From patchwork Wed Jul 1 15:43:18 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ralf Lici X-Patchwork-Id: 5048 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a17:907:9721:b0:c12:c60:681d with SMTP id jg33csp1417417ejc; Wed, 1 Jul 2026 08:44:08 -0700 (PDT) X-Forwarded-Encrypted: i=2; AHgh+RqoVgab64B2xRR6OcqC/tGmQy4QjyCsw0dsp/biZ7m6eyVD81p21mSTVHA3681Kz/5w9/YuSnIun9Y=@openvpn.net X-Received: by 2002:a05:6871:79d:b0:447:1ceb:7cc6 with SMTP id 586e51a60fabf-44cb445f396mr803457fac.15.1782920647652; Wed, 01 Jul 2026 08:44:07 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1782920647; cv=none; d=google.com; s=arc-20260327; b=lrsi22E2fhLJldntIRfEWcfXsYY97yj6+yiABVlPy0Zb28XnvEOXc1F0KLAE6v4Lgu UktT6XNtEz61YsQ/lmQ/QHLSOGI55/R6G1scw5pyzypDcPdUOYrRWbjpv2sLaI/hYDUT B9/foscvtOid5fwr5RqePCRrMG7xX/DNBBHj8yYoGdd24K8FTSWYsD73ztn5HjQBUG2q jzB76HSmo2xkZNRw5Xj0A6DHrzF+ae2gDtaiMjIy1/HamfA+AqnSkL0OuvwV214Q2Io1 WXLYHpnleLSVPpojWtTnHmUizIhItXl6UmAZSX613R9tkpGR3AbttsBKexVatwiKI2Kt LxVA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature:dkim-signature; bh=Inxbfda5hQlOcSA5iYWFt+H0yladaOqkSFLtJsBqUB0=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=hjYYTvF7pznFzwOCuJGWvboggHdIKYlgIDBY7prl8W5nEt7+X6kMgKyOUIkhe50uX4 GVevp4vn6Mqkb30argZvWRThCnl2v6/oCYaThYw/dyhMijDEY1KvwsKswb59EIe4nUpo vhb1DvacxhBhVSIu02fndQuSlNDflqEgCO0X7tsPJtKFNBpDdXxJGGFCZDUThGDLukiL eXQTTEsebEna8NRd0PSaFqZwJ7aGNLzNotEENJ6r63A8OXib/nNFr7zGv0Y60l+PhIil oy006w14TTt4t9gLkDlPq6pqORZzeiQPc31iXaw4bO1Dwl3tBi0DcDQE91rWtT8MA2B6 YdIw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=V22JXYov; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=SYnQaAI4; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b="ji/vR2Xt"; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=PxVP6gCY; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 586e51a60fabf-44cbef209e5si12870fac.255.2026.07.01.08.44.07 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 01 Jul 2026 08:44:07 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=V22JXYov; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=SYnQaAI4; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b="ji/vR2Xt"; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=PxVP6gCY; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=Inxbfda5hQlOcSA5iYWFt+H0yladaOqkSFLtJsBqUB0=; b=V22JXYov8D4ywefOk6oePmIiql mAX6T+m7c4m3wU0IuAZF2JQI8bvFoic0wAjScWQbAMxHfwlgWtSDIB45tj5Bkqt11ZywPq1Ck1MkJ KCTvdEVl6MsEWGtsJnqF7XOithA7xzOa0ptd+YBFatHcMhyCsXyCDeK52eBcKf9VhNTM=; Received: from [127.0.0.1] (helo=sfs-ml-3.v29.lw.sourceforge.com) by sfs-ml-3.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1wex6X-0003j8-Ax; Wed, 01 Jul 2026 15:44:02 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-3.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1wex6V-0003ir-24 for openvpn-devel@lists.sourceforge.net; Wed, 01 Jul 2026 15:44:00 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=odsmdw56VN+KOLiAueYEKfzk4tYXPmjpVqVNF6YRwmY=; b=SYnQaAI4D2enEsPweu3x1U7/ee I2A5hTkK96D8dFKajly3YHw3xZ8CBU3Yi/PQnO372N3CW/mk0RtQmLaAhiQzTSoKB48HwmBf5teKy qjGzhg8ztNs4Ce7gSkHq2NIDuTuYvvcLeSeID9lwIDh5HtpwXO69YBb6jkm7+7bGivmY=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=odsmdw56VN+KOLiAueYEKfzk4tYXPmjpVqVNF6YRwmY=; b=ji/vR2XtnC5+m3fol0ipsDcWo9 irm/DlE11wN48ZLfy1depc0c+OeXpN0x+KojxzSXqt0t4ZSqmvm247M2QrSq53js9svojeq7v3E2X vQ6Jn6/HalmffPaBVVAMTX8amXn4Rc70lwg/H3c6pY5ivOQNltF4zmKzZmjAaRq2mtjw=; Received: from mout-b-210.mailbox.org ([195.10.208.40]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1wex6U-000288-It for openvpn-devel@lists.sourceforge.net; Wed, 01 Jul 2026 15:43:59 +0000 Received: from smtp202.mailbox.org (smtp202.mailbox.org [10.196.197.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA512) (No client certificate requested) by mout-b-210.mailbox.org (Postfix) with ESMTPS id 4gr47C1TGjzMkt2; Wed, 01 Jul 2026 17:43:51 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandelbit.com; s=MBO0001; t=1782920631; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=odsmdw56VN+KOLiAueYEKfzk4tYXPmjpVqVNF6YRwmY=; b=PxVP6gCYardGBsb7bx7oezApt3KNlZvY+NCkRnjzWkX+2KJ02lHAsVHiSandg9QeSvRJrc VHUksJ//q6pEuZaO5gA51YmpuIzS1N9G8uTrZHghsBE1xIF59dyxJAPMwAP6hRNhS7ve3u cFiSGHm6wTmrBoJ8G4bNkTgflux2S3OO3hJNM+EWlayb/BqagLY2sMUupLZlP7ifYmoWWS r0VLOuq/Oj6ut5Kax51cz8BhH0uq4O1mVrtzWkmsiV0WJsj67AnAdtPA1CCD8j1vaVOVma IDcGXpir0f/qfEw3s40uJQB4zlqROGt70NyWwL2vp/cRvc0v4ebf0IFV9Gb2CA== From: Ralf Lici To: openvpn-devel@lists.sourceforge.net Date: Wed, 1 Jul 2026 17:43:18 +0200 Message-ID: In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: OpenVPN userspace tracks AEAD tag verification failures per decrypt key. It asks for a new key after more than 2^35 failures and stops attempting AEAD decryption with that key after more than 2^36 fai [...] Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain X-Headers-End: 1wex6U-000288-It Subject: [Openvpn-devel] [RFC ovpn net-next 03/14] ovpn: limit AEAD decrypt verification failures X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1869527800742370968 X-GMAIL-MSGID: 1869527800742370968 OpenVPN userspace tracks AEAD tag verification failures per decrypt key. It asks for a new key after more than 2^35 failures and stops attempting AEAD decryption with that key after more than 2^36 failures. Mirror that behavior in ovpn. Count only crypto_aead_decrypt authentication failures, reported by the crypto API as -EBADMSG, and notify userspace once when the soft threshold is crossed. Once the hard threshold is exceeded, reject new decrypt attempts with the same key before submitting more crypto work. This applies to all ovpn AEAD ciphers, not only AES-GCM, and is independent from the AES-GCM packet/block usage limits. Signed-off-by: Ralf Lici --- drivers/net/ovpn/crypto.h | 2 ++ drivers/net/ovpn/crypto_aead.c | 24 ++++++++++++++++++++++++ drivers/net/ovpn/crypto_aead.h | 1 + drivers/net/ovpn/io.c | 6 ++++++ 4 files changed, 33 insertions(+) diff --git a/drivers/net/ovpn/crypto.h b/drivers/net/ovpn/crypto.h index 09d3a945c5d9..2be7ff54fc40 100644 --- a/drivers/net/ovpn/crypto.h +++ b/drivers/net/ovpn/crypto.h @@ -43,6 +43,8 @@ struct ovpn_crypto_key_slot { struct crypto_aead *encrypt; struct crypto_aead *decrypt; + atomic64_t decrypt_failures; + unsigned long decrypt_failure_flags; u8 nonce_tail_xmit[OVPN_NONCE_TAIL_SIZE]; u8 nonce_tail_recv[OVPN_NONCE_TAIL_SIZE]; diff --git a/drivers/net/ovpn/crypto_aead.c b/drivers/net/ovpn/crypto_aead.c index 9b10ae6f6002..9e34a553f59a 100644 --- a/drivers/net/ovpn/crypto_aead.c +++ b/drivers/net/ovpn/crypto_aead.c @@ -29,6 +29,25 @@ #define ALG_NAME_AES "gcm(aes)" #define ALG_NAME_CHACHAPOLY "rfc7539(chacha20,poly1305)" +#define OVPN_AEAD_DECRYPT_FAILURE_NOTIFY BIT_ULL(35) +#define OVPN_AEAD_DECRYPT_FAILURE_LIMIT BIT_ULL(36) +#define OVPN_AEAD_DECRYPT_FAILURE_NOTIFY_BIT 0 + +static bool +ovpn_aead_decrypt_failure_exceeded(const struct ovpn_crypto_key_slot *ks) +{ + return atomic64_read(&ks->decrypt_failures) > + OVPN_AEAD_DECRYPT_FAILURE_LIMIT; +} + +bool ovpn_aead_decrypt_failure_record(struct ovpn_crypto_key_slot *ks) +{ + u64 failures = atomic64_inc_return(&ks->decrypt_failures); + + return failures > OVPN_AEAD_DECRYPT_FAILURE_NOTIFY && + !test_and_set_bit(OVPN_AEAD_DECRYPT_FAILURE_NOTIFY_BIT, + &ks->decrypt_failure_flags); +} static int ovpn_aead_encap_overhead(const struct ovpn_crypto_key_slot *ks) { @@ -270,6 +289,9 @@ int ovpn_aead_decrypt(struct ovpn_peer *peer, struct ovpn_crypto_key_slot *ks, if (unlikely(payload_len < 0)) return -EINVAL; + if (unlikely(ovpn_aead_decrypt_failure_exceeded(ks))) + return -EKEYREJECTED; + /* Prepare the skb data buffer to be accessed up until the auth tag. * This is required because this area is directly mapped into the sg * list. @@ -436,6 +458,8 @@ ovpn_aead_crypto_key_slot_new(const struct ovpn_key_config *kc) ovpn_key_usage_limit_init(&ks->usage_limit, kc->cipher_alg); ovpn_key_usage_init(&ks->usage_xmit); ovpn_key_usage_init(&ks->usage_recv); + atomic64_set(&ks->decrypt_failures, 0); + ks->decrypt_failure_flags = 0; ks->encrypt = ovpn_aead_init("encrypt", alg_name, kc->encrypt.cipher_key, diff --git a/drivers/net/ovpn/crypto_aead.h b/drivers/net/ovpn/crypto_aead.h index 65a2ff307898..e5ff0b9b5ee3 100644 --- a/drivers/net/ovpn/crypto_aead.h +++ b/drivers/net/ovpn/crypto_aead.h @@ -25,5 +25,6 @@ ovpn_aead_crypto_key_slot_new(const struct ovpn_key_config *kc); void ovpn_aead_crypto_key_slot_destroy(struct ovpn_crypto_key_slot *ks); enum ovpn_cipher_alg ovpn_aead_crypto_alg(struct ovpn_crypto_key_slot *ks); +bool ovpn_aead_decrypt_failure_record(struct ovpn_crypto_key_slot *ks); #endif /* _NET_OVPN_OVPNAEAD_H_ */ diff --git a/drivers/net/ovpn/io.c b/drivers/net/ovpn/io.c index 31c750b9481a..8085cc345c59 100644 --- a/drivers/net/ovpn/io.c +++ b/drivers/net/ovpn/io.c @@ -129,6 +129,12 @@ void ovpn_decrypt_post(void *data, int ret) /* crypto is done, cleanup skb CB and its members */ kfree(ovpn_skb_cb(skb)->crypto_tmp); + if (unlikely(ret == -EBADMSG)) { + if (unlikely(ovpn_aead_decrypt_failure_record(ks))) + ovpn_nl_key_swap_notify(peer, ks->key_id); + goto drop; + } + if (unlikely(ret < 0)) goto drop;