[Openvpn-devel] [S] Change in openvpn[master]: PUSH_UPDATE: disabling PUSH_UPDATE server and client if DCO is enabled

2025-10-18 Thread mrbff (Code Review) 
Attention is currently required from: cron2, flichtenheld, mrbff, plaisthos.

Hello cron2, flichtenheld, plaisthos,

I'd like you to reexamine a change. Please visit

http://gerrit.openvpn.net/c/openvpn/+/1245?usp=email

to look at the new patch set (#6).


Change subject: PUSH_UPDATE: disabling PUSH_UPDATE server and client if DCO is 
enabled
..

PUSH_UPDATE: disabling PUSH_UPDATE server and client if DCO is enabled

The PUSH_UPDATE currently doesn't work with DCO.
For example, in server, if a new ifconfig is sent, the DCO
doesn't receive the new peer address and the connection drops.
Similarly in the client when a PUSH_UPDATE is received, the tun is
closed and reopened but the DCO doesn't receive the peer info.

Change-Id: Ibe78949435bb2f26ad68301e2710321bf37c9486
Signed-off-by: Marco Baffo 
---
M src/openvpn/push.c
M src/openvpn/push_util.c
M src/openvpn/ssl.c
M tests/unit_tests/openvpn/test_push_update_msg.c
4 files changed, 20 insertions(+), 3 deletions(-)


  git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/45/1245/6

diff --git a/src/openvpn/push.c b/src/openvpn/push.c
index e7fc50c..0c8eb84 100644
--- a/src/openvpn/push.c
+++ b/src/openvpn/push.c
@@ -1112,6 +1112,12 @@
 }
 else if (honor_received_options && buf_string_compare_advance(&buf, 
push_update_cmd))
 {
+if (dco_enabled(&c->options))
+{
+msg(M_WARN, "WARN: PUSH_UPDATE messages cannot currently be 
processed in client mode while DCO is enabled, ignoring."
+" To be able to process PUSH_UPDATE messages, be sure 
to use the --disable-dco option.");
+return PUSH_MSG_ERROR;
+}
 return process_incoming_push_update(c, permission_mask, 
option_types_found, &buf, false);
 }
 else
diff --git a/src/openvpn/push_util.c b/src/openvpn/push_util.c
index 9138bdb..f306104 100644
--- a/src/openvpn/push_util.c
+++ b/src/openvpn/push_util.c
@@ -191,6 +191,13 @@
 int
 send_push_update(struct multi_context *m, const void *target, const char *msg, 
const push_update_type type, const int push_bundle_size)
 {
+if (dco_enabled(&m->top.options))
+{
+msg(M_WARN, "WARN: PUSH_UPDATE messages cannot currently be sent while 
DCO is enabled."
+" To send a PUSH_UPDATE message, be sure to use the 
--disable-dco option.");
+return 0;
+}
+
 if (!msg || !*msg || !m
 || (!target && type != UPT_BROADCAST))
 {
@@ -294,7 +301,6 @@
 } \
 } while (0)

-
 bool
 management_callback_send_push_update_broadcast(void *arg, const char *options)
 {
diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c
index 34036f2..567560f 100644
--- a/src/openvpn/ssl.c
+++ b/src/openvpn/ssl.c
@@ -1926,8 +1926,12 @@
 /* support for exit notify via control channel */
 iv_proto |= IV_PROTO_CC_EXIT_NOTIFY;

-/* support push-updates */
-iv_proto |= IV_PROTO_PUSH_UPDATE;
+/* currently push-update is not supported when DCO is enabled */
+if (!session->opt->dco_enabled)
+{
+/* support push-updates */
+iv_proto |= IV_PROTO_PUSH_UPDATE;
+}

 if (session->opt->pull)
 {
diff --git a/tests/unit_tests/openvpn/test_push_update_msg.c 
b/tests/unit_tests/openvpn/test_push_update_msg.c
index 8a5beeb..6e49f14 100644
--- a/tests/unit_tests/openvpn/test_push_update_msg.c
+++ b/tests/unit_tests/openvpn/test_push_update_msg.c
@@ -465,6 +465,7 @@
 m->instances = calloc(1, sizeof(struct multi_instance *));
 struct multi_instance *mi = calloc(1, sizeof(struct multi_instance));
 *(m->instances) = mi;
+m->top.options.disable_dco = true;
 *state = m;
 return 0;
 }

