPSIkQ0FDSEVESVIvY2lwaGVycy50bXAiCiBPUEVOU1NMPSIke09QRU5TU0w6LW9wZW5z c2x9IgogCiAjIEFsdGVybmF0aXZlIG9wZW52cG4gcGF0Y2hlZCBmb3IgR09TVCBzdXBwb3J0LgpA QCAtMzU2LDYgKzM1NywxMyBAQCBsaXN0X2JyaWRnZXMoKQogCWRvbmUKIH0KIAorbGlzdF9zZWxl Y3RlZF9jaXBoZXJzKCkKK3sKKwlmb3IgY2lwaGVyIGluICQoY2F0ICIkQ0lQSEVSU19UTVAiKTsg ZG8KKwkJd3JpdGVfZW51bV9pdGVtICIkY2lwaGVyIgorCWRvbmUKK30KKwogIyMjIHJlYWQgY2xp ZW50IGNvbmZpZwogcmVhZF9jbGllbnRfbnNfaW5mbygpCiB7CkBAIC00NTAsNyArNDU4LDggQEAg cmVhZF9zZXJ2ZXJfY29uZmlnKCkKIAkJCXdyaXRlX3N0cmluZ19wYXJhbSBicmlkZ2UgIiQoZ2V0 X2JyaWRnZSAiJGRldiIpIgogCQlmaQogCi0JCXdyaXRlX3N0cmluZ19wYXJhbSBjaXBoZXJzICIk KGdldF9jb25maWdfdmFsICIkZGV2IiAnY2lwaGVyJykiCisJCVsgLWQgIiRDQUNIRURJUiIgXSB8 fCBta2RpciAiJENBQ0hFRElSIgorCQlbICEgLWYgIiRDSVBIRVJTX1RNUCIgXSAmJiBnZXRfY29u ZmlnX3ZhbCAiJGRldiIgJ2RhdGEtY2lwaGVycycgfCB0ciAnOicgJ1xuJyA+ICIkQ0lQSEVSU19U TVAiCiAJCXdyaXRlX3N0cmluZ19wYXJhbSB0bHNfY2lwaGVycyAiJChnZXRfY29uZmlnX3ZhbCAi JGRldiIgJ3Rscy1jaXBoZXInKSIKIAkJd3JpdGVfc3RyaW5nX3BhcmFtIGRpZ2VzdHMgIiQoZ2V0 X2NvbmZpZ192YWwgIiRkZXYiICdhdXRoJykiCiAJZWxzZQpAQCAtNzgyLDcgKzc5MSw3IEBAIHN0 YXR1cyBvcGVudnBuLXN0YXR1cy5sb2cKIHZlcmIgMwogU0VSVkVSX0NPTkZfVEVNUExBVEUKIAot CVsgLW4gIiRpbl9jaXBoZXJzIiBdICYmIGVjaG8gImNpcGhlciAkaW5fY2lwaGVycyIgPj4gJENB Q0hFRElSLyRkZXYvJE9WUE5DT05GSUcKKwlbIC1mICIkQ0lQSEVSU19UTVAiIF0gJiYgZWNobyAi ZGF0YS1jaXBoZXJzICQocGFzdGUgLXNkOiAkQ0lQSEVSU19UTVApIiA+PiAkQ0FDSEVESVIvJGRl di8kT1ZQTkNPTkZJRwogCVsgLW4gIiRpbl90bHNfY2lwaGVycyIgXSAmJiBlY2hvICJ0bHMtY2lw aGVyICRpbl90bHNfY2lwaGVycyIgPj4gJENBQ0hFRElSLyRkZXYvJE9WUE5DT05GSUcKIAlbIC1u ICIkaW5fZGlnZXN0cyIgXSAmJiBlY2hvICJhdXRoICRpbl9kaWdlc3RzIiA+PiAkQ0FDSEVESVIv JGRldi8kT1ZQTkNPTkZJRwogCkBAIC03OTMsMTIgKzgwMiw3IEBAIFNFUlZFUl9DT05GX1RFTVBM