[Openvpn-users] TLS Error: local/remote TLS keys are out of sync

Discussion:

Steve Shellswell

2004-11-25 10:22:05 UTC

Hi,

Please forgive ignorance.

When I start the client end manually I get this message.

Does anybody know what keys being out of sync means? Is there some
webpage I should read about this?

Many thanks in advance

Steve

Steve Shellswell

2004-12-01 06:33:07 UTC

Permalink

Hi all,

I am still struggling with this. Please can anyone shed any light on the
error message?

TLS Error: local/remote TLS keys are out of sync: 1.2.3.4:1194 [0]

It is even an openssl error and not openvpn?

I apologise if this has been covered before but I searched the group and
didn't find it... Google doesn't tell me much...

Sorry to bother you all again...

Steve

Charles Duffy

2004-12-01 07:02:00 UTC

Permalink

Post by Steve Shellswell
I am still struggling with this. Please can anyone shed any light on the
error message?
TLS Error: local/remote TLS keys are out of sync: 1.2.3.4:1194 [0]

I don't know the error, but the code that would result in the different
(desired) path being taken follows:

if (DECRYPT_KEY_ENABLED (multi, ks)
&& key_id == ks->key_id
&& ks->authenticated
&& addr_port_match(from, &ks->remote_addr))

so... DECRYPT_KEY_ENABLED could be false, the key_id values could fail to
match, the key_state (ks) could be unauthenticated, or we could have no
remote address match.

Without more context (and better knowledge of the surrounding codebase),
I'm not in a good condition to make suggesions wrt which is most likely.
So, let's back up:

This happens every time, immediately after startup -- right?

How did you generate your CA/key/cert? You're using the same CA on both
ends, right? Any other errorlike messages in your output?

Mind posting your config files?

Steve Shellswell

2004-12-01 07:29:03 UTC

Permalink

Post by Charles Duffy

Post by Steve Shellswell
I am still struggling with this. Please can anyone shed any light on the
error message?
TLS Error: local/remote TLS keys are out of sync: 1.2.3.4:1194 [0]

I don't know the error, but the code that would result in the different
if (DECRYPT_KEY_ENABLED (multi, ks)
&& key_id == ks->key_id
&& ks->authenticated
&& addr_port_match(from, &ks->remote_addr))
so... DECRYPT_KEY_ENABLED could be false, the key_id values could fail to
match, the key_state (ks) could be unauthenticated, or we could have no
remote address match.
Without more context (and better knowledge of the surrounding codebase),
I'm not in a good condition to make suggesions wrt which is most likely.
This happens every time, immediately after startup -- right?

No. Just sometimes. I first noticed it after I had started and stopped
the client end several times in relatively quick succession. This is the
output from starting openvpn manually...

