Attention is currently required from: flichtenheld, plaisthos. stipa has posted comments on this change by plaisthos. ( http://gerrit.openvpn.net/c/openvpn/+/1826?usp=email )
Change subject: Make required action returned from pre_decrypt_verdict more explicit ...................................................................... Patch Set 6: Code-Review-1 (3 comments) File src/openvpn/mudp.c: http://gerrit.openvpn.net/c/openvpn/+/1826/comment/37634b9b_6d626d52?usp=email : PS6, Line 219: return PRE_DECRYPT_CREATE_SESSION_SKIP; If I got this right, before we returned FALSE for invalid/missing SID or wrong pid, and the calling code did nothing. Now we only log "ret" and return PRE_DECRYPT_CREATE_SESSION_SKIP, which makes calling code create multi_instance and call session_skip_to_pre_start() with attacker-supplied session-id. What about return ret ? PRE_DECRYPT_CREATE_SESSION_SKIP : PRE_DECRYPT_NO_ACTION; http://gerrit.openvpn.net/c/openvpn/+/1826/comment/903eb032_918042cd?usp=email : PS6, Line 249: return NULL; here we leak gc http://gerrit.openvpn.net/c/openvpn/+/1826/comment/234941b8_caa0d072?usp=email : PS6, Line 280: mi->context.c2.tls_multi->n_sessions++; previously we only incremented sessions when we skipped to pre_start and now we do it for CREATE_SESSION as well, is this intended? -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/1826?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: Iccdd4cfad090c565aac27e16cdaa9871106c2f89 Gerrit-Change-Number: 1826 Gerrit-PatchSet: 6 Gerrit-Owner: plaisthos <[email protected]> Gerrit-Reviewer: flichtenheld <[email protected]> Gerrit-Reviewer: stipa <[email protected]> Gerrit-CC: openvpn-devel <[email protected]> Gerrit-Attention: plaisthos <[email protected]> Gerrit-Attention: flichtenheld <[email protected]> Gerrit-Comment-Date: Thu, 13 Aug 2026 12:48:28 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes
_______________________________________________ Openvpn-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-devel
