Attention is currently required from: plaisthos. cron2 has uploaded a new patch set (#2) to the change originally created by plaisthos. ( http://gerrit.openvpn.net/c/openvpn/+/1840?usp=email )
The following approvals got outdated and were removed: Code-Review+2 by plaisthos, Code-Review+2 by razvanc Change subject: OpenSSL: avoid resetting the HMAC key on every packet ...................................................................... OpenSSL: avoid resetting the HMAC key on every packet OpenSSL 3.0.3 and newer can reinitialize an EVP_MAC HMAC context with its existing key when EVP_MAC_init is called without parameters. Use that path instead of supplying the digest and key again on every OpenVPN HMAC reset. Retain the old parameter-based reset for OpenSSL 3.0.0 through 3.0.2, where parameterless EVP_MAC reinitialization did not reset the underlying HMAC implementation. Github: closes OpenVPN/openvpn#1088 Change-Id: I1913a6e64b7ce22b66d2034df2a2fac33f60ea9f Signed-off-by: Arne Schwabe <[email protected]> Acked-by: Arne Schwabe <[email protected]> Acked-by: Razvan Cojocaru <[email protected]> Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1840 Message-Id: <[email protected]> URL: https://www.mail-archive.com/[email protected]/msg38313.html Signed-off-by: Gert Doering <[email protected]> --- M src/openvpn/crypto_openssl.c 1 file changed, 9 insertions(+), 5 deletions(-) git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/40/1840/2 diff --git a/src/openvpn/crypto_openssl.c b/src/openvpn/crypto_openssl.c index 1191f20..2019280 100644 --- a/src/openvpn/crypto_openssl.c +++ b/src/openvpn/crypto_openssl.c @@ -1209,7 +1209,7 @@ HMAC_Final(ctx, dst, &in_hmac_len); } -#else /* if OPENSSL_VERSION_NUMBER < 0x30000000L */ +#else /* if OPENSSL_VERSION_NUMBER < 0x30000000L */ hmac_ctx_t * hmac_ctx_new(void) { @@ -1275,10 +1275,14 @@ void hmac_ctx_reset(hmac_ctx_t *ctx) { - /* The OpenSSL MAC API lacks a reset method and passing NULL as params - * does not reset it either, so use the params array to reinitialise it the - * same way as before */ - if (!EVP_MAC_init(ctx->ctx, NULL, 0, ctx->params)) + /* OpenSSL 3.0.3 fixed EVP_MAC reinitialization with an existing key. + * Older versions need the parameters, including the key, to reset. */ +#if OPENSSL_VERSION_NUMBER >= 0x30000030L + const OSSL_PARAM *params = NULL; +#else + const OSSL_PARAM *params = ctx->params; +#endif + if (!EVP_MAC_init(ctx->ctx, NULL, 0, params)) { crypto_msg(M_FATAL, "EVP_MAC_init failed"); } -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/1840?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I1913a6e64b7ce22b66d2034df2a2fac33f60ea9f Gerrit-Change-Number: 1840 Gerrit-PatchSet: 2 Gerrit-Owner: plaisthos <[email protected]> Gerrit-Reviewer: plaisthos <[email protected]> Gerrit-Reviewer: razvanc <[email protected]> Gerrit-CC: openvpn-devel <[email protected]> Gerrit-Attention: plaisthos <[email protected]>
_______________________________________________ Openvpn-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-devel