-----------------------------------------------------------

Thu Nov 25 10:30:55 2004 us=161333 Current Parameter Settings:
Thu Nov 25 10:30:55 2004 us=161452 config = 'config.ovpn'
Thu Nov 25 10:30:55 2004 us=161502 mode = 0
Thu Nov 25 10:30:55 2004 us=161544 show_ciphers = DISABLED
Thu Nov 25 10:30:55 2004 us=161582 show_digests = DISABLED
Thu Nov 25 10:30:55 2004 us=161619 show_engines = DISABLED
Thu Nov 25 10:30:55 2004 us=161656 genkey = DISABLED
Thu Nov 25 10:30:55 2004 us=161693 key_pass_file = '[UNDEF]'
Thu Nov 25 10:30:55 2004 us=161731 show_tls_ciphers = DISABLED
Thu Nov 25 10:30:55 2004 us=161794 proto = 0
Thu Nov 25 10:30:55 2004 us=161835 NOTE: --mute triggered...
Thu Nov 25 10:30:55 2004 us=161977 173 variation(s) on previous 10
message(s) suppressed by --mute
Thu Nov 25 10:30:55 2004 us=161992 OpenVPN 2.0_beta15 Win32-MinGW [SSL]
[LZO] built on Oct 28 2004
Thu Nov 25 10:30:55 2004 us=165986 LZO compression initialized
Thu Nov 25 10:30:55 2004 us=166131 Control Channel MTU parms [ L:1574
D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu Nov 25 10:30:55 2004 us=182889 Data Channel MTU parms [ L:1574
D:1450 EF:42 EB:19 ET:32 EL:0 ]
Thu Nov 25 10:30:55 2004 us=182970 Local Options String: 'V4,dev-type
tap,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,cipher BF-CBC,auth
SHA1,keysize 128,key-method 2,tls-client'
Thu Nov 25 10:30:55 2004 us=182988 Expected Remote Options String:
'V4,dev-type tap,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,cipher
BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Thu Nov 25 10:30:55 2004 us=183020 Local Options hash (VER=V4): 'd79ca330'
Thu Nov 25 10:30:55 2004 us=183042 Expected Remote Options hash
(VER=V4): 'f7df56b8'
Thu Nov 25 10:30:55 2004 us=183091 Socket Buffers: R=[8192->8192]
S=[8192->8192]
Thu Nov 25 10:30:55 2004 us=183117 UDPv4 link local (bound): [undef]:900
Thu Nov 25 10:30:55 2004 us=183133 UDPv4 link remote: 1.2.3.4:900
Thu Nov 25 10:30:55 2004 us=602337 TLS Error: local/remote TLS keys are
out of sync: 1.2.3.4:900 [0]
Thu Nov 25 10:31:06 2004 us=398701 TLS Error: local/remote TLS keys are
out of sync: 1.2.3.4:900 [0]
Thu Nov 25 10:31:11 2004 us=304750 TLS Error: local/remote TLS keys are
out of sync: 1.2.3.4:900 [0]
Thu Nov 25 10:31:21 2004 us=413660 TLS Error: local/remote TLS keys are
out of sync: 1.2.3.4:900 [0]

------------------------------------------------------------

Post by Charles Duffy
How did you generate your CA/key/cert?

Following the instructions on the howto page.

You're using the same CA on both

Post by Charles Duffy
ends, right?

Yep, CA on the server.

Any other errorlike messages in your output?

Post by Charles Duffy
Mind posting your config files?

Client end (windows XP) config file:

---------------------------------------------------------------

remote 1.2.3.4

port 900

proto udp

dev tap

tls-client
ca cacert.pem
cert cert.pem
key key.pem

resolv-retry 86400

up-delay

ping 10
ping-restart 300

comp-lzo

verb 4
mute 10

----------------------------------------------------------------

Server End config file (debian):

----------------------------------------------------------------

port 900
mode server
proto udp

tls-server
dh ../ssl/dh1024.pem
ca ../ssl/cacert.pem
cert ovpncert.pem
key ovpnkey.pem
key-method 2

user nobody
group nogroup
persist-key

ping 10
comp-lzo
client-config-dir /etc/openvpn/clients

verb 4
mute 10
up /etc/local/sbin/tapup

dev tap
persist-tun

----------------------------------------------------------------

Post by Charles Duffy
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/

Steve Shellswell

2004-12-01 07:38:01 UTC

Permalink

BTW: Just to clarify, the port that the error message reads is 900, not
1194.

When I changed the ip address I changed the port aswell.

Thanks for this.

Steve

Post by Steve Shellswell

Post by Charles Duffy

Post by Steve Shellswell
I am still struggling with this. Please can anyone shed any light on
the error message?
TLS Error: local/remote TLS keys are out of sync: 1.2.3.4:1194 [0]

