[Openvpn-devel] [S] Change in openvpn[master]: ssl: Ignore hard reset packets with a non-zero packet id
"cron2 \(Code Review\) via Openvpn-devel" <[email protected]> Fri, 31 Jul 2026 20:09:38 +0000
| Newsgroups | net.sourceforge.lists.openvpn-devel |
|---|---|
| Message-ID | <[email protected]> |
--===============0361642963176366815==
Content-Transfer-Encoding: 8bit
Content-Disposition: inline
Content-Type: multipart/alternative; boundary="8hheFE7pXZs="; charset=UTF-8
--8hheFE7pXZs=
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
cron2 has submitted this change=2E ( http://gerrit=2Eopenvpn=2Enet/c/openvp=
n/+/1832?usp=3Demail )
Change subject: ssl: Ignore hard reset packets with=
a non-zero packet id
=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=
=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=
=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=
=2E=2E=2E
ssl: Ignore hard reset packets with a non-zero packet id
A hard=
reset is always the first packet of a session, so it always
carries reliab=
le packet id 0=2E tls_process_state() relies on that when it
treats a recei=
ved reset as the early negotiation packet only for packet
id 0, and the sta=
teless three-way handshake relies on it as well (see
the comment in session=
_skip_to_pre_start())=2E
A reset claiming a different id is therefore bogu=
s=2E
We had a bug that could cause hard reset replays with packet id 1 in
=
specific scenarios (P2P TCP)=2E In that case we accepted the packet id
at f=
ace value and then ignored the control packet that actually had
id 1 as an =
replay=2E This caused a difficult to diagnose dead connection
that was stuc=
k just before TLS negotiation=2E The check added handles
this specific scen=
ario well in that we just ignore the bogus reset
but do not abort the conne=
ction attempt=2E Starting fresh might retrigger
the bug=2E If there would b=
e a separate bug where the client only sends
hard resets with packet id 1 w=
e will still get logging on the server
side now=2E
Change-Id: I3c7d1f9e5b2=
a4c6d8e1f3a5b7c9d2e4f6a8b1c3d
Signed-off-by: Frank Lichtenheld <frank@licht=
enheld=2Ecom>
Acked-by: Arne Schwabe <arne-openvpn@rfc2549=2Eorg>
Gerrit UR=
L: https://gerrit=2Eopenvpn=2Enet/c/openvpn/+/1832
Message-Id: <20260731114=
605=2E11596-1-gert@greenie=2Emuc=2Ede>
URL: https://www=2Email-archive=2Eco=
m/openvpn-devel@lists=2Esourceforge=2Enet/msg38098=2Ehtml
Signed-off-by: Ge=
rt Doering <gert@greenie=2Emuc=2Ede>
---
M src/openvpn/ssl=2Ec
1 file chang=
ed, 15 insertions(+), 1 deletion(-)
diff --git a/src/openvpn/ssl=2Ec b/=
src/openvpn/ssl=2Ec
index 60df7ce=2E=2Eccd8264 100644
--- a/src/openvpn/ssl=
=2Ec
+++ b/src/openvpn/ssl=2Ec
@@ -3896,8 +3896,22 @@
/* Extract t=
he packet ID from the packet */
if (reliable_ack_read_packet_id(bu=
f, &id))
{
+ /* A hard reset always is the first packet=
of a session, so it
+ * always must use packet id 0=2E Ignore =
it if it claims another id=2E
+ * In a specific existing bug th=
ese packets were replays of an
+ * already handled reset, so ig=
noring it is better than aborting
+ * the connection attempt=2E=
+ */
+ if (is_hard_reset_method2(op) && id !=3D 0)
=
+ {
+ msg(D_TLS_ERRORS,
+ "TLS=
Error: received %s with packet id " packet_id_format
+ =
" from %s -- 0 was expected, ignoring packet",
+ packet_=
opcode_name(op), (packet_id_print_type)id,
+ print_link_=
socket_actual(from, &gc));
+ }
