From: Steffan Karger <stef...@karger.me>
P_DATA_V2 introduced the peer-id. This allows clients to float, but as a
side-effect 32-bit aligns the encrypted data. That alignment improves
performance particularly on cheaper/older CPUs. So although servers don't
actually have a peer-id, still use the V2 packet format (with a zero-id)
for server->client traffic too.
Signed-off-by: Steffan Karger <stef...@karger.me>
---
v2: actually enable P_DATA_V2... Now tested with:
2.4<>2.4 (V2), 2.4-srv<>2.3-clt (V2), 2.3-srv<>2.4-clt (V1),
2.4-srv<>2.2-clt (V1)
v3: move "use_peer_id = true" inside "if IV_PROTO >= 2" (thanks Gert)
src/openvpn/forward.c | 4 ++--
src/openvpn/push.c | 1 +
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/src/openvpn/forward.c b/src/openvpn/forward.c
index 1b7455b..a868a8f 100644
--- a/src/openvpn/forward.c
+++ b/src/openvpn/forward.c
@@ -496,7 +496,7 @@ encrypt_sign(struct context *c, bool comp_frag)
/* If using P_DATA_V2, prepend the 1-byte opcode and 3-byte peer-id to
the
* packet before openvpn_encrypt(), so we can authenticate the opcode
too.
*/
- if (c->c2.buf.len > 0 && !c->c2.tls_multi->opt.server &&
c->c2.tls_multi->use_peer_id)
+ if (c->c2.buf.len > 0 && c->c2.tls_multi->use_peer_id)
{
tls_prepend_opcode_v2(c->c2.tls_multi, &b->encrypt_buf);
}
@@ -512,7 +512,7 @@ encrypt_sign(struct context *c, bool comp_frag)
/* Do packet administration */
if (c->c2.tls_multi)
{
- if (c->c2.buf.len > 0 && (c->c2.tls_multi->opt.server ||
!c->c2.tls_multi->use_peer_id))
+ if (c->c2.buf.len > 0 && !c->c2.tls_multi->use_peer_id)
{
tls_prepend_opcode_v1(c->c2.tls_multi, &c->c2.buf);
}
diff --git a/src/openvpn/push.c b/src/openvpn/push.c
index 5947a31..e7aecbb 100644
--- a/src/openvpn/push.c
+++ b/src/openvpn/push.c
@@ -365,6 +365,7 @@ prepare_push_reply(struct context *c, struct gc_arena *gc,
{
push_option_fmt(gc, push_list, M_USAGE, "peer-id %d",
tls_multi->peer_id);
+ tls_multi->use_peer_id = true;
}
}
--
2.7.4
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Openvpn-devel mailing list
Openvpn-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
