[TEST-ONLY] Mess with internal logic to test epoch data

This rotates/invalidates keys extremely quickly and also jumps forward 1-8 keys instead of always one to test that part of the logic. Change-Id: I7cdf992eb6031315c4978c6a1fbbecfa723fca91 Signed-off-by: Arne Schwabe <[email protected]>
schwabe · Nov 10, 2024 · 6c79c7c · 6c79c7c
1 parent 8646fb9
commit 6c79c7c
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 3 deletions.
diff --git a/src/openvpn/crypto.c b/src/openvpn/crypto.c
@@ -354,6 +354,9 @@ openvpn_encrypt(struct buffer *buf, struct buffer work,
 int64_t
 cipher_get_aead_limits(const char *ciphername)
 {
+    /* TESTING: Make AEAD key limits really really really small to force
+     * key rollever super quickly */
+    return 256;
     if (!cipher_kt_mode_aead(ciphername))
     {
         return 0;

diff --git a/src/openvpn/crypto_epoch.c b/src/openvpn/crypto_epoch.c
@@ -405,8 +405,13 @@ epoch_check_send_iterate(struct crypto_options *opt)
         if (aead_usage_limit_reached(opt->aead_usage_limit, &opt->key_ctx_bi.encrypt,
                                      opt->packet_id.send.id))
         {
-            /* Send key limit reached */
-            epoch_iterate_send_key(opt);
+            int forward = rand() % 8 + 1;
+            /* Send key limit reached, go one key forward or in this TEST
+             * gremlin mode, 1 to 8 to test the other side future key stuff */
+            for (int i = 0; i < forward; i++)
+            {
+                epoch_iterate_send_key(opt);
+            }
         }
         /* draft 8 of the aead usage limit still had but draft 9 complete
          * dropped this statement:
@@ -428,7 +433,13 @@ epoch_check_send_iterate(struct crypto_options *opt)
             /* Receive key limit reached. Increase our own send key to signal
              * that we want to use a new epoch. Peer should then also move its
              * key but is not required to do this */
-            epoch_iterate_send_key(opt);
+            int forward = rand() % 8 + 1;
+            /* gremlin mode, 1 to 8 to test the other side future key stuff */
+            for (int i = 0; i < forward; i++)
+            {
+                epoch_iterate_send_key(opt);
+            }
+
         }
     }