diff mbox series

[Openvpn-devel,v2] Do not hash real addresses of TCP connection

Message ID 20261030134023.19798-1-gert@greenie.muc.de
State New
Headers
Series [Openvpn-devel,v2] Do not hash real addresses of TCP connection |

Commit Message

Gert Doering Oct. 30, 2026, 1:40 p.m. UTC 
  From: Arne Schwabe <arne@rfc2549.org>

With neither status report nor max-clients depending on TCP
connections in m->hash anymore, remove hashing of TCP
connection.

This now allows an obscure corner case of two TCP clients coming
from the same IP and port to different IP or port on the server
but as our operating system can handle this case, we do not have
a problem with that either.

This has a small added benefit to keep the number of entries in
m->hash a bit smaller.

Change-Id: If8ae9cbc971f60800a998abf2f97da0384c023f3
Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: Razvan Cojocaru <razvanc@mailbox.org>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2067
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2067
This mail reflects revision 2 of this Change.

Acked-by according to Gerrit (reflected above):
Razvan Cojocaru <razvanc@mailbox.org>
diff mbox series

Patch

diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c
index 90270f5..dc1f896 100644
--- a/src/openvpn/multi.c
+++ b/src/openvpn/multi.c
@@ -2455,13 +2455,22 @@ 
 
 /**
  * This sets up the client real address (outer tunnel addr) in the
- * hash map for data channel packet. If the address is already taken
- * this steps fails
+ * hash map for data channel packet lookup for DATA_V1 packets.
+ * If the address is already taken this steps fails.
  */
 static enum client_connect_return
 multi_client_connect_real_addr(struct multi_context *m, struct multi_instance *mi,
                                bool deferred, uint64_t *option_types_found)
 {
+    if (proto_is_tcp(mi->real.proto))
+    {
+        /* For TCP connection we neither need to be able to map incoming
+         * DATA_V1 packets to the multi_instance nor do we need to ensure
+         * that two TCP connections are not using the same address as the
+         * OS takes care of that. */
+        return CC_RET_SUCCEEDED;
+    }
+
     /* If the address is already taken up by another client we fail the new
      * connection */
     if (!multi_check_dest_addr_allowed(m, mi, &mi->real))