feat(openvpn): TLS rekey fix, data-ciphers negotiation, tls-crypt-v2 - #2989
Merged
Conversation
Three core fixes for the OpenVPN client: 1. TLS rekey renegotiation (critical): Fixed fatal bug where watchControl() terminated the connection on soft reset instead of performing TLS renegotiation. OpenVPN servers rekey every ~1h by default, causing all connections to die after that period. - control.go: SendSoftReset (toggles keyID, resets counters) - control.go: classifyWatchPacketLocked accepts alternating keyIDs - client.go: doKeyExchange extracted for reuse in rekey - client.go: dataLock (RWMutex) for atomic DataChannel swap - client.go: tls.Config RenegotiateFreelyAsClient 2. data-ciphers negotiation + fallback: Client advertises IV_CIPHERS list, negotiates cipher from server-pushed list intersection. - config.go: DataCiphers + FallbackCipher + NegotiateCipher() - keymethod.go: InstallScriptPeerInfo sends IV_CIPHERS list - push.go: Parse data-ciphers/ncp-ciphers/cipher push options - client.go: doKeyExchange negotiates cipher, derives at max length 3. tls-crypt-v2: Real OpenVPN V3/WKC protocol. - tlscrypt_v2.go: Single client PEM (256B key + wrapped key) - control.go: V3 opcode + wrapped key appended to initial packet - config.go: TLSCryptV2 field + PEM decoding + mutual exclusion Tests: 61/61 pass
…rence during rekey ReadIPPacket previously grabbed c.data before calling ReadDataPacket, which can block for a long time. If a rekey swapped c.data during that window, the packet would be decrypted with a stale DataChannel and silently dropped.
kuno
pushed a commit
to kuno/mihomo
that referenced
this pull request
Aug 12, 2026
Collaborator
|
It looks like this PR of yours has caused a new regression: |
Author
|
… ________________________________
From: wwqgtxx ***@***.***>
Sent: Thursday, 13 August 2026 15:54:19
To: MetaCubeX/mihomo ***@***.***>
Cc: Lanlan13-14 ***@***.***>; Author ***@***.***>
Subject: Re: [MetaCubeX/mihomo] feat(openvpn): TLS rekey fix, data-ciphers negotiation, tls-crypt-v2 (PR #2989)
[https://avatars.githubusercontent.com/u/582584?s=20&v=4]wwqgtxx left a comment (MetaCubeX/mihomo#2989)<#2989 (comment)>
It looks like this PR of yours has caused a new regression:
#3085<#3085>
—
Reply to this email directly, view it on GitHub<#2989?email_source=notifications&email_token=BJT6SIPL3WNG2ZCED3654IL5JVX2XA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMRXG42TSOJWG4YKM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L#issuecomment-5277599670>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/BJT6SINGIKSNJ26BDOFQEID5JVX2XAVCNFSNUABFKJSXA33TNF2G64TZHMZTMOJRG44DSMZVHNEXG43VMU5TIOJRGYYDQMBWGYY2C5QC>.
You are receiving this because you authored the thread.Message ID: ***@***.***>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three fixes for the OpenVPN client:
TLS rekey: the previous code closed the connection when receiving a soft reset from the server instead of renegotiating. This caused connections to drop on every rekey cycle (default 1h). The client now performs TLS renegotiation, re-exchanges key material, and swaps the data channel atomically.
data-ciphers negotiation: the client now advertises an IV_CIPHERS list and negotiates the data cipher from the server's pushed cipher list. Supports data-ciphers-fallback for servers without negotiation.
tls-crypt-v2: implements the V3/WKC handshake using a client PEM containing 256 bytes of key material plus a wrapped client key, sent with P_CONTROL_HARD_RESET_CLIENT_V3.
Tested against a real OpenVPN server. 61 unit tests pass.