From patchwork Wed Oct 28 20:28:32 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gert Doering X-Patchwork-Id: 5523 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:6022:340f:b0:118:2077:975e with SMTP id by15csp2230954lab; Wed, 28 Oct 2026 13:28:50 -0700 (PDT) X-Forwarded-Encrypted: i=2; AKwUvBzufFudnEU7oLJRAJEgrOXeCQUSRvBHVisg+V9T+A+mT5NVTahDUv3nZFtyJb5f0cDRP//9duoAtu8=@openvpn.net X-Received: by 2002:a05:6808:2388:b0:55b:f97a:2439 with SMTP id 5614622812f47-56381c890f1mr2393398b6e.14.1793219330343; Wed, 28 Oct 2026 13:28:50 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1793219330; cv=none; d=google.com; s=arc-20260327; b=VLBM0SqEUXlfNGXmtDnYOMDbagqOaAr7p/jfwgvg822v73edEN6oIE6JSuAtVwfxJx y02/XyCP3EJ+K08U1/73k1OC2PTedo8gytwkWXQdvDAMDR7KXDA+ELJJDrN6e1iUF8Ui FUO4MB3wtd3aDUxnYrlPYiOKwI3pM6d9/g/xvrf4UEj8BdRUBRjvhNJM50pkefF2514v Hy3KDNYjuDwTWnLds1inmYz5Gl+7wO/+c/BmNDQQnPZyWU/HT2I/BqTLAVNTMHpjTNbO RCYUeo97cc68Ah7KnbErulUlDj/HjYlMlcaVg3VmNwpP/ueKSDRCsD/jC2u3P+fuOCFB 7mLg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=kstM9lHvMsIRp/iv1nLCghB32a5vin5oAkPHC1lu+rQ=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=cbZoyXE18M+7lzOgmt2x5eWz3LPyAByA3l0L1hkYjK1CduHVbNV0XZMsr3+zL22EM3 1Fc47vDEHlZaZx6xFWmd7k1DMMCdUXAqph2REppXUcE7joDd7T3rbUvS1yEgeHUjbEXX 2CNtj0aA19Q9SxoYVE0AuNsZQLNwJeL6MzQrNW4s4BFPtsszE7gf51GSDCnmO9JreHNl YwIgUeLEVhyfVkNw5K2/KZXECYl1GNDp7wVp+R4RxH8KMPdT3iKOb+U7jMgKQVNynnPj iux8LWqs+oui+wiMkI5oKo+2B0CNi1UjcBrIU6/vU8KRCPIZc1GDnzojdkctBxUaT5fU unrg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=fDvbOllb; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=gLDBH9Lp; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=avv74TCY; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 5614622812f47-563c9448b97si3409073b6e.127.2026.10.28.13.28.50 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 28 Oct 2026 13:28:50 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=fDvbOllb; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=gLDBH9Lp; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=avv74TCY; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Unsubscribe-Post: List-Owner; bh=kstM9lHvMsIRp/iv1nLCghB32a5vin5oAkPHC1lu+rQ=; b=fDvbOllbUl4wSB 7JjXRaLCCaYCbF2wu9oMiPPrDavtUxMdiAf7vbx/qZv7pyTsjVIxT1L0iOWapXyERufpq5tUA2KzC LTXwYagzeomvTvmDG+Bx8QQ/6K8iUqvXE2Tlag/zZ1AGgHGPtrINHVGfy1IKa24JRP6Fl33Qg+5+z JLU=; Received: from [127.0.0.1] (helo=sfs-ml-1.v29.lw.sourceforge.com) by sfs-ml-1.v29.lw.sourceforge.com with esmtp (Exim 4.100.1) (envelope-from ) id 1xMAGO-0000000013l-1MY2; Wed, 28 Oct 2026 20:28:48 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-1.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.100.1) (envelope-from ) id 1xMAGM-0000000013e-18eC for openvpn-devel@lists.sourceforge.net; Wed, 28 Oct 2026 20:28:46 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Unsubscribe-Post:List-Subscribe:List-Post:List-Owner:List-Archive; bh=ALdFeJqzq8QUtZqtxXka0U/wtumFWQVjskVe34WAQjg=; b=gLDBH9LpmRWiNFuHs8k7iZ8+3T KyBBftNeb4Rr9xvyLiee8xcbwwoyC18A/2k0FsiEbDsTB6pTtc0btWjou5fynvlzEoZf4hGr5vclm FT8/vOcaOkfEYzoLCy9wRjmXhupQ5oIU51mBG7z8CPx3dTq4wfwY2XuRDp2UkZCRJoW4=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Unsubscribe-Post: List-Subscribe:List-Post:List-Owner:List-Archive; bh=ALdFeJqzq8QUtZqtxXka0U/wtumFWQVjskVe34WAQjg=; b=avv74TCYzZtvi/XgkqxO3RrHbr UOs7I/eFsxDrcx3lq/OKrE5pDlUi1zugRT0/8PW6MFPDprKdVngCjPVNLWuliBKfVHLkg2gHwy9WW 0Fs4swM1bzzcqzCaJIKy0AcnbR4frjExjjK5fzOFHa47hmihfnX3NeGyDdpP47V1MB/w=; Received: from [193.149.48.129] (helo=blue.greenie.muc.de) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.100.1) id 1xMAGL-000000002Pj-1O9y for openvpn-devel@lists.sourceforge.net; Wed, 28 Oct 2026 20:28:46 +0000 Received: from blue.greenie.muc.de (localhost [127.0.0.1]) by blue.greenie.muc.de (8.18.1/8.18.1) with ESMTP id 69SKScln014820 for ; Wed, 28 Oct 2026 21:28:38 +0100 Received: (from gert@localhost) by blue.greenie.muc.de (8.18.2/8.18.1/Submit) id 69SKScnw014819 for openvpn-devel@lists.sourceforge.net; Wed, 28 Oct 2026 21:28:38 +0100 From: Gert Doering To: openvpn-devel@lists.sourceforge.net Date: Wed, 28 Oct 2026 21:28:32 +0100 Message-ID: <20261028202838.14796-1-gert@greenie.muc.de> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Arne Schwabe In the past we used the real address hash as proxy for the number of connected clients. TCP connections do not really need this and we might remove adding them to this hash map in the future. UDP conn [...] Content analysis details: (1.3 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS X-Headers-End: 1xMAGL-000000002Pj-1O9y Subject: [Openvpn-devel] [PATCH v2] Track number of assigned peer ids and use it for max-clients check X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1880326752268158655 X-GMAIL-MSGID: 1880326752268158655 From: Arne Schwabe In the past we used the real address hash as proxy for the number of connected clients. TCP connections do not really need this and we might remove adding them to this hash map in the future. UDP connections only need to be added to this hash map in a later stage of the connection process and then only for peers that do not support DATA_V2. Instead have a simple counter that is kept up to date when a peer id is assigned and freed. This also allows this to be decoupled from the real addresses hash. Reported-by: Ar-maan05 https://github.com/OpenVPN/openvpn/issues/1127 Github: Closes OpenVPN/openvpn#1127 Change-Id: Iad51b2f31e4215c58e160cc6239836015ea4d3cf Signed-off-by: Arne Schwabe Acked-by: Razvan Cojocaru Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2064 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2064 This mail reflects revision 2 of this Change. Acked-by according to Gerrit (reflected above): Razvan Cojocaru diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c index e302a81..82757f4 100644 --- a/src/openvpn/multi.c +++ b/src/openvpn/multi.c @@ -621,6 +621,8 @@ { m->max_peerid--; } + + m->assigned_peer_ids--; } schedule_remove_entry(m->schedule, (struct schedule_entry *)mi); @@ -749,7 +751,7 @@ mi->context.c2.tls_multi->multi_state = CAS_NOT_CONNECTED; - if (hash_n_elements(m->hash) >= m->max_clients) + if (m->assigned_peer_ids >= m->max_clients) { msg(D_MULTI_ERRORS, "MULTI: new incoming connection would exceed maximum number of clients (%u)", @@ -4219,6 +4221,8 @@ { m->max_peerid = mi->context.c2.tls_multi->rx_peer_id; } + + m->assigned_peer_ids++; } /** diff --git a/src/openvpn/multi.h b/src/openvpn/multi.h index 5db7147..cc7ccd3 100644 --- a/src/openvpn/multi.h +++ b/src/openvpn/multi.h @@ -174,6 +174,8 @@ uint32_t max_peerid; /**< highest currently allocated peer-id * and maximum allocated/valid index in * instances */ + uint32_t assigned_peer_ids; /**< Number of peer-ids that are + * currently assigned */ struct hash *hash; /**< VPN tunnel instances indexed by real * address of the remote peer. */ struct hash *vhash; /**< VPN tunnel instances indexed by