From patchwork Thu Oct 29 18:42:05 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Drew Blokzyl X-Patchwork-Id: 5528 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:6022:3119:b0:118:2077:975e with SMTP id e25csp1154936laa; Thu, 29 Oct 2026 12:11:11 -0700 (PDT) X-Forwarded-Encrypted: i=2; AKwUvBz46yUHagRudOUFmiGQHtUK3IktBUkYMaso56BB8rAW7Bty2KU0bPqotDYfDR8JkjKmO+jPaGcPfkk=@openvpn.net X-Received: by 2002:a05:693c:8105:b0:35f:2bc:82d3 with SMTP id 5a478bee46e88-36a42378ce4mr374435eec.15.1793301071505; Thu, 29 Oct 2026 12:11:11 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1793301071; cv=none; d=google.com; s=arc-20260327; b=kbFo57WMSLTt9d3bIGp1od00SyRWSGhl3ErvTtyaoCE+oBekiMOUkqn+6GTO2WYXw1 1yzJp4lZioGNa9CkBz6N4LWw5247PLfv7a6niKqKPINskAbc4bwlVzwm0mAmtxvU66G3 /KAvGY8E4ULIIWqDcH9vFU/vaxtvr3dtiHMkKOclxoftBWSwKjQjkT637F+Wap6lyqDh uZ/sn+4wcvNDz7yhMY/2cnLuwzXFzwRhkeXGo7UiajjSoQUpXN7ikjIgQ3sozplWPiVD zmTiHUre4IDuhQU3m9HodLZg+vycrI7mTT964pooAAtFr1MwJOQB/Fcnyl/G66AaccvR IDTw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature:dkim-signature; bh=bRzQ9HnRPDdVVcRR2SLuLcdfYLBY2F3OhBS2i6AEz0I=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=Ek6R90YxkzLa4TxjgeMw6xOqxLe8pZyYWEBXRnHNZU5yFKz/ajhu1Zf65ru18zFarp SkHGj8X7xsjf83drPZrwY3HnkZRTF3vcgHU06aQv0gi/Tco26XDTOdguqt3en5BzgleT aBcYnhNYL1vcR2+mFbvcTaKsckZj8iwwaQFF23PllmLhyz6IoQrlCEwnV616a3gJLiTy 6aUKfTE+Q0Omye2KXSHWspBSnL4GF185H1el+r2AedyDhjz1T8OjEq8IUUVrNc+ZFZre 4LlXjQX1PqYSyYVQlITts6kjmc1latXBH6bOXa631kxuy6325TsS7lYznQbEGWHRNMf6 vmAg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=NspvwOMD; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b="b3j+R/Be"; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=W3mtIJkW; dkim=neutral (body hash did not verify) header.i=@linuxkids-com.20260707.gappssmtp.com header.s=20260707 header.b=jmFIQXPF; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dara=neutral header.i=@openvpn.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 5a478bee46e88-36a42b0b5c5si461738eec.52.2026.10.29.12.11.11 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 29 Oct 2026 12:11:11 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=NspvwOMD; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b="b3j+R/Be"; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=W3mtIJkW; dkim=neutral (body hash did not verify) header.i=@linuxkids-com.20260707.gappssmtp.com header.s=20260707 header.b=jmFIQXPF; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dara=neutral header.i=@openvpn.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Unsubscribe-Post: List-Owner; bh=bRzQ9HnRPDdVVcRR2SLuLcdfYLBY2F3OhBS2i6AEz0I=; b=NspvwOMDxSnsJ7 zqOp6TurnUKmwO7x7ohv/wFVHT3NEGLvc2/aSdUcab1SzIjm4WJ3w5CP8u/0s3vecI9RarjsyQKh0 g+F09Q3Nz13iwMN8hBjKglLYltqlSltntXxWYKmVZXmA3ImMOykwnadx9JhoAys2j1Hea+G4ITY9p FzI=; Received: from [127.0.0.1] (helo=sfs-ml-3.v29.lw.sourceforge.com) by sfs-ml-3.v29.lw.sourceforge.com with esmtp (Exim 4.100.1) (envelope-from ) id 1xMVWm-000000004eO-2wdR; Thu, 29 Oct 2026 19:11:08 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-3.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.100.1) (envelope-from ) id 1xMVWc-000000004e4-43if for openvpn-devel@lists.sourceforge.net; Thu, 29 Oct 2026 19:10:59 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Unsubscribe-Post:List-Subscribe:List-Post:List-Owner:List-Archive; bh=PKLYw0g4T+emSSDfUI64EWCYmKuxWx9uwK+9SujcXq8=; b=b3j+R/Be6mY1mNVF/j4PFaG4Sd 15umgWlmf8OPYY1VZHsJSfnMShiGNCpULT3d3gfr7PZghKfVSqS75T36gdEg+GzJtPblF35I3E6Zg YFNN+nMqfF/HT1G56u8oohvdEAbiM7YSEYbj4U0I0syLKohbC/kd8X7q5/OwD1wFN7qo=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Unsubscribe-Post: List-Subscribe:List-Post:List-Owner:List-Archive; bh=PKLYw0g4T+emSSDfUI64EWCYmKuxWx9uwK+9SujcXq8=; b=W3mtIJkWmm/hEzIAX5ZOlohK9t NRb/GCUD+joWYi6vcK6aoonYAkdGAAQapzRpv5xdUqaiNFtB+dt4XjE/9K8IAxb5afbHjY32/hUBh e5MBx218qwdZ0JFNTZlsmL6BrkhqwKbqXjeg4DMD3SQ1Ncwp8axlmhlavSCj3SdvxyNQ=; Received: from mail-pf1-f181.google.com ([209.85.210.181]) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.100.1) id 1xMVWa-000000001F1-1D9b for openvpn-devel@lists.sourceforge.net; Thu, 29 Oct 2026 19:10:58 +0000 Received: by mail-pf1-f181.google.com with SMTP id d2e1a72fcca58-8a064fac8cbso1882106b3a.1 for ; Thu, 29 Oct 2026 12:10:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxkids-com.20260707.gappssmtp.com; s=20260707; t=1793301050; x=1793905850; darn=lists.sourceforge.net; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=PKLYw0g4T+emSSDfUI64EWCYmKuxWx9uwK+9SujcXq8=; b=jmFIQXPFZ1nMEA4s4c74kMWdl1ebXa9pDgYw1aJkdALNYUpQWFH2vNq1CNhIqRei2Z PjC7GK77J+B5xqb6T114hhFZ3SMPoulWHB0yXb2sdLJcGpJXwKsZXyD4pq8hwoff38pJ rXAWw9CX9Fkr29pbZHSpEk4fZcAd0HZ7tfUaAeMNr0BdMveJ1pAl/sB7ERDmBeIEsFPL GnK5vsgDIcdrH+pM8QUBTvacLY3zoOmSqoObAaSzFGrifIbuCggVFLXqXtPqZh5h9csk xwPI3OHyhHi/kLVKSMLPnk0NOme6lAOhwA07YEQ/kVonPJ0VVcfQ25asyPgfoNPh3dwu udTA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793301050; x=1793905850; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=PKLYw0g4T+emSSDfUI64EWCYmKuxWx9uwK+9SujcXq8=; b=XXl65Bekrt5mEehlyWtA2kj+f+dUinHltbb6Cx/aOR3dRE9RBzNNC+T2glad/jo0tO jEAuEaCaBvTqFDKNvdBlnde9GM0nyg5us+uY+vGcYAou7G+CSpdw4u6EebWnDV9DmKkt Z5y7+8eWMdp4FiT2HJTZgFWfJ9KEISEUNWwdGqsIk+5MU10Z/3H7UucnuSPb6dahqnze 7bpcq7PQhFgqT9GdjqqA+j6cU8tERrnKw14AtqPo7pg4NDNLGz1YkuMd6RWcG3C2R+8p +UMS/fI/qgtsxR1LixvjUMLAaKwA53aiTESggk7ehl1OHaXA3/yunzEpy2Di44qpLACV yQ0Q== X-Gm-Message-State: AFq9FYIarsn9Lx22LrnwSaI/XoT5v0JpDNOTHBPi8MWOzGxiQ5GsDdXD C8PDM7Lx1Lb9/sKVKXRChhCdkcG5jyQ0QXCDLxudaCTWH37prAqGMxlVVdwOxEaQ0dyBxGv2DwD Zg9oyjqpc X-Gm-Gg: AYBFou2+dRq5M17wzyT8rTf36lW0XR5Ch7WEhKipa0Ojmip5hkXg6NPOzhj/q7r2v8+ XqhKG6I0YXvJ8MN8aBMtmkH7Ynx32tU29AuA2qCRbTtYCGkaXGHaLzzzny+xUt4pzRywgHIxGg5 tIuwB2iYQIZ8tH0ZgCBnH2fUxxQtjBggdV63nN+gHzwAMQ24PjZ/s3mn5bPe2/j4eGpVOB/x5sz eAf2B11rsdEOjzSxJRAcvAE3CwFeRtkSfeWBCmyIaFX6s08rU4qhr8ndX/Zns1W6TD7h3cSQX7P rgMv5WQko257HZ5Cdlf3V0hpwlLaxxNxpkMNnutKQ3Nj5+OItOKJMtuImYuLEORUUlFlG6TreNG hWLcx10Wts7SOoDnZvhsPU08oWJB6TCld4hlUoECpZvY4Z53N/yCtnJ2RolR82Sn0kA0DILqaa/ cXnuG516WhM5azOlULp3ajjByguV82AGCy8ZJNslgqSNK4YdLkJkAFFCWZK9Q4HsZb4hKsz/ErM cwpV1ViCWvxn3i4V9GHZE2sXF0/Ni5IMvGY21GUl3IAO+LsZ8yzIpi0F4WoVF+rltkBPBRHZHI4 2TvYVvnKETDG1kxiL48gw7vcaKNgdimUIA0Fo/rGPoCX+IP6k6nTx+Li39aMKW5QRIrJM22ohmK v+c5vguHhlYUyU5SLzg== X-Received: by 2002:a05:690c:d91:b0:8ab:44a4:6362 with SMTP id 00721157ae682-8b1b5a51650mr41293747b3.4.1793299327520; Thu, 29 Oct 2026 11:42:07 -0700 (PDT) Received: from MN-277C755CCA3B.localdomain (71-208-239-209.ftmy.qwest.net. [71.208.239.209]) by smtp.gmail.com with ESMTPSA id 00721157ae682-8b2b4ad5c17sm315667b3.16.2026.10.29.11.42.06 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Thu, 29 Oct 2026 11:42:07 -0700 (PDT) From: Drew Blokzyl To: openvpn-devel@lists.sourceforge.net Date: Thu, 29 Oct 2026 14:42:05 -0400 Message-ID: <20261029184205.76422-1-drew@linuxkids.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260922140520.71500-1-drew@linuxkids.com> References: <20260922140520.71500-1-drew@linuxkids.com> MIME-Version: 1.0 X-Spam-Score: 0.0 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: cipher_get() hands EVP_CIPHER_fetch() whatever name it is given, and the callers that only ask whether a cipher exists or which mode it has (cipher_kt_mode_cbc/ofb_cfb/aead(), cipher_kt_block_size(), [...] Content analysis details: (0.0 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3) [209.85.210.181 listed in wl.mailspike.net] 0.0 RCVD_IN_MSPIKE_WL Mailspike good senders X-Headers-End: 1xMVWa-000000001F1-1D9b Subject: [Openvpn-devel] [PATCH v4] Do not look up the "none" cipher in OpenSSL X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1877587283301169619 X-GMAIL-MSGID: 1880412464526583453 cipher_get() hands EVP_CIPHER_fetch() whatever name it is given, and the callers that only ask whether a cipher exists or which mode it has (cipher_kt_mode_cbc/ofb_cfb/aead(), cipher_kt_block_size(), cipher_kt_insecure()) treat NULL as "not that". For the "none" cipher that is the expected answer, but under OpenSSL 3 the failed fetch also pushes EVP_R_UNSUPPORTED ("digital envelope routines::unsupported, Algorithm (none : 0)") onto the thread's error queue, and nothing pops it. "none" is what every server without --cipher carries in its pre-negotiation key_type: the legacy BF-CBC default is not in --data-ciphers, so do_init_crypto_tls() initialises the key_type with cipher "none". Each new client instance walks it in init_instance() -> do_init_crypto_tls() -> cipher_kt_mode_ofb_cfb("none") and in the frame and OCC calculations, and tls_ctx_reload_crl() runs right after. Before commit 15a1465f ("Make CRL reload EOF detection independent of stale error queue entries") that stale entry made the first handshake after a CRL change log "CRL: cannot read CRL from file" for a CRL it loaded fine (GitHub #1103); since then the reload reports it at D_LOW as "CRL: OpenSSL error queue not empty on CRL load" and clears it. Return NULL for "none" before touching OpenSSL, as cipher_kt_name() already does. Real cipher names behave as before, and cipher_valid_reason() still finds the OpenSSL reason on the queue when it reports an unknown cipher. Left alone on purpose: cipher_kt_block_size()'s probe for the CBC sibling of an AEAD cipher (CHACHA20-POLY1305 -> "CHACHA20-CBC") and md_valid() leave the same kind of entry, but neither runs between client instance creation and the CRL reload. With this change the queue is empty when the CRL reload runs for UDP and TCP clients, and CRL replacements give clean reloads with no "error queue not empty" report (current master: one per replacement). Change-Id: I440c4c73865fdbd80f2c607e83c50e345a0e2438 Signed-off-by: Drew Blokzyl --- v4: drop the md_get() guard (Razvan, Gerrit 1950 PS2). No caller can reach md_get() with "none", so it protected nothing and only changed how md_get() reports a failure. Arne asked for it in v3; I agree with Razvan that it does not belong here. Subject and commit message amended to match. Patch 2/2 of v3 is in master as 15a1465f, so the message now refers to it instead of "the next commit". Retested on master 54a66f35 + this patch, OpenSSL 3, UDP and TCP clients, CRL replaced before each connect: master logs the stale "unsupported" entry and "CRL: OpenSSL error queue not empty on CRL load" on every reload; with this patch only "CRL: loaded 1 CRLs". make check: 23 pass, 0 fail. src/openvpn/crypto_openssl.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/openvpn/crypto_openssl.c b/src/openvpn/crypto_openssl.c index e6abd8f7..6ba9526b 100644 --- a/src/openvpn/crypto_openssl.c +++ b/src/openvpn/crypto_openssl.c @@ -568,6 +568,15 @@ cipher_get(const char *ciphername) { ASSERT(ciphername); + /* "none" is a valid OpenVPN cipher name that OpenSSL does not know. + * Return NULL without asking OpenSSL: a failed EVP_CIPHER_fetch() would + * leave an "unsupported" entry on the error queue that the cipher_kt_*() + * callers never clear. */ + if (strcmp("none", ciphername) == 0) + { + return NULL; + } + ciphername = translate_cipher_name_from_openvpn(ciphername); return EVP_CIPHER_fetch(NULL, ciphername, NULL); }