worker: use TLS 1.3 transparent rekey on TLS 1.3 CSTP sessions

TLS 1.3 has no renegotiation and provides transparent rekeys but this
was not used by the server. Instead rekey-method=ssl was silently
downgraded to new-tunnel, causing a full tunnel/TUN-device rebuild (and
a brief data-path interruption) on every rekey whenever a client
negotiated TLS 1.3.

This commit simplifies that handling by taking advantage of TLS 1.3's own
rekey mechanism instead: the server now performs the "ssl" rekey on
TLS 1.3 sessions via the standard TLS 1.3 KeyUpdate message.

TLS <= 1.2 rekey behavior (client-driven rehandshake, gated on RFC
5746 safe renegotiation) is unchanged.

Resolves: #745

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

tests/data/rekey-tls12.config

@@ -0,0 +1,54 @@
+auth = "plain[@SRCDIR@/data/test1.passwd]"
+
+# Forced off (not @ISOLATE_WORKERS@): this test asserts on worker-emitted
+# log lines, which only reliably reach the captured server output when
+# worker isolation is off.
+isolate-workers = false
+
+occtl-socket-file = @OCCTL_SOCKET@
+use-occtl = true
+
+use-dbus = no
+
+max-clients = 16
+max-same-clients = 2
+
+tcp-port = @PORT@
+udp-port = @PORT@
+
+keepalive = 32400
+dpd = 440
+try-mtu-discovery = false
+
+server-cert = @SRCDIR@/certs/server-cert.pem
+server-key = @SRCDIR@/certs/server-key.pem
+
+# Force TLS 1.2 on the control channel, so the "ssl" rekey-method must
+# keep using the pre-existing in-place TLS <= 1.2 rehandshake path, not
+# the transparent TLS 1.3 KeyUpdate path.
+tls-priorities = "NORMAL:-VERS-ALL:+VERS-TLS1.2:%SERVER_PRECEDENCE:%COMPAT"
+
+auth-timeout = 40
+cookie-timeout = 30
+
+use-utmp = true
+pid-file = /var/run/ocserv.pid
+socket-file = /var/run/ocserv-socket
+
+run-as-user = nobody
+run-as-group = daemon
+
+device = vpns
+default-domain = example.com
+
+ipv4-network = @VPNNET@
+
+ping-leases = false
+
+sec-mod-scale = 6
+
+idle-timeout = 0
+mobile-idle-timeout = 0
+
+rekey-time = 20
+rekey-method = ssl

tests/data/rekey-tls13.config

@@ -0,0 +1,54 @@
+auth = "plain[@SRCDIR@/data/test1.passwd]"
+
+# Forced off (not @ISOLATE_WORKERS@): this test asserts on worker-emitted
+# log lines, which only reliably reach the captured server output when
+# worker isolation is off.
+isolate-workers = false
+
+occtl-socket-file = @OCCTL_SOCKET@
+use-occtl = true
+
+use-dbus = no
+
+max-clients = 16
+max-same-clients = 2
+
+tcp-port = @PORT@
+udp-port = @PORT@
+
+keepalive = 32400
+dpd = 440
+try-mtu-discovery = false
+
+server-cert = @SRCDIR@/certs/server-cert.pem
+server-key = @SRCDIR@/certs/server-key.pem
+
+# Force TLS 1.3 on the control channel, so the "ssl" rekey-method must
+# use the transparent TLS 1.3 KeyUpdate path rather than an in-place
+# TLS <= 1.2 rehandshake.
+tls-priorities = "NORMAL:-VERS-ALL:+VERS-TLS1.3:%SERVER_PRECEDENCE:%COMPAT"
+
+auth-timeout = 40
+cookie-timeout = 30
+
+use-utmp = true
+pid-file = /var/run/ocserv.pid
+socket-file = /var/run/ocserv-socket
+
+run-as-user = nobody
+run-as-group = daemon
+
+device = vpns
+default-domain = example.com
+
+ipv4-network = @VPNNET@
+
+ping-leases = false
+
+sec-mod-scale = 6
+
+idle-timeout = 0
+mobile-idle-timeout = 0
+
+rekey-time = 20
+rekey-method = ssl

tests/meson.build

@@ -298,6 +298,7 @@ if get_option('root-tests')
     'test-occtl', 'test-occtl-commands', 'no-ipv6-ocv3',
     'test-config-per-group', 'test-config-per-group-url-pass',
     'test-config-per-group-url-cert', 'test-multiple-client-ip',
+    'test-rekey-tls13', 'test-rekey-tls12',
   ]
 
   foreach s : root_scripts

tests/test-rekey-tls12

@@ -0,0 +1,103 @@
+#!/bin/bash
+#
+# Copyright (C) 2026 Nikos Mavrogiannopoulos
+#
+# This file is part of ocserv.
+#
+# ocserv is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by the
+# Free Software Foundation; either version 2 of the License, or (at
+# your option) any later version.
+#
+# ocserv is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with GnuTLS; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+#
+# Companion negative case for test-rekey-tls13: with rekey-method = ssl
+# and a CSTP session negotiated at TLS 1.2, the transparent TLS 1.3
+# KeyUpdate path introduced for REQ-PROTO-CTRL-001 must not engage --
+# the legacy client-driven in-place rehandshake keeps working unchanged,
+# and no TLS 1.3 key update is ever logged.
+
+OCCTL="${OCCTL:-../src/occtl/occtl}"
+SERV="${SERV:-../src/ocserv}"
+srcdir=${srcdir:-.}
+OCCTL_SOCKET=./occtl-rekey-tls12-$$.socket
+PIDFILE=ocserv-pid.$$.tmp
+CPIDFILE=openpid.$$.tmp
+OUTFILE=rekey-tls12.$$.tmp
+
+function finish {
+  echo " * Cleaning up..."
+  CLIPID=${CPIDFILE} cleanup_client_server
+  test -n "${OUTFILE}" && rm -f ${OUTFILE} >/dev/null 2>&1
+}
+trap finish EXIT
+
+. `dirname $0`/random-net.sh
+. `dirname $0`/common.sh
+. `dirname $0`/ns.sh
+
+eval "${GETPORT}"
+
+update_config rekey-tls12.config
+${CMDNS2} ${SERV} -p ${PIDFILE} -f -c ${CONFIG} -d 3 >${OUTFILE} 2>&1 & PID=$!
+
+sleep 5
+
+echo "Testing TLS 1.2 rekey is unaffected (rekey-method = ssl, TLS 1.2 forced)... "
+echo "Connecting to obtain cookie... "
+eval `echo "test" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=`
+
+if [ -z "$COOKIE" ]; then
+	cat ${OUTFILE}
+	fail $PID "Could not obtain cookie"
+fi
+
+sleep 1
+echo "Connecting with cookie... "
+${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --no-dtls --background --pid-file "${CPIDFILE}"
+
+sleep 4
+
+if [ ! -f "${CPIDFILE}" ]; then
+	cat ${OUTFILE}
+	fail $PID "It was not possible to establish session!"
+fi
+
+set -e
+${CMDNS1} ping -c 3 ${VPNADDR}
+set +e
+
+echo "Waiting across two rekey-time (20s) intervals... "
+sleep 50
+
+echo "Confirming the tunnel is still usable after the rekey window... "
+set -e
+${CMDNS1} ping -c 3 ${VPNADDR}
+set +e
+
+tun_count=$(grep -c "assigning tun device" ${OUTFILE})
+if [ "${tun_count}" != "1" ]; then
+	cat ${OUTFILE}
+	fail $PID "FAIL: expected exactly 1 tun device assignment (no tunnel rebuild), got ${tun_count}"
+fi
+
+if grep -q "TLS 1.3 session keys refreshed" ${OUTFILE}; then
+	cat ${OUTFILE}
+	fail $PID "FAIL: did not expect a TLS 1.3 key update on a TLS 1.2 session"
+fi
+
+if ! grep -q "TLS rehandshake completed" ${OUTFILE}; then
+	cat ${OUTFILE}
+	fail $PID "FAIL: expected the legacy TLS rehandshake to complete, found none"
+fi
+
+echo "ok"
+
+exit 0

tests/test-rekey-tls13

@@ -0,0 +1,104 @@
+#!/bin/bash
+#
+# Copyright (C) 2026 Nikos Mavrogiannopoulos
+#
+# This file is part of ocserv.
+#
+# ocserv is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by the
+# Free Software Foundation; either version 2 of the License, or (at
+# your option) any later version.
+#
+# ocserv is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with GnuTLS; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+#
+# Verifies REQ-PROTO-CTRL-001: with rekey-method = ssl and a CSTP session
+# negotiated at TLS 1.3, the periodic rekey is performed transparently via
+# the standard TLS 1.3 KeyUpdate message (gnutls_session_key_update()),
+# without any tunnel/TUN-device rebuild. See test-rekey-tls12 for the
+# companion negative case (TLS 1.2, unaffected by this change). The two
+# cases are kept in separate scripts, each with its own network namespace
+# and single connect/disconnect cycle, rather than two VPN sessions in one
+# script/namespace -- the latter was observed to occasionally leave the
+# client namespace's routing in a state where the second session's TCP
+# connect fails with ENETUNREACH, unrelated to the server-side behavior
+# under test.
+
+OCCTL="${OCCTL:-../src/occtl/occtl}"
+SERV="${SERV:-../src/ocserv}"
+srcdir=${srcdir:-.}
+OCCTL_SOCKET=./occtl-rekey-tls13-$$.socket
+PIDFILE=ocserv-pid.$$.tmp
+CPIDFILE=openpid.$$.tmp
+OUTFILE=rekey-tls13.$$.tmp
+
+function finish {
+  echo " * Cleaning up..."
+  CLIPID=${CPIDFILE} cleanup_client_server
+  test -n "${OUTFILE}" && rm -f ${OUTFILE} >/dev/null 2>&1
+}
+trap finish EXIT
+
+. `dirname $0`/random-net.sh
+. `dirname $0`/common.sh
+. `dirname $0`/ns.sh
+
+eval "${GETPORT}"
+
+update_config rekey-tls13.config
+${CMDNS2} ${SERV} -p ${PIDFILE} -f -c ${CONFIG} -d 3 >${OUTFILE} 2>&1 & PID=$!
+
+sleep 5
+
+echo "Testing transparent TLS 1.3 rekey (rekey-method = ssl, TLS 1.3 forced)... "
+echo "Connecting to obtain cookie... "
+eval `echo "test" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=`
+
+if [ -z "$COOKIE" ]; then
+	cat ${OUTFILE}
+	fail $PID "Could not obtain cookie"
+fi
+
+sleep 1
+echo "Connecting with cookie... "
+${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --no-dtls --background --pid-file "${CPIDFILE}"
+
+sleep 4
+
+if [ ! -f "${CPIDFILE}" ]; then
+	cat ${OUTFILE}
+	fail $PID "It was not possible to establish session!"
+fi
+
+set -e
+${CMDNS1} ping -c 3 ${VPNADDR}
+set +e
+
+echo "Waiting across two rekey-time (20s) intervals... "
+sleep 50
+
+echo "Confirming the tunnel is still usable after the rekey window... "
+set -e
+${CMDNS1} ping -c 3 ${VPNADDR}
+set +e
+
+tun_count=$(grep -c "assigning tun device" ${OUTFILE})
+if [ "${tun_count}" != "1" ]; then
+	cat ${OUTFILE}
+	fail $PID "FAIL: expected exactly 1 tun device assignment (no tunnel rebuild), got ${tun_count}"
+fi
+
+if ! grep -q "TLS 1.3 session keys refreshed" ${OUTFILE}; then
+	cat ${OUTFILE}
+	fail $PID "FAIL: expected a transparent TLS 1.3 key update to be logged, found none"
+fi
+
+echo "ok"
+
+exit 0