[Openvpn-devel] [S] Change in openvpn[master]: Make required action returned from pre_decrypt_verdict more explicit

Attention is currently required from: flichtenheld, plaisthos.

stipa has posted comments on this change by plaisthos. ( http://gerrit.openvpn.net/c/openvpn/+/1826?usp=email )

Change subject: Make required action returned from pre_decrypt_verdict more explicit
......................................................................


Patch Set 6: Code-Review-1

(3 comments)

File src/openvpn/mudp.c:

http://gerrit.openvpn.net/c/openvpn/+/1826/comment/37634b9b_6d626d52?usp=email :
PS6, Line 219:         return PRE_DECRYPT_CREATE_SESSION_SKIP;
If I got this right, before we returned FALSE for invalid/missing SID or wrong pid, and the calling code did nothing. Now we only log "ret" and return PRE_DECRYPT_CREATE_SESSION_SKIP, which makes calling code create multi_instance and call session_skip_to_pre_start() with attacker-supplied session-id. 

What about

return ret ? PRE_DECRYPT_CREATE_SESSION_SKIP : PRE_DECRYPT_NO_ACTION;


http://gerrit.openvpn.net/c/openvpn/+/1826/comment/903eb032_918042cd?usp=email :
PS6, Line 249:         return NULL;
here we leak gc


http://gerrit.openvpn.net/c/openvpn/+/1826/comment/234941b8_caa0d072?usp=email :
PS6, Line 280:                     mi->context.c2.tls_multi->n_sessions++;
previously we only incremented sessions when we skipped to pre_start and now we do it for CREATE_SESSION as well, is this intended?



-- 
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1826?usp=email
To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: comment
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Iccdd4cfad090c565aac27e16cdaa9871106c2f89
Gerrit-Change-Number: 1826
Gerrit-PatchSet: 6
Gerrit-Owner: plaisthos <[email protected]>
Gerrit-Reviewer: flichtenheld <[email protected]>
Gerrit-Reviewer: stipa <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>
Gerrit-Attention: plaisthos <[email protected]>
Gerrit-Attention: flichtenheld <[email protected]>
Gerrit-Comment-Date: Thu, 13 Aug 2026 12:48:28 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: Yes

_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel