From patchwork Thu Jan 16 11:34:09 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "mrbff (Code Review)" X-Patchwork-Id: 4063 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:b7cb:b0:5e7:b9eb:58e8 with SMTP id en11csp63545mab; Thu, 16 Jan 2025 03:34:40 -0800 (PST) X-Forwarded-Encrypted: i=2; AJvYcCUXTzbzyhQGj0yWDR6nMK9MXfSzWJ9MVqbBIPYZ/RWp+e41C6gS/aC3H5YL28QzlKAqdUt8Yv1rb+4=@openvpn.net X-Google-Smtp-Source: AGHT+IFCZnqldqXG9SwKQs0g9CTqi/jcvbxUa6zQIlnsosjjgkEdmmiDjHoqNQYrNiT2zNMi0MTR X-Received: by 2002:a05:6808:1703:b0:3ef:27fe:e969 with SMTP id 5614622812f47-3ef2ec26824mr24115129b6e.11.1737027279263; Thu, 16 Jan 2025 03:34:39 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1737027279; cv=none; d=google.com; s=arc-20240605; b=JCtpLEq3JNAbPdkwdhcKaB20gggxsdOKpOismqNint0XqubM6FeWXQUdlR7K0iIRSg zEOqWbWaM/9KYj5QO5Rv/mc5rtj84ajTGz4/dFrdX6UOW8GsGiK0BnVwbBpAj12zUVrs s2qdoZUrGfPHTX42CsgEMh+LLySJp007nmXmn5lvhIhMUp4fPHYBM5KefLhwGtM+//Gt 2nhaWg/nnUUZjrhAE3gVDJVv3XkGJuoyuVfQTP6yawVXWHbXPgv5LklQzgvmdmTTKQqC IZEdYSKVPq5NMmVyv8EJZa9PVAsJt1MuWvkg+leJL/skiZM4Zy7evT2OTRWFr1BbPcWY jJng== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=errors-to:cc:reply-to:list-subscribe:list-help:list-post :list-archive:list-unsubscribe:list-id:precedence:subject:user-agent :mime-version:message-id:references:auto-submitted:to:date:from :dkim-signature:dkim-signature:dkim-signature; bh=VrXVp87Z3/y/CaGs+J7hn9q1Z7DIW9/9TlehOfneBi0=; fh=lm0MLPW7DntlrDqRECIiC9JlE1uPxhepE0URYHIf+eE=; b=V7wPfJSeyGTMzFK4FGLRUYIAy5S4GDWuwDCzBbXCfvSUB1oYGYWdx42WgyF8tSlsow llqeehUu8ADyh8nKuevMVvQ6pUSdygkxXBUFMCBOA2r17mTE7fSqywxiN+Jwuq5DTDC+ gh2U954IQXaN7Ap9d3uHihM3N4sYS+ODtLEB8OdD8sZ5C+NAq/4Io3I99NChbWWZA1RY 9pXtiPkOOKzsXMyrWTLHxOqZpemY6DAGHFEdp8/8+Na1QKUUnxrUym+X/Z7+5EwNL2Rn wglklLt8bZtysOzKHJmU6rQhqBZ8wjkq9EN2Y2rgvLyPnIgFwdB4pgl/qfAtUXUKDfpd lDoA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=SJ90C5b1; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=EQc696p1; dkim=neutral (body hash did not verify) header.i=@openvpn.net header.s=google header.b=ecrOzEUl; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=openvpn.net; dara=fail header.i=@openvpn.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 5614622812f47-3f03749d590si13394457b6e.60.2025.01.16.03.34.38 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 16 Jan 2025 03:34:39 -0800 (PST) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=SJ90C5b1; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=EQc696p1; dkim=neutral (body hash did not verify) header.i=@openvpn.net header.s=google header.b=ecrOzEUl; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=openvpn.net; dara=fail header.i=@openvpn.net Received: from [127.0.0.1] (helo=sfs-ml-1.v29.lw.sourceforge.com) by sfs-ml-1.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1tYO8t-0000eP-PW; Thu, 16 Jan 2025 11:34:32 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-1.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1tYO8m-0000dy-DZ for openvpn-devel@lists.sourceforge.net; Thu, 16 Jan 2025 11:34:25 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Type:Content-Transfer-Encoding:MIME-Version :Message-ID:Reply-To:References:Subject:List-Unsubscribe:List-Id:Cc:To:Date: From:Sender:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:List-Help: List-Subscribe:List-Post:List-Owner:List-Archive; bh=CiIPZTM3Zfw9djFgHpncI430HVXBMQz2YTISm/zcSCk=; b=SJ90C5b1n6mNfpXO/89MpkDE82 1qdQf9kTY1/jfCpv0wMvcGOfrehGCt/9qPKyIq8SRJYc3bCu6zpRpQeoIrBzMz2+aKyPjdQ6/PQZ9 0NpAWAEoolvuqaoWMtpKyQrlatvScW7bzkcsw93e14gNu471PhrhZfeM6d0vnKIPrAlI=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Type:Content-Transfer-Encoding:MIME-Version:Message-ID:Reply-To: References:Subject:List-Unsubscribe:List-Id:Cc:To:Date:From:Sender:Content-ID :Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To: Resent-Cc:Resent-Message-ID:In-Reply-To:List-Help:List-Subscribe:List-Post: List-Owner:List-Archive; bh=CiIPZTM3Zfw9djFgHpncI430HVXBMQz2YTISm/zcSCk=; b=E Qc696p1sP3PGweP4dLsn84uEqMWNddl0W19jPl9jmwG74ssz9PAPrF5uT6+RYyW6jYKd9WWaHq2aL YMIEzoWGmOPubG1hdum0RV8uXZBG041rs5AIFRE6+Vhe+bJ9EeVxt0lJjvXtfdK4e6O9OPvhnfXKI dXT0583MrHmVXXxo=; Received: from mail-wm1-f44.google.com ([209.85.128.44]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.95) id 1tYO8k-0001y1-T3 for openvpn-devel@lists.sourceforge.net; Thu, 16 Jan 2025 11:34:25 +0000 Received: by mail-wm1-f44.google.com with SMTP id 5b1f17b1804b1-436ce2ab251so4759075e9.1 for ; Thu, 16 Jan 2025 03:34:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvpn.net; s=google; t=1737027251; x=1737632051; darn=lists.sourceforge.net; h=user-agent:content-disposition:content-transfer-encoding :mime-version:message-id:reply-to:references:subject :list-unsubscribe:list-id:auto-submitted:cc:to:date:from:from:to:cc :subject:date:message-id:reply-to; bh=CiIPZTM3Zfw9djFgHpncI430HVXBMQz2YTISm/zcSCk=; b=ecrOzEUlQukvaKChppXS60rLLlz38ERgor5hqFoT0Nw3YwIHFct8BQyA/JMvwifKru VCzAp56fvZ6ZzFMscaOiDb6aFzKhMNmpHK4+6UcscRJTalcXhYKhKrmnu8hUb3b3lHGZ rP+zvoXEUlQl0VhEAwRSwRlgg3myo8JwXqY5tod6sDZEbu/nYRK9oZovIbV0QY7SP6eK 737oChTlK7NFtY9b78J35XXnaQMS69Y7GjTyBdySSbLuJmeks0KuG7VGhV83CSRt56GS RO+sj64dz0v4UOgrzzykewsAaYpnLegnFHkHGVAVfoDMiTjwNjeOPyfGyWGhE3kVwlbX Livg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1737027251; x=1737632051; h=user-agent:content-disposition:content-transfer-encoding :mime-version:message-id:reply-to:references:subject :list-unsubscribe:list-id:auto-submitted:cc:to:date:from :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=CiIPZTM3Zfw9djFgHpncI430HVXBMQz2YTISm/zcSCk=; b=CwZ6XmdCMshj+/dbs2LVfzckusjWE/B0RNQZVO5i948ndM55zg3KfcSwNyQuf8yF8I vnCE5nFC1lCgLz8V7gbGR0/Xrs6LhOj+vumUsAwuRfMoHGKVGM0VsXY2VZII22HJk4S8 c7hkmCkL1iiK1CohnaufPUIKzZPzGiLfnEMBEOahqRKjzQ7NoXF1QlBM/q/fzsUHWhpo fHQogLA0mzLnr3BITJ0nmBLirTyITyU8quILY4XJy9TheJ2vTty0DCSi1WBH876Nyeqr 9Sf+tUVc4j4JH5VioFoRqj4gDGyKy59WPOHaF67L4Zjfp1BEvRm6dUYERn/gFdnyITRs mTsg== X-Gm-Message-State: AOJu0YytLMXGWvwvBduDjTkm2hQYz5snZK8INAkRCxRJNTuu8GdRt9+T UC+3uUbHjH1lth1hgMnyrdJSPAUzkBd9o+tvSJYqOK9TVGTj4sTvrggXrf6tOZf2TB5f76AVIjT 4 X-Gm-Gg: ASbGnctpBuaIZZeDGofSQw030BbDHwtoBYtTYHjUne5rVMn3pmF7yQxoHouI26UFOnw eH+iVNBYFUk7Yqdz+TEe3KSxfXWjxtXvFU8PMSwcDcoulhfzBlq1cfTcgV/kl1r4hhzqZjaZ9Fc UWZRhGeK0xHPaMTxVZPqqeNVcCxeGeHPTAtV6P/xarWCDlsoKonj+ALPKrHz0mzFrRmT/ZO0A+Z 31G8Ueb81tF0XePGT34XlDkxVRtS5pPnxugjjYIP3L/AxHv9KNGZbCV5jJVjT0Dy8dAsZPk9AKz xqUbNAfLzYTc3sWsmGbEFvv2Y6rAu3jimxfRyb+24qokjw6u X-Received: by 2002:a05:600c:1c14:b0:434:f0df:a14 with SMTP id 5b1f17b1804b1-436e26786a4mr126960315e9.2.1737027250627; Thu, 16 Jan 2025 03:34:10 -0800 (PST) Received: from gerrit.openvpn.in (ec2-18-159-0-78.eu-central-1.compute.amazonaws.com. [18.159.0.78]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-437c749a127sm56682395e9.7.2025.01.16.03.34.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 16 Jan 2025 03:34:10 -0800 (PST) From: "plaisthos (Code Review)" X-Google-Original-From: "plaisthos (Code Review)" X-Gerrit-PatchSet: 1 Date: Thu, 16 Jan 2025 11:34:09 +0000 To: flichtenheld Auto-Submitted: auto-generated X-Gerrit-MessageType: newchange X-Gerrit-Change-Id: I15c7cfdddb06d4530d669b222a3c65db5169b29a X-Gerrit-Change-Number: 868 X-Gerrit-Project: openvpn X-Gerrit-ChangeURL: X-Gerrit-Commit: 889759d0b143a8661d9dd61a8b31ed3387a6d9e7 References: Message-ID: MIME-Version: 1.0 User-Agent: Gerrit/3.8.2 X-Spam-Score: -2.0 (--) X-Spam-Report: Spam detection software, running on the system "util-spamd-2.v13.lw.sourceforge.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Attention is currently required from: flichtenheld. Hello flichtenheld, I'd like you to do a code review. Please visit Content analysis details: (-2.0 points, 6.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no trust [209.85.128.44 listed in list.dnswl.org] 0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. [209.85.128.44 listed in sa-accredit.habeas.com] 0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. [209.85.128.44 listed in bl.score.senderscore.com] -1.8 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2) [209.85.128.44 listed in wl.mailspike.net] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record 0.0 WEIRD_PORT URI: Uses non-standard port number for HTTP 0.0 HTML_MESSAGE BODY: HTML included in message -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.0 T_KAM_HTML_FONT_INVALID Test for Invalidly Named or Formatted Colors in HTML X-Headers-End: 1tYO8k-0001y1-T3 Subject: [Openvpn-devel] [M] Change in openvpn[master]: Extend the unit test for data channel packets with aead limit tests X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: arne-openvpn@rfc2549.org, openvpn-devel@lists.sourceforge.net, frank@lichtenheld.com Cc: openvpn-devel Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: =?utf-8?q?1821405116453713267?= X-GMAIL-MSGID: =?utf-8?q?1821405116453713267?= X-getmail-filter-classifier: gerrit message type newchange Attention is currently required from: flichtenheld. Hello flichtenheld, I'd like you to do a code review. Please visit http://gerrit.openvpn.net/c/openvpn/+/868?usp=email to review the following change. Change subject: Extend the unit test for data channel packets with aead limit tests ...................................................................... Extend the unit test for data channel packets with aead limit tests Change-Id: I15c7cfdddb06d4530d669b222a3c65db5169b29a --- M tests/unit_tests/openvpn/test_ssl.c 1 file changed, 100 insertions(+), 0 deletions(-) git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/68/868/1 diff --git a/tests/unit_tests/openvpn/test_ssl.c b/tests/unit_tests/openvpn/test_ssl.c index 842c944..b9112d8 100644 --- a/tests/unit_tests/openvpn/test_ssl.c +++ b/tests/unit_tests/openvpn/test_ssl.c @@ -365,9 +365,104 @@ assert_memory_equal(BPTR(&src), BPTR(&buf), i); } + + gc_free(&gc); } +static void +encrypt_one_packet(struct crypto_options *co, int len) +{ + struct frame frame; + init_frame_parameters(&frame); + + struct gc_arena gc = gc_new(); + struct buffer encrypt_workspace = alloc_buf_gc(BUF_SIZE(&frame), &gc); + struct buffer decrypt_workspace = alloc_buf_gc(BUF_SIZE(&frame), &gc); + struct buffer work = alloc_buf_gc(BUF_SIZE(&frame), &gc); + struct buffer buf = clear_buf(); + struct buffer src = alloc_buf_gc(frame.buf.payload_size, &gc); + void *buf_p; + + ASSERT(buf_init(&work, frame.buf.headroom)); + + /* + * Load src with random data. + */ + ASSERT(buf_init(&src, 0)); + ASSERT(len <= src.capacity); + src.len = len; + ASSERT(rand_bytes(BPTR(&src), BLEN(&src))); + + /* copy source to input buf */ + buf = work; + buf_p = buf_write_alloc(&buf, BLEN(&src)); + ASSERT(buf_p); + memcpy(buf_p, BPTR(&src), BLEN(&src)); + + ASSERT(buf_init(&encrypt_workspace, frame.buf.headroom)); \ + openvpn_encrypt(&buf, encrypt_workspace, co); + + /* decrypt */ + openvpn_decrypt(&buf, decrypt_workspace, co, &frame, BPTR(&buf)); + + /* compare */ + assert_int_equal(buf.len, src.len); + assert_memory_equal(BPTR(&src), BPTR(&buf), len); + + gc_free(&gc); +} + + +static void +check_aead_limits(struct crypto_options *co, bool chachapoly) +{ + + /* Check that we correctly react when we have a nearing AEAD limits */ + + /* manually increase the send counter to be past + * the GCM usage limit */ + co->key_ctx_bi.encrypt.plaintext_blocks = 1ul << 40; + + + bool epoch = (co->flags & CO_EPOCH_DATA_KEY_FORMAT); + + int expected_epoch = epoch ? 4 : 0; + + /* Ensure that we are still on the initial key (unit test uses 4) + * or that it is 0 when epoch is not in use */ + assert_int_equal(co->key_ctx_bi.encrypt.epoch, expected_epoch); + + encrypt_one_packet(co, 1000); + + /* either epoch key has been updated or warning is enabled */ + if (epoch && !chachapoly) + { + expected_epoch++; + } + + assert_int_equal(co->key_ctx_bi.encrypt.epoch, expected_epoch); + + if (!epoch) + { + /* Check always against the GCM usage limit here to see if that + * check works */ + assert_true(aead_usage_limit_reached((1ull << 36), + &co->key_ctx_bi.encrypt, + co->packet_id.send.id)); + return; + } + + /* Move to the end of the epoch data key send PID range, ChachaPoly + * should now also move to a new epoch data key */ + co->packet_id.send.id = PACKET_ID_EPOCH_MAX; + + encrypt_one_packet(co, 1000); + encrypt_one_packet(co, 1000); + + expected_epoch++; + assert_int_equal(co->key_ctx_bi.encrypt.epoch, expected_epoch); +} struct crypto_options @@ -428,16 +523,21 @@ static void run_data_channel_with_cipher_epoch(const char *cipher) { + bool ischacha = !strcmp(cipher, "ChaCha20-Poly1305"); + struct crypto_options co = init_crypto_options(cipher, "none", true, NULL); do_data_channel_round_trip(&co); + check_aead_limits(&co, ischacha); uninit_crypto_options(&co); } static void run_data_channel_with_cipher(const char *cipher, const char *auth) { + bool ischacha = !strcmp(cipher, "ChaCha20-Poly1305"); struct crypto_options co = init_crypto_options(cipher, auth, false, NULL); do_data_channel_round_trip(&co); + check_aead_limits(&co, ischacha); uninit_crypto_options(&co); }