)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":1000001,"name":"flichtenheld","display_name":"Frank Lichtenheld","email":"frank@lichtenheld.com","username":"flichtenheld","status":"OpenVPN Inc."},"change_message_id":"8b2b30569b1f3acbe1beaf525cff228ebb1f2435","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"74c9e53a_88cefb08","updated":"2025-07-17 09:33:43.000000000","message":"doesn\u0027t build","commit_id":"196ae729234570015c94386a885e4648368c2b4d"},{"author":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"change_message_id":"863327c46747a3bb094f24f408937310a316b224","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"8745362f_edd6e2cf","updated":"2025-08-05 12:26:47.000000000","message":"Before this can proceed anywhere, I need a clear description of the goals and timeline - \"is this for 2.7?  is this for some future thing?  corp support?\".","commit_id":"a768e1ae7690a3eefb1c118b1fe40d1b7a9f0354"},{"author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"df4dff61d6219b83285cee7f52de8682bb3e347f","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"be050bd1_4a567d6b","updated":"2025-07-17 09:43:55.000000000","message":"I think there are still some things that need to be fixed. See comments","commit_id":"a768e1ae7690a3eefb1c118b1fe40d1b7a9f0354"},{"author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"8feeb0a79b04819a5f428abcc80fb35cd6e9aba0","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"5e97a71b_d2df9c4c","in_reply_to":"0988c1c4_6a8f2cee","updated":"2025-12-02 17:05:11.000000000","message":"This is more 2.8 stuff but having this in 2.7 would not hurt and potientially have a bigger compatibility for the multipeer scenarios.","commit_id":"a768e1ae7690a3eefb1c118b1fe40d1b7a9f0354"},{"author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"99148851cafd2e9cada1aa78877ca477d6cc8a1d","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"0988c1c4_6a8f2cee","in_reply_to":"8745362f_edd6e2cf","updated":"2025-12-02 17:03:54.000000000","message":"This is to potentially allow two openvpn p2mp instances like two server talk to each other directly","commit_id":"a768e1ae7690a3eefb1c118b1fe40d1b7a9f0354"},{"author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"334f152f34aa95ea6819e4a33b0196f499fa7dfa","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":4,"id":"26836bc6_0d294f6a","updated":"2025-10-07 15:50:10.000000000","message":"The part that picks the \"peer-id\" pushed and parsed options.c that sets peer-id on receiving peer-id\n\n    if (found \u0026 OPT_P_PEER_ID)\n    {\n        msg(D_PUSH_DEBUG, \"OPTIONS IMPORT: peer-id set\");\n        c-\u003ec2.tls_multi-\u003euse_peer_id \u003d true;\n        c-\u003ec2.tls_multi-\u003etx_peer_id \u003d c-\u003eoptions.peer_id;\n    }\n    \n\nshould probably also be adjusted to set both rx and tx as peer-id as pushed option should set both.","commit_id":"816b0f141c576aa0348d75ce5f23de29812c28de"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"2da8d2c9c39b513cbbc31f5cb192b313ae6ebdbb","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"432c272b_476c93f3","in_reply_to":"26836bc6_0d294f6a","updated":"2025-10-27 13:47:02.000000000","message":"Done","commit_id":"816b0f141c576aa0348d75ce5f23de29812c28de"},{"author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"d345a39c42b0d8c8adf7f54da85f6ddb7343a0d6","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":7,"id":"23fe066a_1fb437de","updated":"2025-11-10 14:49:46.000000000","message":"So this seem to not work correctly in P2p mode.\n\npeer a: openvpn --port 1195 --tls-server --ifconfig 10.173.0.1 255.255.255.0 --topology subnet  --topology subnet --cert ~/nemesis.pem  --key ~/nemesis.pem   --dev tun --verb 4  --tun-mtu 1400 --config ~/fp   --disable-dco\n\npeer b: openvpn --verb 4  --dev tun  --remote nemesis.fritz.box 1195 --config ~/ovpn/confs/fp  --tls-client --cert ~/ovpn/confs/styx-ed25519.pem --key ~/ovpn/confs/styx-ed25519.pem --disable-dco --ifconfig  10.173.0.2 255.255.255.0 \n\n\nThe fp config just has the fingerpints in it.\n\nAnd the negotiated peer ids just don\u0027t make sense. It should be just the same ids with rx and tx swapped but this is is not really that. \n\n2025-11-10 15:48:41 us\u003d782130 Data Channel: cipher \u0027AES-256-GCM\u0027, rx_peer-id: 7762030, tx_peer-id: 5695615\n\n2025-11-10 14:48:41 us\u003d533055 Data Channel: cipher \u0027AES-256-GCM\u0027, rx_peer-id: 7762030, tx_peer-id: 14459670\n\nAlso it seems to *always* use 7762030 in my tests.","commit_id":"ec3d4eb241c1d10d775374f5f28a495ac7d6e748"},{"author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"f01c2d591676b9a0e20db598cb3e3887b3b2bfe5","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":9,"id":"d7e41d80_95aad17e","updated":"2025-12-09 14:05:11.000000000","message":"I accidentially pushed a rebased version to this PR.","commit_id":"f90a0d87a53759dad9c20e9731f3af5f237ece28"},{"author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"e9ef3d8f26b12089eb718f2757dfae13bf612ecc","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":10,"id":"28e597a2_d4f7f0af","updated":"2026-04-21 15:26:39.000000000","message":"See the maxpeer id check","commit_id":"d8f80ca6d924e0b5c8a9469aeee42dcd08b99af2"},{"author":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"change_message_id":"7c1275e4fa13744c6ff76220b878e4f6f1a3d663","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":18,"id":"470e5161_e321fa96","updated":"2026-07-17 21:31:48.000000000","message":"this needs more work to make the logic not even worse than it is already","commit_id":"71a6b89896a36a08adac3b61bcccd949bcf149c1"},{"author":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"change_message_id":"03d3a149be70791d281fffa97bcd7e4eb3a04dfa","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":27,"id":"235f9e9b_4f0cc511","updated":"2026-07-27 13:41:51.000000000","message":"getting there, just one small irk remaining","commit_id":"25f3955efd71e5c7ab54e0da3d4181610cb0b5c9"},{"author":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"change_message_id":"d6dd6d8548f489020c76840f14ce6827e68ae5ce","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":28,"id":"bc5a5233_252f876f","updated":"2026-07-27 15:18:16.000000000","message":"reviewing \"as if I had never seen it before\", found a few more things.  Getting there.  Waiting for @arne-openvpn@rfc2549.org for a full protocol correctness review.","commit_id":"1051a4ef164c3c97f42459c97e27384b2e500bf4"}],"src/openvpn/dco.c":[{"author":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"change_message_id":"7c1275e4fa13744c6ff76220b878e4f6f1a3d663","unresolved":true,"context_lines":[{"line_number":690,"context_line":"    if (addrtype \u003d\u003d MR_ADDR_IPV6)"},{"line_number":691,"context_line":"    {"},{"line_number":692,"context_line":"#if defined(_WIN32)"},{"line_number":693,"context_line":"        dco_win_add_iroute_ipv6(\u0026c-\u003ec1.tuntap-\u003edco, addr-\u003ev6.addr, addr-\u003enetbits, c-\u003ec2.tls_multi-\u003erx_peer_id);"},{"line_number":694,"context_line":"#else"},{"line_number":695,"context_line":"        const struct in6_addr *gateway \u003d \u0026mi-\u003econtext.c2.push_ifconfig_ipv6_local;"},{"line_number":696,"context_line":"        if (addr-\u003etype \u0026 MR_ONLINK_DCO_ADDR)"}],"source_content_type":"text/x-csrc","patch_set":18,"id":"e24ee2fa_4cf1aa90","line":693,"updated":"2026-07-17 21:31:48.000000000","message":"is this unwrapping intentional?","commit_id":"71a6b89896a36a08adac3b61bcccd949bcf149c1"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"57c436a594a87308c46dd5389b607fb82a2ccf7f","unresolved":false,"context_lines":[{"line_number":690,"context_line":"    if (addrtype \u003d\u003d MR_ADDR_IPV6)"},{"line_number":691,"context_line":"    {"},{"line_number":692,"context_line":"#if defined(_WIN32)"},{"line_number":693,"context_line":"        dco_win_add_iroute_ipv6(\u0026c-\u003ec1.tuntap-\u003edco, addr-\u003ev6.addr, addr-\u003enetbits, c-\u003ec2.tls_multi-\u003erx_peer_id);"},{"line_number":694,"context_line":"#else"},{"line_number":695,"context_line":"        const struct in6_addr *gateway \u003d \u0026mi-\u003econtext.c2.push_ifconfig_ipv6_local;"},{"line_number":696,"context_line":"        if (addr-\u003etype \u0026 MR_ONLINK_DCO_ADDR)"}],"source_content_type":"text/x-csrc","patch_set":18,"id":"60ec1c4c_82ec962f","line":693,"in_reply_to":"e24ee2fa_4cf1aa90","updated":"2026-07-20 12:01:06.000000000","message":"Unintentional","commit_id":"71a6b89896a36a08adac3b61bcccd949bcf149c1"}],"src/openvpn/init.c":[{"author":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"change_message_id":"7c1275e4fa13744c6ff76220b878e4f6f1a3d663","unresolved":true,"context_lines":[{"line_number":2692,"context_line":"        if (!c-\u003ec2.tls_multi-\u003euse_asymmetric_peer_id)"},{"line_number":2693,"context_line":"        {"},{"line_number":2694,"context_line":"            c-\u003ec2.tls_multi-\u003erx_peer_id \u003d c-\u003eoptions.peer_id;"},{"line_number":2695,"context_line":"            c-\u003ec2.tls_multi-\u003etx_peer_id \u003d c-\u003eoptions.peer_id;"},{"line_number":2696,"context_line":"        }"},{"line_number":2697,"context_line":"    }"},{"line_number":2698,"context_line":""}],"source_content_type":"text/x-csrc","patch_set":18,"id":"0f1d8f42_e233cf1b","line":2695,"updated":"2026-07-17 21:31:48.000000000","message":"why set `tx_peer_id` twice, to the same value?","commit_id":"71a6b89896a36a08adac3b61bcccd949bcf149c1"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"57c436a594a87308c46dd5389b607fb82a2ccf7f","unresolved":false,"context_lines":[{"line_number":2692,"context_line":"        if (!c-\u003ec2.tls_multi-\u003euse_asymmetric_peer_id)"},{"line_number":2693,"context_line":"        {"},{"line_number":2694,"context_line":"            c-\u003ec2.tls_multi-\u003erx_peer_id \u003d c-\u003eoptions.peer_id;"},{"line_number":2695,"context_line":"            c-\u003ec2.tls_multi-\u003etx_peer_id \u003d c-\u003eoptions.peer_id;"},{"line_number":2696,"context_line":"        }"},{"line_number":2697,"context_line":"    }"},{"line_number":2698,"context_line":""}],"source_content_type":"text/x-csrc","patch_set":18,"id":"e495bd2c_9f3ac369","line":2695,"in_reply_to":"0f1d8f42_e233cf1b","updated":"2026-07-20 12:01:06.000000000","message":"Done","commit_id":"71a6b89896a36a08adac3b61bcccd949bcf149c1"},{"author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"a0a18c83306f4ddcb796f0a3e3c6642fd3775a3f","unresolved":true,"context_lines":[{"line_number":2207,"context_line":"                   md_kt_name(o-\u003eauthname));"},{"line_number":2208,"context_line":"    }"},{"line_number":2209,"context_line":""},{"line_number":2210,"context_line":"    if (o-\u003euse_peer_id)"},{"line_number":2211,"context_line":"    {"},{"line_number":2212,"context_line":"        buf_printf(\u0026out, \", rx-peer-id: %u, tx-peer-id: %u\", c-\u003ec2.tls_multi-\u003erx_peer_id, c-\u003ec2.tls_multi-\u003etx_peer_id);"},{"line_number":2213,"context_line":"    }"}],"source_content_type":"text/x-csrc","patch_set":28,"id":"80ca065d_6d40bf39","line":2210,"updated":"2026-07-27 16:01:54.000000000","message":"I think we should not use o-\u003euse_peer_id but rather check tls_multi-\u003euse_peer_id instead. \n\nWe should also update o-\u003euse_peer_id to somethig like \n\n/** peer-id was pushed in the received options */\nbool use_peer_id;\n\nand then not try so hard keep o-\u003euse_peer_id in sync with the other methods of having peer_id negotiaed.","commit_id":"1051a4ef164c3c97f42459c97e27384b2e500bf4"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"65a67d1e53220bb4c32b68e015c417fc69497cda","unresolved":false,"context_lines":[{"line_number":2207,"context_line":"                   md_kt_name(o-\u003eauthname));"},{"line_number":2208,"context_line":"    }"},{"line_number":2209,"context_line":""},{"line_number":2210,"context_line":"    if (o-\u003euse_peer_id)"},{"line_number":2211,"context_line":"    {"},{"line_number":2212,"context_line":"        buf_printf(\u0026out, \", rx-peer-id: %u, tx-peer-id: %u\", c-\u003ec2.tls_multi-\u003erx_peer_id, c-\u003ec2.tls_multi-\u003etx_peer_id);"},{"line_number":2213,"context_line":"    }"}],"source_content_type":"text/x-csrc","patch_set":28,"id":"bdf8cbc3_8728920f","line":2210,"in_reply_to":"80ca065d_6d40bf39","updated":"2026-07-28 07:47:45.000000000","message":"Done","commit_id":"1051a4ef164c3c97f42459c97e27384b2e500bf4"},{"author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"a0a18c83306f4ddcb796f0a3e3c6642fd3775a3f","unresolved":true,"context_lines":[{"line_number":2683,"context_line":"        if (!c-\u003ec2.tls_multi-\u003euse_asymmetric_peer_id)"},{"line_number":2684,"context_line":"        {"},{"line_number":2685,"context_line":"            c-\u003ec2.tls_multi-\u003erx_peer_id \u003d c-\u003eoptions.peer_id;"},{"line_number":2686,"context_line":"        }"},{"line_number":2687,"context_line":"    }"},{"line_number":2688,"context_line":""},{"line_number":2689,"context_line":"    /* process (potentially) pushed options */"}],"source_content_type":"text/x-csrc","patch_set":28,"id":"9979a4d1_7c0adc14","line":2686,"updated":"2026-07-27 16:01:54.000000000","message":"I think here you just want to use\n\n            c-\u003ec2.tls_multi-\u003erx_peer_id \u003d c-\u003eoptions.peer_id;\n            \nsince a server that wants to use assymetric peer id should not have pushed peer-id           as part of the pushed options. And being pushed a \"peer-id xyz\" mean that both direction should be set to that id.","commit_id":"1051a4ef164c3c97f42459c97e27384b2e500bf4"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"65a67d1e53220bb4c32b68e015c417fc69497cda","unresolved":false,"context_lines":[{"line_number":2683,"context_line":"        if (!c-\u003ec2.tls_multi-\u003euse_asymmetric_peer_id)"},{"line_number":2684,"context_line":"        {"},{"line_number":2685,"context_line":"            c-\u003ec2.tls_multi-\u003erx_peer_id \u003d c-\u003eoptions.peer_id;"},{"line_number":2686,"context_line":"        }"},{"line_number":2687,"context_line":"    }"},{"line_number":2688,"context_line":""},{"line_number":2689,"context_line":"    /* process (potentially) pushed options */"}],"source_content_type":"text/x-csrc","patch_set":28,"id":"ba692d43_01149e69","line":2686,"in_reply_to":"9979a4d1_7c0adc14","updated":"2026-07-28 07:47:45.000000000","message":"Done","commit_id":"1051a4ef164c3c97f42459c97e27384b2e500bf4"},{"author":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"change_message_id":"d6dd6d8548f489020c76840f14ce6827e68ae5ce","unresolved":true,"context_lines":[{"line_number":3480,"context_line":"    if (c-\u003ec2.tls_multi)"},{"line_number":3481,"context_line":"    {"},{"line_number":3482,"context_line":"        tls_multi_init_finalize(c-\u003ec2.tls_multi, c-\u003eoptions.ce.tls_mtu);"},{"line_number":3483,"context_line":"        if (c-\u003ec2.tls_multi-\u003erx_peer_id !\u003d MAX_PEER_ID)"},{"line_number":3484,"context_line":"        {"},{"line_number":3485,"context_line":"            c-\u003eoptions.use_peer_id \u003d true;"},{"line_number":3486,"context_line":"        }"}],"source_content_type":"text/x-csrc","patch_set":28,"id":"c19d8bf5_ec2feaad","line":3483,"updated":"2026-07-27 15:18:16.000000000","message":"should that not check `tx_peer_id`?  We control \"what we send\" with `use_peer_id`, and that would be \"tx\", no?  (In most cases the distinction is probably moot, as you\u0027d have \"something that is not MAX_PEER_ID\" in both ways, or none at all, but I find it confusing still.","commit_id":"1051a4ef164c3c97f42459c97e27384b2e500bf4"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"65a67d1e53220bb4c32b68e015c417fc69497cda","unresolved":false,"context_lines":[{"line_number":3480,"context_line":"    if (c-\u003ec2.tls_multi)"},{"line_number":3481,"context_line":"    {"},{"line_number":3482,"context_line":"        tls_multi_init_finalize(c-\u003ec2.tls_multi, c-\u003eoptions.ce.tls_mtu);"},{"line_number":3483,"context_line":"        if (c-\u003ec2.tls_multi-\u003erx_peer_id !\u003d MAX_PEER_ID)"},{"line_number":3484,"context_line":"        {"},{"line_number":3485,"context_line":"            c-\u003eoptions.use_peer_id \u003d true;"},{"line_number":3486,"context_line":"        }"}],"source_content_type":"text/x-csrc","patch_set":28,"id":"2d9fdbb0_4880cd5f","line":3483,"in_reply_to":"c19d8bf5_ec2feaad","updated":"2026-07-28 07:47:45.000000000","message":"Done","commit_id":"1051a4ef164c3c97f42459c97e27384b2e500bf4"},{"author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"a0a18c83306f4ddcb796f0a3e3c6642fd3775a3f","unresolved":true,"context_lines":[{"line_number":3482,"context_line":"        tls_multi_init_finalize(c-\u003ec2.tls_multi, c-\u003eoptions.ce.tls_mtu);"},{"line_number":3483,"context_line":"        if (c-\u003ec2.tls_multi-\u003erx_peer_id !