From patchwork Wed Jul 15 15:01:25 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gert Doering X-Patchwork-Id: 5109 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:5462:b0:878:73b6:dbac with SMTP id d2csp1098030mas; Wed, 15 Jul 2026 08:31:23 -0700 (PDT) X-Forwarded-Encrypted: i=2; AHgh+RolkoZxfTn0bx6CO+fsYpVaiDouDJfmU461BsW/3YqD0DXPZYMWsHyioYwuoDV+cge1/tCr8hTQoy0=@openvpn.net X-Received: by 2002:a05:6808:14c7:b0:492:3a59:37cf with SMTP id 5614622812f47-4a42b07e494mr13697059b6e.37.1784129483158; Wed, 15 Jul 2026 08:31:23 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1784129483; cv=none; d=google.com; s=arc-20260327; b=XnZ+DhFWnj8CFc8L9Miq109jiyN6MtOh9Vvrv/qTSfXGUC6dapZSWKFE0W/5mwF+1s L5tj06NLtgpbllEfyXQ7dHq96Rj/16dWC6CdmW6CBMhGspTNGIFAQHTbNeH9NuLT3kGH wNCn/WDYk4XwX5KJPOxAX6cRDF7f947DELCXj0vEZ+dBglKZ8V8En9ezzRVRFTKVM1O8 d7mzAnu6/pmUN5BfBAYBkw2gaha9MLrzzpc7Sb30TZW0lAFkTl67wP4xDrWnEpbeZWVl ij69DpoObn6j+TImaodlAZoyA9cNgYacBqNzJ84aot5Jg9FcNJ7A0/CIRRF82T/JgOio huXA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=u+7444MVhGCQqUDt3NLceERp2/6GpJ1O+wGGJbO5+/4=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=c9LGqd7yhbelKPorlnuIlSkGmCkDaOiBGfZiYPZTw2n3MpDNHgShor3hE3pH3vq2QE byXY+R/yz6c70Ksa8VQ6ETjBDmQwWc+RhJWszeQK9PLG99D3Mb2Whqv7nWEWi+QJgJxU bQ16rJGyS9IqXJISoz3yLxc/bekj2HoPY0Rgp2+noiU+Hu2TSChAe+LZQ6HsYn7rgr9r eyMCg8/o7tUwaSfTNZsqzIVjuYEk1tM3ecrcGfFtBp5MvR1IR+CbCkmY0V/A7pRo1J1g uKHEzCiuFzLJNHNBv4n700FOg95+ZpI51q2iF++HSe1BlLRIP3dUDIX+NUfwOyLiacW6 jE4Q==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=GrzlnCLW; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=RUkS9XoH; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=SuRUcRAD; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 5614622812f47-4a1adeaca7esi17084305b6e.53.2026.07.15.08.31.22 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 15 Jul 2026 08:31:23 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=GrzlnCLW; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=RUkS9XoH; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=SuRUcRAD; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=u+7444MVhGCQqUDt3NLceERp2/6GpJ1O+wGGJbO5+/4=; b=GrzlnCLWu8U1/UJV+go2KqBmv2 wm8r2VlTEBLYYgz8uN+08SUogjExj2t+g6zmArS6yH16f9ppAQYlOw3wihUGsuKlYyL5ov677JABs Hfw+ehHpAxYtVQrVDFtHyHhUa61yBOnVS23Guop+N5VPiyWO2IVopAnaPA+0ssjBfZ5c=; Received: from [127.0.0.1] (helo=sfs-ml-2.v29.lw.sourceforge.com) by sfs-ml-2.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1wk1Zu-0006uB-Mk; Wed, 15 Jul 2026 15:31:19 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-2.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1wk1Zs-0006tv-37 for openvpn-devel@lists.sourceforge.net; Wed, 15 Jul 2026 15:31:17 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=VSZfHDVa3EC9GtOIJMLEyJXToBkkt5Dbd+VMmmw7hlw=; b=RUkS9XoHYCWTHv8g6nuiBqUjAz J/156Gd6haB0ReGWvoVl1Oyfd3k2CLp7/Xv5EyeZEgMXZMCXG2s9NYIDPyOehS9EXmmN0ZmpOeM4r u2g8RGe9ACB84BDhuhPFaIVM5jjEKH75ONfiRPLVoHKo2xi7Ayvp86XigAIJBTR/hl8s=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=VSZfHDVa3EC9GtOIJMLEyJXToBkkt5Dbd+VMmmw7hlw=; b=SuRUcRAD/71gg+Ws12ftsp1eXE