From patchwork Wed Nov 4 17:43:44 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gert Doering X-Patchwork-Id: 5601 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:6022:30a9:b0:118:2077:975e with SMTP id f41csp742063laa; Wed, 4 Nov 2026 09:44:02 -0800 (PST) X-Forwarded-Encrypted: i=2; AKwUvBwkoeenLbKxWoLECBBj4Sx3btJz0nh9Px0QM3iAf9zC+j5Mh37wI7sWX9iUjwSkZ/WuPM4pOE5tLKE=@openvpn.net X-Received: by 2002:a05:7301:9f04:b0:36a:15c3:2aaa with SMTP id 5a478bee46e88-36a4240bdd9mr36206989eec.29.1793814241656; Wed, 04 Nov 2026 09:44:01 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1793814241; cv=none; d=google.com; s=arc-20260327; b=WxvSzMD8EKO4CpkHGoUKAbpagmvQkTKa1F5+FHVDPLgCJe/t+gGfwTqX+KzGJsaGJt tK4xIooVix07Chyy0yu/DjHM3K+m4PbuP65YgHy4oBjy9fPbLZ/tLbU4tBCPu6VxWAeu 79MZd06sJsO0iDOZdnhwox8dQ04sE291KKntLiCRykSpUHoDufjODkHeQA1jWXSnzIBK ZRcvla0WqUKyQpSoTbctHBKf5ADG4qArifIt2icGqc9HURdxqT3/Rv9ARWqMwovMJS8o XwYXWqKN93bPpUqX6DSLwTykBNxor++g5yXruZlKtDmKwpfJATmt90uUYidZXmRM4FUN j5Ew== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=nJWkNMrThQLbD9YObbMOSgWmvprtu/lbGpinHChcrVk=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=cO9fsfMVJ04yGCM/DWqubU6H/zQf47G30j7xi7FCyKVxymgPPnl8cWdm4k+ulxoIpg 3wBrET/75MBouuor8h2U/6LCwJrzBxgw8c7Jf1bMYJ9zMANwbAYSfX1+zhCW1Ahe01qP VyZWaCOaHQw7BMyp/SB3sYvudAenBj5HUjx/mJTXbpmUE2c4yJX+/2NFz+tObnkak+4Z loamXK6lNwtv448NYZYPyCU6yIdh7qIB1b1ENy64EMk3eo9XPEmYNWjcB109Wk9g60jQ YAmnuiqSoXQQmTcsYh/FbOek8D+La+4ZFjcq+NYB9qD2bgdIHGpZNnkxdEIt5dGl5AI3 /xKw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=SbQRv2tX; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=dne64Ob1; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=XM2mDHlx; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 5a478bee46e88-36df28ebb13si125478eec.41.2026.11.04.09.44.01 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 04 Nov 2026 09:44:01 -0800 (PST) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=SbQRv2tX; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=dne64Ob1; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=XM2mDHlx; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Unsubscribe-Post: List-Owner; bh=nJWkNMrThQLbD9YObbMOSgWmvprtu/lbGpinHChcrVk=; b=SbQRv2tXAhbTKc w8pWrAKDtqEgRipWPdcH2elTdt4i7Y40pmxAOZQ0OMpzPeSeMY7IOt8FIWDl2meqhhu3QgylEv4So nn6QPV4LURpwWCH7SEF7LuovD29OtWiHHmN72+FgeRoVDMCmHD400dEZcgmXXlwJstQQr/oNPsauF iAw=; Received: from [127.0.0.1] (helo=sfs-ml-3.v29.lw.sourceforge.com) by sfs-ml-3.v29.lw.sourceforge.com with esmtp (Exim 4.100.1) (envelope-from ) id 1xOf1k-000000008R1-2iPg; Wed, 04 Nov 2026 17:44:00 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-3.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.100.1) (envelope-from ) id 1xOf1j-000000008Qu-09sn for openvpn-devel@lists.sourceforge.net; Wed, 04 Nov 2026 17:43:59 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Unsubscribe-Post:List-Subscribe:List-Post:List-Owner:List-Archive; bh=xrrfwMGgjOR1sb03Ad7yqIG8JhXacrpXL2sqQnYqeBQ=; b=dne64Ob1xmuvJ101slck6WqQju Jo9nCFPKWeCtG5CpiK6CWiSoLetz0njOZFQIJRBnkKqKU8sF3atTthzPuXxEGwCVUnfrn05yhXjT6 dX5iXibmXcS39p9aJTChpKuXPq9aJyhvVWAvvOwfsAS7NnGWfzOIeQr+k7RSWUhypAcE=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Unsubscribe-Post: List-Subscribe:List-Post:List-Owner:List-Archive; bh=xrrfwMGgjOR1sb03Ad7yqIG8JhXacrpXL2sqQnYqeBQ=; b=XM2mDHlxGGYgOW+fLxlkM+4mcV uDuCzvhRsvNjPLwni9wcN6t5eeTyFjYx2QsUOAnO2jpBB8L9wPM5htOoJj6nGQD0zZ/j6MQmwv24P 768hj1JTO5UeBPlggZ8AbDHlw1RXu6F2GZ910e503k6j/f9Z7UtkvixQaqAyVVzeck3E=; Received: from [193.149.48.129] (helo=blue.greenie.muc.de) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.100.1) id 1xOf1h-000000000P1-03Dv for openvpn-devel@lists.sourceforge.net; Wed, 04 Nov 2026 17:43:58 +0000 Received: from blue.greenie.muc.de (localhost [127.0.0.1]) by blue.greenie.muc.de (8.18.1/8.18.1) with ESMTP id 6A4Hho8E015285 for ; Wed, 4 Nov 2026 18:43:50 +0100 Received: (from gert@localhost) by blue.greenie.muc.de (8.18.2/8.18.1/Submit) id 6A4HhoL7015284 for openvpn-devel@lists.sourceforge.net; Wed, 4 Nov 2026 18:43:50 +0100 From: Gert Doering To: openvpn-devel@lists.sourceforge.net Date: Wed, 4 Nov 2026 18:43:44 +0100 Message-ID: <20261104174350.15275-1-gert@greenie.muc.de> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Razvan Cojocaru The function cannot fail since a4eeef17 ("Add function for common env setting of verify user/pass calls") moved the username check out of it, so it always returned KMDA_SUCCESS and man_def_auth could [...] Content analysis details: (1.3 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URI: openvpn.net] 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS X-Headers-End: 1xOf1h-000000000P1-03Dv Subject: [Openvpn-devel] [PATCH v2] ssl_verify: drop the return value of verify_user_pass_management() X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1880950562245543881 X-GMAIL-MSGID: 1880950562245543881 From: Razvan Cojocaru The function cannot fail since a4eeef17 ("Add function for common env setting of verify user/pass calls") moved the username check out of it, so it always returned KMDA_SUCCESS and man_def_auth could never become KMDA_ERROR. Make it void, track only whether deferred management auth is enabled, and drop the KMDA_* codes. Change-Id: I04c128a934e9a2e767394dbe82427df2ee886178 Signed-off-by: Razvan Cojocaru Acked-by: Frank Lichtenheld Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2118 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2118 This mail reflects revision 2 of this Change. Acked-by according to Gerrit (reflected above): Frank Lichtenheld diff --git a/src/openvpn/ssl_verify.c b/src/openvpn/ssl_verify.c index 0cdec1e..f5af932 100644 --- a/src/openvpn/ssl_verify.c +++ b/src/openvpn/ssl_verify.c @@ -1521,18 +1521,9 @@ #ifdef ENABLE_MANAGEMENT -/* - * management deferred internal ssl_verify.c status codes - */ -#define KMDA_ERROR 0 -#define KMDA_SUCCESS 1 -#define KMDA_UNDEF 2 -#define KMDA_DEF 3 - -static int +static void verify_user_pass_management(struct tls_session *session, const struct user_pass *up) { - int retval = KMDA_ERROR; const struct key_state *ks = &session->key[KS_PRIMARY]; /* primary key */ /* set username/password in private env space */ @@ -1545,10 +1536,6 @@ } setenv_del(session->opt->es, "password"); - - retval = KMDA_SUCCESS; - - return retval; } #endif /* ifdef ENABLE_MANAGEMENT */ @@ -1613,12 +1600,7 @@ ASSERT(up && !up->protected); #ifdef ENABLE_MANAGEMENT - int man_def_auth = KMDA_UNDEF; - - if (management_enable_def_auth(management)) - { - man_def_auth = KMDA_DEF; - } + const bool man_def_auth = management_enable_def_auth(management); #endif /* enforce character class restrictions in username/password */ @@ -1706,9 +1688,9 @@ if (!skip_auth) { #ifdef ENABLE_MANAGEMENT - if (man_def_auth == KMDA_DEF) + if (man_def_auth) { - man_def_auth = verify_user_pass_management(session, up); + verify_user_pass_management(session, up); } #endif if (plugin_defined(session->opt->plugins, OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY)) @@ -1736,11 +1718,7 @@ bool script_ok = script_status == OPENVPN_PLUGIN_FUNC_SUCCESS || script_status == OPENVPN_PLUGIN_FUNC_DEFERRED; - if (script_ok && plugin_ok && tls_lock_username(multi, up->username) -#ifdef ENABLE_MANAGEMENT - && man_def_auth != KMDA_ERROR -#endif - ) + if (script_ok && plugin_ok && tls_lock_username(multi, up->username)) { ks->authenticated = KS_AUTH_TRUE; if (plugin_status == OPENVPN_PLUGIN_FUNC_DEFERRED @@ -1749,7 +1727,7 @@ ks->authenticated = KS_AUTH_DEFERRED; } #ifdef ENABLE_MANAGEMENT - if (man_def_auth != KMDA_UNDEF) + if (man_def_auth) { if (skip_auth) {