--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1245?usp=email
To unsubscribe, or for help writing mail filters, visit 
http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: newpatchset
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Ibe78949435bb2f26ad68301e2710321bf37c9486
Gerrit-Change-Number: 1245
Gerrit-PatchSet: 6
Gerrit-Owner: mrbff 
Gerrit-Reviewer: cron2 
Gerrit-Reviewer: flichtenheld 
Gerrit-Reviewer: plaisthos 
Gerrit-CC: openvpn-devel 
Gerrit-CC: ordex 
Gerrit-Attention: plaisthos 
Gerrit-Attention: cron2 
Gerrit-Attention: flichtenheld 
Gerrit-Attention: mrbff 
___
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

[Openvpn-devel] [S] Change in openvpn[master]: PUSH_UPDATE: disabling PUSH_UPDATE server and client if DCO is enabled

2025-10-18 Thread cron2 (Code Review) 
cron2 has submitted this change. ( 
http://gerrit.openvpn.net/c/openvpn/+/1245?usp=email )

Change subject: PUSH_UPDATE: disabling PUSH_UPDATE server and client if DCO is 
enabled
..

PUSH_UPDATE: disabling PUSH_UPDATE server and client if DCO is enabled

The PUSH_UPDATE currently doesn't work with DCO.
For example, in server, if a new ifconfig is sent, the DCO
doesn't receive the new peer address and the connection drops.
Similarly in the client when a PUSH_UPDATE is received, the tun is
closed and reopened but the DCO doesn't receive the peer info.

Change-Id: Ibe78949435bb2f26ad68301e2710321bf37c9486
Signed-off-by: Marco Baffo 
Acked-by: Antonio Quartulli 
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1245
Message-Id: <[email protected]>
URL: https://sourceforge.net/p/openvpn/mailman/message/59243711/
Signed-off-by: Gert Doering 
---
M src/openvpn/push.c
M src/openvpn/push_util.c
M src/openvpn/ssl.c
M tests/unit_tests/openvpn/test_push_update_msg.c
4 files changed, 20 insertions(+), 3 deletions(-)




diff --git a/src/openvpn/push.c b/src/openvpn/push.c
index e7fc50c..0c8eb84 100644
--- a/src/openvpn/push.c
+++ b/src/openvpn/push.c
@@ -1112,6 +1112,12 @@
 }
 else if (honor_received_options && buf_string_compare_advance(&buf, 
push_update_cmd))
 {
+if (dco_enabled(&c->options))
+{
+msg(M_WARN, "WARN: PUSH_UPDATE messages cannot currently be 
processed in client mode while DCO is enabled, ignoring."
+" To be able to process PUSH_UPDATE messages, be sure 
to use the --disable-dco option.");
+return PUSH_MSG_ERROR;
+}
 return process_incoming_push_update(c, permission_mask, 
option_types_found, &buf, false);
 }
 else
diff --git a/src/openvpn/push_util.c b/src/openvpn/push_util.c
index 9138bdb..f306104 100644
--- a/src/openvpn/push_util.c
+++ b/src/openvpn/push_util.c
@@ -191,6 +191,13 @@
 int
 send_push_update(struct multi_context *m, const void *target, const char *msg, 
const push_update_type type, const int push_bundle_size)
 {
+if (dco_enabled(&m->top.options))
+{
+msg(M_WARN, "WARN: PUSH_UPDATE messages cannot currently be sent while 
DCO is enabled."
+" To send a PUSH_UPDATE message, be sure to use the 
--disable-dco option.");
+return 0;
+}
+
 if (!msg || !*msg || !m
 || (!target && type != UPT_BROADCAST))
 {
@@ -294,7 +301,6 @@
 } \
 } while (0)

-
 bool
 management_callback_send_push_update_broadcast(void *arg, const char *options)
 {
diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c
index 34036f2..567560f 100644
--- a/src/openvpn/ssl.c
+++ b/src/openvpn/ssl.c
@@ -1926,8 +1926,12 @@
 /* support for exit notify via control channel */
 iv_proto |= IV_PROTO_CC_EXIT_NOTIFY;

