[Openvpn-devel] [XS] Change in openvpn[master]: Correctly calculate packet id size when epoch packet format is in use
"cron2 \(Code Review\) via Openvpn-devel" <[email protected]> Wed, 29 Jul 2026 16:34:51 +0000
| Newsgroups | net.sourceforge.lists.openvpn-devel |
|---|---|
| Message-ID | <242c9fc02e689346d63c86f2a6a0657556fb1b5c-EmailReplacePatchSet-HTML@gerrit.openvpn.net> |
--===============5859727646873115541==
Content-Transfer-Encoding: 8bit
Content-Disposition: inline
Content-Type: multipart/alternative; boundary="RD447l+uEf0="; charset=UTF-8
--RD447l+uEf0=
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
cron2 has uploaded a new patch set (#3) to the change originally created by=
plaisthos=2E ( http://gerrit=2Eopenvpn=2Enet/c/openvpn/+/1829?usp=3Demail =
)
The following approvals got outdated and were removed:
Code-Review+2 by =
ordex
Change subject: Correctly calculate packet id size when epoch packe=
t format is in use
=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=
=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=
=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=
=2E=2E
Correctly calculate packet id size when epoch packet format is in u=
se
The code assumed that always when tls mode (without CFB/OFB) is in use
=
that the packet size is 4 bytes=2E With epoch packet format is incorrect
as=
that uses 64 bit=2E
Even thought packet_id_long_form has a the same size =
(8 byte) it is not
the same header format (32 bit time + 32 bit IV) as the =
epoch
format (16 bit epoch + 48 IV)=2E Use a simple sizeof(uint64_t) to
avo=
id suggesting that it might be the same=2E
Github: closes OpenVPN/openvpn#=
1074
Change-Id: I5b862eabe032eb4d2229ff5b2f4f6af7406f6f4e
Signed-off-by: A=
rne Schwabe <arne@rfc2549=2Eorg>
Acked-by: Antonio Quartulli <antonio@mande=
lbit=2Ecom>
Gerrit URL: https://gerrit=2Eopenvpn=2Enet/c/openvpn/+/1829
Mes=
sage-Id: <20260729064158=2E15731-1-gert@greenie=2Emuc=2Ede>
URL: https://ww=
w=2Email-archive=2Ecom/openvpn-devel@lists=2Esourceforge=2Enet/msg37983=2Eh=
tml
Signed-off-by: Gert Doering <gert@greenie=2Emuc=2Ede>
---
M src/openvpn=
/mtu=2Ec
1 file changed, 8 insertions(+), 0 deletions(-)
git pull ssh:/=
/gerrit=2Eopenvpn=2Enet:29418/openvpn refs/changes/29/1829/3
diff --git a/=
src/openvpn/mtu=2Ec b/src/openvpn/mtu=2Ec
index e5db8ab=2E=2Ef3c2874 100644=
--- a/src/openvpn/mtu=2Ec
+++ b/src/openvpn/mtu=2Ec
@@ -35,6 +35,7 @@
#in=
clude "crypto=2Eh"
#include "memdbg=2Eh"
+#include "ssl_common=2Eh"
/=
* allocate a buffer for socket or tun layer */
void
@@ -51,6 +52,13 @@
ca=
lc_packet_id_size_dc(const struct options *options, const struct key_type *=
kt)
{
bool tlsmode =3D options->tls_server || options->tls_client;
+ =
bool epoch =3D options->imported_protocol_flags & CO_EPOCH_DATA_KEY_FORM=
AT;
+
+ /* epoch format uses a 64-bit packet id: 16 bit epoch + 48 bit p=
er-epoch counter */
+ if (epoch)
+ {
+ return sizeof(uint64_t)=
;
+ }
bool packet_id_long_form =3D !tlsmode || cipher_kt_mode_ofb=
_cfb(kt->cipher);
--
To view, visit http://gerrit=2Eopenvpn=2Enet/c/ope=
nvpn/+/1829?usp=3Demail
To unsubscribe, or for help writing mail filters, v=
isit http://gerrit=2Eopenvpn=2Enet/settings?usp=3Demail
Gerrit-MessageType=
: newpatchset
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-I=
d: I5b862eabe032eb4d2229ff5b2f4f6af7406f6f4e
Gerrit-Change-Number: 1829
Ger=
rit-PatchSet: 3
Gerrit-Owner: plaisthos <arne-openvpn@rfc2549=2Eorg>
Gerrit=
-Reviewer: ordex <antonio@mandelbit=2Ecom>
Gerrit-CC: openvpn-devel <openvp=
n-devel@lists=2Esourceforge=2Enet>
--RD447l+uEf0=
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE html><html><head><style></style></head><body><p>cron2 <strong>upl=
oaded patch set #3</strong> to the change originally created by plaisthos=
=2E</p><p><a href=3D"http://gerrit=2Eopenvpn=2Enet/c/openvpn/+/1829?usp=3De=
mail">View Change</a></p><p>The following approvals got outdated and were r=
emoved:
Code-Review+2 by ordex</p><pre class=3D"blocks" style=3D"font-famil=
y: monospace,monospace; white-space: pre-wrap;">Correctly calculate packet =
id size when epoch packet format is in use<br><br>The code assumed that alw=
ays when tls mode (without CFB/OFB) is in use<br>that the packet size is 4 =
