This was initially reported as a security vulnerability, providing a
way to crash a running OpenVPN server process. Detailed testing turned
out that this does not work, but the state machine and the ASSERT()s
are still a bit too fragile, so this is a welcome improvement.
With the new code, if we really manage to de-sync userland and kernel,
it will now only kill the client instance (on a p2mp server) or restart
the connection, not exit() the process. Better.
Lightly tested on the DCO+release/2.7 and 2.6 t_server tests
(ovpn_dco_v2.ko / ovpn.ko).
Your patch has been applied to the master, release/2.7 and
release/2.6 branch (bugfix).
commit ea3bb67e2b1e130c90cd2b28ec5e31a455d60164 (master)
commit d0528fae559c44c1d7815459f1c96e32ac96a8f3 (release/2.7)
commit 5b17c050dc3020186d71bbbd422d7e8525f1d6b6 (release/2.6)
Author: Ralf Lici
Date: Tue Jul 21 22:38:01 2026 +0200
dco: make key state desync recoverable
Signed-off-by: Ralf Lici <[email protected]>
Acked-by: Antonio Quartulli <[email protected]>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1795
Message-Id: <[email protected]>
URL:
https://www.mail-archive.com/[email protected]/msg37732.html
Signed-off-by: Gert Doering <[email protected]>
--
kind regards,
Gert Doering
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
