diff mbox series

[Openvpn-devel,v15] Add check that username is identical to multi float

Message ID 20260731100815.3406-1-gert@greenie.muc.de
State New
Headers
Series [Openvpn-devel,v15] Add check that username is identical to multi float |

Commit Message

Gert Doering July 31, 2026, 10:08 a.m. UTC 
  From: Arne Schwabe <arne@rfc2549.org>

This adds an additional safe guard for setups that do not use
client certificates.

Change-Id: Ie552084638320b3bace76be2f589013f12af3c46
Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: Frank Lichtenheld <frank@lichtenheld.com>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1724
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1724
This mail reflects revision 15 of this Change.

Acked-by according to Gerrit (reflected above):
Frank Lichtenheld <frank@lichtenheld.com>

Comments

Gert Doering Aug. 9, 2026, 3:22 p.m. UTC | #1 
"Makes sense", close one edge case... - in theory this could go to
2.7 as well, but I don't think it's so important to have, and the patch
"as it is" won't go in without all the refactoring we do not want to
have in 2.7.

Did not actually test this with floating clients with an address conflict
(hard to setup).

Technically this refers to "v15" of the patch while gerrit has a "v19",
but everything after v3 is code-identical rebases.

Your patch has been applied to the master branch.

commit d42a9912c1d62006323a12af86baa148c77592e9
Author: Arne Schwabe
Date:   Fri Jul 31 12:08:09 2026 +0200

     Add check that username is identical to multi float

     Signed-off-by: Arne Schwabe <arne@rfc2549.org>
     Acked-by: Frank Lichtenheld <frank@lichtenheld.com>
     Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1724
     Message-Id: <20260731100815.3406-1-gert@greenie.muc.de>
     URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg38095.html
     Signed-off-by: Gert Doering <gert@greenie.muc.de>


--
kind regards,

Gert Doering
diff mbox series

Patch

diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c
index 9b64598..0560ac5 100644
--- a/src/openvpn/multi.c
+++ b/src/openvpn/multi.c
@@ -3112,6 +3112,18 @@ 
         goto done;
     }
 
+    /* do not allow if target address has a different username */
+    if (m1->locked_username || m2->locked_username)
+    {
+        if (!m1->locked_username || !m2->locked_username
+            || strcmp(m1->locked_username, m2->locked_username) != 0)
+        {
+            msg(D_MULTI_LOW, "Disallow float to an address taken by another client %s",
+                multi_instance_string(ex_mi, false, &gc));
+            goto done;
+        }
+    }
+
     /* It doesn't make sense to let a peer float to the address it already
      * has, so we disallow it. This can happen if a DCO netlink notification
      * gets lost and we miss a floating step.
@@ -3128,7 +3140,7 @@ 
 
     msg(D_MULTI_LOW,
         "closing instance %s due to float collision with %s "
-        "using the same certificate",
+        "using the same certificate and username",
         multi_instance_string(ex_mi, false, &gc), multi_instance_string(mi, false, &gc));
     multi_close_instance(m, ex_mi, false);
     ret = true;