ovpn_nl_key_new_doit(9)

💅 ovpn_nl_key_new_doit(9) — the Kernel API Manual, bestie edition ✨

okay so real talk, this is a section 9 kernel API page, and the star of the show is ovpn_nl_key_new_doit. yes the name is a mouthful. no we're not renaming it. it's giving "my parents let my sibling name me" energy but she's iconic and she works 💖

---

🌸 NAME 🌸

ovpn_nl_key_new_doit — configure a new key for the specified peer 🔑

---

✨ SYNOPSIS ✨

int ovpn_nl_key_new_doit (struct sk_buff *skb , struct genl_info *info
);

---

🎀 ARGUMENTS 🎀

• skb — the incoming netlink message, literally the mail arriving in her inbox 📬
• info — the genetlink metadata, aka all the little deets about who sent what 🏷️

---

🦋 DESCRIPTION 🦋

so this function is the one that lets the user install a new key into the peer crypto state. and bestie, the setup? it's a two-slot situation. every peer has two 'slots' — namely 'primary' and 'secondary' — and that's where keys get installed 💅

the key chillin' in the 'primary' slot is the one used for encryption, while both keys can be used for decryption by matching the key ID carried in the incoming packet. yes, both. she's flexible like that 🌈

the user is responsible for rotating keys when necessary — no cap, that's on you, not the kernel. the user may fetch peer traffic statistics via netlink to better identify the right time to rotate keys. (traffic stats = the vibe check that tells you when it's time 👀)

the renegotiation follows these steps:

1. a new key is computed by the user and is installed in the 'secondary' slot
2. at user discretion (usually after a predetermined time) 'primary' and encryption, while the old key is kept around for decryption of late packets.

🫶 just a heads up, that numbered list is exactly how the original doc reads — step 2 sort of trails off mid-thought. we're preserving it character-for-character because that's the whole assignment, and honestly? she's mysterious. main character energy. iykyk 💀

---

⭐ RETURN ⭐

0 on success, or a negative error code otherwise. slay when it's zero, sad girl hours when it's negative 😭

---

👑 SEE ALSO 👑

kernel file ./drivers/net/ovpn/netlink.c — and the whole friend group:

• ovpn_get_dev_from_attrs(9)
• ovpn_nl_peer_modify(9)
• ovpn_nl_peer_del_notify(9)
• ovpn_nl_peer_float_notify(9)
• ovpn_nl_key_swap_notify(9)
• ovpn_nl_register(9)
• ovpn_nl_unregister(9)

---

that's the whole page, bestie 🍓 this little gem lives over at ./drivers/net/ovpn, and it's dated October 2026, page ovpn_nl_key_new_doit(9) — go forth and rotate those keys responsibly ✨💜🧚