No. Just sometimes. I first noticed it after I had started and stopped
the client end several times in relatively quick succession. This is the
output from starting openvpn manually...
-----------------------------------------------------------
Thu Nov 25 10:30:55 2004 us=161452 config = 'config.ovpn'
Thu Nov 25 10:30:55 2004 us=161502 mode = 0
Thu Nov 25 10:30:55 2004 us=161544 show_ciphers = DISABLED
Thu Nov 25 10:30:55 2004 us=161582 show_digests = DISABLED
Thu Nov 25 10:30:55 2004 us=161619 show_engines = DISABLED
Thu Nov 25 10:30:55 2004 us=161656 genkey = DISABLED
Thu Nov 25 10:30:55 2004 us=161693 key_pass_file = '[UNDEF]'
Thu Nov 25 10:30:55 2004 us=161731 show_tls_ciphers = DISABLED
Thu Nov 25 10:30:55 2004 us=161794 proto = 0
Thu Nov 25 10:30:55 2004 us=161835 NOTE: --mute triggered...
Thu Nov 25 10:30:55 2004 us=161977 173 variation(s) on previous 10
message(s) suppressed by --mute
Thu Nov 25 10:30:55 2004 us=161992 OpenVPN 2.0_beta15 Win32-MinGW [SSL]
[LZO] built on Oct 28 2004
Thu Nov 25 10:30:55 2004 us=165986 LZO compression initialized
Thu Nov 25 10:30:55 2004 us=166131 Control Channel MTU parms [ L:1574
D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu Nov 25 10:30:55 2004 us=182889 Data Channel MTU parms [ L:1574
D:1450 EF:42 EB:19 ET:32 EL:0 ]
Thu Nov 25 10:30:55 2004 us=182970 Local Options String: 'V4,dev-type
tap,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,cipher BF-CBC,auth
SHA1,keysize 128,key-method 2,tls-client'
'V4,dev-type tap,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,cipher
BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Thu Nov 25 10:30:55 2004 us=183020 Local Options hash (VER=V4): 'd79ca330'
Thu Nov 25 10:30:55 2004 us=183042 Expected Remote Options hash
(VER=V4): 'f7df56b8'
Thu Nov 25 10:30:55 2004 us=183091 Socket Buffers: R=[8192->8192]
S=[8192->8192]
Thu Nov 25 10:30:55 2004 us=183117 UDPv4 link local (bound): [undef]:900
Thu Nov 25 10:30:55 2004 us=183133 UDPv4 link remote: 1.2.3.4:900
Thu Nov 25 10:30:55 2004 us=602337 TLS Error: local/remote TLS keys are
out of sync: 1.2.3.4:900 [0]
Thu Nov 25 10:31:06 2004 us=398701 TLS Error: local/remote TLS keys are
out of sync: 1.2.3.4:900 [0]
Thu Nov 25 10:31:11 2004 us=304750 TLS Error: local/remote TLS keys are
out of sync: 1.2.3.4:900 [0]
Thu Nov 25 10:31:21 2004 us=413660 TLS Error: local/remote TLS keys are
out of sync: 1.2.3.4:900 [0]
------------------------------------------------------------

Post by Charles Duffy
How did you generate your CA/key/cert?

Following the instructions on the howto page.
You're using the same CA on both

Post by Charles Duffy
ends, right?

Yep, CA on the server.
Any other errorlike messages in your output?

Post by Charles Duffy
Mind posting your config files?

---------------------------------------------------------------
remote 1.2.3.4
port 900
proto udp
dev tap
tls-client
ca cacert.pem
cert cert.pem
key key.pem
resolv-retry 86400
up-delay
ping 10
ping-restart 300
comp-lzo
verb 4
mute 10
----------------------------------------------------------------
----------------------------------------------------------------
port 900
mode server
proto udp
tls-server
dh ../ssl/dh1024.pem
ca ../ssl/cacert.pem
cert ovpncert.pem
key ovpnkey.pem
key-method 2
user nobody
group nogroup
persist-key
ping 10
comp-lzo
client-config-dir /etc/openvpn/clients
verb 4
mute 10
up /etc/local/sbin/tapup
dev tap
persist-tun
----------------------------------------------------------------

-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/

Charles Duffy

2004-12-01 07:49:09 UTC

Permalink

Post by Steve Shellswell

Post by Charles Duffy
This happens every time, immediately after startup -- right?