/* Avoid deadlock by=
rejecting packet that would de-sequentialize receive buffer */
- =
if (reliable_wont_break_sequentiality(ks->rec_reliable, id))
+ =
else if (reliable_wont_break_sequentiality(ks->rec_reliable, id))
=
{
if (reliable_not_replay(ks->rec_reliable, id))
=
{
--
To view, visit http://gerrit=2Eopenvpn=2Enet/c/openvpn/=
+/1832?usp=3Demail
To unsubscribe, or for help writing mail filters, visit =
http://gerrit=2Eopenvpn=2Enet/settings?usp=3Demail
Gerrit-MessageType: mer=
ged
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: I3c7d1f=
9e5b2a4c6d8e1f3a5b7c9d2e4f6a8b1c3d
Gerrit-Change-Number: 1832
Gerrit-PatchS=
et: 2
Gerrit-Owner: flichtenheld <frank@lichtenheld=2Ecom>
Gerrit-Reviewer:=
plaisthos <arne-openvpn@rfc2549=2Eorg>
Gerrit-CC: openvpn-devel <openvpn-d=
evel@lists=2Esourceforge=2Enet>
--8hheFE7pXZs=
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE html><html><head><style></style></head><body><p>cron2 <strong>sub=
mitted</strong> this change=2E</p><p><a href=3D"http://gerrit=2Eopenvpn=2En=
et/c/openvpn/+/1832?usp=3Demail">View Change</a></p><div style=3D"white-spa=
ce:pre-wrap"></div><pre class=3D"blocks" style=3D"font-family: monospace,mo=
nospace; white-space: pre-wrap;">ssl: Ignore hard reset packets with a non-=
zero packet id<br><br>A hard reset is always the first packet of a session,=
so it always<br>carries reliable packet id 0=2E tls_process_state() relies=
on that when it<br>treats a received reset as the early negotiation packet=
only for packet<br>id 0, and the stateless three-way handshake relies on i=
t as well (see<br>the comment in session_skip_to_pre_start())=2E<br><br>A r=
eset claiming a different id is therefore bogus=2E<br><br>We had a bug that=
could cause hard reset replays with packet id 1 in<br>specific scenarios (=
P2P TCP)=2E In that case we accepted the packet id<br>at face value and the=
n ignored the control packet that actually had<br>id 1 as an replay=2E This=
caused a difficult to diagnose dead connection<br>that was stuck just befo=
re TLS negotiation=2E The check added handles<br>this specific scenario wel=
l in that we just ignore the bogus reset<br>but do not abort the connection=
attempt=2E Starting fresh might retrigger<br>the bug=2E If there would be =
a separate bug where the client only sends<br>hard resets with packet id 1 =
we will still get logging on the server<br>side now=2E<br><br>Change-Id: I3=
c7d1f9e5b2a4c6d8e1f3a5b7c9d2e4f6a8b1c3d<br>Signed-off-by: Frank Lichtenheld=
<frank@lichtenheld=2Ecom><br>Acked-by: Arne Schwabe <arne-openvpn=
@rfc2549=2Eorg><br>Gerrit URL: https://gerrit=2Eopenvpn=2Enet/c/openvpn/=
+/1832<br>Message-Id: <20260731114605=2E11596-1-gert@greenie=2Emuc=2Ede&=
gt;<br>URL: https://www=2Email-archive=2Ecom/openvpn-devel@lists=2Esourcefo=
rge=2Enet/msg38098=2Ehtml<br>Signed-off-by: Gert Doering <gert@greenie=
=2Emuc=2Ede><br>---<br>M src/openvpn/ssl=2Ec<br>1 file changed, 15 inser=
tions(+), 1 deletion(-)<br><br></pre>
<pre style=3D"font-family: monospace,=
monospace; white-space: pre-wrap;"><span>diff --git a/src/openvpn/ssl=2Ec b=
/src/openvpn/ssl=2Ec</span><br><span>index 60df7ce=2E=2Eccd8264 100644</spa=
n><br><span>--- a/src/openvpn/ssl=2Ec</span><br><span>+++ b/src/openvpn/ssl=
=2Ec</span><br><span>@@ -3896,8 +3896,22 @@</span><br><span> /* Ext=
ract the packet ID from the packet */</span><br><span> if (reliable=