\u003d MAX_PEER_ID)"},{"line_number":3484,"context_line":"        {"},{"line_number":3485,"context_line":"            c-\u003eoptions.use_peer_id \u003d true;"},{"line_number":3486,"context_line":"        }"},{"line_number":3487,"context_line":"        ASSERT(c-\u003ec2.tls_multi-\u003eopt.frame.buf.payload_size \u003c\u003d c-\u003ec2.frame.buf.payload_size);"},{"line_number":3488,"context_line":"        frame_print(\u0026c-\u003ec2.tls_multi-\u003eopt.frame, D_MTU_INFO, \"Control Channel MTU parms\");"}],"source_content_type":"text/x-csrc","patch_set":28,"id":"85aca552_9d31393f","line":3485,"updated":"2026-07-27 16:01:54.000000000","message":"I think we can just remove this whole section. See my comment to tls_print_deferred_options_results.","commit_id":"1051a4ef164c3c97f42459c97e27384b2e500bf4"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"65a67d1e53220bb4c32b68e015c417fc69497cda","unresolved":false,"context_lines":[{"line_number":3482,"context_line":"        tls_multi_init_finalize(c-\u003ec2.tls_multi, c-\u003eoptions.ce.tls_mtu);"},{"line_number":3483,"context_line":"        if (c-\u003ec2.tls_multi-\u003erx_peer_id !\u003d MAX_PEER_ID)"},{"line_number":3484,"context_line":"        {"},{"line_number":3485,"context_line":"            c-\u003eoptions.use_peer_id \u003d true;"},{"line_number":3486,"context_line":"        }"},{"line_number":3487,"context_line":"        ASSERT(c-\u003ec2.tls_multi-\u003eopt.frame.buf.payload_size \u003c\u003d c-\u003ec2.frame.buf.payload_size);"},{"line_number":3488,"context_line":"        frame_print(\u0026c-\u003ec2.tls_multi-\u003eopt.frame, D_MTU_INFO, \"Control Channel MTU parms\");"}],"source_content_type":"text/x-csrc","patch_set":28,"id":"da50ae29_57842b0a","line":3485,"in_reply_to":"85aca552_9d31393f","updated":"2026-07-28 07:47:45.000000000","message":"Done","commit_id":"1051a4ef164c3c97f42459c97e27384b2e500bf4"},{"author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"3d01ae6077e24f5e532603c99cc54495b0f2bb71","unresolved":true,"context_lines":[{"line_number":2330,"context_line":"    /* The peer-id can also be negotiated without being pushed, so sync the"},{"line_number":2331,"context_line":"     * option before the frame is recalculated: it decides whether the"},{"line_number":2332,"context_line":"     * DATA_V2 header is accounted for */"},{"line_number":2333,"context_line":"    c-\u003eoptions.use_peer_id \u003d c-\u003ec2.tls_multi-\u003euse_peer_id;"},{"line_number":2334,"context_line":""},{"line_number":2335,"context_line":"    struct tls_session *session \u003d \u0026c-\u003ec2.tls_multi-\u003esession[TM_ACTIVE];"},{"line_number":2336,"context_line":"    if (!tls_session_update_crypto_params(c-\u003ec2.tls_multi, session, \u0026c-\u003eoptions, \u0026c-\u003ec2.frame,"}],"source_content_type":"text/x-csrc","patch_set":29,"id":"9dd0589c_911979bb","line":2333,"updated":"2026-07-28 12:08:39.000000000","message":"I will accept this for now but I think we should eventually clean that up so we have only one boolean that is the single source of truth instead of having to have two bools that are kept in sync.","commit_id":"166bad41b6b290bffc81db9e747967d58833ea1e"}],"src/openvpn/multi.c":[{"author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"df4dff61d6219b83285cee7f52de8682bb3e347f","unresolved":true,"context_lines":[{"line_number":1813,"context_line":"    {"},{"line_number":1814,"context_line":"        tls_multi-\u003euse_peer_id \u003d true;"},{"line_number":1815,"context_line":"        o-\u003euse_peer_id \u003d true;"},{"line_number":1816,"context_line":"        uint32_t peer_id \u003d extract_asymmetric_peer_id(peer_info);"},{"line_number":1817,"context_line":"        if (peer_id)"},{"line_number":1818,"context_line":"        {"},{"line_number":1819,"context_line":"            tls_multi-\u003etx_peer_id \u003d peer_id;"}],"source_content_type":"text/x-csrc","patch_set":2,"id":"7be28da8_ce83b435","line":1816,"updated":"2025-07-17 09:43:55.000000000","message":"I am somehow missing the client side/p2p that does the same and also calls extract_asymmetric_peer_id to figure out what peer-id the server wants to use.","commit_id":"a768e1ae7690a3eefb1c118b1fe40d1b7a9f0354"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"fb2a91f5448bca36d7a956fd0c96c3bd455c7e57","unresolved":false,"context_lines":[{"line_number":1813,"context_line":"    {"},{"line_number":1814,"context_line":"        tls_multi-\u003euse_peer_id \u003d true;"},{"line_number":1815,"context_line":"        o-\u003euse_peer_id \u003d true;"},{"line_number":1816,"context_line":"        uint32_t peer_id \u003d extract_asymmetric_peer_id(peer_info);"},{"line_number":1817,"context_line":"        if (peer_id)"},{"line_number":1818,"context_line":"        {"},{"line_number":1819,"context_line":"            tls_multi-\u003etx_peer_id \u003d peer_id;"}],"source_content_type":"text/x-csrc","patch_set":2,"id":"d20f4c46_6ddf1dff","line":1816,"in_reply_to":"7be28da8_ce83b435","updated":"2025-08-05 07:56:28.000000000","message":"Acknowledged","commit_id":"a768e1ae7690a3eefb1c118b1fe40d1b7a9f0354"},{"author":{"_account_id":1000001,"name":"flichtenheld","display_name":"Frank Lichtenheld","email":"frank@lichtenheld.com","username":"flichtenheld","status":"OpenVPN Inc."},"change_message_id":"30122c3ff696fc0d7be576a9120c168006362ecd","unresolved":true,"context_lines":[{"line_number":1726,"context_line":"        tls_multi-\u003euse_peer_id \u003d true;"},{"line_number":1727,"context_line":"        o-\u003euse_peer_id \u003d true;"},{"line_number":1728,"context_line":"    }"},{"line_number":1729,"context_line":""},{"line_number":1730,"context_line":"    else if (dco_enabled(o))"},{"line_number":1731,"context_line":"    {"},{"line_number":1732,"context_line":"        msg(M_INFO, \"Client does not support DATA_V2. Data channel offloading \""}],"source_content_type":"text/x-csrc","patch_set":16,"id":"4cc88294_1a96a5b5","line":1729,"updated":"2026-06-24 13:31:42.000000000","message":"spurious change","commit_id":"02829edd0828bd5af8934ffba182588901a03440"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"911c091ad78cf2d2486f85cd092c55199baedfec","unresolved":false,"context_lines":[{"line_number":1726,"context_line":"        tls_multi-\u003euse_peer_id \u003d true;"},{"line_number":1727,"context_line":"        o-\u003euse_peer_id \u003d true;"},{"line_number":1728,"context_line":"    }"},{"line_number":1729,"context_line":""},{"line_number":1730,"context_line":"    else if (dco_enabled(o))"},{"line_number":1731,"context_line":"    {"},{"line_number":1732,"context_line":"        msg(M_INFO, \"Client does not support DATA_V2. Data channel offloading \""}],"source_content_type":"text/x-csrc","patch_set":16,"id":"8d816606_628dd24e","line":1729,"in_reply_to":"4cc88294_1a96a5b5","updated":"2026-06-29 01:39:17.000000000","message":"Done","commit_id":"02829edd0828bd5af8934ffba182588901a03440"},{"author":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"change_message_id":"e94ef3038bb4bdd6dbcade446d02fdd045acdcb4","unresolved":true,"context_lines":[{"line_number":3141,"context_line":"        mi-\u003econtext.c2.tls_multi-\u003erx_peer_id,"},{"line_number":3142,"context_line":"        tls_common_name(mi-\u003econtext.c2.tls_multi, false),"},{"line_number":3143,"context_line":"        mroute_addr_print(\u0026mi-\u003ereal, \u0026gc),"},{"line_number":3144,"context_line":"        print_link_socket_actual(\u0026m-\u003etop.c2.from, \u0026gc));"},{"line_number":3145,"context_line":""},{"line_number":3146,"context_line":"    /* remove old address from hash table before changing address */"},{"line_number":3147,"context_line":"    ASSERT(hash_remove(m-\u003ehash, \u0026mi-\u003ereal));"}],"source_content_type":"text/x-csrc","patch_set":18,"id":"213f695b_c1306824","line":3144,"updated":"2026-07-17 21:19:24.000000000","message":"this change looks like a rebase artefact - the `rx_peer_id` is clear, but the `mroute_addr_print` parts have nothing to do whatsoever with the peer-id change, and I assume this is older code reappearing due to rebasing context.  Can you double-check please?","commit_id":"71a6b89896a36a08adac3b61bcccd949bcf149c1"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"57c436a594a87308c46dd5389b607fb82a2ccf7f","unresolved":false,"context_lines":[{"line_number":3141,"context_line":"        mi-\u003econtext.c2.tls_multi-\u003erx_peer_id,"},{"line_number":3142,"context_line":"        tls_common_name(mi-\u003econtext.c2.tls_multi, false),"},{"line_number":3143,"context_line":"        mroute_addr_print(\u0026mi-\u003ereal, \u0026gc),"},{"line_number":3144,"context_line":"        print_link_socket_actual(\u0026m-\u003etop.c2.from, \u0026gc));"},{"line_number":3145,"context_line":""},{"line_number":3146,"context_line":"    /* remove old address from hash table before changing address */"},{"line_number":3147,"context_line":"    ASSERT(hash_remove(m-\u003ehash, \u0026mi-\u003ereal));"}],"source_content_type":"text/x-csrc","patch_set":18,"id":"d9f5177e_03242945","line":3144,"in_reply_to":"213f695b_c1306824","updated":"2026-07-20 12:01:06.000000000","message":"Done","commit_id":"71a6b89896a36a08adac3b61bcccd949bcf149c1"}],"src/openvpn/options.c":[{"author":{"_account_id":1000001,"name":"flichtenheld","display_name":"Frank Lichtenheld","email":"frank@lichtenheld.com","username":"flichtenheld","status":"OpenVPN Inc."},"change_message_id":"30122c3ff696fc0d7be576a9120c168006362ecd","unresolved":true,"context_lines":[{"line_number":3887,"context_line":"                     \"incompatible with each other.\");"},{"line_number":3888,"context_line":"    }"},{"line_number":3889,"context_line":""},{"line_number":3890,"context_line":""},{"line_number":3891,"context_line":"    if (dco_enabled(o))"},{"line_number":3892,"context_line":"    {"},{"line_number":3893,"context_line":"        /* check if any option should force disabling DCO */"}],"source_content_type":"text/x-csrc","patch_set":16,"id":"a92aab4d_80a8d40f","line":3890,"updated":"2026-06-24 13:31:42.000000000","message":"spurious change","commit_id":"02829edd0828bd5af8934ffba182588901a03440"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"911c091ad78cf2d2486f85cd092c55199baedfec","unresolved":false,"context_lines":[{"line_number":3887,"context_line":"                     \"incompatible with each other.\");"},{"line_number":3888,"context_line":"    }"},{"line_number":3889,"context_line":""},{"line_number":3890,"context_line":""},{"line_number":3891,"context_line":"    if (dco_enabled(o))"},{"line_number":3892,"context_line":"    {"},{"line_number":3893,"context_line":"        /* check if any option should force disabling DCO */"}],"source_content_type":"text/x-csrc","patch_set":16,"id":"58dea1af_17b21c2d","line":3890,"in_reply_to":"a92aab4d_80a8d40f","updated":"2026-06-29 01:39:17.000000000","message":"Done","commit_id":"02829edd0828bd5af8934ffba182588901a03440"}],"src/openvpn/push.c":[{"author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"df4dff61d6219b83285cee7f52de8682bb3e347f","unresolved":true,"context_lines":[{"line_number":654,"context_line":"    if (tls_multi-\u003euse_peer_id)"},{"line_number":655,"context_line":"    {"},{"line_number":656,"context_line":"        push_option_fmt(gc, push_list, M_USAGE, \"peer-id %d\","},{"line_number":657,"context_line":"                        tls_multi-\u003erx_peer_id);"},{"line_number":658,"context_line":"    }"},{"line_number":659,"context_line":"    /*"},{"line_number":660,"context_line":"     * If server uses --auth-gen-token and we have an auth token"}],"source_content_type":"text/x-csrc","patch_set":2,"id":"ad29de27_05d54fe8","line":657,"updated":"2025-07-17 09:43:55.000000000","message":"This will instruct the client to use that peer-id on both send/receive. The idea was to *not* push peer-id in this scenario but rather have both sides see that if the other peer has ID\u003d in their peerinfo then they both switch to assymmetric peer-id","commit_id":"a768e1ae7690a3eefb1c118b1fe40d1b7a9f0354"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"2055e30e29b4776a5f310d0cf95344bba10d41f5","unresolved":false,"context_lines":[{"line_number":654,"context_line":"    if (tls_multi-\u003euse_peer_id)"},{"line_number":655,"context_line":"    {"},{"line_number":656,"context_line":"        push_option_fmt(gc, push_list, M_USAGE, \"peer-id %d\","},{"line_number":657,"context_line":"                        tls_multi-\u003erx_peer_id);"},{"line_number":658,"context_line":"    }"},{"line_number":659,"context_line":"    /*"},{"line_number":660,"context_line":"     * If server uses --auth-gen-token and we have an auth token"}],"source_content_type":"text/x-csrc","patch_set":2,"id":"643315b6_ec74dded","line":657,"in_reply_to":"098ded6f_b8a7adfd","updated":"2025-09-29 09:37:04.000000000","message":"Done","commit_id":"a768e1ae7690a3eefb1c118b1fe40d1b7a9f0354"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"fb2a91f5448bca36d7a956fd0c96c3bd455c7e57","unresolved":true,"context_lines":[{"line_number":654,"context_line":"    if (tls_multi-\u003euse_peer_id)"},{"line_number":655,"context_line":"    {"},{"line_number":656,"context_line":"        push_option_fmt(gc, push_list, M_USAGE, \"peer-id %d\","},{"line_number":657,"context_line":"                        tls_multi-\u003erx_peer_id);"},{"line_number":658,"context_line":"    }"},{"line_number":659,"context_line":"    /*"},{"line_number":660,"context_line":"     * If server uses --auth-gen-token and we have an auth token"}],"source_content_type":"text/x-csrc","patch_set":2,"id":"dfe60a3c_ec0e72ed","line":657,"in_reply_to":"ad29de27_05d54fe8","updated":"2025-08-05 07:56:28.000000000","message":"ok but what about the mapping? we\u0027re using the current peer-id assigned by the server as index to keep track of the instances, should we implement a different kind of mapping? Of curse on server side I will prepend to the buffer the tx_peer_id (if supported) along with the opcode but yeah the client will keep prepending the old one.","commit_id":"a768e1ae7690a3eefb1c118b1fe40d1b7a9f0354"},{"author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"8390654e74e78b1c6c5f074bf1b49d08a5521628","unresolved":true,"context_lines":[{"line_number":654,"context_line":"    if (tls_multi-\u003euse_peer_id)"},{"line_number":655,"context_line":"    {"},{"line_number":656,"context_line":"        push_option_fmt(gc, push_list, M_USAGE, \"peer-id %d\","},{"line_number":657,"context_line":"                        tls_multi-\u003erx_peer_id);"},{"line_number":658,"context_line":"    }"},{"line_number":659,"context_line":"    /*"},{"line_number":660,"context_line":"     * If server uses --auth-gen-token and we have an auth token"}],"source_content_type":"text/x-csrc","patch_set":2,"id":"098ded6f_b8a7adfd","line":657,"in_reply_to":"dfe60a3c_ec0e72ed","updated":"2025-08-05 12:22:11.000000000","message":"Yes, but the idea of the protocol is:\n\n- server pushes peer-id: client uses *same* peer-id for send and receive.