No. Just sometimes. I first noticed it after I had started and stopped
the client end several times in relatively quick succession. This is the
output from starting openvpn manually...

Hmm. This is *really* looking like a problem for James.

One thing I'm still a touch unclear on: Does this only happen immediately
after startup, or can it happen later on? (You might want specify
--reneg-sec 30 or somesuch during debugging).

James Yonan

2004-12-01 15:09:02 UTC

Permalink

Post by Charles Duffy

Post by Steve Shellswell

Post by Charles Duffy
This happens every time, immediately after startup -- right?

No. Just sometimes. I first noticed it after I had started and stopped
the client end several times in relatively quick succession. This is the
output from starting openvpn manually...

Hmm. This is *really* looking like a problem for James.
One thing I'm still a touch unclear on: Does this only happen immediately
after startup, or can it happen later on? (You might want specify
--reneg-sec 30 or somesuch during debugging).

This message can occur when running OpenVPN in UDP mode, as UDP is
not connection-oriented, so there's no easy way for one side of the
connection to know that the other side has gone down or restarted. This
error will almost never occur when running in TCP mode, because TCP
enforces solid client/server semantics and connection-reset when either
side of the connection goes down.

Suppose you have a UDP OpenVPN connection between "Client" and "Server".
If Client is restarted, because it is a client, it will renegotiate new
TLS keys with the server, and the keys will immediately be in sync.
However if the Server is restarted, it will not know that it must force a
key renegotiation with a previously connected client because servers don't
initiate connections, they wait for them to be initiated by clients.

The current solution uses ping/ping-restart or keepalive which will cause
the client to renegotiate with the server if the server is restarted after
a specified period of silence without any ping messages coming from the
server. The disadvantage of this approach is that it is not immediate.
If the server goes down, it may take a minute or more for clients to
recognize this and renegotiate new keys with the restarted server. You
can reduce the time-lag by using a small ping-restart value, but then you
may restart based on "false posititve" triggers such as short-term network
outages which last less that 60 seconds.

There are other possible solutions, such as adding control info to the UDP
channel which is similar to the mechanism used by TCP to immediately
signal connection reset to OpenVPN if the other side of the connection
goes down. This has been discussed but will probably not see
implementation until post 2.0.

So to answer your question, if you get the "local/remote TLS keys are out
of sync" message and then shortly thereafter, both sides of the connection
reconnect and the VPN link successfully comes back up, then OpenVPN is
operating normally.

If you continue to get "out of sync" errors and the link does not come up,
then it means that something is probably wrong with your config file. You
must use either ping and ping-restart on both sides of the connection, or
keepalive on the server side of a client/server connection, in order to
gracefully recover from "local/remote TLS keys are out
of sync" errors.

James

James Yonan

2004-12-01 15:24:01 UTC

Permalink

Post by Charles Duffy

Post by Steve Shellswell
I am still struggling with this. Please can anyone shed any light on the
error message?
TLS Error: local/remote TLS keys are out of sync: 1.2.3.4:1194 [0]

I don't know the error, but the code that would result in the different
if (DECRYPT_KEY_ENABLED (multi, ks)
&& key_id == ks->key_id
&& ks->authenticated
&& addr_port_match(from, &ks->remote_addr))

This is the basic test of TLS state compatibility between a local OpenVPN
instance and its remote peer.

If the test fails, it tells us that we are getting a packet from a source
which claims reference to a prior negotiated TLS session, but the local
OpenVPN instance has no memory of such a negotiation.

It almost always occurs on UDP sessions when the passive side of the
connection is restarted without the active side restarting as well (The
passive side is the server which only listens for the connections, the
active side is the client which initiates connections).

James

Alex Filonov

2004-12-01 14:11:08 UTC

Permalink

Post by Steve Shellswell
When I start the client end manually I get this message.
Does anybody know what keys being out of sync means? Is there some

I had the same problem with Openvpn 2.0beta15. Upgrading to 20.beta18 fixed the
problem.

HTH.

Alex.