From patchwork Mon Nov 2 13:46:23 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gert Doering X-Patchwork-Id: 5548 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:6022:3119:b0:118:2077:975e with SMTP id e25csp5428468laa; Mon, 2 Nov 2026 05:46:43 -0800 (PST) X-Forwarded-Encrypted: i=2; AKwUvBx/uRoClP+R8qwoXdY5iOpSkO4APPwq54gAvXxzM84XYqAar/PJguX39MtopaudkBt8cLYjYISECog=@openvpn.net X-Received: by 2002:a05:7022:eb44:10b0:154:dc96:c1d8 with SMTP id a92af1059eb24-1ac56c9fda4mr15579002c88.2.1793627203280; Mon, 02 Nov 2026 05:46:43 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1793627203; cv=none; d=google.com; s=arc-20260327; b=EFfxb4xLs0EF61f5iTE1Tta9GcavM73JmTiFUiwV/RCzhR8HVBQuGJcqTy2zi0ybQs dCjQijiL9cdekgAxL/PvIe77tJ4r4FebBdvaz01QVdvJUk4OWRANXaEOH+axghKEJapA E2/1eyrpXFmTm4UyiH0KLo668ZcLN8Emy79dZuKpskoLotcyStBiRO4cC4A5szCLt6GB GixjcfaAH7s6Q+8sutQP0GMNOKrcz2+jZ/y3dX7CA8vgY7uhjKl5LO3/agKLw0cRUxyF M0ed9aVLkUCdd5V+T93fmw23xJIvUMKc5dnb8mPpmS36NpIsJOebel2AA6q/UGmisMUX bTIA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=7MRGuljW7EYmE/2txl8mx3iZ/MKSXfzGGSDCtDDfPw4=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=ONeZ3WhR9f9mKTzfNdihfPfloV9bmiIyquRqR6flyraW7KOeHY/kC1L2QDeJzopNEP 1+TkhBObCGkzPu58x4DYVIvrazOHO0pxXhUWkdFA6woKTChGyzewIRrPSFggXK3QOzY1 DCpqTwxBQTVRjI8n2bs3KJH0QQ0M672AIyC7s8jo2UBob4vr3SCa10qpZnoxjaOcN9sq zz7Bq617KTFMiS+w7E0EePWHHExSj358OoisakAjMj4EC0SdVP0Jw/jmjBIZLUvI9Aox DW2nY/HJ0/Eas8n0v3WAc123R+FYM3j7PkJ5i+6lM/qYbUqOFsNjSq/a3Qb0CEGg5hVJ +XVA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=iUFwNOcQ; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=ZQRN2PoJ; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=XpdpcpBo; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id a92af1059eb24-1ac1adbf581si29668674c88.77.2026.11.02.05.46.42 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 02 Nov 2026 05:46:43 -0800 (PST) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=iUFwNOcQ; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=ZQRN2PoJ; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=XpdpcpBo; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Unsubscribe-Post: List-Owner; bh=7MRGuljW7EYmE/2txl8mx3iZ/MKSXfzGGSDCtDDfPw4=; b=iUFwNOcQgPj3KL hAH49HzDymVhYcSJdaCBupNYzHt4aWcZTmg3JcQ3NmLu111RVLVtN/j3i4cT4ldR4KBG1bQvIAGcf dmK+HjHBDYo5QML/GshMrl3wVq3ffbTA6xUNZPy8HezR3sVmtrKHYr1EgdH/BXGxfvFaqkzK/x6d+ wSc=; Received: from [127.0.0.1] (helo=sfs-ml-3.v29.lw.sourceforge.com) by sfs-ml-3.v29.lw.sourceforge.com with esmtp (Exim 4.100.1) (envelope-from ) id 1xNsMx-000000006ZN-3yr3; Mon, 02 Nov 2026 13:46:39 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-3.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.100.1) (envelope-from ) id 1xNsMv-000000006ZG-3UwE for openvpn-devel@lists.sourceforge.net; Mon, 02 Nov 2026 13:46:37 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Unsubscribe-Post:List-Subscribe:List-Post:List-Owner:List-Archive; bh=bnbayoIajBpkcZsn17vQA2PL0MRIPHv8DW6VaYetUl8=; b=ZQRN2PoJZ+HFMbKNXj9MVGHan9 S2LLZd9dBjw84OiNot8gOKVcH4R3IeADp5xaDnEe/ku+zGbliPPI93qYwRAhCn2WFgbAY/FuUmTRu 3Qri6Sb85f3QG2+7kcieqLaVRM96gvtOOMx9Ki/jVOWwkE+wC6zC2CUQcbTi6JH4aJik=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Unsubscribe-Post: List-Subscribe:List-Post:List-Owner:List-Archive; bh=bnbayoIajBpkcZsn17vQA2PL0MRIPHv8DW6VaYetUl8=; b=XpdpcpBoux6ERlSJfY1Jvl1ydu OYySwHEX5Jd7IeXzKVU90vsnjIWUt1rhsf4bWoYh4vKND+UekIc7uFA0+gL+lEVO9cXqFI/ZL35ed ab71WQkwKC9X97rLhuWxS2h5b8+H3mTRNlGI4VHjDBlWrhM7PKB8nX6UcN5VtvJkfQS4=; Received: from [193.149.48.129] (helo=blue.greenie.muc.de) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.100.1) id 1xNsMt-000000000Tc-3gza for openvpn-devel@lists.sourceforge.net; Mon, 02 Nov 2026 13:46:37 +0000 Received: from blue.greenie.muc.de (localhost [127.0.0.1]) by blue.greenie.muc.de (8.18.1/8.18.1) with ESMTP id 6A2DkSmv026263 for ; Mon, 2 Nov 2026 14:46:28 +0100 Received: (from gert@localhost) by blue.greenie.muc.de (8.18.2/8.18.1/Submit) id 6A2DkS3i026262 for openvpn-devel@lists.sourceforge.net; Mon, 2 Nov 2026 14:46:28 +0100 From: Gert Doering To: openvpn-devel@lists.sourceforge.net Date: Mon, 2 Nov 2026 14:46:23 +0100 Message-ID: <20261102134628.26248-1-gert@greenie.muc.de> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-1.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Arne Schwabe This function allows us to map from a management key id to a key structure and also allows this function to be reused. Patch v2: add message when key is not found. Patch v3: only consider valid keys Content analysis details: (1.3 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS X-Headers-End: 1xNsMt-000000000Tc-3gza Subject: [Openvpn-devel] [PATCH v13] Introduce get_key_by_management_key_id helper function X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1880754438544358988 X-GMAIL-MSGID: 1880754438544358988 From: Arne Schwabe This function allows us to map from a management key id to a key structure and also allows this function to be reused. Patch v2: add message when key is not found. Patch v3: only consider valid keys Change-Id: I42d8785959c24bf688190965e58b9b98251b8557 Signed-off-by: Arne Schwabe Acked-by: Razvan Cojocaru Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1856 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1856 This mail reflects revision 13 of this Change. Acked-by according to Gerrit (reflected above): Razvan Cojocaru diff --git a/src/openvpn/ssl_common.h b/src/openvpn/ssl_common.h index 579f46c..9a55ead 100644 --- a/src/openvpn/ssl_common.h +++ b/src/openvpn/ssl_common.h @@ -764,4 +764,24 @@ return &multi->session[TM_ACTIVE].key[KS_PRIMARY]; } +#ifdef ENABLE_MANAGEMENT +/** + * Gets the \c key_state object that belongs to the management key id or + * return NULL if not found. + */ +static inline struct key_state * +get_key_by_management_key_id(struct tls_multi *multi, unsigned int mda_key_id) +{ + for (int i = 0; i < KEY_SCAN_SIZE; ++i) + { + struct key_state *ks = get_key_scan(multi, i); + if (ks->mda_key_id == mda_key_id && ks->state > S_UNDEF) + { + return ks; + } + } + return NULL; +} +#endif + #endif /* SSL_COMMON_H_ */ diff --git a/src/openvpn/ssl_verify.c b/src/openvpn/ssl_verify.c index 73e3696..077ee2d 100644 --- a/src/openvpn/ssl_verify.c +++ b/src/openvpn/ssl_verify.c @@ -1250,22 +1250,24 @@ tls_authenticate_key(struct tls_multi *multi, const unsigned int mda_key_id, const bool auth, const char *client_reason) { - bool ret = false; + struct key_state *ks = NULL; if (multi) { - int i; auth_set_client_reason(multi, client_reason); - for (i = 0; i < KEY_SCAN_SIZE; ++i) + ks = get_key_by_management_key_id(multi, mda_key_id); + + if (ks) { - struct key_state *ks = get_key_scan(multi, i); - if (ks->mda_key_id == mda_key_id) - { - ks->mda_status = auth ? ACF_SUCCEEDED : ACF_FAILED; - ret = true; - } + ks->mda_status = auth ? ACF_SUCCEEDED : ACF_FAILED; + } + else + { + msg(D_TLS_DEBUG_LOW, "%s: no key state found for management key id " + "%u", + __func__, mda_key_id); } } - return ret; + return (bool)ks; } #endif /* ifdef ENABLE_MANAGEMENT */