[S] Change in openvpn[master]: Add check that username is identical to multi float
"plaisthos \(Code Review\) via Openvpn-devel" <[email protected]> Thu, 30 Jul 2026 12:03:44 +0000
| Newsgroups | gmane.network.openvpn.devel |
|---|---|
| Message-ID | <fa9497dd0f5154823fd28efebfb85bf95046b01a-EmailReplacePatchSet-HTML@gerrit.openvpn.net> |
--===============4560949590963043255==
Content-Transfer-Encoding: 8bit
Content-Disposition: inline
Content-Type: multipart/alternative; boundary="lhiiztUH7/k="; charset=UTF-8
--lhiiztUH7/k=
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Attention is currently required from: plaisthos=2E
Hello flichtenheld,
I=
'd like you to reexamine a change=2E Please visit
http://gerrit=2Eopen=
vpn=2Enet/c/openvpn/+/1724?usp=3Demail
to look at the new patch set (#15)=
=2E
The change is no longer submittable: checks~ChecksSubmitRule is unsati=
sfied now=2E
Change subject: Add check that username is identical to mult=
i float
=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=
=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=
=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E
Add =
check that username is identical to multi float
This adds an additional sa=
fe guard for setups that do not use
client certificates=2E
Change-Id: Ie55=
2084638320b3bace76be2f589013f12af3c46
Signed-off-by: Arne Schwabe <arne@rfc=
2549=2Eorg>
---
M src/openvpn/multi=2Ec
1 file changed, 13 insertions(+), 1=
deletion(-)
git pull ssh://gerrit=2Eopenvpn=2Enet:29418/openvpn refs/c=
hanges/24/1724/15
diff --git a/src/openvpn/multi=2Ec b/src/openvpn/multi=
=2Ec
index 9b64598=2E=2E0560ac5 100644
--- a/src/openvpn/multi=2Ec
+++ b/sr=
c/openvpn/multi=2Ec
@@ -3112,6 +3112,18 @@
goto done;
}
+ =
/* do not allow if target address has a different username */
+ if (m1=
->locked_username || m2->locked_username)
+ {
+ if (!m1->locked_u=
sername || !m2->locked_username
+ || strcmp(m1->locked_username,=
m2->locked_username) !=3D 0)
+ {
+ msg(D_MULTI_LOW, "Dis=
allow float to an address taken by another client %s",
+ mul=
ti_instance_string(ex_mi, false, &gc));
+ goto done;
+ }
=
+ }
+
/* It doesn't make sense to let a peer float to the address i=
t already
* has, so we disallow it=2E This can happen if a DCO netlin=
k notification
* gets lost and we miss a floating step=2E
@@ -3128,7 =
+3140,7 @@
msg(D_MULTI_LOW,
"closing instance %s due to flo=
at collision with %s "
- "using the same certificate",
+ "usi=
ng the same certificate and username",
multi_instance_string(ex_mi=
, false, &gc), multi_instance_string(mi, false, &gc));
multi_close_ins=
tance(m, ex_mi, false);
ret =3D true;
--
To view, visit http://gerri=
t=2Eopenvpn=2Enet/c/openvpn/+/1724?usp=3Demail
To unsubscribe, or for help =
writing mail filters, visit http://gerrit=2Eopenvpn=2Enet/settings?usp=3Dem=
ail
Gerrit-MessageType: newpatchset
Gerrit-Project: openvpn
Gerrit-Branch:=
master
Gerrit-Change-Id: Ie552084638320b3bace76be2f589013f12af3c46
Gerrit-=
Change-Number: 1724
Gerrit-PatchSet: 15
Gerrit-Owner: plaisthos <arne-openv=
pn@rfc2549=2Eorg>
Gerrit-Reviewer: flichtenheld <frank@lichtenheld=2Ecom>
G=
errit-CC: openvpn-devel <openvpn-devel@lists=2Esourceforge=2Enet>
Gerrit-At=
tention: plaisthos <arne-openvpn@rfc2549=2Eorg>
--lhiiztUH7/k=
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE html><html><head><style></style></head><body><p> Attention is cur=
rently required from: plaisthos=2E </p>
<p>plaisthos <strong>uploaded patch=
set #15</strong> to this change=2E</p><p><a href=3D"http://gerrit=2Eopenvp=
n=2Enet/c/openvpn/+/1724?usp=3Demail">View Change</a></p><p>The change is n=
o longer submittable: checks~ChecksSubmitRule is unsatisfied now=2E</p><pre=
class=3D"blocks" style=3D"font-family: monospace,monospace; white-space: p=
re-wrap;">Add check that username is identical to multi float<br><br>This a=
dds an additional safe guard for setups that do not use<br>client certifica=
tes=2E<br><br>Change-Id: Ie552084638320b3bace76be2f589013f12af3c46<br>Signe=
d-off-by: Arne Schwabe <arne@rfc2549=2Eorg><br>---<br>M src/openvpn/m=
ulti=2Ec<br>1 file changed, 13 insertions(+), 1 deletion(-)<br><br></pre><p=
re class=3D"blocks" style=3D"font-family: monospace,monospace; white-space:=
pre-wrap;">git pull ssh://gerrit=2Eopenvpn=2Enet:29418/openvpn refs/change=
s/24/1724/15</pre><pre style=3D"font-family: monospace,monospace; white-spa=
ce: pre-wrap;"><span>diff --git a/src/openvpn/multi=2Ec b/src/openvpn/multi=
=2Ec</span><br><span>index 9b64598=2E=2E0560ac5 100644</span><br><span>--- =
a/src/openvpn/multi=2Ec</span><br><span>+++ b/src/openvpn/multi=2Ec</span><=
br><span>@@ -3112,6 +3112,18 @@</span><br><span> goto done;</span><=
br><span> }</span><br><span> </span><br><span style=3D"color: hsl(120, =
100%, 40%);">+ /* do not allow if target address has a different usernam=
e */</span><br><span style=3D"color: hsl(120, 100%, 40%);">+ if (m1->=
locked_username || m2->locked_username)</span><br><span style=3D"color: =
hsl(120, 100%, 40%);">+ {</span><br><span style=3D"color: hsl(120, 100%,=
40%);">+ if (!m1->locked_username || !m2->locked_username</sp=
an><br><span style=3D"color: hsl(120, 100%, 40%);">+ || strcmp(m=
1->locked_username, m2->locked_username) !=3D 0)</span><br><span styl=
e=3D"color: hsl(120, 100%, 40%);">+ {</span><br><span style=3D"color=
: hsl(120, 100%, 40%);">+ msg(D_MULTI_LOW, "Disallow float =
to an address taken by another client %s",</span><br><span style=3D"co=
lor: hsl(120, 100%, 40%);">+ multi_instance_string(ex_mi, fa=
lse, &gc));</span><br><span style=3D"color: hsl(120, 100%, 40%);">+ =
goto done;</span><br><span style=3D"color: hsl(120, 100%, 40%);">+ =
}</span><br><span style=3D"color: hsl(120, 100%, 40%);">+ }</span=
><br><span style=3D"color: hsl(120, 100%, 40%);">+</span><br><span> /* =
It doesn't make sense to let a peer float to the address it already</sp=
an><br><span> * has, so we disallow it=2E This can happen if a DCO net=
link notification</span><br><span> * gets lost and we miss a floating =
step=2E</span><br><span>@@ -3128,7 +3140,7 @@</span><br><span> </span><br><=
span> msg(D_MULTI_LOW,</span><br><span> "closing instance =
%s due to float collision with %s "</span><br><span style=3D"color: hs=
l(0, 100%, 40%);">- "using the same certificate",</span><b=
r><span style=3D"color: hsl(120, 100%, 40%);">+ "using the same=
certificate and username",</span><br><span> multi_instance_st=
ring(ex_mi, false, &gc), multi_instance_string(mi, false, &gc));</s=
pan><br><span> multi_close_instance(m, ex_mi, false);</span><br><span> =
ret =3D true;</span><br><span></span><br></pre><p>To view, visit <a hre=
f=3D"http://gerrit=2Eopenvpn=2Enet/c/openvpn/+/1724?usp=3Demail">change 172=
4</a>=2E To unsubscribe, or for help writing mail filters, visit <a href=3D=
"http://gerrit=2Eopenvpn=2Enet/settings?usp=3Demail">settings</a>=2E</p><di=
v itemscope itemtype=3D"http://schema=2Eorg/EmailMessage"><div itemscope it=
emprop=3D"action" itemtype=3D"http://schema=2Eorg/ViewAction"><link itempro=
p=3D"url" href=3D"http://gerrit=2Eopenvpn=2Enet/c/openvpn/+/1724?usp=3Demai=
l"/><meta itemprop=3D"name" content=3D"View Change"/></div></div>
<div sty=
le=3D"display:none"> Gerrit-MessageType: newpatchset </div>
<div style=3D"d=
isplay:none"> Gerrit-Project: openvpn </div>
<div style=3D"display:none"> G=
errit-Branch: master </div>
<div style=3D"display:none"> Gerrit-Change-Id: =
Ie552084638320b3bace76be2f589013f12af3c46 </div>
<div style=3D"display:none=
"> Gerrit-Change-Number: 1724 </div>
<div style=3D"display:none"> Gerrit-Pa=
tchSet: 15 </div>
<div style=3D"display:none"> Gerrit-Owner: plaisthos <=
arne-openvpn@rfc2549=2Eorg> </div>
<div style=3D"display:none"> Gerrit-R=
eviewer: flichtenheld <frank@lichtenheld=2Ecom> </div>
<div style=3D"=
display:none"> Gerrit-CC: openvpn-devel <openvpn-devel@lists=2Esourcefor=
ge=2Enet> </div>
<div style=3D"display:none"> Gerrit-Attention: plaistho=
s <arne-openvpn@rfc2549=2Eorg> </div>
</body></html>
--lhiiztUH7/k=--
--===============4560949590963043255==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
--===============4560949590963043255==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
--===============4560949590963043255==--