_ack_read_packet_id(buf, &id))</span><br><span> {</span><br><sp=
an style=3D"color: hsl(120, 100%, 40%);">+ /* A hard reset alway=
s is the first packet of a session, so it</span><br><span style=3D"color: h=
sl(120, 100%, 40%);">+ * always must use packet id 0=2E Ignore =
it if it claims another id=2E</span><br><span style=3D"color: hsl(120, 100%=
, 40%);">+ * In a specific existing bug these packets were repl=
ays of an</span><br><span style=3D"color: hsl(120, 100%, 40%);">+ =
* already handled reset, so ignoring it is better than aborting</span><b=
r><span style=3D"color: hsl(120, 100%, 40%);">+ * the connectio=
n attempt=2E</span><br><span style=3D"color: hsl(120, 100%, 40%);">+ =
*/</span><br><span style=3D"color: hsl(120, 100%, 40%);">+ =
if (is_hard_reset_method2(op) && id !=3D 0)</span><br><span style=
=3D"color: hsl(120, 100%, 40%);">+ {</span><br><span style=3D"co=
lor: hsl(120, 100%, 40%);">+ msg(D_TLS_ERRORS,</span><br><sp=
an style=3D"color: hsl(120, 100%, 40%);">+ "TLS Err=
or: received %s with packet id " packet_id_format</span><br><span styl=
e=3D"color: hsl(120, 100%, 40%);">+ " from %s -- 0 =
was expected, ignoring packet",</span><br><span style=3D"color: hsl(12=
0, 100%, 40%);">+ packet_opcode_name(op), (packet_id_pri=
nt_type)id,</span><br><span style=3D"color: hsl(120, 100%, 40%);">+ =
print_link_socket_actual(from, &gc));</span><br><span style=
=3D"color: hsl(120, 100%, 40%);">+ }</span><br><span> =
/* Avoid deadlock by rejecting packet that would de-sequentialize receive=
buffer */</span><br><span style=3D"color: hsl(0, 100%, 40%);">- =
if (reliable_wont_break_sequentiality(ks->rec_reliable, id))</span><br>=
<span style=3D"color: hsl(120, 100%, 40%);">+ else if (reliable_=
wont_break_sequentiality(ks->rec_reliable, id))</span><br><span> =
{</span><br><span> if (reliable_not_replay(ks->rec_=
reliable, id))</span><br><span> {</span><br><span></span><b=
r></pre><p>To view, visit <a href=3D"http://gerrit=2Eopenvpn=2Enet/c/openvp=
n/+/1832?usp=3Demail">change 1832</a>=2E To unsubscribe, or for help writin=
g mail filters, visit <a href=3D"http://gerrit=2Eopenvpn=2Enet/settings?usp=
=3Demail">settings</a>=2E</p><div itemscope itemtype=3D"http://schema=2Eorg=
/EmailMessage"><div itemscope itemprop=3D"action" itemtype=3D"http://schema=
=2Eorg/ViewAction"><link itemprop=3D"url" href=3D"http://gerrit=2Eopenvpn=
=2Enet/c/openvpn/+/1832?usp=3Demail"/><meta itemprop=3D"name" content=3D"Vi=
ew Change"/></div></div>
<div style=3D"display:none"> Gerrit-MessageType: =
merged </div>
<div style=3D"display:none"> Gerrit-Project: openvpn </div>
<=
div style=3D"display:none"> Gerrit-Branch: master </div>
<div style=3D"disp=
lay:none"> Gerrit-Change-Id: I3c7d1f9e5b2a4c6d8e1f3a5b7c9d2e4f6a8b1c3d </di=
v>
<div style=3D"display:none"> Gerrit-Change-Number: 1832 </div>
<div styl=
e=3D"display:none"> Gerrit-PatchSet: 2 </div>
<div style=3D"display:none"> =
Gerrit-Owner: flichtenheld <frank@lichtenheld=2Ecom> </div>
<div styl=
e=3D"display:none"> Gerrit-Reviewer: plaisthos <arne-openvpn@rfc2549=2Eo=
rg> </div>
<div style=3D"display:none"> Gerrit-CC: openvpn-devel <ope=
nvpn-devel@lists=2Esourceforge=2Enet> </div>
</body></html>
--8hheFE7pXZs=--
--===============0361642963176366815==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
--===============0361642963176366815==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
--===============0361642963176366815==--