From 34aaafd4516dcefa20593640e2860cea16bf3fa6 Mon Sep 17 00:00:00 2001 From: Arne Schwabe Date: Fri, 11 Oct 2024 15:19:17 +0200 Subject: [PATCH] Rename aead-tag-at-end to aead-epoch Change-Id: I9e9433b56dcbaa538d9bed30e50cf74948c647cc Signed-off-by: Arne Schwabe --- src/openvpn/crypto.c | 6 +++--- src/openvpn/crypto.h | 7 ++++--- src/openvpn/init.c | 4 ++-- src/openvpn/options.c | 4 ++-- src/openvpn/push.c | 4 ++-- src/openvpn/ssl.h | 3 +++ tests/unit_tests/openvpn/test_ssl.c | 2 +- 7 files changed, 17 insertions(+), 13 deletions(-) diff --git a/src/openvpn/crypto.c b/src/openvpn/crypto.c index 0cfd30d72..206b63ab9 100644 --- a/src/openvpn/crypto.c +++ b/src/openvpn/crypto.c @@ -128,7 +128,7 @@ openvpn_encrypt_aead(struct buffer *buf, struct buffer work, dmsg(D_PACKET_CONTENT, "ENCRYPT AD: %s", format_hex(BPTR(&work), BLEN(&work), 0, &gc)); - if (!(opt->flags & CO_AEAD_TAG_AT_THE_END)) + if (!(opt->flags & CO_EPOCH_DATA_KEY_FORMAT)) { /* Reserve space for authentication tag */ mac_out = buf_write_alloc(&work, mac_len); @@ -149,7 +149,7 @@ openvpn_encrypt_aead(struct buffer *buf, struct buffer work, ASSERT(buf_inc_len(&work, outlen)); /* if the tag is at end the end, allocate it now */ - if (opt->flags & CO_AEAD_TAG_AT_THE_END) + if (opt->flags & CO_EPOCH_DATA_KEY_FORMAT) { /* Reserve space for authentication tag */ mac_out = buf_write_alloc(&work, mac_len); @@ -475,7 +475,7 @@ openvpn_decrypt_aead(struct buffer *buf, struct buffer work, uint8_t *tag_ptr = NULL; int data_len = 0; - if (opt->flags & CO_AEAD_TAG_AT_THE_END) + if (opt->flags & CO_EPOCH_DATA_KEY_FORMAT) { data_len = BLEN(buf) - tag_size; tag_ptr = BPTR(buf) + data_len; diff --git a/src/openvpn/crypto.h b/src/openvpn/crypto.h index 081657043..3c64a7c78 100644 --- a/src/openvpn/crypto.h +++ b/src/openvpn/crypto.h @@ -320,9 +320,10 @@ struct crypto_options /**< Bit-flag indicating that renegotiations are using tls-crypt * with a TLS-EKM derived key. */ -#define CO_AEAD_TAG_AT_THE_END (1<<8) - /**< Bit-flag indicating that the AEAD tag is at the end of the - * packet. +#define CO_EPOCH_DATA_KEY_FORMAT (1<<8) + /**< Bit-flag indicating that the data format using + * AEAD tag is at the end of the packet and using epoch + * keys is used. */ unsigned int flags; /**< Bit-flags determining behavior of diff --git a/src/openvpn/init.c b/src/openvpn/init.c index ae911a9fc..3b9833960 100644 --- a/src/openvpn/init.c +++ b/src/openvpn/init.c @@ -2392,9 +2392,9 @@ tls_print_deferred_options_results(struct context *c) { buf_printf(&out, " dyn-tls-crypt"); } - if (o->imported_protocol_flags & CO_AEAD_TAG_AT_THE_END) + if (o->imported_protocol_flags & CO_EPOCH_DATA_KEY_FORMAT) { - buf_printf(&out, " aead-tag-end"); + buf_printf(&out, " aead-epoch"); } } diff --git a/src/openvpn/options.c b/src/openvpn/options.c index ebca4d0cf..5428a73b8 100644 --- a/src/openvpn/options.c +++ b/src/openvpn/options.c @@ -8719,9 +8719,9 @@ add_option(struct options *options, options->imported_protocol_flags |= CO_USE_DYNAMIC_TLS_CRYPT; } #endif - else if (streq(p[j], "aead-tag-end")) + else if (streq(p[j], "aead-epoch")) { - options->imported_protocol_flags |= CO_AEAD_TAG_AT_THE_END; + options->imported_protocol_flags |= CO_EPOCH_DATA_KEY_FORMAT; } else { diff --git a/src/openvpn/push.c b/src/openvpn/push.c index 6c0637415..01d369932 100644 --- a/src/openvpn/push.c +++ b/src/openvpn/push.c @@ -689,9 +689,9 @@ prepare_push_reply(struct context *c, struct gc_arena *gc, buf_printf(&proto_flags, " dyn-tls-crypt"); } - if (o->imported_protocol_flags & CO_AEAD_TAG_AT_THE_END) + if (o->imported_protocol_flags & CO_EPOCH_DATA_KEY_FORMAT) { - buf_printf(&proto_flags, " aead-tag-end"); + buf_printf(&proto_flags, " aead-epoch"); } if (buf_len(&proto_flags) > 0) diff --git a/src/openvpn/ssl.h b/src/openvpn/ssl.h index eea13234b..e47a94d33 100644 --- a/src/openvpn/ssl.h +++ b/src/openvpn/ssl.h @@ -107,6 +107,9 @@ /** Support to dynamic tls-crypt (renegotiation with TLS-EKM derived tls-crypt key) */ #define IV_PROTO_DYN_TLS_CRYPT (1<<9) +/** Support the extended packet id and epoch format for data channel packets */ +#define IV_PROTO_DATA_EPOCH (1<<10) + /** Supports the --dns option after all the incompatible changes */ #define IV_PROTO_DNS_OPTION_V2 (1<<11) diff --git a/tests/unit_tests/openvpn/test_ssl.c b/tests/unit_tests/openvpn/test_ssl.c index caacd9ec0..845ca56b4 100644 --- a/tests/unit_tests/openvpn/test_ssl.c +++ b/tests/unit_tests/openvpn/test_ssl.c @@ -404,7 +404,7 @@ static void run_data_channel_with_cipher_end(const char *cipher) { struct crypto_options co = init_crypto_options(cipher, "none"); - co.flags |= CO_AEAD_TAG_AT_THE_END; + co.flags |= CO_EPOCH_DATA_KEY_FORMAT; do_data_channel_round_trip(&co); uninit_crypto_options(&co); }