Page MenuHomeFreeBSD

if_ovpn: ensure we never re-use sequence numbers
ClosedPublic

Authored by kp on May 20 2023, 6:38 PM.
Tags
None
Referenced Files
Unknown Object (File)
Wed, Oct 1, 12:55 AM
Unknown Object (File)
Mon, Sep 29, 5:48 AM
Unknown Object (File)
Sun, Sep 28, 3:27 PM
Unknown Object (File)
Sat, Sep 27, 10:42 PM
Unknown Object (File)
Wed, Sep 17, 12:36 AM
Unknown Object (File)
Tue, Sep 16, 1:59 AM
Unknown Object (File)
Sat, Sep 13, 11:49 PM
Unknown Object (File)
Sat, Sep 13, 12:14 AM

Details

Summary

if_ovpn already notified userpsace when there was a risk of sequence
number re-use, but it trusted userspace to actually rotate the key.

Convert the internal sequence number counter to 64 bits so we can detect
overflows and then refuse to send packets.

Event: BSDCan 2023
Sponsored by: Rubicon Communications, LLC ("Netgate")

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

kp requested review of this revision.May 20 2023, 6:38 PM
This revision was not accepted when it landed; it landed in state Needs Review.May 23 2023, 2:14 PM
This revision was automatically updated to reflect the committed changes.