QVRFCiAJCWlmIFsgLWYgIiRDUllQVE9DT01ESVIvbGliL2VuZ2luZXMvbGliY3J5cHRvY29tLnNv IiBdOyB0aGVuCiAJCQllbmdpbmU9Y3J5cHRvY29tCiAJCWZpCi0gICAgICAgIGNhdCA+PiAiJENB Q0hFRElSLyRkZXYvJE9WUE5DT05GSUciIDw8RU9GCi1lbmdpbmUgJGVuZ2luZQotY2lwaGVyIGdv c3Q4OQotYXV0aCBnb3N0LW1hYwotdGxzLWNpcGhlciBHT1NUMjAwMS1HT1NUODktR09TVDg5Ci1F T0YKKyAgICAgICAgZWNobyAiZW5naW5lICRlbmdpbmUiID4+ICIkQ0FDSEVESVIvJGRldi8kT1ZQ TkNPTkZJRyIKIAkJaWYgWyAteCAiJEdPU1RfT1ZQTiIgXTsgdGhlbgogCQkJc2hlbGxfY29uZmln X3NldCAiJENBQ0hFRElSLyRkZXYvb3B0aW9ucyIgT1ZQTiAiJEdPU1RfT1ZQTiIKIAkJZmkKQEAg LTk0Myw2ICs5NDcsMTYgQEAgb25fbWVzc2FnZSgpCiAgICAgICAgICAgICBbIC1uICIkaW5fc2Vy dmVyX25ldCIgLWEgLW4gIiRpbl9zZXJ2ZXJfbmV0bWFzayIgXSAmJgogICAgICAgICAgICAgc2Vk IC1pICIvJGluX3NlcnZlcl9uZXRbWzpibGFuazpdXVwrJGluX3NlcnZlcl9uZXRtYXNrL2QiICIk U0VSVkVSX05FVFdPUktTX1RNUCIKICAgICAgICAgICAgIDs7CisJCQlhZGQtY2lwaGVyKQorCQkJ aWYgWyAtbiAiJGluX2NpcGhlcnMiIF0gJiYgISBncmVwIC1GeHEgIiRpbl9jaXBoZXJzIiAiJENJ UEhFUlNfVE1QIjt0aGVuCisJCQkJZWNobyAiJGluX2NpcGhlcnMiID4+ICIkQ0lQSEVSU19UTVAi CisJCQlmaQorCQkJOzsKKwkJCXJlbW92ZS1jaXBoZXIpCisJCQlpZiBbIC1uICIkaW5fc2VsZWN0 ZWRfY2lwaGVycyIgXTsgdGhlbgorCQkJCXNlZCAtaSAiL14kaW5fc2VsZWN0ZWRfY2lwaGVyc1wk L2QiICIkQ0lQSEVSU19UTVAiCisJCQlmaQorCQkJOzsKICAgICAgICAgICAgIGNsaWVudC1ucy1k b21haW4pCiAgICAgICAgICAgICB2ZGV2PSIkKGdldF9jYWNoZWRfdmRldikiCiAgICAgICAgICAg ICBpZiAhIGNoZWNrX2NsaWVudF9ucyAiJHZkZXYiICIkaW5fY2xpZW50X25hbWUiICIkaW5fY2xp ZW50X25zIjt0aGVuCkBAIC0xMDAzLDYgKzEwMTcsOCBAQCBvbl9tZXNzYWdlKCkKIAkJOzsKIAkJ YXZhaWxfY2lwaGVycykgbGlzdF9jaXBoZXJzIHwgd3JpdGVfZW51bQogCQk7OworCQlzZWxlY3Rl ZF9jaXBoZXJzKSBsaXN0X3NlbGVjdGVkX2NpcGhlcnMgfCB3cml0ZV9lbnVtCisJCTs7CiAJCWF2 YWlsX3Rsc19jaXBoZXJzKSBsaXN0X3Rsc19jaXBoZXJzIHwgd3JpdGVfZW51bQogCQk7OwogICAg