waHnJ906Ysa0hlQwZtnMLufmyPtrUO2Zvl6FkB5S2Ff4msfRongecEdqk3fwXagRxeq4q2KJtLspH HndGJPTbXTGtK8FdyWVv38sxKr9ZMP4ZHc69uWQfixdqClxpzTanzXp4ZHNaGw0EDBpQ=; Received: from [193.149.48.129] (helo=blue.greenie.muc.de) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1wk1Zq-0000GA-Uz for openvpn-devel@lists.sourceforge.net; Wed, 15 Jul 2026 15:31:16 +0000 Received: from blue.greenie.muc.de (localhost [127.0.0.1]) by blue.greenie.muc.de (8.18.1/8.18.1) with ESMTP id 66FF1UCd022338 for ; Wed, 15 Jul 2026 17:01:30 +0200 Received: (from gert@localhost) by blue.greenie.muc.de (8.18.2/8.18.1/Submit) id 66FF1UZq022335 for openvpn-devel@lists.sourceforge.net; Wed, 15 Jul 2026 17:01:30 +0200 From: Gert Doering To: openvpn-devel@lists.sourceforge.net Date: Wed, 15 Jul 2026 17:01:25 +0200 Message-ID: <20260715150130.22295-1-gert@greenie.muc.de> X-Mailer: git-send-email 2.53.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Arne Schwabe This adds an additional safe guard for setups that do not use client certificates. Change-Id: Ie552084638320b3bace76be2f589013f12af3c46 Signed-off-by: Arne Schwabe Acked-by: Frank Lichtenheld Gerrit URL: https://gerrit.openvpn.net/c/openvpn [...] Content analysis details: (1.3 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS X-Headers-End: 1wk1Zq-0000GA-Uz Subject: [Openvpn-devel] [PATCH v4] Add check that username is identical to multi float X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1870795356997922738 X-GMAIL-MSGID: 1870795356997922738 From: Arne Schwabe This adds an additional safe guard for setups that do not use client certificates. Change-Id: Ie552084638320b3bace76be2f589013f12af3c46 Signed-off-by: Arne Schwabe Acked-by: Frank Lichtenheld Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1724 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1724 This mail reflects revision 4 of this Change. Acked-by according to Gerrit (reflected above): Frank Lichtenheld diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c index c40ebe4..ce6807e 100644 --- a/src/openvpn/multi.c +++ b/src/openvpn/multi.c @@ -3115,6 +3115,18 @@ goto done; } + /* do not allow if target address has a different username */ + if (m1->locked_username || m2->locked_username) + { + if (!m1->locked_username || !m2->locked_username + || strcmp(m1->locked_username, m2->locked_username) != 0) + { + msg(D_MULTI_LOW, "Disallow float to an address taken by another client %s", + multi_instance_string(ex_mi, false, &gc)); + goto done; + } + } + /* It doesn't make sense to let a peer float to the address it already * has, so we disallow it. This can happen if a DCO netlink notification * gets lost and we miss a floating step. @@ -3131,7 +3143,7 @@ msg(D_MULTI_LOW, "closing instance %s due to float collision with %s " - "using the same certificate", + "using the same certificate and username", multi_instance_string(ex_mi, false, &gc), multi_instance_string(mi, false, &gc)); multi_close_instance(m, ex_mi, false); ret = true;