\n- server pushes nothing but has ID\u003d in its own peer-info, client reconigses that the peer is supporting assymetric peer-id and uses the peer\u0027s ID for sending packets and expecting the id the ID it send in peerinfo for incoming packets.","commit_id":"a768e1ae7690a3eefb1c118b1fe40d1b7a9f0354"},{"author":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"change_message_id":"7c1275e4fa13744c6ff76220b878e4f6f1a3d663","unresolved":true,"context_lines":[{"line_number":664,"context_line":"    if (!tls_multi-\u003euse_asymmetric_peer_id)"},{"line_number":665,"context_line":"    {"},{"line_number":666,"context_line":"        push_option_fmt(gc, push_list, M_USAGE, \"peer-id %d\","},{"line_number":667,"context_line":"                        tls_multi-\u003erx_peer_id);"},{"line_number":668,"context_line":"    }"},{"line_number":669,"context_line":"    /*"},{"line_number":670,"context_line":"     * If server uses --auth-gen-token and we have an auth token"}],"source_content_type":"text/x-csrc","patch_set":18,"id":"ddd6871f_ae9c28e6","line":667,"updated":"2026-07-17 21:31:48.000000000","message":"was this wrapping intentional? it makes reading the diff harder...","commit_id":"71a6b89896a36a08adac3b61bcccd949bcf149c1"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"57c436a594a87308c46dd5389b607fb82a2ccf7f","unresolved":false,"context_lines":[{"line_number":664,"context_line":"    if (!tls_multi-\u003euse_asymmetric_peer_id)"},{"line_number":665,"context_line":"    {"},{"line_number":666,"context_line":"        push_option_fmt(gc, push_list, M_USAGE, \"peer-id %d\","},{"line_number":667,"context_line":"                        tls_multi-\u003erx_peer_id);"},{"line_number":668,"context_line":"    }"},{"line_number":669,"context_line":"    /*"},{"line_number":670,"context_line":"     * If server uses --auth-gen-token and we have an auth token"}],"source_content_type":"text/x-csrc","patch_set":18,"id":"8eaa710e_d2d3ae5e","line":667,"in_reply_to":"ddd6871f_ae9c28e6","updated":"2026-07-20 12:01:06.000000000","message":"Uintentional.","commit_id":"71a6b89896a36a08adac3b61bcccd949bcf149c1"},{"author":{"_account_id":1000007,"name":"ordex","display_name":"Antonio Quartulli","email":"antonio@mandelbit.com","username":"ordex"},"change_message_id":"1b044b6c957982c3ee3e5bcac3b5d5163384716c","unresolved":true,"context_lines":[{"line_number":661,"context_line":"                        print_in_addr_t(c-\u003ec2.push_ifconfig_remote_netmask, 0, gc));"},{"line_number":662,"context_line":"    }"},{"line_number":663,"context_line":""},{"line_number":664,"context_line":"    if (!tls_multi-\u003euse_asymmetric_peer_id)"},{"line_number":665,"context_line":"    {"},{"line_number":666,"context_line":"        push_option_fmt(gc, push_list, M_USAGE, \"peer-id %d\", tls_multi-\u003erx_peer_id);"},{"line_number":667,"context_line":"    }"}],"source_content_type":"text/x-csrc","patch_set":19,"id":"f86a6636_fa825513","line":664,"updated":"2026-07-21 22:58:31.000000000","message":"this is not equivalent to what was used before (use_peer_id).\nwhat about a peer going with DATA_V1 (i.e. use_peer_id\u003d\u003dfalse) and also not using symmetric peer id?\n\nit now gets pushed the peer_id although DATA_V1 implies it should not get any.\n\nmakes sense?","commit_id":"5738669616b166a39c7b91d031672c8e7fabb5c8"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"73e2db927c34f4884ef1363f9dc1a6d2f003fd30","unresolved":false,"context_lines":[{"line_number":661,"context_line":"                        print_in_addr_t(c-\u003ec2.push_ifconfig_remote_netmask, 0, gc));"},{"line_number":662,"context_line":"    }"},{"line_number":663,"context_line":""},{"line_number":664,"context_line":"    if (!tls_multi-\u003euse_asymmetric_peer_id)"},{"line_number":665,"context_line":"    {"},{"line_number":666,"context_line":"        push_option_fmt(gc, push_list, M_USAGE, \"peer-id %d\", tls_multi-\u003erx_peer_id);"},{"line_number":667,"context_line":"    }"}],"source_content_type":"text/x-csrc","patch_set":19,"id":"46cf6413_d5ac6ec0","line":664,"in_reply_to":"f86a6636_fa825513","updated":"2026-07-22 11:37:25.000000000","message":"Changed it to use_peer_id \u0026\u0026 !use_asymmetric_peer_id, so DATA_V1 stays untouched and only the classic DATA_V2 case gets the push (the asymmetric case announces its id through peer-info instead).","commit_id":"5738669616b166a39c7b91d031672c8e7fabb5c8"}],"src/openvpn/ssl.c":[{"author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"df4dff61d6219b83285cee7f52de8682bb3e347f","unresolved":true,"context_lines":[{"line_number":2040,"context_line":"        iv_proto |\u003d IV_PROTO_DYN_TLS_CRYPT;"},{"line_number":2041,"context_line":""},{"line_number":2042,"context_line":"        buf_printf(\u0026out, \"IV_PROTO\u003d%d\\n\", iv_proto);"},{"line_number":2043,"context_line":"        buf_printf(\u0026out, \"ID\u003d%x\\n\", peer_id);"},{"line_number":2044,"context_line":""},{"line_number":2045,"context_line":"        if (session-\u003eopt-\u003epush_peer_info_detail \u003e 1)"},{"line_number":2046,"context_line":"        {"}],"source_content_type":"text/x-csrc","patch_set":2,"id":"231475b7_833b9982","line":2043,"updated":"2025-07-17 09:43:55.000000000","message":"This need to be guarded by the actual DCO capability. We cannot announce this if the DCO module/implementation then cannot actually support assymetric ID support.","commit_id":"a768e1ae7690a3eefb1c118b1fe40d1b7a9f0354"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"fb2a91f5448bca36d7a956fd0c96c3bd455c7e57","unresolved":false,"context_lines":[{"line_number":2040,"context_line":"        iv_proto |\u003d IV_PROTO_DYN_TLS_CRYPT;"},{"line_number":2041,"context_line":""},{"line_number":2042,"context_line":"        buf_printf(\u0026out, \"IV_PROTO\u003d%d\\n\", iv_proto);"},{"line_number":2043,"context_line":"        buf_printf(\u0026out, \"ID\u003d%x\\n\", peer_id);"},{"line_number":2044,"context_line":""},{"line_number":2045,"context_line":"        if (session-\u003eopt-\u003epush_peer_info_detail \u003e 1)"},{"line_number":2046,"context_line":"        {"}],"source_content_type":"text/x-csrc","patch_set":2,"id":"7a3b0954_5bc84265","line":2043,"in_reply_to":"231475b7_833b9982","updated":"2025-08-05 07:56:28.000000000","message":"Acknowledged","commit_id":"a768e1ae7690a3eefb1c118b1fe40d1b7a9f0354"},{"author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"334f152f34aa95ea6819e4a33b0196f499fa7dfa","unresolved":true,"context_lines":[{"line_number":1176,"context_line":"    ret-\u003eopt \u003d *tls_options;"},{"line_number":1177,"context_line":"    ret-\u003edco_peer_id \u003d -1;"},{"line_number":1178,"context_line":"    ret-\u003euse_asymmetric_peer_id \u003d false;"},{"line_number":1179,"context_line":"    ret-\u003erx_peer_id \u003d MAX_PEER_ID;"},{"line_number":1180,"context_line":"    ret-\u003etx_peer_id \u003d MAX_PEER_ID;"},{"line_number":1181,"context_line":""},{"line_number":1182,"context_line":"    return ret;"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"7b89f526_1248648b","line":1179,"updated":"2025-10-07 15:50:10.000000000","message":"Add comment here that we also use the rx peer id to identify DCO clients as this has become now a important distinction.","commit_id":"816b0f141c576aa0348d75ce5f23de29812c28de"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"2da8d2c9c39b513cbbc31f5cb192b313ae6ebdbb","unresolved":false,"context_lines":[{"line_number":1176,"context_line":"    ret-\u003eopt \u003d *tls_options;"},{"line_number":1177,"context_line":"    ret-\u003edco_peer_id \u003d -1;"},{"line_number":1178,"context_line":"    ret-\u003euse_asymmetric_peer_id \u003d false;"},{"line_number":1179,"context_line":"    ret-\u003erx_peer_id \u003d MAX_PEER_ID;"},{"line_number":1180,"context_line":"    ret-\u003etx_peer_id \u003d MAX_PEER_ID;"},{"line_number":1181,"context_line":""},{"line_number":1182,"context_line":"    return ret;"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"483a5681_27b0022b","line":1179,"in_reply_to":"7b89f526_1248648b","updated":"2025-10-27 13:47:02.000000000","message":"Done","commit_id":"816b0f141c576aa0348d75ce5f23de29812c28de"},{"author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"334f152f34aa95ea6819e4a33b0196f499fa7dfa","unresolved":true,"context_lines":[{"line_number":1979,"context_line":"        if (peer_id !\u003d MAX_PEER_ID)"},{"line_number":1980,"context_line":"        {"},{"line_number":1981,"context_line":"            buf_printf(\u0026out, \"ID\u003d%x\\n\", peer_id);"},{"line_number":1982,"context_line":"        }"},{"line_number":1983,"context_line":""},{"line_number":1984,"context_line":"        if (session-\u003eopt-\u003epush_peer_info_detail \u003e 1)"},{"line_number":1985,"context_line":"        {"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"18e30fd6_0e66350f","line":1982,"updated":"2025-10-07 15:50:10.000000000","message":"This is still not guarded by DCO capability. With the current version we still always indicate to the peer that we are always asymmetric peer ID capable even if the underlying DCO module is not able to use a different peer ID for TX.","commit_id":"816b0f141c576aa0348d75ce5f23de29812c28de"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"2da8d2c9c39b513cbbc31f5cb192b313ae6ebdbb","unresolved":false,"context_lines":[{"line_number":1979,"context_line":"        if (peer_id !