From patchwork Tue Nov 10 11:58:22 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gert Doering X-Patchwork-Id: 5645 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:6022:20a6:b0:11a:a05e:cb97 with SMTP id 38csp921318lad; Tue, 10 Nov 2026 03:58:44 -0800 (PST) X-Forwarded-Encrypted: i=2; AL+hErFJkLCeAkXE6dIm+eykeFDvwbSkCqNwNyfoYRe8HjFtmzOUqrISQXrveZHKLaCQoYzHokjKjDWHUNk=@openvpn.net X-Received: by 2002:a05:701b:4651:10b0:19a:20d3:a3d6 with SMTP id a92af1059eb24-1b3b5e7df7fmr3148481c88.1.1794311924365; Tue, 10 Nov 2026 03:58:44 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1794311924; cv=none; d=google.com; s=arc-20260327; b=plMABPyCZYEgG0NCSDlIElQfiF5+Ee6pHqnfCwnQURrt2jy2Wbj/7dwgytGp2svhJb R/PsjRt/LjlECwGFAVCJd07ds9BGbF+0il1NwdIYn4G78RBMoBQwYSHiMp8oaCnIemmE B25IctcpsXWVY5YBd5gPlBRDqE1oNBaVgxvxBzZwjmecO4hg1F/yR7cZFnoLbee8bh3R gdUvj3jEsHwj7E1e/7HEYKSpexppzXRUXncYLSatBez4fLwIEBtdQgrUjyEKstccDmCT f84Oh8AKimPn3sRGPD4c5AeCohFKswch1VVu1DpLIq2qfTWzEE6UXCc+dC4J0WtrKlOu qGFw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=2Z4XaUBz7dNxMDE58VHBnzWRgrUi0+1DBKdsesAn8mE=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=KW2UEJLGGSdukHozmbhsANoC+V6NsBOsTHckm18OjMDmKAzqi17Que+eKHgLAkWa38 g0QxTnYyGND/xv33TUSP9vvAU+Weusr9RfXodipq3+mRsCqa86xNJtKXjGfaH86eQ27V iglMPbF77ZAMNF42TYq0V2C5vOQx2xunqMs9nauSAZczE4J94HJjv9wCdgSlYoZPuB1r 3TB/osK9ZcGkxANInP5Hn0kXBOpMIKjwQ/nTWXOn75uxeie5/s2KObsNfZfzOp+qQLek PLduvWR8PGfRhVBqbXrJvJt2MCfLcDj+WKvVIviwvWv2jtdgtqcLZ5YeF+0noGsUhfsZ EcZw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=DIEhugKd; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=jj14vu6l; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=bFbOx2es; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id a92af1059eb24-1b3b5bcb041si10241534c88.75.2026.11.10.03.58.43 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 10 Nov 2026 03:58:44 -0800 (PST) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=DIEhugKd; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=jj14vu6l; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=bFbOx2es; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Unsubscribe-Post: List-Owner; bh=2Z4XaUBz7dNxMDE58VHBnzWRgrUi0+1DBKdsesAn8mE=; b=DIEhugKd1w/2xB 5ZsOkwxpGeRO4oB1DZWPosoC30pasIe7Sdwog9M0ZpuTg7QFLhbYPU4V5/LUpBh+kYBtZonqFNlGG ARwaSLTAlmWvVQjDjYJ9PazrD9+H9UABTepbJAFyUA8EjZvLrigka7DXWAzniu3CWKDZWlpSq6kX2 KiA=; Received: from [127.0.0.1] (helo=sfs-ml-2.v29.lw.sourceforge.com) by sfs-ml-2.v29.lw.sourceforge.com with esmtp (Exim 4.100.1) (envelope-from ) id 1xQkUr-000000000bs-06l0; Tue, 10 Nov 2026 11:58:41 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-2.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.100.1) (envelope-from ) id 1xQkUm-000000000bP-2hcs for openvpn-devel@lists.sourceforge.net; Tue, 10 Nov 2026 11:58:36 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Unsubscribe-Post:List-Subscribe:List-Post:List-Owner:List-Archive; bh=OYZM0HM2hY1pSi1agBag/Kk88rB4daG/VyHLOrO/gng=; b=jj14vu6lIeujqYkrWcWafrKnpv 94UytxrKOmfP+b0I7Om7bKV1tCVk+ZDPNdBN9CyippaJvNGnLNGNlvBdQAgIMwCq3Jm5ONKHoy9D4 VlefxM0oZfm2vwlSj5FnRjKXauVVutS8STvy8XvIT1ks/y52CWebl0KfVppYsdVjCtsc=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Unsubscribe-Post: List-Subscribe:List-Post:List-Owner:List-Archive; bh=OYZM0HM2hY1pSi1agBag/Kk88rB4daG/VyHLOrO/gng=; b=bFbOx2esyyhvTKta1TQlbBScVn rsCqUQkGuRBFaL6slueFvCbg8V9LGZOA+/J0cQmtgkaEGhjIzTK8yPNXZohuJUclbOMdlzd7B0g0n ilHo2XG8TzZHPn1qchxNaxbxoM7/+4si/72zbrTHy/z+eL9zzs3qFUXSzBgdQgSb183s=; Received: from [193.149.48.129] (helo=blue.greenie.muc.de) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.100.1) id 1xQkUk-0000000052Z-36QW for openvpn-devel@lists.sourceforge.net; Tue, 10 Nov 2026 11:58:36 +0000 Received: from blue.greenie.muc.de (localhost [127.0.0.1]) by blue.greenie.muc.de (8.18.1/8.18.1) with ESMTP id 6AABwR5P001661 for ; Tue, 10 Nov 2026 12:58:27 +0100 Received: (from gert@localhost) by blue.greenie.muc.de (8.18.2/8.18.1/Submit) id 6AABwRwk001660 for openvpn-devel@lists.sourceforge.net; Tue, 10 Nov 2026 12:58:27 +0100 From: Gert Doering To: openvpn-devel@lists.sourceforge.net Date: Tue, 10 Nov 2026 12:58:22 +0100 Message-ID: <20261110115827.1649-1-gert@greenie.muc.de> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-1.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Ralf Lici Incoming P_CONTROL_SOFT_RESET_V1 can arrive while the active key is not yet fully valid for renegotiation. This includes the window where we are still waiting for auth_deferred_expire (derived from ha [...] Content analysis details: (1.3 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS X-Headers-End: 1xQkUk-0000000052Z-36QW Subject: [Openvpn-devel] [PATCH v6] tls: reject incoming reneg request if primary key is not fully valid X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1858564474457634487 X-GMAIL-MSGID: 1881472420304331166 From: Ralf Lici Incoming P_CONTROL_SOFT_RESET_V1 can arrive while the active key is not yet fully valid for renegotiation. This includes the window where we are still waiting for auth_deferred_expire (derived from handshake/reneg timing), as well as cases where deferred or mid-session auth later leaves the key non-authenticated even though state is S_GENERATED_KEYS. This patch keeps read_control_auth as the first gate, then rejects the incoming renegotiation requests unless the primary key is KS_AUTH_TRUE and auth_deferred_expire has passed. The rejected request is not counted as a TLS error, since soft TLS errors trigger an instance restart in TCP mode. Change-Id: I704c560fa23c03237d0f8adc30908a617265a5a1 Signed-off-by: Ralf Lici Acked-by: Arne Schwabe Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1478 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1478 This mail reflects revision 6 of this Change. Acked-by according to Gerrit (reflected above): Arne Schwabe diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c index 420daef..54223da 100644 --- a/src/openvpn/ssl.c +++ b/src/openvpn/ssl.c @@ -3951,6 +3951,21 @@ goto error; } + /* + * Do not allow incoming renegotiation unless our primary key is + * fully authenticated and past the deferred-auth/transition gate. + */ + time_t auth_deferred_left = ks->auth_deferred_expire - now; + if (ks->authenticated != KS_AUTH_TRUE || auth_deferred_left > 0) + { + msg(D_TLS_ERRORS, + "TLS: refusing premature incoming renegotiation request for key-id %d: " + "auth=%s, auth_deferred_expire in %d seconds", + ks->key_id, ks_auth_name(ks->authenticated), + auth_deferred_left > 0 ? (int)auth_deferred_left : 0); + goto done; + } + key_state_soft_reset(session, NULL); dmsg(D_TLS_DEBUG, "TLS: received P_CONTROL_SOFT_RESET_V1 s=%d sid=%s", i,