ICAgICBhdmFpbF9kaHBhcmFtcykgbGlzdF9kaHBhcmFtcyB8IHdyaXRlX2VudW0KZGlmZiAtLWdp dCBhL3VpL29wZW52cG4tc2VydmVyL2FqYXguc2NtIGIvdWkvb3BlbnZwbi1zZXJ2ZXIvYWpheC5z Y20KaW5kZXggNGIwYWZlYS4uNzdhYjgzOSAxMDA2NDQKLS0tIGEvdWkvb3BlbnZwbi1zZXJ2ZXIv YWpheC5zY20KKysrIGIvdWkvb3BlbnZwbi1zZXJ2ZXIvYWpheC5zY20KQEAgLTEzLDYgKzEzLDgg QEAKIAkoZm9ybS11cGRhdGUtdmlzaWJpbGl0eSAic2VydmVyX25ldG1hc2siIHJvdXRlZCkKIAko Zm9ybS11cGRhdGUtdmlzaWJpbGl0eSAiYWRkX25ldHdvcmsiIHJvdXRlZCkKIAkoZm9ybS11cGRh dGUtdmlzaWJpbGl0eSAicmVtb3ZlX25ldHdvcmsiIHJvdXRlZCkKKwkoZm9ybS11cGRhdGUtdmlz aWJpbGl0eSAic2VsZWN0ZWRfY2lwaGVycyIgcm91dGVkKQorCShmb3JtLXVwZGF0ZS12aXNpYmls aXR5ICJhZGRfY2lwaGVyIiByb3V0ZWQpCiAJKGZvcm0tdXBkYXRlLXZpc2liaWxpdHkgImdhdGV3 YXlfdnBuYWRkciIgKG5vdCByb3V0ZWQpKQogCShmb3JtLXVwZGF0ZS12aXNpYmlsaXR5ICJ2cG5w b29sX3N0YXJ0IiAobm90IHJvdXRlZCkpCiAJKGZvcm0tdXBkYXRlLXZpc2liaWxpdHkgInZwbnBv b2xfZW5kIiAobm90IHJvdXRlZCkpCkBAIC0zNyw2ICszOSw3IEBACiAgIChsZXQgKChjbWQgKHdv by1yZWFkLWZpcnN0ICIvb3BlbnZwbi1zZXJ2ZXIiICd0eXBlIChmb3JtLXZhbHVlICJ0eXBlIikg J2xhbmd1YWdlIChmb3JtLXZhbHVlICJsYW5ndWFnZSIpKSkpCiAJKGZvcm0tdXBkYXRlLWVudW0g InNlcnZlcl9uZXR3b3JrcyIgKHdvby1saXN0ICIvb3BlbnZwbi1zZXJ2ZXIvYXZhaWxfc2VydmVy X25ldHdvcmtzIikpCiAJKGZvcm0tdXBkYXRlLWVudW0gImJyaWRnZSIgKHdvby1saXN0ICIvb3Bl bnZwbi1zZXJ2ZXIvYXZhaWxfYnJpZGdlcyIpKQorCShmb3JtLXVwZGF0ZS1lbnVtICJzZWxlY3Rl ZF9jaXBoZXJzIiAod29vLWxpc3QgIi9vcGVudnBuLXNlcnZlci9zZWxlY3RlZF9jaXBoZXJzIikp CiAJKGZvcm0tdXBkYXRlLXZhbHVlLWxpc3QKIAkgICcoImVuYWJsZWQiICJ0eXBlIiAiYnJpZGdl IiAicG9ydCIgInNlcnZlcl9uZXQiICJzZXJ2ZXJfbmV0bWFzayIgInZwbm5ldCIgInZwbm5ldG1h c2siCiAJCSJnYXRld2F5X3ZwbmFkZHIiICJ2cG5wb29sX3N0YXJ0IiAidnBucG9vbF9lbmQiICJs