From db45d988237dfcbb9f131fa1cd715750b439c865 Mon Sep 17 00:00:00 2001
From: Arne Schwabe <arne@openvpn.net>
Date: Mon, 23 Sep 2024 13:38:33 +0200
Subject: [PATCH] Disable data v3 implementation

The current data v3 implementation does not take into account
that GCM should only used a certain number of blocks.

Signed-off-by: Arne Schwabe <arne@openvpn.net>
---
 openvpn/ssl/proto.hpp | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/openvpn/ssl/proto.hpp b/openvpn/ssl/proto.hpp
index 42888275..fcbe93cd 100644
--- a/openvpn/ssl/proto.hpp
+++ b/openvpn/ssl/proto.hpp
@@ -1104,8 +1104,10 @@ class ProtoContext : public logging::LoggingMixin<OPENVPN_DEBUG_PROTO,
                                     | IV_PROTO_AUTH_FAIL_TEMP
                                     | IV_PROTO_PUSH_UPDATE;
 
-            if (proto_v3_support)
-                iv_proto |= IV_PROTO_DATA_V3;
+            /* Note, this is disabled until OpenVPN3 implements data v3 support
+             * with epoch key rotation */
+            /* if (proto_v3_support)
+                iv_proto |= IV_PROTO_DATA_V3; */
 
             if (CryptoAlgs::lookup("SHA256") != CryptoAlgs::NONE && CryptoAlgs::lookup("AES-256-CTR") != CryptoAlgs::NONE)
                 iv_proto |= IV_PROTO_DYN_TLS_CRYPT;