ITADN

[DCO] [MIPS] [BUG] Ecnryption key renegotiation during TLS session drops the connection on MIPS

#95Closednetmonitoring 创建于 2026-02-16
N
netmonitoringcommented
**Describe the bug** When DCO is enabled, OpenVPN server drops the connection with client near the time when **"reneg-sec"** value should expire and it causes full connection procedure from scratch instead of only session key update and continue session. The key (dco_install_key/dco_new_key) is created only once at initialization step. In the OpenVPN log there no mentions about attempt to add/update the key after initialization, when "reneg-sec" expires or before it will expire. The kernel log does not contain any errors for dco_install_key/dco_new_key. `reneg-sec 1800` ``` 2026-02-15 06:43:54 us=880667 ovpn.internal/<IP>:3009 peer-id=0 dco_install_key: peer_id=0 keyid=0, currently 0 keys installed 2026-02-15 06:43:54 us=881089 ovpn.internal/<IP>:3009 peer-id=0 dco_new_key: slot 0, key-id 0, peer-id 0, cipher CHACHA20-POLY1305 ``` **...** ``` 2026-02-15 07:10:57 us=239095 ovpn.internal/<IP>:3009 peer-id=0 TLS: soft reset sec=1623/1623 bytes=0/-1 pkts=0/0 2026-02-15 07:10:57 us=240205 ovpn.internal/<IP>:3009 peer-id=0 write_control_auth(): P_CONTROL_SOFT_RESET_V1 2026-02-15 07:10:57 us=240869 event_wait returned 1 2026-02-15 07:10:57 us=241710 ovpn.internal/<IP>:3009 peer-id=0 UDPv4 WRITE [54] to [AF_INET]<IP>:3009: P_CONTROL_SOFT_RESET_V1 kid=1 sid=8f3e544d 294dd9bd pid=[ OpenVPN/openvpn#1 / time = (1771132257) 2026-02-15 07:10:57 ] tls_crypt_hmac=1144a7d7 7ab3f000 6772dc07 43921837 2fba36cd d6acdac5 ef9714ec ff9f5f3c ``` **...** `Sun Feb 15 07:11:57 2026 kern.info kernel: [ 2206.800268] ovpn_decrypt_one: no available key for peer 0, key-id: 1` **To Reproduce** Set "reneg-sec" parameter to short interval, for example 1 minute and check either OpenVPN client does full reconnection procedure to OpenVPN server or not when "reneg-sec" expires. **Expected behavior** The initialized session should not be dropped. The encryption key should be added/updated on server side to DCO module and session should continue without reconnection. **Version information (please complete the following information):** **OpenVPN server version:** > OpenVPN 2.6.14 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] [DCO] > library versions: OpenSSL 3.5.5 27 Jan 2026, LZO 2.10 > DCO version: N/A > Originally developed by James Yonan > Copyright (C) 2002-2024 OpenVPN Inc <sales@openvpn.net> **Test on:** > Device: TP-Link Archer C7 v2 (Architecture: MIPS 74Kc / ath79) > OpenWrt 24.10.5, r29087-d9c5716d1d > DCO Module: kmod-ovpn-dco-v2 - 6.6.119.0.2.20240320-r1 (ovpn_dco_v2 loaded) > Cipher: CHACHA20-POLY1305 (AEAD) **Also tested on:** > Device: TP-Link Archer C7 v2 (Architecture: MIPS 74Kc / ath79) > OpenWrt SNAPSHOT r33075-20644af030 > DCO Module: kmod-ovpn-dco-v2-6.12.69.0.2.20250801-r1 = 6.12.69.0.2.20250801-r1 (ovpn_dco_v2 loaded) > Cipher: CHACHA20-POLY1305 (AEAD)
关闭于 2026-02-17 16 条评论