Attention is currently required from: MaxF, flichtenheld, razvanc. plaisthos has posted comments on this change by plaisthos. ( http://gerrit.openvpn.net/c/openvpn/+/30?usp=email )
Change subject: Implement initial packet reflection protection using bloom filter ...................................................................... Patch Set 10: (15 comments) Commit Message: http://gerrit.openvpn.net/c/openvpn/+/30/comment/51354ed6_da206fb0?usp=email : PS10, Line 9: When an OpenVPN server is used/tried to be usedc in a reflection attack > "usedc" -> "used" Done http://gerrit.openvpn.net/c/openvpn/+/30/comment/c4176285_f52d1eb2?usp=email : PS10, Line 10: the protection with the simple --connect-freq-initial also block legimitate > "block" -> "blocks" […] Done http://gerrit.openvpn.net/c/openvpn/+/30/comment/31a33a1b_dd251071?usp=email : PS10, Line 11: client from other networks that are not attacked by a reflection attack. > "clients"? Acknowledged http://gerrit.openvpn.net/c/openvpn/+/30/comment/1064e1d2_8fd9df9d?usp=email : PS10, Line 18: As compromoise we use a bloom filter to store the information. This data > "compromoise" -> "compromise" (maybe "a compromise"?). Done http://gerrit.openvpn.net/c/openvpn/+/30/comment/0644e666_87c13371?usp=email : PS10, Line 26: easily be exchangable by another data structure. > "exchangeable" Done http://gerrit.openvpn.net/c/openvpn/+/30/comment/2eb11839_38014551?usp=email : PS10, Line 28: As hash funtion SIPHASH has been chosen since it was designed for this kind > "funtion" -> "function" Done File src/openvpn/Makefile.am: http://gerrit.openvpn.net/c/openvpn/+/30/comment/232c129e_bea81336?usp=email : PS8, Line 46: b > tabs vs spaces Done File src/openvpn/bloom.h: http://gerrit.openvpn.net/c/openvpn/+/30/comment/70f7a256_3942ad54?usp=email : PS8, Line 8: 2022 > Shouldn't this be 2024? Done http://gerrit.openvpn.net/c/openvpn/+/30/comment/0dc7e94f_62f4e08b?usp=email : PS8, Line 32: BLOOM_FILTER_BIT_COUNT > BITS Done File src/openvpn/bloom.c: http://gerrit.openvpn.net/c/openvpn/+/30/comment/83cdb58d_bc8545dd?usp=email : PS8, Line 101: /** : * Calculates the number of bytes we need for storing a bloom filter of size : * size. We add + 1 to avoid rounding problems and too small allocation */ : static inline : size_t : bloom_get_filter_byte_count(size_t size) : { : static_assert(sizeof(bloom_counter_t) * 8 % BLOOM_FILTER_BITS_COUNT == 0, : "bloom_counter_t must be a multiple of BLOOM_FILTER_BIT_COUNT"); : : return size * sizeof(bloom_counter_t)/BLOOM_FILTER_BITS_COUNT + 1; : } > I'm really confused by what size means here. […] Yeah. I also think that the calculation was wrong I fixed that. http://gerrit.openvpn.net/c/openvpn/+/30/comment/29bc0ff4_0b65c478?usp=email : PS8, Line 115: static inline : size_t : bloom_get_filter_bit_offset(size_t bucket) : { : return (bucket * BLOOM_FILTER_BITS_COUNT) % sizeof(bloom_counter_t); : } > If this is a bit offset, don't we need 8 * sizeof(bloom_counter_t) here? Done http://gerrit.openvpn.net/c/openvpn/+/30/comment/030c812c_7f88cbbc?usp=email : PS8, Line 122: static inline : size_t : bloom_get_filter_array_index(size_t bucket) : { : return (bucket * BLOOM_FILTER_BITS_COUNT) / sizeof(bloom_counter_t); : } > This seems wrong to me. Every bucket is 2 bits wide. […] You are correct. I forgot the translation of bloom_counter_t to bytes. http://gerrit.openvpn.net/c/openvpn/+/30/comment/08ce5d7d_01f2f7e0?usp=email : PS8, Line 172: > whitespace Done File src/openvpn/reflect_filter.c: http://gerrit.openvpn.net/c/openvpn/+/30/comment/6fa0024d_0c16878c?usp=email : PS8, Line 43: static bool : reflect_filter_rate_l > Remove empty line Done http://gerrit.openvpn.net/c/openvpn/+/30/comment/4f9db450_35e4dab3?usp=email : PS8, Line 116: /* we keep the count in the key instead of in the bloom filter table as : * can then keep the counter in the bloom filter itself small (2 bits) > ...as we can then... Done -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/30?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I0a9274cab7fefce3b13c05052fb9a072e0bfa6b9 Gerrit-Change-Number: 30 Gerrit-PatchSet: 10 Gerrit-Owner: plaisthos <[email protected]> Gerrit-Reviewer: MaxF <[email protected]> Gerrit-Reviewer: flichtenheld <[email protected]> Gerrit-CC: openvpn-devel <[email protected]> Gerrit-CC: razvanc <[email protected]> Gerrit-Attention: flichtenheld <[email protected]> Gerrit-Attention: razvanc <[email protected]> Gerrit-Attention: MaxF <[email protected]> Gerrit-Comment-Date: Tue, 15 Sep 2026 12:00:56 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: razvanc <[email protected]> Comment-In-Reply-To: MaxF <[email protected]>
_______________________________________________ Openvpn-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-devel