\u003d MAX_PEER_ID)"},{"line_number":1980,"context_line":"        {"},{"line_number":1981,"context_line":"            buf_printf(\u0026out, \"ID\u003d%x\\n\", peer_id);"},{"line_number":1982,"context_line":"        }"},{"line_number":1983,"context_line":""},{"line_number":1984,"context_line":"        if (session-\u003eopt-\u003epush_peer_info_detail \u003e 1)"},{"line_number":1985,"context_line":"        {"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"d7cabc51_e6990ae0","line":1982,"in_reply_to":"18e30fd6_0e66350f","updated":"2025-10-27 13:47:02.000000000","message":"Done","commit_id":"816b0f141c576aa0348d75ce5f23de29812c28de"},{"author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"334f152f34aa95ea6819e4a33b0196f499fa7dfa","unresolved":true,"context_lines":[{"line_number":2162,"context_line":"    }"},{"line_number":2163,"context_line":""},{"line_number":2164,"context_line":"    /* Calculate the asymmetric peer-id */"},{"line_number":2165,"context_line":"    if (multi-\u003erx_peer_id \u003d\u003d MAX_PEER_ID \u0026\u0026 session-\u003eopt-\u003emode !\u003d MODE_SERVER)"},{"line_number":2166,"context_line":"    {"},{"line_number":2167,"context_line":"        uint8_t peerid[3];"},{"line_number":2168,"context_line":"        srand((unsigned)time(NULL));"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"3fb67b50_b42dfeaf","line":2165,"updated":"2025-10-07 15:50:10.000000000","message":"This feel be a very hacky place to set the multi rx peer id. I think there is a better place to do that.","commit_id":"816b0f141c576aa0348d75ce5f23de29812c28de"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"2da8d2c9c39b513cbbc31f5cb192b313ae6ebdbb","unresolved":true,"context_lines":[{"line_number":2162,"context_line":"    }"},{"line_number":2163,"context_line":""},{"line_number":2164,"context_line":"    /* Calculate the asymmetric peer-id */"},{"line_number":2165,"context_line":"    if (multi-\u003erx_peer_id \u003d\u003d MAX_PEER_ID \u0026\u0026 session-\u003eopt-\u003emode !\u003d MODE_SERVER)"},{"line_number":2166,"context_line":"    {"},{"line_number":2167,"context_line":"        uint8_t peerid[3];"},{"line_number":2168,"context_line":"        srand((unsigned)time(NULL));"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"c0fec251_e0eada21","line":2165,"in_reply_to":"3fb67b50_b42dfeaf","updated":"2025-10-27 13:47:02.000000000","message":"I moved this into tls_multi_init_finalize(), hope that\u0027s fine.","commit_id":"816b0f141c576aa0348d75ce5f23de29812c28de"},{"author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"aab5d3255c358df12fa9c2d8e882da827666dc14","unresolved":false,"context_lines":[{"line_number":2162,"context_line":"    }"},{"line_number":2163,"context_line":""},{"line_number":2164,"context_line":"    /* Calculate the asymmetric peer-id */"},{"line_number":2165,"context_line":"    if (multi-\u003erx_peer_id \u003d\u003d MAX_PEER_ID \u0026\u0026 session-\u003eopt-\u003emode !\u003d MODE_SERVER)"},{"line_number":2166,"context_line":"    {"},{"line_number":2167,"context_line":"        uint8_t peerid[3];"},{"line_number":2168,"context_line":"        srand((unsigned)time(NULL));"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"826f4e99_d4eca514","line":2165,"in_reply_to":"c0fec251_e0eada21","updated":"2026-01-22 12:47:56.000000000","message":"Done","commit_id":"816b0f141c576aa0348d75ce5f23de29812c28de"},{"author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"b65dc234bfd57362033d7490729c2fb95d60c045","unresolved":true,"context_lines":[{"line_number":1191,"context_line":"        if (multi-\u003erx_peer_id \u003d\u003d MAX_PEER_ID \u0026\u0026 multi-\u003esession[TM_INITIAL].opt-\u003emode !\u003d MODE_SERVER)"},{"line_number":1192,"context_line":"        {"},{"line_number":1193,"context_line":"            uint8_t peerid[3];"},{"line_number":1194,"context_line":"            srand((unsigned)time(NULL));"},{"line_number":1195,"context_line":"            for (int i \u003d 0; i \u003c 3; i++)"},{"line_number":1196,"context_line":"            {"},{"line_number":1197,"context_line":"                peerid[i] \u003d (uint8_t)rand();"}],"source_content_type":"text/x-csrc","patch_set":11,"id":"30f18a42_e2c10e22","line":1194,"updated":"2026-06-08 16:33:39.000000000","message":"srand will be flagged by people for not being a secure random. Rather use rand_bytes here.","commit_id":"040bb8548c15c48df5d615e916e46e7669c8d32b"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"dd5ca163213054a2b315bec23a28399e2f3eb83b","unresolved":false,"context_lines":[{"line_number":1191,"context_line":"        if (multi-\u003erx_peer_id \u003d\u003d MAX_PEER_ID \u0026\u0026 multi-\u003esession[TM_INITIAL].opt-\u003emode !\u003d MODE_SERVER)"},{"line_number":1192,"context_line":"        {"},{"line_number":1193,"context_line":"            uint8_t peerid[3];"},{"line_number":1194,"context_line":"            srand((unsigned)time(NULL));"},{"line_number":1195,"context_line":"            for (int i \u003d 0; i \u003c 3; i++)"},{"line_number":1196,"context_line":"            {"},{"line_number":1197,"context_line":"                peerid[i] \u003d (uint8_t)rand();"}],"source_content_type":"text/x-csrc","patch_set":11,"id":"cc54099c_5992e30e","line":1194,"in_reply_to":"30f18a42_e2c10e22","updated":"2026-06-09 11:56:06.000000000","message":"Done","commit_id":"040bb8548c15c48df5d615e916e46e7669c8d32b"},{"author":{"_account_id":1000001,"name":"flichtenheld","display_name":"Frank Lichtenheld","email":"frank@lichtenheld.com","username":"flichtenheld","status":"OpenVPN Inc."},"change_message_id":"30122c3ff696fc0d7be576a9120c168006362ecd","unresolved":true,"context_lines":[{"line_number":2344,"context_line":"    }"},{"line_number":2345,"context_line":"    else"},{"line_number":2346,"context_line":"    {"},{"line_number":2347,"context_line":"        free(multi-\u003epeer_info);"},{"line_number":2348,"context_line":"        multi-\u003epeer_info \u003d read_string_alloc(buf);"},{"line_number":2349,"context_line":"    }"},{"line_number":2350,"context_line":"    if (session-\u003eopt-\u003emode \u003d\u003d MODE_POINT_TO_POINT \u0026\u0026 !session-\u003eopt-\u003edco_enabled)"}],"source_content_type":"text/x-csrc","patch_set":16,"id":"92521dd9_9d09e7d5","line":2347,"updated":"2026-06-24 13:31:42.000000000","message":"useless free, we know it is NULL","commit_id":"02829edd0828bd5af8934ffba182588901a03440"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"911c091ad78cf2d2486f85cd092c55199baedfec","unresolved":false,"context_lines":[{"line_number":2344,"context_line":"    }"},{"line_number":2345,"context_line":"    else"},{"line_number":2346,"context_line":"    {"},{"line_number":2347,"context_line":"        free(multi-\u003epeer_info);"},{"line_number":2348,"context_line":"        multi-\u003epeer_info \u003d read_string_alloc(buf);"},{"line_number":2349,"context_line":"    }"},{"line_number":2350,"context_line":"    if (session-\u003eopt-\u003emode \u003d\u003d MODE_POINT_TO_POINT \u0026\u0026 !session-\u003eopt-\u003edco_enabled)"}],"source_content_type":"text/x-csrc","patch_set":16,"id":"b9c300b5_e281c165","line":2347,"in_reply_to":"92521dd9_9d09e7d5","updated":"2026-06-29 01:39:17.000000000","message":"Done","commit_id":"02829edd0828bd5af8934ffba182588901a03440"},{"author":{"_account_id":1000001,"name":"flichtenheld","display_name":"Frank Lichtenheld","email":"frank@lichtenheld.com","username":"flichtenheld","status":"OpenVPN Inc."