em8iICJ1c2VfdGNwIiAiY2lwaGVycyIgInRsc19jaXBoZXJzIiAiZGlnZXN0cyIgImRocGFyYW1z IikKQEAgLTY1LDcgKzY4LDcgQEAKIAkJCSAnb3BlcmF0aW9uIHJlYXNvbgogCQkJIChmb3JtLXZh bHVlLWxpc3QKIAkJCSAgICcoImVuYWJsZWQiICJ0eXBlIiAiYnJpZGdlIiAicG9ydCIgInNlcnZl cl9uZXQiICJzZXJ2ZXJfbmV0bWFzayIgInZwbm5ldCIgInZwbm5ldG1hc2siCi0JCQkJICJnYXRl d2F5X3ZwbmFkZHIiICJ2cG5wb29sX3N0YXJ0IiAidnBucG9vbF9lbmQiICJsem8iICJ1c2VfdGNw IiAibGFuZ3VhZ2UiICJjaXBoZXJzIiAidGxzX2NpcGhlcnMiICJkaWdlc3RzIiAiZGhwYXJhbXMi KSkpKSkpCisJCQkJICJnYXRld2F5X3ZwbmFkZHIiICJ2cG5wb29sX3N0YXJ0IiAidnBucG9vbF9l bmQiICJsem8iICJ1c2VfdGNwIiAibGFuZ3VhZ2UiICJjaXBoZXJzIiAic2VsZWN0ZWRfY2lwaGVy cyIgInRsc19jaXBoZXJzIiAiZGlnZXN0cyIgImRocGFyYW1zIikpKSkpKQogCiAoZGVmaW5lIChh ZGQtbmV0d29yaykKICAgKHdyaXRlLWNvbmZpZyAiYWRkLXNlcnZlci1uZXR3b3JrIikKQEAgLTg2 LDYgKzg5LDE0IEBACiAgICAgICAgICAgICAgICAgICAgICAgICdsYW5ndWFnZSAoZm9ybS12YWx1 ZSAibGFuZ3VhZ2UiKSkKIAkJCQkocmVhZC1jb25maWcpKSkpKQogCisoZGVmaW5lIChhZGQtY2lw aGVyKQorICAod3JpdGUtY29uZmlnICJhZGQtY2lwaGVyIikKKyAgKHJlYWQtY29uZmlnKSkKKwor KGRlZmluZSAocmVtb3ZlLWNpcGhlcikKKyAgKHdyaXRlLWNvbmZpZyAicmVtb3ZlLWNpcGhlciIp CisgIChyZWFkLWNvbmZpZykpCisKIChkZWZpbmUgKGFwcGx5LWNvbmZpZykKICAgKHdyaXRlLWNv bmZpZyAiYXBwbHkiKSkKIApAQCAtMTE2LDEwICsxMjcsMTEgQEAKICAgKGZvcm0tYmluZCAidHlw ZSIgImNoYW5nZSIgcmVhZC1jb25maWcpCiAgIChmb3JtLWJpbmQtdXBsb2FkICJ1cGxvYWRfYnV0 dG9uIiAiY2xpY2siICJjYV9jZXJ0IiBvbi11cGxvYWQpCiAgIChmb3JtLWJpbmQgInNlcnZlcl9u ZXR3b3JrcyIgImNoYW5nZSIgKGxhbWJkYSgpICh1cGRhdGUtc2VydmVyLW5ldC12YWx1ZXMgKGZv cm0tdmFsdWUgInNlcnZlcl9uZXR3b3JrcyIpKSkpCisgIChmb3JtLWJpbmQgImNpcGhlcnMiICJj aGFuZ2UiIGFkZC1jaXBoZXIpCisgIChmb3JtLWJpbmQgInJlbW92ZV9jaXBoZXIiICJjbGljayIg cmVtb3ZlLWNpcGhlcikKICAgKGZvcm0tYmluZCAiYWRkX25ldHdvcmsiICJjbGljayIgYWRkLW5l