From: Arne Schwabe Date: Wed, 29 Jul 2026 06:41:52 +0000 (+0200) Subject: Correctly calculate packet id size when epoch packet format is in use X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=HEAD;p=thirdparty%2Fopenvpn.git Correctly calculate packet id size when epoch packet format is in use The code assumed that always when tls mode (without CFB/OFB) is in use that the packet size is 4 bytes. With epoch packet format is incorrect as that uses 64 bit. Even thought packet_id_long_form has a the same size (8 byte) it is not the same header format (32 bit time + 32 bit IV) as the epoch format (16 bit epoch + 48 IV). Use a simple sizeof(uint64_t) to avoid suggesting that it might be the same. Github: closes OpenVPN/openvpn#1074 Change-Id: I5b862eabe032eb4d2229ff5b2f4f6af7406f6f4e Signed-off-by: Arne Schwabe Acked-by: Antonio Quartulli Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1829 Message-Id: <20260729064158.15731-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg37983.html Signed-off-by: Gert Doering --- diff --git a/src/openvpn/mtu.c b/src/openvpn/mtu.c index e5db8ab13..f3c287487 100644 --- a/src/openvpn/mtu.c +++ b/src/openvpn/mtu.c @@ -35,6 +35,7 @@ #include "crypto.h" #include "memdbg.h" +#include "ssl_common.h" /* allocate a buffer for socket or tun layer */ void @@ -51,6 +52,13 @@ unsigned int calc_packet_id_size_dc(const struct options *options, const struct key_type *kt) { bool tlsmode = options->tls_server || options->tls_client; + bool epoch = options->imported_protocol_flags & CO_EPOCH_DATA_KEY_FORMAT; + + /* epoch format uses a 64-bit packet id: 16 bit epoch + 48 bit per-epoch counter */ + if (epoch) + { + return sizeof(uint64_t); + } bool packet_id_long_form = !tlsmode || cipher_kt_mode_ofb_cfb(kt->cipher);