Attention is currently required from: plaisthos, ralf_lici. stipa has posted comments on this change by stipa. ( http://gerrit.openvpn.net/c/openvpn/+/1752?usp=email )
Change subject: oob: Add --server-probe-reply to advertise probe reply values ...................................................................... Patch Set 25: (2 comments) File doc/man-sections/server-options.rst: http://gerrit.openvpn.net/c/openvpn/+/1752/comment/2df5a7be_fd1f0939?usp=email : PS24, Line 691: A UDP server : answers probes by default, whether or not this option is given > IMHO this is a wrong design decision. […] I would keep it on by default, but I take the point that it should be a conscious decision, so let me spell out the reasoning. Probing only works when servers answer; if every admin has to turn it on, clients see no replies for years and the feature is dead on arrival. That is how other protocol capabilities have gone in: a server announces IV_ flags, answers ECHO, sends PUSH_UPDATE, without a switch per feature. The reply is stateless, costs one small packet, is rate-limited, is only ever sent for a probe that passed the control channel wrapping and the timestamp check (now with a budget for stale ones), and carries nothing the server does not already reveal in its reset. The ordering effect you describe is real: after an upgrade, upgraded servers get preferred over old ones by probing clients. But that is what the old ones would get once upgraded too, and the admin who does not want it has --server-probe-reply off, and the one who wants a policy has the values. The RFC leaves this open ("the server can then reply"). If you still think the default is wrong I will flip it, but I would rather not ship a feature that is off everywhere. File src/openvpn/mudp.c: http://gerrit.openvpn.net/c/openvpn/+/1752/comment/ac3e9c44_e0cca7be?usp=email : PS24, Line 131: && opcode_is_oob(*BPTR(&m->top.c2.buf) >> P_OPCODE_SHIFT)) > `opcode_is_oob` identifies the generic OOB envelope, not a `SERVER_PROBE` > specifically. […] Right, once ECHO and ACC go out-of-band this would silence them too. Moved the check to after the packet is unwrapped and parsed as a SERVER_PROBE, so off disables exactly the probe reply. -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/1752?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: Id74cfae7e9d69029d2ddbf635ee85a2a6cedc3d8 Gerrit-Change-Number: 1752 Gerrit-PatchSet: 25 Gerrit-Owner: stipa <[email protected]> Gerrit-Reviewer: plaisthos <[email protected]> Gerrit-Reviewer: ralf_lici <[email protected]> Gerrit-CC: openvpn-devel <[email protected]> Gerrit-Attention: plaisthos <[email protected]> Gerrit-Attention: ralf_lici <[email protected]> Gerrit-Comment-Date: Thu, 17 Sep 2026 07:39:20 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: ralf_lici <[email protected]>
_______________________________________________ Openvpn-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-devel
