From patchwork Tue Nov 3 10:09:50 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gert Doering X-Patchwork-Id: 5574 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:6022:4121:b0:118:2077:975e with SMTP id d33csp424106laa; Tue, 3 Nov 2026 02:10:09 -0800 (PST) X-Forwarded-Encrypted: i=2; AKwUvBzJAWIDFWRmLAN7bKth/eAAtgis8u4I5yQkHA211eonVCmkqpC0raZ14Qf4zTXshMGFxgeCScp1hHE=@openvpn.net X-Received: by 2002:a05:7022:3f04:b0:16b:fdbf:4a9c with SMTP id a92af1059eb24-1ac5ac4cd7emr20342294c88.23.1793700609024; Tue, 03 Nov 2026 02:10:09 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1793700609; cv=none; d=google.com; s=arc-20260327; b=PzHbBtjBgLObtXZM72vdYnqI5Emh1RCqp4p7vMxZ0FTo5x6DOcxQIiT89KSxT0C3pe oIfIg46QU7r5PSaQ+UzLH6m7rWdMf+tfKtcnAP/qVAfbPDFrX+HdH2icq3FKK+QXIcI6 xad8kwn5zV+BTMBXtYJxfG6Q5m4Ici2rGDedP7mwEnei6/MJHeqsVn2RUWSIPb9wTVbr No/eWefBmPPnrrf18mhqSFEs9GjQj4sLfAtQvalebRg3KXvyrX6OD7OLeYs28iwgAuNd /zvsB3pG+7jG5JAf84JMGMdNOcIltMlQO5cZRaqrIhnnmsEXNQ8GzDgAAYBxMCHnPO9K 1DTA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=xXzTAEYHlYY4OtGRL6FfQOKCudWmdZDGKQw0AahQAmY=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=L7uFcCWjy9v746KCUDWAetne5ez8NqFQiojzyQ7tPa9qzMrGmx4j/6ZPLAT0A0WV48 WAMKSDoD2I1Ep0J9wbrB187TbgWnaAjlGhUT/+b7JbTKGQEaIr12HHxONBpwCjG5Swo9 Dv+OV4WJRawMlL4hISpOauqnf2q9CB3rLv+VQDKOTS0AwOJczXABFUhLCP2yiSnlzTQN LGSBlxhEJ6nRNewwbI/hlgyOwkRe7AIavy2BTWoOPSYTvrY/tFZ18H0PEXUgiLIftRJO yUdxUtj7elYxGDEfHjPnyFR6tBI6kPoqnZpHvY1LL34IUx57V4jX/qC1NRcOQUz9pWyu +mcA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=Ud5I92YV; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=G4gzhYx8; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=gNNjRq2k; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id a92af1059eb24-1ac187393e3si44736489c88.34.2026.11.03.02.10.08 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 03 Nov 2026 02:10:09 -0800 (PST) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=Ud5I92YV; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=G4gzhYx8; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=gNNjRq2k; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Unsubscribe-Post: List-Owner; bh=xXzTAEYHlYY4OtGRL6FfQOKCudWmdZDGKQw0AahQAmY=; b=Ud5I92YV0ATMF+ I2YqY2smiv+0O075fxW9zXVRnhB6c22mGVMoTNo7TEKRascN6ri5WcsbjEVOgHuguUdyx+ioOaX/o /AF+RRzx6kTOQz0wurstZ/W9ea5Qj7d/1YCbvhiDxMIvVOIQtMeGnWr2Zvae7Tn0qLyMZaEnQtImJ 7CI=; Received: from [127.0.0.1] (helo=sfs-ml-1.v29.lw.sourceforge.com) by sfs-ml-1.v29.lw.sourceforge.com with esmtp (Exim 4.100.1) (envelope-from ) id 1xOBSx-000000005iV-1BuR; Tue, 03 Nov 2026 10:10:07 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-1.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.100.1) (envelope-from ) id 1xOBSu-000000005iO-3zJO for openvpn-devel@lists.sourceforge.net; Tue, 03 Nov 2026 10:10:04 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Unsubscribe-Post:List-Subscribe:List-Post:List-Owner:List-Archive; bh=MByE9S/eMrHhup+uSc9T+T+CQLJXSjnkO3VVIurWKhQ=; b=G4gzhYx8wEQ4e9UTz7z3W/Ysim ldU6mWHBCpYmIPtInSqDJDv6EUdYXT31T9+aRgqe15Kev/A2ixwcTiZpgV+juy8CVaCSI8pBlq4D/ qEyzD9Sj7JjPlz3k9Ry0A3dOek3eedEAfJu/VEFKVTOIwKU8ie/F2vmjTq+YLLACiX+I=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Unsubscribe-Post: List-Subscribe:List-Post:List-Owner:List-Archive; bh=MByE9S/eMrHhup+uSc9T+T+CQLJXSjnkO3VVIurWKhQ=; b=gNNjRq2kqY8/enZMgCPU2oenSN bXHzC5ITHM6Rzxjkg7RD2Wke8ZNB1KyZJJqEB4Mkk9r1q38WGMWwSJJ9f2PM6wE+YK5dXRy+pL+R+ TKUsVog8F6jjTWSVJhSQq1Xfq+/Bn+j1SBbR9WBKnQEZ3iSdNE3hhjJ1AJTnwk62cmJs=; Received: from [193.149.48.129] (helo=blue.greenie.muc.de) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.100.1) id 1xOBSs-000000007cu-3xoK for openvpn-devel@lists.sourceforge.net; Tue, 03 Nov 2026 10:10:04 +0000 Received: from blue.greenie.muc.de (localhost [127.0.0.1]) by blue.greenie.muc.de (8.18.1/8.18.1) with ESMTP id 6A3A9tna020928 for ; Tue, 3 Nov 2026 11:09:55 +0100 Received: (from gert@localhost) by blue.greenie.muc.de (8.18.2/8.18.1/Submit) id 6A3A9tUH020927 for openvpn-devel@lists.sourceforge.net; Tue, 3 Nov 2026 11:09:55 +0100 From: Gert Doering To: openvpn-devel@lists.sourceforge.net Date: Tue, 3 Nov 2026 11:09:50 +0100 Message-ID: <20261103100955.20917-1-gert@greenie.muc.de> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Arne Schwabe This function allows us to map from a management key id to a key structure and also allows this function to be reused. Patch v2: add message when key is not found. Patch v3: only consider valid keys Content analysis details: (1.3 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS X-Headers-End: 1xOBSs-000000007cu-3xoK Subject: [Openvpn-devel] [PATCH v14] Introduce get_key_by_management_key_id helper function X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1880754438544358988 X-GMAIL-MSGID: 1880831409378476507 From: Arne Schwabe This function allows us to map from a management key id to a key structure and also allows this function to be reused. Patch v2: add message when key is not found. Patch v3: only consider valid keys Change-Id: I42d8785959c24bf688190965e58b9b98251b8557 Signed-off-by: Arne Schwabe Acked-by: Razvan Cojocaru Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1856 Message-Id: <20261102134628.26248-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg40434.html Signed-off-by: Gert Doering Acked-by: Razvan Cojocaru Acked-by: Arne Schwabe Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1856 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1856 This mail reflects revision 14 of this Change. Acked-by according to Gerrit (reflected above): Razvan Cojocaru Arne Schwabe diff --git a/src/openvpn/ssl_common.h b/src/openvpn/ssl_common.h index 579f46c..9a55ead 100644 --- a/src/openvpn/ssl_common.h +++ b/src/openvpn/ssl_common.h @@ -764,4 +764,24 @@ return &multi->session[TM_ACTIVE].key[KS_PRIMARY]; } +#ifdef ENABLE_MANAGEMENT +/** + * Gets the \c key_state object that belongs to the management key id or + * return NULL if not found. + */ +static inline struct key_state * +get_key_by_management_key_id(struct tls_multi *multi, unsigned int mda_key_id) +{ + for (int i = 0; i < KEY_SCAN_SIZE; ++i) + { + struct key_state *ks = get_key_scan(multi, i); + if (ks->mda_key_id == mda_key_id && ks->state > S_UNDEF) + { + return ks; + } + } + return NULL; +} +#endif + #endif /* SSL_COMMON_H_ */ diff --git a/src/openvpn/ssl_verify.c b/src/openvpn/ssl_verify.c index 73e3696..7baa4fc 100644 --- a/src/openvpn/ssl_verify.c +++ b/src/openvpn/ssl_verify.c @@ -1250,22 +1250,24 @@ tls_authenticate_key(struct tls_multi *multi, const unsigned int mda_key_id, const bool auth, const char *client_reason) { - bool ret = false; + struct key_state *ks = NULL; if (multi) { - int i; auth_set_client_reason(multi, client_reason); - for (i = 0; i < KEY_SCAN_SIZE; ++i) + ks = get_key_by_management_key_id(multi, mda_key_id); + + if (ks) { - struct key_state *ks = get_key_scan(multi, i); - if (ks->mda_key_id == mda_key_id) - { - ks->mda_status = auth ? ACF_SUCCEEDED : ACF_FAILED; - ret = true; - } + ks->mda_status = auth ? ACF_SUCCEEDED : ACF_FAILED; + } + else + { + msg(D_TLS_DEBUG_LOW, + "%s: no key state found for management key id %u", + __func__, mda_key_id); } } - return ret; + return (bool)ks; } #endif /* ifdef ENABLE_MANAGEMENT */