From patchwork Wed Oct 28 12:15:10 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gert Doering X-Patchwork-Id: 5518 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:78dc:b0:8dc:5c83:a4ec with SMTP id e28csp1424109max; Wed, 28 Oct 2026 05:15:32 -0700 (PDT) X-Forwarded-Encrypted: i=2; AKwUvBwSJLNvKMBhuMckQVSYaJUtaHYKvHaSVL6PAQTS6+tMJ9JG0ttwzOqAlKi8p5n2/L9x3pIr1tBgZzo=@openvpn.net X-Received: by 2002:a05:6870:2155:b0:4a2:4dcb:fa75 with SMTP id 586e51a60fabf-4a8bb198cebmr1848480fac.2.1793189732591; Wed, 28 Oct 2026 05:15:32 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1793189732; cv=none; d=google.com; s=arc-20260327; b=FeCVKlslYwsDowKLar8fzdc8HmTBUFOmOgBSD78cQrxaC7wbKuPcfjJWStIs9scIVU d/Q0ay8n55J8nZ1mdarZ0DZZGsZ+xAp129iFfyU7XO4YLjMjyGYKjxj4LaxSOjDkEtM1 D/K97x96+IoqKPMY+RIu2+6HhRYqq9B2z2qEemZoPAtfkIiAgOcCzqPLpqhz/FDRNjHS eejsQ1my+m2PKvW29OP5tcpmhp2LJENkhLHlmrZ9FpDPj87VM6myjWYJ/ritM8YaBxxr uEFMSJ6+R/ZQ7ftFCx+ra1p4PZP6OMu8CPXhTjmw1AQIIdE6/rvl3r/GwVMDp9B4Bfno 1lBQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=1bLrKxjQvDIrHrLLXfAUe2v5TaUJcnGHr4QN7Rm+tj4=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=EVRZcRo8aOQItVI0ueDELlrIxryhGC0CbxE8aKmII8pgShal7Z+pf6vifFAgu5R4Or YHrClgOA4oqzXyPTfjSqnB9hMA0815z2gOM5GsuMCGKtxNwieD20XgPgyHooOhcFu2Ir Q6PjRBgAAp0SyZwwkW9W/JHuSMkjI3jeeRHQ0hCOWAZ8PvRtPtR/Ah8JPJreq3CUfNYi 70bAiPLgGmYQdnAcs2WPNiLzunGCWen5OuwHTVp75ZU1iqjPwZvW+AFXkCPTosgQaQ1y qEkp6w3G3sQq6Fx4sKd1JeVs0Fi1LgRtGZVatUzt+hw5gDAit/bziWZLC+dBgAu5kKll Xitg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=mH1zmQcG; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=Co05Asy4; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=DGs7F4A4; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 586e51a60fabf-4a8b7a3c16fsi3597222fac.326.2026.10.28.05.15.31 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 28 Oct 2026 05:15:32 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=mH1zmQcG; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=Co05Asy4; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=DGs7F4A4; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Unsubscribe-Post: List-Owner; bh=1bLrKxjQvDIrHrLLXfAUe2v5TaUJcnGHr4QN7Rm+tj4=; b=mH1zmQcG8hUdOn aUc7evyzr6jLYhSY8YZU+a95Z1/iElaxPCJzCmH7vIHwRdHi3GrmEHFVtQg9WlrA6RAVwnbasK1U2 uo028ca967h84jrkfv9dCd96IvM/XREtgRb1nedNEZLt5p/5BI/acE4BVO1+vwx0X29ggjDibq8pg 098=; Received: from [127.0.0.1] (helo=sfs-ml-2.v29.lw.sourceforge.com) by sfs-ml-2.v29.lw.sourceforge.com with esmtp (Exim 4.100.1) (envelope-from ) id 1xM2Yy-000000007nt-0XPm; Wed, 28 Oct 2026 12:15:28 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-2.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.100.1) (envelope-from ) id 1xM2Yv-000000007nc-38sT for openvpn-devel@lists.sourceforge.net; Wed, 28 Oct 2026 12:15:25 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Unsubscribe-Post:List-Subscribe:List-Post:List-Owner:List-Archive; bh=gWIKeABkuNftNDxbqowZmihyTnHIMYf1b2HTQz76Syk=; b=Co05Asy4Se0QgArvbflxtym76W r579oAqL1YcfI4INFFixk8w7wSZzpq4JTVPVd7x87I/ARenD5YtgPObV+CJ4AtwVw8P3AM1vZz/Lj gAYB8IaVS4pe2FQp0Dn0L+BIGCohyJbegSA1ailH7jgCg+6cS47xdlslEbPk1Dv25Ljo=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Unsubscribe-Post: List-Subscribe:List-Post:List-Owner:List-Archive; bh=gWIKeABkuNftNDxbqowZmihyTnHIMYf1b2HTQz76Syk=; b=DGs7F4A4rvt0fSHbUANPYzqtFJ ss+nfNuOnsvZTSO/w0ETtgRYOxq0PjDKOhSOWvp49fCPesNKvN6YQ6zf/8OQu7uzkWmI96kTpM8jq YQwrkjha19k1sZ7SxCUaKuAk+vwutKMVf4ubyk+P8ksy6nT18LLZg9U+5EZQwIJEQJO4=; Received: from [193.149.48.129] (helo=blue.greenie.muc.de) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.100.1) id 1xM2Yt-000000005D2-2cWF for openvpn-devel@lists.sourceforge.net; Wed, 28 Oct 2026 12:15:25 +0000 Received: from blue.greenie.muc.de (localhost [127.0.0.1]) by blue.greenie.muc.de (8.18.1/8.18.1) with ESMTP id 69SCFGat002373 for ; Wed, 28 Oct 2026 13:15:16 +0100 Received: (from gert@localhost) by blue.greenie.muc.de (8.18.2/8.18.1/Submit) id 69SCFGe9002372 for openvpn-devel@lists.sourceforge.net; Wed, 28 Oct 2026 13:15:16 +0100 From: Gert Doering To: openvpn-devel@lists.sourceforge.net Date: Wed, 28 Oct 2026 13:15:10 +0100 Message-ID: <20261028121516.2361-1-gert@greenie.muc.de> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-1.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Arne Schwabe Commit d42a9912c1 introduced a check to ensure that also the username is identical for floats and not only the certificate. This check did not mark the buffer as invalid in those cases like the certif [...] Content analysis details: (1.3 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS X-Headers-End: 1xM2Yt-000000005D2-2cWF Subject: [Openvpn-devel] [PATCH v1] Mark buffer invalid with username mismatch in server side float X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1880295717132594284 X-GMAIL-MSGID: 1880295717132594284 From: Arne Schwabe Commit d42a9912c1 introduced a check to ensure that also the username is identical for floats and not only the certificate. This check did not mark the buffer as invalid in those cases like the certificate check. Reported-By: QiuYiati on https://github.com/OpenVPN/openvpn/issues/1137 GitHub: closes OpenVPN/openvpn#1137 Change-Id: Ide5a3064e51d4a22f914e76c1d8165fdd4d005f4 Signed-off-by: Arne Schwabe Acked-by: Razvan Cojocaru Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2058 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2058 This mail reflects revision 1 of this Change. Acked-by according to Gerrit (reflected above): Razvan Cojocaru diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c index e302a81..caee3ff 100644 --- a/src/openvpn/multi.c +++ b/src/openvpn/multi.c @@ -3172,6 +3172,7 @@ { msg(D_MULTI_LOW, "Disallow float/connect to an address taken by another client %s", multi_instance_string(ex_mi, false, &gc)); + mi->context.c2.buf.len = 0; goto done; } }