},"change_message_id":"30122c3ff696fc0d7be576a9120c168006362ecd","unresolved":true,"context_lines":[{"line_number":2345,"context_line":"    else"},{"line_number":2346,"context_line":"    {"},{"line_number":2347,"context_line":"        free(multi-\u003epeer_info);"},{"line_number":2348,"context_line":"        multi-\u003epeer_info \u003d read_string_alloc(buf);"},{"line_number":2349,"context_line":"    }"},{"line_number":2350,"context_line":"    if (session-\u003eopt-\u003emode \u003d\u003d MODE_POINT_TO_POINT \u0026\u0026 !session-\u003eopt-\u003edco_enabled)"},{"line_number":2351,"context_line":"    {"}],"source_content_type":"text/x-csrc","patch_set":16,"id":"0dbe9a30_4550caf1","line":2348,"updated":"2026-06-24 13:31:42.000000000","message":"This needs a comment. Why if we do not find a peer_info, we just try again? Where does the empty string come from? And why does the MODE_SERVER code only use the first one while the MODE_POINT_TO_POINT code is happy to use either?","commit_id":"02829edd0828bd5af8934ffba182588901a03440"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"911c091ad78cf2d2486f85cd092c55199baedfec","unresolved":false,"context_lines":[{"line_number":2345,"context_line":"    else"},{"line_number":2346,"context_line":"    {"},{"line_number":2347,"context_line":"        free(multi-\u003epeer_info);"},{"line_number":2348,"context_line":"        multi-\u003epeer_info \u003d read_string_alloc(buf);"},{"line_number":2349,"context_line":"    }"},{"line_number":2350,"context_line":"    if (session-\u003eopt-\u003emode \u003d\u003d MODE_POINT_TO_POINT \u0026\u0026 !session-\u003eopt-\u003edco_enabled)"},{"line_number":2351,"context_line":"    {"}],"source_content_type":"text/x-csrc","patch_set":16,"id":"1b54d5fd_1af13e14","line":2348,"in_reply_to":"0dbe9a30_4550caf1","updated":"2026-06-29 01:39:17.000000000","message":"If I remember correctly we needed this because the server were supposed to send an empty string via peer_info (as you can see from the previous code, when peer_info_details are \u003c 1 we just print an empty string to the buffer) but, we the latest changes we made this else block is no more required so I reworked this part a bit.","commit_id":"02829edd0828bd5af8934ffba182588901a03440"},{"author":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"change_message_id":"7c1275e4fa13744c6ff76220b878e4f6f1a3d663","unresolved":true,"context_lines":[{"line_number":2076,"context_line":"    {"},{"line_number":2077,"context_line":"        if (!(session-\u003eopt-\u003emode \u003d\u003d MODE_SERVER \u0026\u0026 multi-\u003euse_asymmetric_peer_id"},{"line_number":2078,"context_line":"                  ? write_string(buf, BSTR(\u0026out), -1)"},{"line_number":2079,"context_line":"                  : write_empty_string(buf)))"},{"line_number":2080,"context_line":"        {"},{"line_number":2081,"context_line":"            goto error;"},{"line_number":2082,"context_line":"        }"}],"source_content_type":"text/x-csrc","patch_set":18,"id":"446bf172_079ab262","line":2079,"updated":"2026-07-17 21:31:48.000000000","message":"please do not call functions with side effects as part of a ternary condition in an if() - it\u0027s really hard to follow what this does","commit_id":"71a6b89896a36a08adac3b61bcccd949bcf149c1"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"57c436a594a87308c46dd5389b607fb82a2ccf7f","unresolved":false,"context_lines":[{"line_number":2076,"context_line":"    {"},{"line_number":2077,"context_line":"        if (!(session-\u003eopt-\u003emode \u003d\u003d MODE_SERVER \u0026\u0026 multi-\u003euse_asymmetric_peer_id"},{"line_number":2078,"context_line":"                  ? write_string(buf, BSTR(\u0026out), -1)"},{"line_number":2079,"context_line":"                  : write_empty_string(buf)))"},{"line_number":2080,"context_line":"        {"},{"line_number":2081,"context_line":"            goto error;"},{"line_number":2082,"context_line":"        }"}],"source_content_type":"text/x-csrc","patch_set":18,"id":"c63de6c1_f1737fb4","line":2079,"in_reply_to":"446bf172_079ab262","updated":"2026-07-20 12:01:06.000000000","message":"Done","commit_id":"71a6b89896a36a08adac3b61bcccd949bcf149c1"},{"author":{"_account_id":1000007,"name":"ordex","display_name":"Antonio Quartulli","email":"antonio@mandelbit.com","username":"ordex"},"change_message_id":"b3cafca95fab023d4cb0f8833f43f3ed2af2d90a","unresolved":true,"context_lines":[{"line_number":1197,"context_line":"                msg(M_FATAL, \"rand_bytes() failed\");"},{"line_number":1198,"context_line":"            }"},{"line_number":1199,"context_line":""},{"line_number":1200,"context_line":"            multi-\u003erx_peer_id \u003d ((uint32_t)peerid[0] \u003c\u003c 16)"},{"line_number":1201,"context_line":"                                | ((uint32_t)peerid[1] \u003c\u003c 8)"},{"line_number":1202,"context_line":"                                | (uint32_t)peerid[2];"},{"line_number":1203,"context_line":"        }"}],"source_content_type":"text/x-csrc","patch_set":19,"id":"ff85c098_36cb0bb2","line":1200,"updated":"2026-07-21 22:55:38.000000000","message":"what happens if this turns to be MAX_PEER_ID (0xFFFFFF)? Could this be problematic?","commit_id":"5738669616b166a39c7b91d031672c8e7fabb5c8"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"73e2db927c34f4884ef1363f9dc1a6d2f003fd30","unresolved":false,"context_lines":[{"line_number":1197,"context_line":"                msg(M_FATAL, \"rand_bytes() failed\");"},{"line_number":1198,"context_line":"            }"},{"line_number":1199,"context_line":""},{"line_number":1200,"context_line":"            multi-\u003erx_peer_id \u003d ((uint32_t)peerid[0] \u003c\u003c 16)"},{"line_number":1201,"context_line":"                                | ((uint32_t)peerid[1] \u003c\u003c 8)"},{"line_number":1202,"context_line":"                                | (uint32_t)peerid[2];"},{"line_number":1203,"context_line":"        }"}],"source_content_type":"text/x-csrc","patch_set":19,"id":"c641e2bd_1cb61b43","line":1200,"in_reply_to":"ff85c098_36cb0bb2","updated":"2026-07-22 11:37:25.000000000","message":"Yeah, that\u0027s a real one. It\u0027s 3 random bytes, so it can land on 0xFFFFFF, which is MAX_PEER_ID, our \"unset\" marker. When that happens we don\u0027t announce the id and use_peer_id never gets set, so the feature just quietly turns itself off. Wrapped the generation in a do/while that retries until it\u0027s not MAX_PEER_ID.","commit_id":"5738669616b166a39c7b91d031672c8e7fabb5c8"},{"author":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"change_message_id":"03d3a149be70791d281fffa97bcd7e4eb3a04dfa","unresolved":true,"context_lines":[{"line_number":1190,"context_line":"        /* Calculate the asymmetric peer-id */"},{"line_number":1191,"context_line":"        if (multi-\u003erx_peer_id \u003d\u003d MAX_PEER_ID \u0026\u0026 multi-\u003esession[TM_INITIAL].opt-\u003emode !\u003d MODE_SERVER)"},{"line_number":1192,"context_line":"        {"},{"line_number":1193,"context_line":"            uint8_t peerid[3];"},{"line_number":1194,"context_line":""},{"line_number":1195,"context_line":"            do"},{"line_number":1196,"context_line":"            {"}],"source_content_type":"text/x-csrc","patch_set":27,"id":"be3a2177_8ee1643b","line":1193,"updated":"2026-07-27 13:41:51.000000000","message":"please rewrite using `multi-\u003erx_peer_id \u003d get_random() \u0026 0xffffff` - shorter, easier to understand.\n\nOr we can get rid of the loop doing maybe `get_random % (MAX_PEER_ID-1)` if uniformness is less important.  Or `\u0026 0xefffff` if only half the number space is sufficient ;-)","commit_id":"25f3955efd71e5c7ab54e0da3d4181610cb0b5c9"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"73ce5bd46d08bf348fa9df3e139845e18301e61e","unresolved":false,"context_lines":[{"line_number":1190,"context_line":"        /* Calculate the asymmetric peer-id */"},{"line_number":1191,"context_line":"        if (multi-\u003erx_peer_id \u003d\u003d MAX_PEER_ID \u0026\u0026 multi-\u003esession[TM_INITIAL].opt-\u003emode !\u003d MODE_SERVER)"},{"line_number":1192,"context_line":"        {"},{"line_number":1193,"context_line":"            uint8_t peerid[3];"},{"line_number":1194,"context_line":""},{"line_number":1195,"context_line":"            do"},{"line_number":1196,"context_line":"            {"}],"source_content_type":"text/x-csrc","patch_set":27,"id":"6494e3bf_2e1f4801","line":1193,"in_reply_to":"9ccc98c0_fc4e3b53","updated":"2026-07-27 14:50:51.000000000","message":"Done","commit_id":"25f3955efd71e5c7ab54e0da3d4181610cb0b5c9"},{"author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"1356e36f48c7c77629a5fbef4b75c45f3f453a22","unresolved":true,"context_lines":[{"line_number":1190,"context_line":"        /* Calculate the asymmetric peer-id */"},{"line_number":1191,"context_line":"        if (multi-\u003erx_peer_id \u003d\u003d MAX_PEER_ID \u0026\u0026 multi-\u003esession[TM_INITIAL].opt-\u003emode !