[S] Change in openvpn[master]: Make required action returned from pre_decrypt_verdict more explicit

plaisthos has uploaded this change for review. ( http://gerrit.openvpn.net/c/openvpn/+/1826?usp=email )


Change subject: Make required action returned from pre_decrypt_verdict more explicit
......................................................................

Make required action returned from pre_decrypt_verdict more explicit

The current code relies on the condition if state.server_session_id
is defined to decided if session_skip_to_pre_start should be used.

Instead explicitly return the intent and use that to decide if
session_skip_to_pre_start should be called.

Change-Id: Iccdd4cfad090c565aac27e16cdaa9871106c2f89
---
M src/openvpn/mudp.c
1 file changed, 24 insertions(+), 12 deletions(-)



  git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/26/1826/1

diff --git a/src/openvpn/mudp.c b/src/openvpn/mudp.c
index 9658b18..abae066 100644
--- a/src/openvpn/mudp.c
+++ b/src/openvpn/mudp.c
@@ -73,9 +73,15 @@
     msg_set_prefix(NULL);
 }
 
+enum pre_decrypt_verdict
+{
+    PRE_DECRYPT_NO_ACTION,
+    PRE_DECRYPT_CREATE_SESSION,
+    PRE_DECRYPT_CREATE_SESSION_SKIP
+};
 
 /* Returns true if this packet should create a new session */
-static bool
+static enum pre_decrypt_verdict
 do_pre_decrypt_check(struct multi_context *m, struct tls_pre_decrypt_state *state,
                      struct mroute_addr addr, struct link_socket *sock)
 {
@@ -97,7 +103,7 @@
          * responses */
         if (!reflect_filter_rate_limit_check(m->initial_rate_limiter))
         {
-            return false;
+            return PRE_DECRYPT_NO_ACTION;
         }
     }
 
@@ -122,7 +128,7 @@
                 calculate_session_id_hmac(state->peer_session_id, from, hmac, handwindow, 0);
             send_hmac_reset_packet(m, state, tas, &sid, true, sock);
 
-            return false;
+            return PRE_DECRYPT_NO_ACTION;
         }
         else
         {
@@ -139,11 +145,11 @@
                     "ignoring connection attempt from old client (%s)",
                     peer);
                 gc_free(&gc);
-                return false;
+                return PRE_DECRYPT_NO_ACTION;
             }
             else
             {
-                return true;
+                return PRE_DECRYPT_CREATE_SESSION;
             }
         }
     }
@@ -156,7 +162,7 @@
         send_hmac_reset_packet(m, state, tas, &sid, false, sock);
 
         /* We have a reply do not create a new session */
-        return false;
+        return PRE_DECRYPT_NO_ACTION;
     }
     else if (verdict == VERDICT_VALID_CONTROL_V1 || verdict == VERDICT_VALID_ACK_V1
              || verdict == VERDICT_VALID_WKC_V1)
@@ -187,11 +193,11 @@
         }
         gc_free(&gc);
 
-        return ret;
+        return PRE_DECRYPT_CREATE_SESSION_SKIP;
     }
 
     /* VERDICT_INVALID */
-    return false;
+    return PRE_DECRYPT_NO_ACTION;
 }
 
 /**
@@ -217,8 +223,11 @@
             "MULTI: Connection attempt from %s ignored while server is "
             "shutting down",
             mroute_addr_print(real, &gc));
+        return NULL;
     }
-    else if (do_pre_decrypt_check(m, &state, *real, sock))
+    enum pre_decrypt_verdict verdict = do_pre_decrypt_check(m, &state, *real, sock);
+
+    if (verdict != PRE_DECRYPT_NO_ACTION)
     {
         /* This is an unknown session but with valid tls-auth/tls-crypt
          * (or no auth at all).  If this is the initial packet of a
@@ -243,13 +252,16 @@
 
                 /* If we have a session id already, ensure that the
                  * state is using the same */
-                if (session_id_defined(&state.server_session_id)
-                    && session_id_defined((&state.peer_session_id)))
+                if (session_id_defined((&state.peer_session_id)))
                 {
                     mi->context.c2.tls_multi->n_sessions++;
                     struct tls_session *session =
                         &mi->context.c2.tls_multi->session[TM_INITIAL];
-                    session_skip_to_pre_start(session, &state, &m->top.c2.from);
+
+                    if (verdict == PRE_DECRYPT_CREATE_SESSION_SKIP)
+                    {
+                        session_skip_to_pre_start(session, &state, &m->top.c2.from);
+                    }
                 }
             }
         }

-- 
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1826?usp=email
To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: newchange
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Iccdd4cfad090c565aac27e16cdaa9871106c2f89
Gerrit-Change-Number: 1826
Gerrit-PatchSet: 1
Gerrit-Owner: plaisthos <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>

_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel