[L] Change in openvpn[master]: oob: Add SERVER_PROBE parsing and the probe-reply decision

Attention is currently required from: flichtenheld, plaisthos.

stipa has posted comments on this change by stipa. ( http://gerrit.openvpn.net/c/openvpn/+/1742?usp=email )

Change subject: oob: Add SERVER_PROBE parsing and the probe-reply decision
......................................................................


Patch Set 9:

(2 comments)

File src/openvpn/oob.h:

http://gerrit.openvpn.net/c/openvpn/+/1742/comment/c9972fc4_8a4889bf?usp=email :
PS8, Line 161:  * skipped, so the scan tolerates additional/future TLVs. @p payload is consumed
> the scan?
Let's just leave "other than probe_parameters are skipped".


File src/openvpn/oob.c:

http://gerrit.openvpn.net/c/openvpn/+/1742/comment/1554b53d_267d712a?usp=email :
PS8, Line 226:     }
Is this needed for the clients with the wrong timestamp?

At the moment the window is picked as --hand-window which is 60s default. I would say the implementation is in accordance to the spec:

> Any OOB SERVER_PROBE MUST include this TLV. The timestamp allows a server to silently drop any request that is not in an acceptable window of time to reduce the attack surface for replay attacks.



-- 
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1742?usp=email
To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: comment
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Iafa9efc1c156974ad9f5752e9de810a8c2f68c30
Gerrit-Change-Number: 1742
Gerrit-PatchSet: 9
Gerrit-Owner: stipa <[email protected]>
Gerrit-Reviewer: flichtenheld <[email protected]>
Gerrit-Reviewer: plaisthos <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>
Gerrit-Attention: plaisthos <[email protected]>
Gerrit-Attention: flichtenheld <[email protected]>
Gerrit-Comment-Date: Tue, 28 Jul 2026 15:04:42 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: plaisthos <[email protected]>

_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel