So, the need for this is "not directly obvious", because, "everything
works fine", no? Discussed this on IRC with Antonio and Gianmarco, and
the finding they made is that basically this is just working by accident,
given that the event handler does not work really well for setups with
multiple UDP sockets having activity at the same time. Gerrit#1635 sets
out to fix this - and uncovers that our "initial packet reply" code
is misbehaving, so if you have multiple sockets receiving RESET packets
at the same time, replies get sent to the wrong address. Very bad.
Now, to trigger this, you need to actually have multiple sockets at
the same time, *and* lots of concurrent connection activities - which
is not very typical at steady state, but after restarting a busy server,
this might get hit.
I have stared at it "and it seems to make sense", and also my t_server
testbed passes all server side tests just fine - so it's not breaking
anything ;-) - also, Arne had a close look and since he understands the
initial handshake bits best, if he's fine, so am I.
Your patch has been applied to the master and release/2.7 branch (bugfix).
commit 9a80d609674b70324abf23ded4d2133f967f99d3
Author: Antonio Quartulli
Date: Mon Jun 8 08:02:20 2026 +0200
mudp: send HMAC reset reply synchronously
Signed-off-by: Antonio Quartulli <[email protected]>
Acked-by: Arne Schwabe <[email protected]>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1702
Message-Id: <[email protected]>
URL:
https://www.mail-archive.com/[email protected]/msg37081.html
Signed-off-by: Gert Doering <[email protected]>
--
kind regards,
Gert Doering
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
