From patchwork Wed Nov 4 12:20:57 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gert Doering X-Patchwork-Id: 5592 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:6022:30a9:b0:118:2077:975e with SMTP id f41csp282414laa; Wed, 4 Nov 2026 04:21:14 -0800 (PST) X-Forwarded-Encrypted: i=2; AKwUvBxlQ+zkhZpgZF30LOGK6g2R4Jbv0H/CJmyEbNyCGTIdjb58g8D0C0icnsC1rCooSqsqcqsryIbddc4=@openvpn.net X-Received: by 2002:a05:701b:4514:20b0:181:6b8:31f1 with SMTP id a92af1059eb24-1a9494d8c4amr25564783c88.10.1793794874015; Wed, 04 Nov 2026 04:21:14 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1793794874; cv=none; d=google.com; s=arc-20260327; b=W38o9hNHQwKSeUoYtB0yKuJfVp5QWjL0dIr3r4fmnPZghOO37Et6L0YV4oKQZGo91E eFZIvQushpKrDAP2dM69yU+XzgcFBrJADs+BGONkaxgqHFygd+gLTgxSFnsgymkcFgrb jx5Hkj1+d5vb7oTUVYlBMbD7bxUkH7QUPJSr7bWp1LDdzXFgV68qkrB0HOdbrG815aBj tIn+65pqlZr9wLDgpgd3eC9vyliSAODC4q6zj1BYtHQZfHmk5QqeVL8lHmgDlg3nTbzR FgAui8e+EKGL6p51aWnnWGdMFBkiaqQJxBcUijci7f5vn7miJRvwx1QfvATEI+/bAdMX WzTg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=n//wZOdzvQ5M3DHD0T/fP5J1rYJxQAbPc/cG64tXNvY=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=B94E9ON6qIH9t0WKjbn0SR1cxE2pnkOZXFfOK+cHDz9ksyYIenD49oXBL21TaG4h58 QCbH5mtKzO21pn0weIh+9HRfMJjn1GspCkhcGUUjD2nNkOvbGgvOxIz9noegdEX1P5/v 6yIYBZCyDhvsfMDGptxLR371VAmuZPL7jxIDepPB+1nZ8wLu4Y503hN6iZCAcCfuyiLW il1Z/OvE5AiMZj9CKNW3pH6YrdvoMQlcigQnDeR5lmcdEnnF1n/7Z6ujjTOtA3ErRWXM Rh+rVqlnmJgH95zJyFsFH485Uv9ACujsDGk5bLC6nKHaSnAm65QSapqKe76lXjIGFk+F u2MA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=j6Vu4S+y; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=LoCDlvOp; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=X7pb+uS2; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id a92af1059eb24-1b245c277ecsi7507092c88.32.2026.11.04.04.21.13 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 04 Nov 2026 04:21:14 -0800 (PST) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=j6Vu4S+y; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=LoCDlvOp; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=X7pb+uS2; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Unsubscribe-Post: List-Owner; bh=n//wZOdzvQ5M3DHD0T/fP5J1rYJxQAbPc/cG64tXNvY=; b=j6Vu4S+yF4q8Kg L9ZmkY6UH1kq9Ade9Sitt9V9lNrv2ENJAthkBki+8wcOkPtmJ1i5lPx83Ebrk5YdaFdVoGmC1Z8zL JlqizZeX27XB0vJCUg4ryYHsV25g2F8MnjbgnXQRpA81EfGGxTCZo+N5+Fa1BA8lbECwQPBQbbt2P 9dI=; Received: from [127.0.0.1] (helo=sfs-ml-2.v29.lw.sourceforge.com) by sfs-ml-2.v29.lw.sourceforge.com with esmtp (Exim 4.100.1) (envelope-from ) id 1xOZzM-000000003O5-3qZH; Wed, 04 Nov 2026 12:21:12 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-2.