Attention is currently required from: flichtenheld.
Hello flichtenheld,
I'd like you to reexamine a change. Please visit
http://gerrit.openvpn.net/c/openvpn/+/1856?usp=email
to look at the new patch set (#7).
The following approvals got outdated and were removed:
Code-Review-1 by flichtenheld
Change subject: Introduce get_key_by_management_key_id helper function
......................................................................
Introduce get_key_by_management_key_id helper function
This function allows us to map from a management key id to a key structure
and also allows this function to be reused.
Patch v2: add message when key is not found.
Patch v3: only consider valid keys
Change-Id: I42d8785959c24bf688190965e58b9b98251b8557
Signed-off-by: Arne Schwabe <[email protected]>
---
M src/openvpn/ssl_common.h
M src/openvpn/ssl_verify.c
2 files changed, 32 insertions(+), 10 deletions(-)
git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/56/1856/7
diff --git a/src/openvpn/ssl_common.h b/src/openvpn/ssl_common.h
index f6392f9..6b86bc0 100644
--- a/src/openvpn/ssl_common.h
+++ b/src/openvpn/ssl_common.h
@@ -759,4 +759,24 @@
return &multi->session[TM_ACTIVE].key[KS_PRIMARY];
}
+#ifdef ENABLE_MANAGEMENT
+/**
+ * Gets the \c key_state object that belongs to the management key id or
+ * return NULL if not found.
+ */
+static inline struct key_state *
+get_key_by_management_key_id(struct tls_multi *multi, unsigned int mda_key_id)
+{
+ for (int i = 0; i < KEY_SCAN_SIZE; ++i)
+ {
+ struct key_state *ks = get_key_scan(multi, i);
+ if (ks->mda_key_id == mda_key_id && ks->state > S_UNDEF)
+ {
+ return ks;
+ }
+ }
+ return NULL;
+}
+#endif
+
#endif /* SSL_COMMON_H_ */
diff --git a/src/openvpn/ssl_verify.c b/src/openvpn/ssl_verify.c
index 063fa5d..7375e87 100644
--- a/src/openvpn/ssl_verify.c
+++ b/src/openvpn/ssl_verify.c
@@ -1249,22 +1249,24 @@
tls_authenticate_key(struct tls_multi *multi, const unsigned int mda_key_id,
const bool auth,
const char *client_reason)
{
- bool ret = false;
+ struct key_state *ks = NULL;
if (multi)
{
- int i;
auth_set_client_reason(multi, client_reason);
- for (i = 0; i < KEY_SCAN_SIZE; ++i)
+ ks = get_key_by_management_key_id(multi, mda_key_id);
+
+ if (ks)
{
- struct key_state *ks = get_key_scan(multi, i);
- if (ks->mda_key_id == mda_key_id)
- {
- ks->mda_status = auth ? ACF_SUCCEEDED : ACF_FAILED;
- ret = true;
- }
+ ks->mda_status = auth ? ACF_SUCCEEDED : ACF_FAILED;
+ }
+ else
+ {
+ msg(D_TLS_DEBUG_LOW, "%s: no key state found for management key id
"
+ "%d",
+ __func__, mda_key_id);
}
}
- return ret;
+ return (bool)ks;
}
#endif /* ifdef ENABLE_MANAGEMENT */
--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1856?usp=email
To unsubscribe, or for help writing mail filters, visit
http://gerrit.openvpn.net/settings?usp=email
Gerrit-MessageType: newpatchset
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: I42d8785959c24bf688190965e58b9b98251b8557
Gerrit-Change-Number: 1856
Gerrit-PatchSet: 7
Gerrit-Owner: plaisthos <[email protected]>
Gerrit-Reviewer: flichtenheld <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>
Gerrit-Attention: flichtenheld <[email protected]>
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