-/* support push-updates */
-iv_proto |= IV_PROTO_PUSH_UPDATE;
+/* currently push-update is not supported when DCO is enabled */
+if (!session->opt->dco_enabled)
+{
+/* support push-updates */
+iv_proto |= IV_PROTO_PUSH_UPDATE;
+}

 if (session->opt->pull)
 {
diff --git a/tests/unit_tests/openvpn/test_push_update_msg.c 
b/tests/unit_tests/openvpn/test_push_update_msg.c
index 8a5beeb..6e49f14 100644
--- a/tests/unit_tests/openvpn/test_push_update_msg.c
+++ b/tests/unit_tests/openvpn/test_push_update_msg.c
@@ -465,6 +465,7 @@
 m->instances = calloc(1, sizeof(struct multi_instance *));
 struct multi_instance *mi = calloc(1, sizeof(struct multi_instance));
 *(m->instances) = mi;
+m->top.options.disable_dco = true;
 *state = m;
 return 0;
 }

--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1245?usp=email
To unsubscribe, or for help writing mail filters, visit 
http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: merged
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Ibe78949435bb2f26ad68301e2710321bf37c9486
Gerrit-Change-Number: 1245
Gerrit-PatchSet: 7
Gerrit-Owner: mrbff 
Gerrit-Reviewer: cron2 
Gerrit-Reviewer: flichtenheld 
Gerrit-Reviewer: ordex 
Gerrit-Reviewer: plaisthos 
Gerrit-CC: openvpn-devel 
___
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

[Openvpn-devel] [S] Change in openvpn[master]: PUSH_UPDATE: disabling PUSH_UPDATE server and client if DCO is enabled

2025-10-18 Thread mrbff (Code Review) 
Attention is currently required from: cron2, flichtenheld, ordex, plaisthos.

mrbff has posted comments on this change by mrbff. ( 
http://gerrit.openvpn.net/c/openvpn/+/1245?usp=email )

Change subject: PUSH_UPDATE: disabling PUSH_UPDATE server and client if DCO is 
enabled
..


Patch Set 6:

(4 comments)

File src/openvpn/push.c:

http://gerrit.openvpn.net/c/openvpn/+/1245/comment/3127766f_33b50006?usp=email :
PS5, Line 1117: msg(M_WARN, "WARN: PUSH_UPDATE messages cannot 
currently be received while DCO is enabled, ignoring."
> I'd reword: "be received while.." -> "be processed in client mode while.. […]
Done


http://gerrit.openvpn.net/c/openvpn/+/1245/comment/c5e2e7d0_4498f1b8?usp=email :
PS5, Line 1118: " To receive PUSH_UPDATE messages, be 
sure to use the --disable-dco option.");
> I'd reword: "To receive.." -> "To be able to process.. […]
Done


File src/openvpn/push_util.c:

http://gerrit.openvpn.net/c/openvpn/+/1245/comment/13c28d61_88982957?usp=email :
PS5, Line 301: if (dco_enabled(&m->top.options))
> Why not doing this check only once at the beginning of `send_push_update()` ?
Done


http://gerrit.openvpn.net/c/openvpn/+/1245/comment/b41cfce5_b268256b?usp=email :
PS5, Line 301: if (dco_enabled(&m->top.options))
> Why not doing this check only once at the beginning of `send_push_update()` ?
Done



--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1245?usp=email
To unsubscribe, or for help writing mail filters, visit 
http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: comment
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Ibe78949435bb2f26ad68301e2710321bf37c9486
Gerrit-Change-Number: 1245
Gerrit-PatchSet: 6
Gerrit-Owner: mrbff 
Gerrit-Reviewer: cron2 
Gerrit-Reviewer: flichtenheld 
Gerrit-Reviewer: plaisthos 
Gerrit-CC: openvpn-devel 
Gerrit-CC: ordex 
Gerrit-Attention: plaisthos 
Gerrit-Attention: cron2 
Gerrit-Attention: flichtenheld 
Gerrit-Attention: ordex 
Gerrit-Comment-Date: Wed, 08 Oct 2025 08:19:58 +
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: ordex 
___
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

[Openvpn-devel] [S] Change in openvpn[master]: PUSH_UPDATE: disabling PUSH_UPDATE server and client if DCO is enabled

2025-10-18 Thread ordex (Code Review) 
Attention is currently required from: cron2, flichtenheld, mrbff, plaisthos.

ordex has posted comments on this change by mrbff. ( 
http://gerrit.openvpn.net/c/openvpn/+/1245?usp=email )

Change subject: PUSH_UPDATE: disabling PUSH_UPDATE server and client if DCO is 
enabled
..


Patch Set 6: Code-Review+2


--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1245?usp=email
To unsubscribe, or for help writing mail filters, visit 
http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: comment
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Ibe78949435bb2f26ad68301e2710321bf37c9486
Gerrit-Change-Number: 1245
Gerrit-PatchSet: 6
Gerrit-Owner: mrbff 
Gerrit-Reviewer: cron2 
Gerrit-Reviewer: flichtenheld 
Gerrit-Reviewer: ordex 
Gerrit-Reviewer: plaisthos 
Gerrit-CC: openvpn-devel 
Gerrit-Attention: plaisthos 
Gerrit-Attention: cron2 
Gerrit-Attention: flichtenheld 
Gerrit-Attention: mrbff 
Gerrit-Comment-Date: Wed, 08 Oct 2025 08:26:40 +
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
___
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

[Openvpn-devel] [S] Change in openvpn[master]: PUSH_UPDATE: disabling PUSH_UPDATE server and client if DCO is enabled

2025-10-18 Thread cron2 (Code Review) 
cron2 has uploaded a new patch set (#7) to the change originally created by 
mrbff. ( http://gerrit.openvpn.net/c/openvpn/+/1245?usp=email )

The following approvals got outdated and were removed:
Code-Review+2 by ordex


Change subject: PUSH_UPDATE: disabling PUSH_UPDATE server and client if DCO is 
enabled
..

PUSH_UPDATE: disabling PUSH_UPDATE server and client if DCO is enabled

The PUSH_UPDATE currently doesn't work with DCO.
For example, in server, if a new ifconfig is sent, the DCO
doesn't receive the new peer address and the connection drops.
Similarly in the client when a PUSH_UPDATE is received, the tun is
closed and reopened but the DCO doesn't receive the peer info.

Change-Id: Ibe78949435bb2f26ad68301e2710321bf37c9486
Signed-off-by: Marco Baffo 
Acked-by: Antonio Quartulli 
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1245
Message-Id: <[email protected]>
URL: https://sourceforge.net/p/openvpn/mailman/message/59243711/
Signed-off-by: Gert Doering 
---
M src/openvpn/push.c
M src/openvpn/push_util.c
M src/openvpn/ssl.c
M tests/unit_tests/openvpn/test_push_update_msg.c
4 files changed, 20 insertions(+), 3 deletions(-)


  git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/45/1245/7

diff --git a/src/openvpn/push.c b/src/openvpn/push.c
index e7fc50c..0c8eb84 100644
--- a/src/openvpn/push.c
+++ b/src/openvpn/push.c
@@ -1112,6 +1112,12 @@
 }
 else if (honor_received_options && buf_string_compare_advance(&buf, 
push_update_cmd))
 {
+if (dco_enabled(&c->options))
+{
+msg(M_WARN, "WARN: PUSH_UPDATE messages cannot currently be 
processed in client mode while DCO is enabled, ignoring."
+" To be able to process PUSH_UPDATE messages, be sure 
to use the --disable-dco option.");
+return PUSH_MSG_ERROR;
+}
 return process_incoming_push_update(c, permission_mask, 
option_types_found, &buf, false);
 }
 else
diff --git a/src/openvpn/push_util.c b/src/openvpn/push_util.c
index 9138bdb..f306104 100644
--- a/src/openvpn/push_util.c
+++ b/src/openvpn/push_util.c
@@ -191,6 +191,13 @@
 int
 send_push_update(struct multi_context *m, const void *target, const char *msg, 
const push_update_type type, const int push_bundle_size)
 {
+if (dco_enabled(&m->top.options))
+{
+msg(M_WARN, "WARN: PUSH_UPDATE messages cannot currently be sent while 
DCO is enabled."
+" To send a PUSH_UPDATE message, be sure to use the 
--disable-dco option.");
+return 0;
+}
+
 if (!msg || !*msg || !m
 || (!target && type != UPT_BROADCAST))
 {
@@ -294,7 +301,6 @@
 } \
 } while (0)

-
 bool
 management_callback_send_push_update_broadcast(void *arg, const char *options)
 {
diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c
index 34036f2..567560f 100644
--- a/src/openvpn/ssl.c
+++ b/src/openvpn/ssl.c
@@ -1926,8 +1926,12 @@
 /* support for exit notify via control channel */
 iv_proto |= IV_PROTO_CC_EXIT_NOTIFY;

-/* support push-updates */
-iv_proto |= IV_PROTO_PUSH_UPDATE;
+/* currently push-update is not supported when DCO is enabled */
+if (!session->opt->dco_enabled)
+{
+/* support push-updates */
+iv_proto |= IV_PROTO_PUSH_UPDATE;
+}

 if (session->opt->pull)
 {
diff --git a/tests/unit_tests/openvpn/test_push_update_msg.c 
b/tests/unit_tests/openvpn/test_push_update_msg.c
index 8a5beeb..6e49f14 100644
--- a/tests/unit_tests/openvpn/test_push_update_msg.c
+++ b/tests/unit_tests/openvpn/test_push_update_msg.c
@@ -465,6 +465,7 @@
 m->instances = calloc(1, sizeof(struct multi_instance *));
 struct multi_instance *mi = calloc(1, sizeof(struct multi_instance));
 *(m->instances) = mi;
+m->top.options.disable_dco = true;
 *state = m;
 return 0;
 }

--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1245?usp=email
To unsubscribe, or for help writing mail filters, visit 
http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: newpatchset
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Ibe78949435bb2f26ad68301e2710321bf37c9486
Gerrit-Change-Number: 1245
Gerrit-PatchSet: 7
Gerrit-Owner: mrbff 
Gerrit-Reviewer: cron2 
Gerrit-Reviewer: flichtenheld 
Gerrit-Reviewer: ordex 
Gerrit-Reviewer: plaisthos 
Gerrit-CC: openvpn-devel 
___
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

[Openvpn-devel] [S] Change in openvpn[master]: PUSH_UPDATE: disabling PUSH_UPDATE server and client if DCO is enabled

2025-10-17 Thread mrbff (Code Review) 
Attention is currently required from: cron2, flichtenheld, plaisthos.

Hello cron2, flichtenheld, plaisthos,

I'd like you to reexamine a change. Please visit

http://gerrit.openvpn.net/c/openvpn/+/1245?usp=email

to look at the new patch set (#4).


Change subject: PUSH_UPDATE: disabling PUSH_UPDATE server and client if DCO is 
enabled
..

PUSH_UPDATE: disabling PUSH_UPDATE server and client if DCO is enabled

The PUSH_UPDATE currently doesn't work with DCO.
For example, in server, if a new ifconfig is sent, the DCO
doesn't receive the new peer address and the connection drops.
In the client instead, when a PUSH_UPDATE is received, the tun is
closed and reopened but the DCO doesn't receive the the peer info.

Change-Id: Ibe78949435bb2f26ad68301e2710321bf37c9486
Signed-off-by: Marco Baffo 
---
M src/openvpn/push.c
M src/openvpn/push_util.c
2 files changed, 22 insertions(+), 1 deletion(-)


  git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/45/1245/4

diff --git a/src/openvpn/push.c b/src/openvpn/push.c
index e7fc50c..e5f090f 100644
--- a/src/openvpn/push.c
+++ b/src/openvpn/push.c
@@ -1112,6 +1112,12 @@
 }
 else if (honor_received_options && buf_string_compare_advance(&buf, 
push_update_cmd))
 {
+if (dco_enabled(&c->options))
+{
+msg(M_WARN, "WARN: PUSH_UPDATE messages cannot currently be 
received while DCO is enabled, ignoring."
+" To receive PUSH_UPDATE messages, be sure to use the 
--disable-dco option.");
+return PUSH_MSG_ERROR;
+}
 return process_incoming_push_update(c, permission_mask, 
option_types_found, &buf, false);
 }
 else
diff --git a/src/openvpn/push_util.c b/src/openvpn/push_util.c
index 9138bdb..bbca00f 100644
--- a/src/openvpn/push_util.c
+++ b/src/openvpn/push_util.c
@@ -294,10 +294,17 @@
 } \
 } while (0)

-
 bool
 management_callback_send_push_update_broadcast(void *arg, const char *options)
 {
+struct multi_context *m = arg;
+if (dco_enabled(&m->top.options))
+{
+msg(M_WARN, "WARN: PUSH_UPDATE messages cannot currently be sent while 
DCO is enabled."
+" To send a PUSH_UPDATE message, be sure to use the 
--disable-dco option.");
+return false;
+}
+
 int n_sent = send_push_update(arg, NULL, options, UPT_BROADCAST, 
PUSH_BUNDLE_SIZE);

 RETURN_UPDATE_STATUS(n_sent);
@@ -306,6 +313,14 @@
 bool
 management_callback_send_push_update_by_cid(void *arg, unsigned long cid, 
const char *options)
 {
+struct multi_context *m = arg;
+if (dco_enabled(&m->top.options))
+{
+msg(M_WARN, "WARN: PUSH_UPDATE messages cannot currently be sent while 
DCO is enabled."
+" To send a PUSH_UPDATE message, be sure to use the 
--disable-dco option.");
+return false;
+}
+
 int n_sent = send_push_update(arg, &cid, options, UPT_BY_CID, 
PUSH_BUNDLE_SIZE);

 RETURN_UPDATE_STATUS(n_sent);

--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1245?usp=email
To unsubscribe, or for help writing mail filters, visit 
http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: newpatchset
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Ibe78949435bb2f26ad68301e2710321bf37c9486
Gerrit-Change-Number: 1245
Gerrit-PatchSet: 4
Gerrit-Owner: mrbff 
Gerrit-Reviewer: cron2 
Gerrit-Reviewer: flichtenheld 
Gerrit-Reviewer: plaisthos 
Gerrit-CC: openvpn-devel 
Gerrit-Attention: plaisthos 
Gerrit-Attention: cron2 
Gerrit-Attention: flichtenheld 
___
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

[Openvpn-devel] [S] Change in openvpn[master]: PUSH_UPDATE: disabling PUSH_UPDATE server and client if DCO is enabled

2025-10-17 Thread ordex (Code Review) 
Attention is currently required from: cron2, flichtenheld, mrbff, plaisthos.

ordex has posted comments on this change by mrbff. ( 
http://gerrit.openvpn.net/c/openvpn/+/1245?usp=email )

Change subject: PUSH_UPDATE: disabling PUSH_UPDATE server and client if DCO is 
enabled
..


Patch Set 5:

(3 comments)

File src/openvpn/push.c:

http://gerrit.openvpn.net/c/openvpn/+/1245/comment/cff164a5_fe297422?usp=email :
PS5, Line 1117: msg(M_WARN, "WARN: PUSH_UPDATE messages cannot 
currently be received while DCO is enabled, ignoring."
I'd reword: "be received while.." -> "be processed in client mode while.."


http://gerrit.openvpn.net/c/openvpn/+/1245/comment/c79ce5b0_07a07e3b?usp=email :
PS5, Line 1118: " To receive PUSH_UPDATE messages, be 
sure to use the --disable-dco option.");
I'd reword: "To receive.." -> "To be able to process.."


File src/openvpn/push_util.c:

http://gerrit.openvpn.net/c/openvpn/+/1245/comment/e9277b6d_e934a501?usp=email :
PS5, Line 301: if (dco_enabled(&m->top.options))
Why not doing this check only once at the beginning of `send_push_update()` ?



--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1245?usp=email
To unsubscribe, or for help writing mail filters, visit 
http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: comment
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Ibe78949435bb2f26ad68301e2710321bf37c9486
Gerrit-Change-Number: 1245
Gerrit-PatchSet: 5
Gerrit-Owner: mrbff 
Gerrit-Reviewer: cron2 
Gerrit-Reviewer: flichtenheld 
Gerrit-Reviewer: plaisthos 
Gerrit-CC: openvpn-devel 
Gerrit-CC: ordex 
Gerrit-Attention: plaisthos 
Gerrit-Attention: cron2 
Gerrit-Attention: flichtenheld 
Gerrit-Attention: mrbff 
Gerrit-Comment-Date: Wed, 08 Oct 2025 07:42:53 +
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
___
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

[Openvpn-devel] [S] Change in openvpn[master]: PUSH_UPDATE: disabling PUSH_UPDATE server and client if DCO is enabled

2025-10-17 Thread mrbff (Code Review) 
Attention is currently required from: cron2, flichtenheld, plaisthos.

Hello cron2, flichtenheld, plaisthos,

I'd like you to reexamine a change. Please visit

http://gerrit.openvpn.net/c/openvpn/+/1245?usp=email

to look at the new patch set (#5).


