Attention is currently required from: MaxF, cron2, flichtenheld, plaisthos.
syzzer has posted comments on this change. ( http://gerrit.openvpn.net/c/openvpn/+/796?usp=email ) Change subject: Trigger renegotiation of data key if getting close to the AEAD usage limit ...................................................................... Patch Set 12: Code-Review-1 (5 comments) Patchset: PS12: Looks good in general. Math checks out. Some minor nits and one fundamental remark to consider. File src/openvpn/ssl.c: http://gerrit.openvpn.net/c/openvpn/+/796/comment/2fd3c45a_2a4cdbb4 : PS12, Line 144: /* set limit to 7/8 of the limit so the renogiation can succeed before renegotiation http://gerrit.openvpn.net/c/openvpn/+/796/comment/a6fc21b4_8bd28a4d : PS12, Line 146: limit = limit * 7/8; Consider adding overflow checks. I know, unlikely, and doesn´t result in an unsafe situation, but if cipher_get_aead_limits at some point could return values close to 2**64, this calculation could result in very low limit values. http://gerrit.openvpn.net/c/openvpn/+/796/comment/7971040c_bac1d94b : PS12, Line 149: PRIi64 " for block and packets before renegotiation", This suggests a hard limit, but it's a soft limit we can (and typically will) exceed. Without the 64-bit pid, we had a hard limit at 2**32-1. To be able to claim we never exceed the real limit (the "8/8" value), we should consider adding a hard limit enforcement. http://gerrit.openvpn.net/c/openvpn/+/796/comment/502879b2_3c1a0f24 : PS12, Line 3027: || aead_usage_limit_reached(usage_limit, &key_ctx_bi->decrypt, This is a safety precaution? The sending party is ultimately responsible for not exceeding the limit of course. (But I admit, in practice this would likely prevent buggy peers from exceeding the limit.) -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/796?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I057f007577f10c6ac917ee4620ee3d2559187dc7 Gerrit-Change-Number: 796 Gerrit-PatchSet: 12 Gerrit-Owner: plaisthos <arne-open...@rfc2549.org> Gerrit-Reviewer: MaxF <m...@max-fillinger.net> Gerrit-Reviewer: flichtenheld <fr...@lichtenheld.com> Gerrit-Reviewer: syzzer <stef...@karger.me> Gerrit-CC: cron2 <g...@greenie.muc.de> Gerrit-CC: openvpn-devel <openvpn-devel@lists.sourceforge.net> Gerrit-Attention: plaisthos <arne-open...@rfc2549.org> Gerrit-Attention: cron2 <g...@greenie.muc.de> Gerrit-Attention: flichtenheld <fr...@lichtenheld.com> Gerrit-Attention: MaxF <m...@max-fillinger.net> Gerrit-Comment-Date: Wed, 11 Dec 2024 21:15:40 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes Gerrit-MessageType: comment
_______________________________________________ Openvpn-devel mailing list Openvpn-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-devel
