Your message dated Sun, 5 Jul 2026 23:20:05 +0200
with message-id <[email protected]>
and subject line Re: Bug#1108963: v2.6.3 has a curious bug: AEAD and descrypt
errors at key expiration
has caused the Debian Bug report #1108963,
regarding v2.6.3 has a curious bug: AEAD and descrypt errors at key expiration
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1108963: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1108963
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: openvpn
Version: 2.6.3-1+deb12u3
Severity: normal
Tags: upstream, fixed-upstream, bookworm
Control: notfound -1 2.5.1-3+deb11u1
Control: fixed -1 2.6.14-1
Somewhere between 2.5.1 and 2.6.3 there manifested a bug where a client
can lose the connection around session key expiration, which is not
detected by the server, which in turn cause a 60 seconds connection
gap until resynchonisation. It seems to be only dependent on the server
version.
The effect is that the client may log a large amnount of
AEAD Decrypt error: cipher final failed
errors, or in case of kernel module:
ovpn_decrypt_one: error during decryption for peer 0, key-id 0: -74
ovpn_aead_decrypt: decrypt failed: -74
errors when the server have expired the key, and it stays dead
until server timeout (usually 60 seconds) expires and triggers a
resync. From then on everything works fine until the next expiration.
This seems to be fixed in v2.6.14 server, which is not in stable, nor
in the backports. It probably should be.
Thanks!
--- End Message ---
--- Begin Message ---
On 08/07/25 06:39 PM, grin wrote:
> This seems to be fixed in v2.6.14 server, which is not in stable, nor
> in the backports. It probably should be.
Closing since both bookworm and trixie have fixed versions.
Bernhard
--- End Message ---