Change subject: PUSH_UPDATE: disabling PUSH_UPDATE server and client if DCO is 
enabled
..

PUSH_UPDATE: disabling PUSH_UPDATE server and client if DCO is enabled

The PUSH_UPDATE currently doesn't work with DCO.
For example, in server, if a new ifconfig is sent, the DCO
doesn't receive the new peer address and the connection drops.
Similarly in the client when a PUSH_UPDATE is received, the tun is
closed and reopened but the DCO doesn't receive the peer info.

Change-Id: Ibe78949435bb2f26ad68301e2710321bf37c9486
Signed-off-by: Marco Baffo 
---
M src/openvpn/push.c
M src/openvpn/push_util.c
M src/openvpn/ssl.c
3 files changed, 28 insertions(+), 3 deletions(-)


  git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/45/1245/5

diff --git a/src/openvpn/push.c b/src/openvpn/push.c
index e7fc50c..e5f090f 100644
--- a/src/openvpn/push.c
+++ b/src/openvpn/push.c
@@ -1112,6 +1112,12 @@
 }
 else if (honor_received_options && buf_string_compare_advance(&buf, 
push_update_cmd))
 {
+if (dco_enabled(&c->options))
+{
+msg(M_WARN, "WARN: PUSH_UPDATE messages cannot currently be 
received while DCO is enabled, ignoring."
+" To receive PUSH_UPDATE messages, be sure to use the 
--disable-dco option.");
+return PUSH_MSG_ERROR;
+}
 return process_incoming_push_update(c, permission_mask, 
option_types_found, &buf, false);
 }
 else
diff --git a/src/openvpn/push_util.c b/src/openvpn/push_util.c
index 9138bdb..bbca00f 100644
--- a/src/openvpn/push_util.c
+++ b/src/openvpn/push_util.c
@@ -294,10 +294,17 @@
 } \
 } while (0)
 
-
 bool
 management_callback_send_push_update_broadcast(void *arg, const char *options)
 {
+struct multi_context *m = arg;
+if (dco_enabled(&m->top.options))
+{
+msg(M_WARN, "WARN: PUSH_UPDATE messages cannot currently be sent while 
DCO is enabled."
+" To send a PUSH_UPDATE message, be sure to use the 
--disable-dco option.");
+return false;
+}
+
 int n_sent = send_push_update(arg, NULL, options, UPT_BROADCAST, 
PUSH_BUNDLE_SIZE);

 RETURN_UPDATE_STATUS(n_sent);
@@ -306,6 +313,14 @@
 bool
 management_callback_send_push_update_by_cid(void *arg, unsigned long cid, 
const char *options)
 {
+struct multi_context *m = arg;
+if (dco_enabled(&m->top.options))
+{
+msg(M_WARN, "WARN: PUSH_UPDATE messages cannot currently be sent while 
DCO is enabled."
+" To send a PUSH_UPDATE message, be sure to use the 
--disable-dco option.");
+return false;
+}
+
 int n_sent = send_push_update(arg, &cid, options, UPT_BY_CID, 
PUSH_BUNDLE_SIZE);

 RETURN_UPDATE_STATUS(n_sent);
diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c
index 34036f2..567560f 100644
--- a/src/openvpn/ssl.c
+++ b/src/openvpn/ssl.c
@@ -1926,8 +1926,12 @@
 /* support for exit notify via control channel */
 iv_proto |= IV_PROTO_CC_EXIT_NOTIFY;

-/* support push-updates */
-iv_proto |= IV_PROTO_PUSH_UPDATE;
+/* currently push-update is not supported when DCO is enabled */
+if (!session->opt->dco_enabled)
+{
+/* support push-updates */
+iv_proto |= IV_PROTO_PUSH_UPDATE;
+}

 if (session->opt->pull)
 {

--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1245?usp=email
To unsubscribe, or for help writing mail filters, visit 
http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: newpatchset
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Ibe78949435bb2f26ad68301e2710321bf37c9486
Gerrit-Change-Number: 1245
Gerrit-PatchSet: 5
Gerrit-Owner: mrbff 
Gerrit-Reviewer: cron2 
Gerrit-Reviewer: flichtenheld 
Gerrit-Reviewer: plaisthos 
Gerrit-CC: openvpn-devel 
Gerrit-Attention: plaisthos 
Gerrit-Attention: cron2 
Gerrit-Attention: flichtenheld 
___
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel