diff mbox series

[Openvpn-devel,v2] Track number of assigned peer ids and use it for max-clients check

Message ID 20261028202838.14796-1-gert@greenie.muc.de
State New
Headers
Series [Openvpn-devel,v2] Track number of assigned peer ids and use it for max-clients check |

Commit Message

Gert Doering Oct. 28, 2026, 8:28 p.m. UTC 
  From: Arne Schwabe <arne@rfc2549.org>

In the past we used the real address hash as proxy for the number
of connected clients. TCP connections do not really need
this and we might remove adding them to this hash map in the future.
UDP connections only need to be added to this hash map in a later stage
of the connection process and then only for peers that do not support
DATA_V2.

Instead have a simple counter that is kept up to date when a peer id
is assigned and freed. This also allows this to be decoupled from
the real addresses hash.

Reported-by: Ar-maan05 https://github.com/OpenVPN/openvpn/issues/1127
Github: Closes OpenVPN/openvpn#1127
Change-Id: Iad51b2f31e4215c58e160cc6239836015ea4d3cf
Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: Razvan Cojocaru <razvanc@mailbox.org>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2064
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2064
This mail reflects revision 2 of this Change.

Acked-by according to Gerrit (reflected above):
Razvan Cojocaru <razvanc@mailbox.org>
diff mbox series

Patch

diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c
index e302a81..82757f4 100644
--- a/src/openvpn/multi.c
+++ b/src/openvpn/multi.c
@@ -621,6 +621,8 @@ 
             {
                 m->max_peerid--;
             }
+
+            m->assigned_peer_ids--;
         }
 
         schedule_remove_entry(m->schedule, (struct schedule_entry *)mi);
@@ -749,7 +751,7 @@ 
 
     mi->context.c2.tls_multi->multi_state = CAS_NOT_CONNECTED;
 
-    if (hash_n_elements(m->hash) >= m->max_clients)
+    if (m->assigned_peer_ids >= m->max_clients)
     {
         msg(D_MULTI_ERRORS,
             "MULTI: new incoming connection would exceed maximum number of clients (%u)",
@@ -4219,6 +4221,8 @@ 
     {
         m->max_peerid = mi->context.c2.tls_multi->rx_peer_id;
     }
+
+    m->assigned_peer_ids++;
 }
 
 /**
diff --git a/src/openvpn/multi.h b/src/openvpn/multi.h
index 5db7147..cc7ccd3 100644
--- a/src/openvpn/multi.h
+++ b/src/openvpn/multi.h
@@ -174,6 +174,8 @@ 
     uint32_t max_peerid;               /**< highest currently allocated peer-id
                                         * and maximum allocated/valid index in
                                         * instances */
+    uint32_t assigned_peer_ids;        /**< Number of peer-ids that are
+                                        *   currently assigned */
     struct hash *hash;                 /**< VPN tunnel instances indexed by real
                                         *   address of the remote peer. */
     struct hash *vhash;                /**< VPN tunnel instances indexed by