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.100.1) (envelope-from ) id 1xOZzL-000000003Nx-0ucG for openvpn-devel@lists.sourceforge.net; Wed, 04 Nov 2026 12:21:11 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Unsubscribe-Post:List-Subscribe:List-Post:List-Owner:List-Archive; bh=hA5EqrKM4YxBjV2hYxQRdqo6MwHFh9XkbInf12vNu4k=; b=LoCDlvOpiKcgBdsk9CmplkZcOj TX7j2XCytUMepP0x9o07Yt77wvSvfHpAPJX1YCJM9bNQ8f6Y9bMeVef8hUm5dPICddwkdfBU/6KPC ztHFTWL79qnAuQmqusFtsrwKGAuzpScgTdhckCHjqBuUJqrk3HbhgmoiXrvCn4cTUZPs=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Unsubscribe-Post: List-Subscribe:List-Post:List-Owner:List-Archive; bh=hA5EqrKM4YxBjV2hYxQRdqo6MwHFh9XkbInf12vNu4k=; b=X7pb+uS2rcxyvmVxSg4M6bAq0v qHSf3F3Ubw4E79NOY/giCCk0Uis4GWok0VQYTUjc63qdeekEj8T0b+ENvTOeORNk7haRAzENEiejS 4kmPrjd9tedKjtopC/2IkhnQXb7H1b33y3UBx3da2xp1ykaPR4kq5C/ijz0hTa9YEqbA=; Received: from [193.149.48.129] (helo=blue.greenie.muc.de) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.100.1) id 1xOZzK-0000000088E-0DMV for openvpn-devel@lists.sourceforge.net; Wed, 04 Nov 2026 12:21:11 +0000 Received: from blue.greenie.muc.de (localhost [127.0.0.1]) by blue.greenie.muc.de (8.18.1/8.18.1) with ESMTP id 6A4CL3kh015650 for ; Wed, 4 Nov 2026 13:21:03 +0100 Received: (from gert@localhost) by blue.greenie.muc.de (8.18.2/8.18.1/Submit) id 6A4CL38q015649 for openvpn-devel@lists.sourceforge.net; Wed, 4 Nov 2026 13:21:03 +0100 From: Gert Doering To: openvpn-devel@lists.sourceforge.net Date: Wed, 4 Nov 2026 13:20:57 +0100 Message-ID: <20261104122103.15637-1-gert@greenie.muc.de> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Razvan Cojocaru CRYPT_ERROR() jumps to error_exit, so the hint about a client key generated for a different server key was never printed. Log it first, and drop a stray ')' from it. Content analysis details: (1.3 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS X-Headers-End: 1xOZzK-0000000088E-0DMV Subject: [Openvpn-devel] [PATCH v1] tls_crypt: print tls-crypt-v2 client key hint before CRYPT_ERROR X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1880930254040416543 X-GMAIL-MSGID: 1880930254040416543 From: Razvan Cojocaru CRYPT_ERROR() jumps to error_exit, so the hint about a client key generated for a different server key was never printed. Log it first, and drop a stray ')' from it. Broken since 7a477c16 ("Print a more user-friendly error when tls-crypt-v2 client auth fails"). Change-Id: Icab02b28773a409821fa9b80ccb1560d2796d1df Signed-off-by: Razvan Cojocaru Acked-by: Frank Lichtenheld Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2117 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2117 This mail reflects revision 1 of this Change. Acked-by according to Gerrit (reflected above): Frank Lichtenheld diff --git a/src/openvpn/tls_crypt.c b/src/openvpn/tls_crypt.c index 99e2411..e769190 100644 --- a/src/openvpn/tls_crypt.c +++ b/src/openvpn/tls_crypt.c @@ -488,9 +488,9 @@ { dmsg(D_CRYPTO_DEBUG, "tag : %s", format_hex(tag, sizeof(tag_check), 0, &gc)); dmsg(D_CRYPTO_DEBUG, "tag_check: %s", format_hex(tag_check, sizeof(tag_check), 0, &gc)); - CRYPT_ERROR("client key authentication error"); msg(D_TLS_DEBUG_LOW, "This might be a client-key that was generated for " - "a different tls-crypt-v2 server key)"); + "a different tls-crypt-v2 server key"); + CRYPT_ERROR("client key authentication error"); } if (BLENZ(&plaintext) < sizeof(client_key->keys))