dHdvcmspCiAgIChmb3JtLWJpbmQgInJlbW92ZV9uZXR3b3JrIiAiY2xpY2siIHJlbW92ZS1uZXR3 b3JrKQogICAoZm9ybS1iaW5kICJjbGllbnRzX21hbmFnbWVudCIgImNsaWNrIiBjbGllbnRzLW5l dHdvcmtzLWludGVyZmFjZSkKICAgKGZvcm0tYmluZCAicmVzZXQiICJjbGljayIgcmVzZXQtY29u ZmlnKQogICAoZm9ybS1iaW5kICJhcHBseSIgImNsaWNrIiBhcHBseS1jb25maWcpCiAgIChmb3Jt LWJpbmQgImNlcnRpZmljYXRlIiAiY2xpY2siIGNlcnRpZmljYXRlLWludGVyZmFjZSkpCi0KZGlm ZiAtLWdpdCBhL3VpL29wZW52cG4tc2VydmVyL2luZGV4Lmh0bWwgYi91aS9vcGVudnBuLXNlcnZl ci9pbmRleC5odG1sCmluZGV4IGUxZmJkMmQuLjdiNTUwYjUgMTAwNjQ0Ci0tLSBhL3VpL29wZW52 cG4tc2VydmVyL2luZGV4Lmh0bWwKKysrIGIvdWkvb3BlbnZwbi1zZXJ2ZXIvaW5kZXguaHRtbApA QCAtNjYsOSArNjYsMTQgQEAKIAkJCQkJCQkJPHRkPjxzZWxlY3QgbmFtZT0idnBubmV0bWFzayI+ PC9zZWxlY3Q+PC90ZD4KIAkJCQkJCQk8L3RyPgogCQkJCQkJCTx0cj4KLQkJCQkJCQkJPHRkPjxz cGFuIHRyYW5zbGF0ZT0iXyIgbmFtZT0iY2lwaGVycyI+Q2lwaGVyOjwvc3Bhbj48L3RkPgorCQkJ CQkJCQk8dGQ+PHNwYW4gdHJhbnNsYXRlPSJfIiBuYW1lPSJjaXBoZXJzIj5TZWxlY3QgY2lwaGVy czo8L3NwYW4+PC90ZD4KIAkJCQkJCQkJPHRkPjxzZWxlY3QgbmFtZT0iY2lwaGVycyI+PC9zZWxl Y3Q+PC90ZD4KIAkJCQkJCQk8L3RyPgorCQkJCQkJCTx0cj4KKwkJCQkJCQkJPHRkIHN0eWxlPSJ2 ZXJ0aWNhbC1hbGlnbjp0b3AiPjxzcGFuIHRyYW5zbGF0ZT0iXyI+Q2lwaGVyczwvc3Bhbj48L3Rk PgorCQkJCQkJCQk8dGQgY29sc3Bhbj0iMiI+PHNlbGVjdCBuYW1lPSJzZWxlY3RlZF9jaXBoZXJz IiBzaXplPSI0IiBzdHlsZT0id2lkdGg6MjQwcHgiPjwvc2VsZWN0PjwvdGQ+CisgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIDx0ZD48aW5wdXQgdHlwZT0iYnV0dG9uIiBjbGFzcz0iYnRu IiBuYW1lPSJyZW1vdmVfY2lwaGVyIiB2YWx1ZT0iUmVtb3ZlIi8+PC90ZD4KKwkJCQkJCQk8L3Ry PgogCQkJCQkJCTx0cj4KIAkJCQkJCQkJPHRkPjxzcGFuIHRyYW5zbGF0ZT0iXyIgbmFtZT0idGxz X2NpcGhlcnMiPlRMUyBDaXBoZXI6PC9zcGFuPjwvdGQ+CiAJCQkJCQkJCTx0ZD48c2VsZWN0IG5h bWU9InRsc19jaXBoZXJzIj48L3NlbGVjdD48L3RkPgo=