diff mbox series

[Openvpn-devel,v14] Introduce get_key_by_management_key_id helper function

Message ID 20261103100955.20917-1-gert@greenie.muc.de
State New
Headers
Series [Openvpn-devel,v14] Introduce get_key_by_management_key_id helper function |

Commit Message

Gert Doering Nov. 3, 2026, 10:09 a.m. UTC 
  From: Arne Schwabe <arne@rfc2549.org>

This function allows us to map from a management key id to a key structure
and also allows this function to be reused.

Patch v2: add message when key is not found.
Patch v3: only consider valid keys

Change-Id: I42d8785959c24bf688190965e58b9b98251b8557
Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: Razvan Cojocaru <razvanc@mailbox.org>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1856
Message-Id: <20261102134628.26248-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg40434.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Razvan Cojocaru <razvanc@mailbox.org>
Acked-by: Arne Schwabe <arne-openvpn@rfc2549.org>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1856
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1856
This mail reflects revision 14 of this Change.

Acked-by according to Gerrit (reflected above):
Razvan Cojocaru <razvanc@mailbox.org>
Arne Schwabe <arne-openvpn@rfc2549.org>

Comments

Gert Doering Nov. 3, 2026, 12:17 p.m. UTC | #1 
Infrastructure, needed by the next patch (1858)...  tested (t_server,
though that does not really excercise this particular end of things)
plus stare-at-code, plus "can we please have this dangling %u rewrapped"
(thanks).

Your patch has been applied to the master branch.

commit 6b617486ada6b9b936e0076081ca878ba493a3a9
Author: Arne Schwabe
Date:   Tue Nov 3 11:09:50 2026 +0100

     Introduce get_key_by_management_key_id helper function

     Signed-off-by: Arne Schwabe <arne@rfc2549.org>
     Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1856
     Acked-by: Razvan Cojocaru <razvanc@mailbox.org>
     Acked-by: Arne Schwabe <arne-openvpn@rfc2549.org>
     Message-Id: <20261103100955.20917-1-gert@greenie.muc.de>
     URL: https://lore.kernel.org/openvpn-devel/20261103100955.20917-1-gert@greenie.muc.de
     Signed-off-by: Gert Doering <gert@greenie.muc.de>


--
kind regards,

Gert Doering
diff mbox series

Patch

diff --git a/src/openvpn/ssl_common.h b/src/openvpn/ssl_common.h
index 579f46c..9a55ead 100644
--- a/src/openvpn/ssl_common.h
+++ b/src/openvpn/ssl_common.h
@@ -764,4 +764,24 @@ 
     return &multi->session[TM_ACTIVE].key[KS_PRIMARY];
 }
 
+#ifdef ENABLE_MANAGEMENT
+/**
+ * Gets the \c key_state object that belongs to the management key id or
+ * return NULL if not found.
+ */
+static inline struct key_state *
+get_key_by_management_key_id(struct tls_multi *multi, unsigned int mda_key_id)
+{
+    for (int i = 0; i < KEY_SCAN_SIZE; ++i)
+    {
+        struct key_state *ks = get_key_scan(multi, i);
+        if (ks->mda_key_id == mda_key_id && ks->state > S_UNDEF)
+        {
+            return ks;
+        }
+    }
+    return NULL;
+}
+#endif
+
 #endif /* SSL_COMMON_H_ */
diff --git a/src/openvpn/ssl_verify.c b/src/openvpn/ssl_verify.c
index 73e3696..7baa4fc 100644
--- a/src/openvpn/ssl_verify.c
+++ b/src/openvpn/ssl_verify.c
@@ -1250,22 +1250,24 @@ 
 tls_authenticate_key(struct tls_multi *multi, const unsigned int mda_key_id, const bool auth,
                      const char *client_reason)
 {
-    bool ret = false;
+    struct key_state *ks = NULL;
     if (multi)
     {
-        int i;
         auth_set_client_reason(multi, client_reason);
-        for (i = 0; i < KEY_SCAN_SIZE; ++i)
+        ks = get_key_by_management_key_id(multi, mda_key_id);
+
+        if (ks)
         {
-            struct key_state *ks = get_key_scan(multi, i);
-            if (ks->mda_key_id == mda_key_id)
-            {
-                ks->mda_status = auth ? ACF_SUCCEEDED : ACF_FAILED;
-                ret = true;
-            }
+            ks->mda_status = auth ? ACF_SUCCEEDED : ACF_FAILED;
+        }
+        else
+        {
+            msg(D_TLS_DEBUG_LOW,
+                "%s: no key state found for management key id %u",
+                __func__, mda_key_id);
         }
     }
-    return ret;
+    return (bool)ks;
 }
 #endif /* ifdef ENABLE_MANAGEMENT */