bytes=2E With epoch packet format is incorrect<br>as that uses 64 bit=2E<br=
><br>Even thought packet_id_long_form has a the same size (8 byte) it is no=
t<br>the same header format (32 bit time + 32 bit IV) as the epoch<br>forma=
t (16 bit epoch + 48 IV)=2E Use a simple sizeof(uint64_t) to<br>avoid sugge=
sting that it might be the same=2E<br><br>Github: closes OpenVPN/openvpn#10=
74<br><br>Change-Id: I5b862eabe032eb4d2229ff5b2f4f6af7406f6f4e<br>Signed-of=
f-by: Arne Schwabe <arne@rfc2549=2Eorg><br>Acked-by: Antonio Quartull=
i <antonio@mandelbit=2Ecom><br>Gerrit URL: https://gerrit=2Eopenvpn=
=2Enet/c/openvpn/+/1829<br>Message-Id: <20260729064158=2E15731-1-gert@gr=
eenie=2Emuc=2Ede><br>URL: https://www=2Email-archive=2Ecom/openvpn-devel=
@lists=2Esourceforge=2Enet/msg37983=2Ehtml<br>Signed-off-by: Gert Doering &=
lt;gert@greenie=2Emuc=2Ede><br>---<br>M src/openvpn/mtu=2Ec<br>1 file ch=
anged, 8 insertions(+), 0 deletions(-)<br><br></pre><pre class=3D"blocks" s=
tyle=3D"font-family: monospace,monospace; white-space: pre-wrap;">git pull =
ssh://gerrit=2Eopenvpn=2Enet:29418/openvpn refs/changes/29/1829/3</pre><pre=
style=3D"font-family: monospace,monospace; white-space: pre-wrap;"><span>d=
iff --git a/src/openvpn/mtu=2Ec b/src/openvpn/mtu=2Ec</span><br><span>index=
e5db8ab=2E=2Ef3c2874 100644</span><br><span>--- a/src/openvpn/mtu=2Ec</spa=
n><br><span>+++ b/src/openvpn/mtu=2Ec</span><br><span>@@ -35,6 +35,7 @@</sp=
an><br><span> #include "crypto=2Eh"</span><br><span> </span><br><=
span> #include "memdbg=2Eh"</span><br><span style=3D"color: hsl(1=
20, 100%, 40%);">+#include "ssl_common=2Eh"</span><br><span> </sp=
an><br><span> /* allocate a buffer for socket or tun layer */</span><br><sp=
an> void</span><br><span>@@ -51,6 +52,13 @@</span><br><span> calc_packet_id=
_size_dc(const struct options *options, const struct key_type *kt)</span><b=
r><span> {</span><br><span> bool tlsmode =3D options->tls_server || =
options->tls_client;</span><br><span style=3D"color: hsl(120, 100%, 40%)=
;">+ bool epoch =3D options->imported_protocol_flags & CO_EPOCH_D=
ATA_KEY_FORMAT;</span><br><span style=3D"color: hsl(120, 100%, 40%);">+</sp=
an><br><span style=3D"color: hsl(120, 100%, 40%);">+ /* epoch format use=
s a 64-bit packet id: 16 bit epoch + 48 bit per-epoch counter */</span><br>=
<span style=3D"color: hsl(120, 100%, 40%);">+ if (epoch)</span><br><span=
style=3D"color: hsl(120, 100%, 40%);">+ {</span><br><span style=3D"colo=
r: hsl(120, 100%, 40%);">+ return sizeof(uint64_t);</span><br><span =
style=3D"color: hsl(120, 100%, 40%);">+ }</span><br><span> </span><br><s=
pan> bool packet_id_long_form =3D !tlsmode || cipher_kt_mode_ofb_cfb(kt=
->cipher);</span><br><span> </span><br><span></span><br></pre><p>To view=
, visit <a href=3D"http://gerrit=2Eopenvpn=2Enet/c/openvpn/+/1829?usp=3Dema=
il">change 1829</a>=2E To unsubscribe, or for help writing mail filters, vi=
sit <a href=3D"http://gerrit=2Eopenvpn=2Enet/settings?usp=3Demail">settings=
</a>=2E</p><div itemscope itemtype=3D"http://schema=2Eorg/EmailMessage"><di=
v itemscope itemprop=3D"action" itemtype=3D"http://schema=2Eorg/ViewAction"=
><link itemprop=3D"url" href=3D"http://gerrit=2Eopenvpn=2Enet/c/openvpn/+/1=
829?usp=3Demail"/><meta itemprop=3D"name" content=3D"View Change"/></div></=
div>
<div style=3D"display:none"> Gerrit-MessageType: newpatchset </div>
<=
div style=3D"display:none"> Gerrit-Project: openvpn </div>
<div style=3D"di=
splay:none"> Gerrit-Branch: master </div>
<div style=3D"display:none"> Gerr=
it-Change-Id: I5b862eabe032eb4d2229ff5b2f4f6af7406f6f4e </div>
<div style=
=3D"display:none"> Gerrit-Change-Number: 1829 </div>
<div style=3D"display:=
none"> Gerrit-PatchSet: 3 </div>
<div style=3D"display:none"> Gerrit-Owner:=
plaisthos <arne-openvpn@rfc2549=2Eorg> </div>
<div style=3D"display:=
none"> Gerrit-Reviewer: ordex <antonio@mandelbit=2Ecom> </div>
<div s=
tyle=3D"display:none"> Gerrit-CC: openvpn-devel <openvpn-devel@lists=2Es=
ourceforge=2Enet> </div>
</body></html>
--RD447l+uEf0=--
--===============5859727646873115541==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
--===============5859727646873115541==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
--===============5859727646873115541==--