[Openvpn-devel] [L] Change in openvpn[master]: multipeer: introduce asymmetric peer-id

Attention is currently required from: cron2, flichtenheld, ordex, plaisthos.

its_Giaan has posted comments on this change by its_Giaan. ( http://gerrit.openvpn.net/c/openvpn/+/1089?usp=email )

Change subject: multipeer: introduce asymmetric peer-id
......................................................................


Patch Set 20:

(3 comments)

File src/openvpn/push.c:

http://gerrit.openvpn.net/c/openvpn/+/1089/comment/46cf6413_d5ac6ec0?usp=email :
PS19, Line 664:     if (!tls_multi->use_asymmetric_peer_id)
> this is not equivalent to what was used before (use_peer_id). […]
Changed it to use_peer_id && !use_asymmetric_peer_id, so DATA_V1 stays untouched and only the classic DATA_V2 case gets the push (the asymmetric case announces its id through peer-info instead).


File src/openvpn/ssl.c:

http://gerrit.openvpn.net/c/openvpn/+/1089/comment/c641e2bd_1cb61b43?usp=email :
PS19, Line 1200:             multi->rx_peer_id = ((uint32_t)peerid[0] << 16)
> what happens if this turns to be MAX_PEER_ID (0xFFFFFF)? Could this be problematic?
Yeah, that's a real one. It's 3 random bytes, so it can land on 0xFFFFFF, which is MAX_PEER_ID, our "unset" marker. When that happens we don't announce the id and use_peer_id never gets set, so the feature just quietly turns itself off. Wrapped the generation in a do/while that retries until it's not MAX_PEER_ID.


File src/openvpn/ssl_util.c:

http://gerrit.openvpn.net/c/openvpn/+/1089/comment/6ea823d8_43425e06?usp=email :
PS19, Line 78:     const char *optstr = peer_info ? strstr(peer_info, "ID=") : NULL;
> could the strstr() also match substrings like "UV_ID=..." or "GUID=... […]
It can, yes. peer_info also carries the client's UV_* vars, so something like UV_ID=... (or GUID=...) has ID= as a substring and strstr will match it. The other extract helpers get away with a plain strstr only because their keys are long enough to never appear inside another token. Changed it to accept ID= only.



-- 
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1089?usp=email
To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: comment
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: I0a13ee90b6706acf20eabcee3bab3f2dff639bf9
Gerrit-Change-Number: 1089
Gerrit-PatchSet: 20
Gerrit-Owner: its_Giaan <[email protected]>
Gerrit-Reviewer: cron2 <[email protected]>
Gerrit-Reviewer: flichtenheld <[email protected]>
Gerrit-Reviewer: plaisthos <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>
Gerrit-CC: ordex <[email protected]>
Gerrit-Attention: plaisthos <[email protected]>
Gerrit-Attention: cron2 <[email protected]>
Gerrit-Attention: flichtenheld <[email protected]>
Gerrit-Attention: ordex <[email protected]>
Gerrit-Comment-Date: Wed, 22 Jul 2026 11:37:25 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: ordex <[email protected]>

_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel