[DCO] [MIPS] [BUG] Ecnryption key renegotiation during TLS session drops the connection on MIPS
**Describe the bug**
When DCO is enabled, OpenVPN server drops the connection with client near the time when **"reneg-sec"** value should expire and it causes full connection procedure from scratch instead of only session key update and continue session.
The key (dco_install_key/dco_new_key) is created only once at initialization step.
In the OpenVPN log there no mentions about attempt to add/update the key after initialization, when "reneg-sec" expires or before it will expire.
The kernel log does not contain any errors for dco_install_key/dco_new_key.
`reneg-sec 1800`
```
2026-02-15 06:43:54 us=880667 ovpn.internal/<IP>:3009 peer-id=0 dco_install_key: peer_id=0 keyid=0, currently 0 keys installed
2026-02-15 06:43:54 us=881089 ovpn.internal/<IP>:3009 peer-id=0 dco_new_key: slot 0, key-id 0, peer-id 0, cipher CHACHA20-POLY1305
```
**...**
```
2026-02-15 07:10:57 us=239095 ovpn.internal/<IP>:3009 peer-id=0 TLS: soft reset sec=1623/1623 bytes=0/-1 pkts=0/0
2026-02-15 07:10:57 us=240205 ovpn.internal/<IP>:3009 peer-id=0 write_control_auth(): P_CONTROL_SOFT_RESET_V1
2026-02-15 07:10:57 us=240869 event_wait returned 1
2026-02-15 07:10:57 us=241710 ovpn.internal/<IP>:3009 peer-id=0 UDPv4 WRITE [54] to [AF_INET]<IP>:3009: P_CONTROL_SOFT_RESET_V1 kid=1 sid=8f3e544d 294dd9bd pid=[ OpenVPN/openvpn#1 / time = (1771132257) 2026-02-15 07:10:57 ] tls_crypt_hmac=1144a7d7 7ab3f000 6772dc07 43921837 2fba36cd d6acdac5 ef9714ec ff9f5f3c
```
**...**
`Sun Feb 15 07:11:57 2026 kern.info kernel: [ 2206.800268] ovpn_decrypt_one: no available key for peer 0, key-id: 1`
**To Reproduce**
Set "reneg-sec" parameter to short interval, for example 1 minute and check either OpenVPN client does full reconnection procedure to OpenVPN server or not when "reneg-sec" expires.
**Expected behavior**
The initialized session should not be dropped. The encryption key should be added/updated on server side to DCO module and session should continue without reconnection.
**Version information (please complete the following information):**
**OpenVPN server version:**
> OpenVPN 2.6.14 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] [DCO]
> library versions: OpenSSL 3.5.5 27 Jan 2026, LZO 2.10
> DCO version: N/A
> Originally developed by James Yonan
> Copyright (C) 2002-2024 OpenVPN Inc <sales@openvpn.net>
**Test on:**
> Device: TP-Link Archer C7 v2 (Architecture: MIPS 74Kc / ath79)
> OpenWrt 24.10.5, r29087-d9c5716d1d
> DCO Module: kmod-ovpn-dco-v2 - 6.6.119.0.2.20240320-r1 (ovpn_dco_v2 loaded)
> Cipher: CHACHA20-POLY1305 (AEAD)
**Also tested on:**
> Device: TP-Link Archer C7 v2 (Architecture: MIPS 74Kc / ath79)
> OpenWrt SNAPSHOT r33075-20644af030
> DCO Module: kmod-ovpn-dco-v2-6.12.69.0.2.20250801-r1 = 6.12.69.0.2.20250801-r1 (ovpn_dco_v2 loaded)
> Cipher: CHACHA20-POLY1305 (AEAD)
关闭于 2026-02-17 16 条评论