From patchwork Wed Jul 1 15:43:16 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ralf Lici X-Patchwork-Id: 5050 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a17:907:9721:b0:c12:c60:681d with SMTP id jg33csp1417425ejc; Wed, 1 Jul 2026 08:44:08 -0700 (PDT) X-Forwarded-Encrypted: i=2; AFNElJ/4Fs2p2lRAASqPQUUTSwMNAZAImMndfCqmoIJc+QYXmoiY8CEBMeIfAuTSGjFEA6++vZ4k7VqhYkw=@openvpn.net X-Received: by 2002:a05:6820:174e:b0:6a1:50ec:43fd with SMTP id 006d021491bc7-6a30d8fc2f4mr733018eaf.58.1782920648641; Wed, 01 Jul 2026 08:44:08 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1782920648; cv=none; d=google.com; s=arc-20260327; b=ckjkeCZs7jfdglM1vgmfUl6JDTTVghhZirV5Reg5T+oUrX/OoCyJhESIPNu/l3eOD/ 1Cnf1yWkYUvFC6atEz/jhIALtufONEX2J+sGfJtmHaK/C0QUV6c7+rLoTjK5OU+TENNH SSRG8+DoRzJ3z5TFGuCygq5i0zr2e1YwqfGcuD++zzHL3OwoVQ1cG3PP3jXP4FNm39qj AkJ27/KrhfAWKbCrKsiAbpVCcwiNQK8wP6iQJUkusgzDovFJPyfXRiv/HwKdxkeSI/wO EjbktDbt2xaN01HpRLrlvlCG2MjE87tEzB154oH60u1sLbjY+8jIZNGl0sWxCJmoVxuB i2Ow== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature:dkim-signature; bh=gC/P/HrqBNFIYklgfZySIBdHlKJLtHAQCzaMEnV0KAE=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=Ft3JmeEbgZeV4nn6RCAk+itI1NH8wOChtYV3nPJeIDq12zfvKqSWtLA2PBwIZVxCFG AlpCzAND/eR68Y96Ji6yNGC8cNVMSREXhoVCnUsff64Io819rYrPL4Abefw5kq1BZMJQ p13B75Mxf1EjHayVJ5PGRvfmGk1VFexDq/JCmLv/mmDX6qH97aHbnOYBtgU7WopC8BKX ulNllyxZ+HzJdRBfcd4wLeHZx8ywAchOMkXVjvjiBW6lOGhYWpuL28BTWgBtp0lnMqHX pg+eTu8IrfVch7IkKniz2nYVxqnR8WCzZ+sRXUl+GIdhesEWdB6RFCD78qdGYNBctzK/ 9I7Q==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b="jd5xDD/y"; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=SNuFxtim; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=mvQQEPVl; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b="XpXbhpw/"; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 006d021491bc7-6a31000ee1esi225515eaf.33.2026.07.01.08.44.06 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 01 Jul 2026 08:44:08 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b="jd5xDD/y"; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=SNuFxtim; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=mvQQEPVl; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b="XpXbhpw/"; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=gC/P/HrqBNFIYklgfZySIBdHlKJLtHAQCzaMEnV0KAE=; b=jd5xDD/y24kUHZx14mOKWqQ/Le fE8u6PbPBOU/NkyVS4LJXPo40uuhks4lpjdmgpiBmL5TVN5zXuN2Fec46pJZSdMOIQhMWfE6eIZNo OKqrhuTXGP5zFcsV1pmA3l4STtL7NPk2YOHrUF93vMrGqJ74SQKMPWWf/ZQCnELu5Nuc=; Received: from [127.0.0.1] (helo=sfs-ml-2.v29.lw.sourceforge.com) by sfs-ml-2.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1wex6W-0003jC-NC; Wed, 01 Jul 2026 15:44:01 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-2.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1wex6U-0003iz-9V for openvpn-devel@lists.sourceforge.net; Wed, 01 Jul 2026 15:44:00 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=V6CP2QFoKAE3Bgtas4MvggHDvL3CdgdmA4+QPuixhkM=; b=SNuFxtimGf2Vdpy4LdQR2WHYlu OgBajA8mMugGj77ff/oD+v5x9M+6+xixpcZA5OKslR3LVY26IBulOZCjP7KEjFyjsEkE+OCS2XPT9 UcQrMg6ya2G7nZ3rc1xJJRih5A9bFzWiI3XJGLTloCWKDNfRIHtlfObYRBcNZVMiZUAw=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=V6CP2QFoKAE3Bgtas4MvggHDvL3CdgdmA4+QPuixhkM=; b=mvQQEPVlqI21dKpdCV8axx10Kw GDbixsMAtBD506+McpOwil0Pa1uA65ebhMFmHGYsM9bBM+uDYCNcFXK4VFbWpJtPoBP+9K6tLY4lI kyhk41/fYF5sD4ockyBoHfE40LXTPYAg5Pc3V3f9ygxok0Z91MG4OIUVsBEm4evuTw4U=; Received: from mout-b-203.mailbox.org ([195.10.208.52]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1wex6R-00027z-Fl for openvpn-devel@lists.sourceforge.net; Wed, 01 Jul 2026 15:43:58 +0000 Received: from smtp202.mailbox.org (smtp202.mailbox.org [IPv6:2001:67c:2050:b231:465::202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-b-203.mailbox.org (Postfix) with ESMTPS id 4gr4776vkyz9xGd; Wed, 1 Jul 2026 17:43:47 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandelbit.com; s=MBO0001; t=1782920628; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=V6CP2QFoKAE3Bgtas4MvggHDvL3CdgdmA4+QPuixhkM=; b=XpXbhpw/2o24mTXA/7fK7jktBGJ+fMCpBkMAkMPuvAJhwxH4ro8NeyO/FK0vIEnhbxcBQm jwDg/XCqvHZwvLIwD1DB9mDBBzdZfITAy7YkdyTnwBo3f0863ogVbG90ofUGaJZu0yILwT vdo504zO93OogPJwvvKUfwuj/FClHJ8V1mZJvJatksx42zR+JgiPU43nvl7gPLwnN3q9K9 cdxTi8TisVX1+gfYbV7sVjQd2Y4am5OOwPZAGI+0g22wxbE5/MhzxZURSRYF1IchR5QvXZ 3AiG1IOP9rhQig+yhrtzpBBnoRNg9OEgF++My++DmHS7d4k/X9krPzYFd8PAxw== Authentication-Results: outgoing_mbo_mout; dkim=none; spf=pass (outgoing_mbo_mout: domain of ralf@mandelbit.com designates 2001:67c:2050:b231:465::202 as permitted sender) smtp.mailfrom=ralf@mandelbit.com From: Ralf Lici To: openvpn-devel@lists.sourceforge.net Date: Wed, 1 Jul 2026 17:43:16 +0200 Message-ID: <6c66a38af8ea53e4fbc587f087c594573fd8ee6a.1782919654.git.ralf@mandelbit.com> In-Reply-To: References: MIME-Version: 1.0 X-Rspamd-Queue-Id: 4gr4776vkyz9xGd X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-1.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: OpenVPN needs packet-ID and cipher usage thresholds to decide when a data-channel key should be renewed or stopped. The existing transmit packet-ID helper only returns the next ID and has no way to re [...] Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain X-Headers-End: 1wex6R-00027z-Fl Subject: [Openvpn-devel] [RFC ovpn net-next 01/14] ovpn: prepare packet ID state for usage limits X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1869527801972934827 X-GMAIL-MSGID: 1869527801972934827 OpenVPN needs packet-ID and cipher usage thresholds to decide when a data-channel key should be renewed or stopped. The existing transmit packet-ID helper only returns the next ID and has no way to request a threshold notification. Teach the transmit packet-ID helper to return 1 when the fixed OpenVPN packet-ID soft threshold is crossed. The counter is monotonic, so the exact crossing is naturally reported only once. The hard packet-ID wrap check still stops TX; this only gives userspace a chance to rekey while packet-ID space is still available. Signed-off-by: Ralf Lici --- drivers/net/ovpn/crypto_aead.c | 3 +++ drivers/net/ovpn/netlink.c | 4 ++-- drivers/net/ovpn/pktid.h | 31 +++++++++++++++++++++++++------ 3 files changed, 30 insertions(+), 8 deletions(-) diff --git a/drivers/net/ovpn/crypto_aead.c b/drivers/net/ovpn/crypto_aead.c index 8f07c418622b..86b69aeddcf7 100644 --- a/drivers/net/ovpn/crypto_aead.c +++ b/drivers/net/ovpn/crypto_aead.c @@ -19,6 +19,7 @@ #include "pktid.h" #include "crypto_aead.h" #include "crypto.h" +#include "netlink.h" #include "peer.h" #include "proto.h" #include "skb.h" @@ -207,6 +208,8 @@ int ovpn_aead_encrypt(struct ovpn_peer *peer, struct ovpn_crypto_key_slot *ks, ret = ovpn_pktid_xmit_next(&ks->pid_xmit, &pktid); if (unlikely(ret < 0)) return ret; + if (unlikely(ret > 0)) + ovpn_nl_key_swap_notify(peer, ks->key_id); /* concat 4 bytes packet id and 8 bytes nonce tail into 12 bytes * nonce diff --git a/drivers/net/ovpn/netlink.c b/drivers/net/ovpn/netlink.c index 4c66c1ec497e..83d81a468b5a 100644 --- a/drivers/net/ovpn/netlink.c +++ b/drivers/net/ovpn/netlink.c @@ -1312,8 +1312,8 @@ int ovpn_nl_key_swap_notify(struct ovpn_peer *peer, u8 key_id) int ret = -EMSGSIZE; void *hdr; - netdev_info(peer->ovpn->dev, "peer with id %u must rekey - primary key unusable.\n", - peer->id); + netdev_info(peer->ovpn->dev, "peer with id %u should rekey key %u\n", + peer->id, key_id); msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); if (!msg) diff --git a/drivers/net/ovpn/pktid.h b/drivers/net/ovpn/pktid.h index 21845f353bc8..82f59256b4a3 100644 --- a/drivers/net/ovpn/pktid.h +++ b/drivers/net/ovpn/pktid.h @@ -17,6 +17,9 @@ */ #define PKTID_RECV_EXPIRE (30 * HZ) +/* notify userspace when the packet ID space is close to wrapping */ +#define PKTID_XMIT_REKEY_NOTIFY 0xff000000U + /* Packet-ID state for transmitter */ struct ovpn_pktid_xmit { atomic_t seq_num; @@ -52,20 +55,36 @@ struct ovpn_pktid_recv { spinlock_t lock; }; -/* Get the next packet ID for xmit */ +/** + * ovpn_pktid_xmit_next - allocate a transmit packet ID + * @pid: transmit packet ID state + * @pktid: location where the generated packet ID is stored + * + * The returned packet ID becomes part of the AEAD nonce, so the helper rejects + * the packet before the 32-bit packet-ID space wraps. + * + * The packet-ID soft threshold does not reject the packet. It returns 1 once + * so the caller can notify userspace to rekey while packet-ID space remains. + * + * Return: 1 if userspace should be notified, 0 if no notification is needed, + * or a negative error code otherwise. + */ static inline int ovpn_pktid_xmit_next(struct ovpn_pktid_xmit *pid, u32 *pktid) { const u32 seq_num = atomic_fetch_add_unless(&pid->seq_num, 1, 0); - /* when the 32bit space is over, we return an error because the packet - * ID is used to create the cipher IV and we do not want to reuse the - * same value more than once - */ + int ret = 0; + + /* packet IDs are used to create cipher IVs and must not wrap */ if (unlikely(!seq_num)) return -ERANGE; + /* notify userspace before the packet ID space is close to wrapping */ + if (unlikely(seq_num == PKTID_XMIT_REKEY_NOTIFY)) + ret = 1; + *pktid = seq_num; - return 0; + return ret; } /* Write 12-byte AEAD IV to dest */