From patchwork Mon Nov 2 11:58:13 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gert Doering X-Patchwork-Id: 5544 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:6022:3119:b0:118:2077:975e with SMTP id e25csp5300497laa; Mon, 2 Nov 2026 03:58:34 -0800 (PST) X-Forwarded-Encrypted: i=2; AKwUvBzy/Q09vF8m2iDvH155fZSAKrhHnLBQQrARhRGgJ2K8DYK3mmMA+1s6gF5RzSzRtmtVeE30iC+XXy0=@openvpn.net X-Received: by 2002:a05:701b:2411:b0:167:4198:2cb3 with SMTP id a92af1059eb24-1b2366f4972mr1946703c88.18.1793620713847; Mon, 02 Nov 2026 03:58:33 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1793620713; cv=none; d=google.com; s=arc-20260327; b=HX09fUIhoUdKbwh9ALjh91IrP78w445zM4uEmXU00BytZG4hVX+mXeUCSHSZk609Em O08DRmvw6aIySl/mTHanq18D9fP5jc48VbpW1MJ7fiAhGM7HwfJNsSrSRmmOqYRwWB1f metwgL+2dx4Bkfr3NcShW+2S4AenCC3Kt2WHJiECdrryt/VRVzIUj7+1n0B6GrbSG3/4 wp1BH5K68K/HhJW5R9DvWIAnY2ID+6Oqhdn/bC3lWmR2mJjM2Xx81NpZZyOJA4OoSv/h KK+PTsTXBN+lfyB3ZyqbPzFvSKEopWncaDCvecCi0dE5SRuk8q6A2rPpuExKMehG1MjC 1XJw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=kxPxRbgEI2GjU/SV34T1q6Gtms457XjwUgpAdubhtNk=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=lyMTWkPafsFJTSYvv7LHdslkZO1ZD6QDFQKVMKN9Hb1P6VtU9qb1WHrpMVCi7WBgQW 3Y665748OkMYtsoHJVxjWjhWKolj24qSQmtjWJvUDstSDR2ILYr4hZrT5jZJceRZoFhd K4rUfN6fW4VI6GII+y8Ydpni7ipBQtFj19j46EsDyuiyB4mdulp5ANX8F0PDyqxe/kbN dkEYUWFIMFQ3Ven0yYMykE+KxWPft9FNsMwT33xHkTnb16LR3Q2O04OVaJVhw+O5ed86 WCWobsvhNgsFLIFwcb13Zg/pzPquNRYasS3t7tEzLs9CH/Ypr5l68gG86MeAAuMsVmB8 +6/A==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=Nv82cEBC; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b="dEzeVN/s"; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=fNa+eHQ7; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id a92af1059eb24-1ac1b19c325si37735595c88.82.2026.11.02.03.58.33 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 02 Nov 2026 03:58:33 -0800 (PST) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=Nv82cEBC; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b="dEzeVN/s"; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=fNa+eHQ7; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Unsubscribe-Post: List-Owner; bh=kxPxRbgEI2GjU/SV34T1q6Gtms457XjwUgpAdubhtNk=; b=Nv82cEBCpqeh5p tBxyLDrZaDajCC5h5Q1n+Inh1N3KVuLATgNQ7n+qPzw+8wbVSCzZLm5DLl0jyt//ERmmWt7oWN9I4 0SrqYY6uuNz0hERh+6Op0dLJwd/5WcDLrjP8fhoa5fmYidPuBlyZBkX1EEykcJd78wvMeL3YAPMhX FSs=; Received: from [127.0.0.1] (helo=sfs-ml-2.v29.lw.sourceforge.com) by sfs-ml-2.v29.lw.sourceforge.com with esmtp (Exim 4.100.1) (envelope-from ) id 1xNqgK-000000005jy-2S9R; Mon, 02 Nov 2026 11:58:32 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-2.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.100.1) (envelope-from ) id 1xNqgF-000000005jV-2Knz for openvpn-devel@lists.sourceforge.net; Mon, 02 Nov 2026 11:58:27 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Unsubscribe-Post:List-Subscribe:List-Post:List-Owner:List-Archive; bh=1DxaacC0+6FGJwOt96JmLDqj3IU4Az1xVsO03UOJ3KM=; b=dEzeVN/sX2xcU4GCw4J7i++ACs EdY59X1nOofMJo3uPke88svosivvilTdrNyYxFHXe3vcvz5lmiDfSuna2h6n0vpJdfP139uuMCOao 7fmaoQ4Fhpn1dvCKhoSg06PiKSjRbz0zxfeHDy7C8whDIUhA9HnYjnsUM0J/X2FKp+7w=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Unsubscribe-Post: List-Subscribe:List-Post:List-Owner:List-Archive; bh=1DxaacC0+6FGJwOt96JmLDqj3IU4Az1xVsO03UOJ3KM=; b=fNa+eHQ7IKUc438PISnvtV4fGF CCo+nQTB6b7dOlDOzyepcRXSLbKKwia6Ty4Jgd9zVf6hL3hXdokkYkSOqG7gm9pI7wp10Oa2PREg4 o3HPeoStc4hERN1HNTsT2bSF15CrbXxp/tD+I/Pg/GvBQAyKhgPDm893POjnZXMJsHec=; Received: from [193.149.48.129] (helo=blue.greenie.muc.de) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.100.1) id 1xNqgD-000000005z5-3iQc for openvpn-devel@lists.sourceforge.net; Mon, 02 Nov 2026 11:58:27 +0000 Received: from blue.greenie.muc.de (localhost [127.0.0.1]) by blue.greenie.muc.de (8.18.1/8.18.1) with ESMTP id 6A2BwINb014201 for ; Mon, 2 Nov 2026 12:58:18 +0100 Received: (from gert@localhost) by blue.greenie.muc.de (8.18.2/8.18.1/Submit) id 6A2BwIq7014200 for openvpn-devel@lists.sourceforge.net; Mon, 2 Nov 2026 12:58:18 +0100 From: Gert Doering To: openvpn-devel@lists.sourceforge.net Date: Mon, 2 Nov 2026 12:58:13 +0100 Message-ID: <20261102115818.14189-1-gert@greenie.muc.de> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-1.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Razvan Cojocaru The file name was passed as the is_inline flag, so the check was always skipped. Pass extra_certs_file_inline instead. Broken since cb2e9218 ("convert *_inline attributes to bool"). Content analysis details: (1.3 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS X-Headers-End: 1xNqgD-000000005z5-3iQc Subject: [Openvpn-devel] [PATCH v1] check_file_access: fix --extra-certs access check X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1880747633252735303 X-GMAIL-MSGID: 1880747633252735303 From: Razvan Cojocaru The file name was passed as the is_inline flag, so the check was always skipped. Pass extra_certs_file_inline instead. Broken since cb2e9218 ("convert *_inline attributes to bool"). Change-Id: Ia3f6dd4ce35869c92619ce0c56eeda8796bde006 Signed-off-by: Razvan Cojocaru Acked-by: Frank Lichtenheld Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2084 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2084 This mail reflects revision 1 of this Change. Acked-by according to Gerrit (reflected above): Frank Lichtenheld diff --git a/src/openvpn/check_file_access.c b/src/openvpn/check_file_access.c index 83654b2..25d7f90 100644 --- a/src/openvpn/check_file_access.c +++ b/src/openvpn/check_file_access.c @@ -267,7 +267,7 @@ errs |= check_file_access_inline(options->cert_file_inline, CHKACC_FILE | CHKACC_ACCEPT_URI, options->cert_file, R_OK, "--cert"); - errs |= check_file_access_inline(options->extra_certs_file, CHKACC_FILE, + errs |= check_file_access_inline(options->extra_certs_file_inline, CHKACC_FILE, options->extra_certs_file, R_OK, "--extra-certs"); if (!(options->management_flags & MF_EXTERNAL_KEY))