\u003d MODE_SERVER)"},{"line_number":1192,"context_line":"        {"},{"line_number":1193,"context_line":"            uint8_t peerid[3];"},{"line_number":1194,"context_line":""},{"line_number":1195,"context_line":"            do"},{"line_number":1196,"context_line":"            {"}],"source_content_type":"text/x-csrc","patch_set":27,"id":"9ccc98c0_fc4e3b53","line":1193,"in_reply_to":"be3a2177_8ee1643b","updated":"2026-07-27 13:43:10.000000000","message":"I would vote for the `get_random() % (MAX_PEER_ID-1)` method.","commit_id":"25f3955efd71e5c7ab54e0da3d4181610cb0b5c9"},{"author":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"change_message_id":"d6dd6d8548f489020c76840f14ce6827e68ae5ce","unresolved":true,"context_lines":[{"line_number":2079,"context_line":"                goto error;"},{"line_number":2080,"context_line":"            }"},{"line_number":2081,"context_line":"        }"},{"line_number":2082,"context_line":"    }"},{"line_number":2083,"context_line":"    ret \u003d true;"},{"line_number":2084,"context_line":""},{"line_number":2085,"context_line":"error:"}],"source_content_type":"text/x-csrc","patch_set":28,"id":"da19c571_23390c09","line":2082,"updated":"2026-07-27 15:18:16.000000000","message":"this is still ugly.  We do not decide whether to write the \"out\" string to \"buf\" by whether or not it has content, but by relying on a complex condition that nobody reading this function will understand.\n\nWhat about\n\n```\n/* write peer info string if there is anything in it, empty string otherwise */\nif ( blenz(\u0026out) \u003e 0 )\n{\n    if (!write_string(...))\n      {...}\n}\nelse\n{\n    if (!write_empty_string(..))\n       {...}\n}\n```\n\nmoving this out from the `else {}` branch, and also removing the `write_string()` from the end of the previous `if ()` clause?","commit_id":"1051a4ef164c3c97f42459c97e27384b2e500bf4"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"65a67d1e53220bb4c32b68e015c417fc69497cda","unresolved":false,"context_lines":[{"line_number":2079,"context_line":"                goto error;"},{"line_number":2080,"context_line":"            }"},{"line_number":2081,"context_line":"        }"},{"line_number":2082,"context_line":"    }"},{"line_number":2083,"context_line":"    ret \u003d true;"},{"line_number":2084,"context_line":""},{"line_number":2085,"context_line":"error:"}],"source_content_type":"text/x-csrc","patch_set":28,"id":"233abad1_02fe649c","line":2082,"in_reply_to":"da19c571_23390c09","updated":"2026-07-28 07:47:45.000000000","message":"Done","commit_id":"1051a4ef164c3c97f42459c97e27384b2e500bf4"},{"author":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"change_message_id":"d6dd6d8548f489020c76840f14ce6827e68ae5ce","unresolved":true,"context_lines":[{"line_number":2337,"context_line":"            else"},{"line_number":2338,"context_line":"            {"},{"line_number":2339,"context_line":"                /* With DCO we don\u0027t need the tx_peer_id atm */"},{"line_number":2340,"context_line":"                multi-\u003etx_peer_id \u003d multi-\u003erx_peer_id;"},{"line_number":2341,"context_line":"            }"},{"line_number":2342,"context_line":"        }"},{"line_number":2343,"context_line":"        if (session-\u003eopt-\u003emode \u003d\u003d MODE_POINT_TO_POINT \u0026\u0026 !session-\u003eopt-\u003edco_enabled)"}],"source_content_type":"text/x-csrc","patch_set":28,"id":"ba74cf4c_9a52cb50","line":2340,"updated":"2026-07-27 15:18:16.000000000","message":"that comment is confusing.  \"We don\u0027t need it, but we store it\", what is that good for?  Maybe make that `/* DCO currently can only handle symmetric peer IDs */`?","commit_id":"1051a4ef164c3c97f42459c97e27384b2e500bf4"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"65a67d1e53220bb4c32b68e015c417fc69497cda","unresolved":false,"context_lines":[{"line_number":2337,"context_line":"            else"},{"line_number":2338,"context_line":"            {"},{"line_number":2339,"context_line":"                /* With DCO we don\u0027t need the tx_peer_id atm */"},{"line_number":2340,"context_line":"                multi-\u003etx_peer_id \u003d multi-\u003erx_peer_id;"},{"line_number":2341,"context_line":"            }"},{"line_number":2342,"context_line":"        }"},{"line_number":2343,"context_line":"        if (session-\u003eopt-\u003emode \u003d\u003d MODE_POINT_TO_POINT \u0026\u0026 !session-\u003eopt-\u003edco_enabled)"}],"source_content_type":"text/x-csrc","patch_set":28,"id":"8cf8bc76_6d00696d","line":2340,"in_reply_to":"ba74cf4c_9a52cb50","updated":"2026-07-28 07:47:45.000000000","message":"Done","commit_id":"1051a4ef164c3c97f42459c97e27384b2e500bf4"},{"author":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"change_message_id":"d6dd6d8548f489020c76840f14ce6827e68ae5ce","unresolved":true,"context_lines":[{"line_number":2349,"context_line":"                multi-\u003euse_asymmetric_peer_id \u003d true;"},{"line_number":2350,"context_line":"                multi-\u003euse_peer_id \u003d true;"},{"line_number":2351,"context_line":"            }"},{"line_number":2352,"context_line":"        }"},{"line_number":2353,"context_line":"    }"},{"line_number":2354,"context_line":""},{"line_number":2355,"context_line":"    free(multi-\u003eremote_ciphername);"}],"source_content_type":"text/x-csrc","patch_set":28,"id":"11a198a6_27b5988b","line":2352,"updated":"2026-07-27 15:18:16.000000000","message":"Looks like a repeat of the previous code block...?  Can the POINT_TO_POINT case not be included in the `MODE_SERVER` case?\n\n```\nif ( session-\u003eopt-\u003emode \u003d\u003d MODE_SERVER || session-\u003eopt_mode \u003d\u003d MODE_POINT_TO_POINT )\n{\n    peer_id \u003d ..\n    if ( peer_id !\u003d MAX_PEER_ID \u0026\u0026 !session-\u003eopt_dco_enabled )\n    {\n        /* asymmetric */\n    }\n    else\n    {\n         /* peer has no support for asymmetric peer-id, DCO has no support for it */\n         multi-\u003etx_peer_id \u003d multi-\u003erx_peer_id;\n    }       \n}\n```","commit_id":"1051a4ef164c3c97f42459c97e27384b2e500bf4"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"65a67d1e53220bb4c32b68e015c417fc69497cda","unresolved":false,"context_lines":[{"line_number":2349,"context_line":"                multi-\u003euse_asymmetric_peer_id \u003d true;"},{"line_number":2350,"context_line":"                multi-\u003euse_peer_id \u003d true;"},{"line_number":2351,"context_line":"            }"},{"line_number":2352,"context_line":"        }"},{"line_number":2353,"context_line":"    }"},{"line_number":2354,"context_line":""},{"line_number":2355,"context_line":"    free(multi-\u003eremote_ciphername);"}],"source_content_type":"text/x-csrc","patch_set":28,"id":"a87d852e_76e6e317","line":2352,"in_reply_to":"11a198a6_27b5988b","updated":"2026-07-28 07:47:45.000000000","message":"Done","commit_id":"1051a4ef164c3c97f42459c97e27384b2e500bf4"},{"author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"3d01ae6077e24f5e532603c99cc54495b0f2bb71","unresolved":true,"context_lines":[{"line_number":2320,"context_line":"        }"},{"line_number":2321,"context_line":"        else"},{"line_number":2322,"context_line":"        {"},{"line_number":2323,"context_line":"            /* Peer has no support for asymmetric peer-id, and DCO currently"},{"line_number":2324,"context_line":"             * can only handle symmetric peer IDs */"},{"line_number":2325,"context_line":"            multi-\u003etx_peer_id \u003d multi-\u003erx_peer_id;"},{"line_number":2326,"context_line":"        }"}],"source_content_type":"text/x-csrc","patch_set":29,"id":"1e3199ef_e1c248d4","line":2323,"updated":"2026-07-28 12:08:39.000000000","message":"This sounds like both conditions are true here to me. Can we change tit something that makes it clear that is either condition?\n```suggestion\n            /* Peer has either no support for asymmetric peer-id, or DCO is in use and \n             * can only handle symmetric peer IDs */\n```","commit_id":"166bad41b6b290bffc81db9e747967d58833ea1e"}],"src/openvpn/ssl_ncp.c":[{"author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"df4dff61d6219b83285cee7f52de8682bb3e347f","unresolved":true,"context_lines":[{"line_number":428,"context_line":"        multi-\u003euse_peer_id \u003d true;"},{"line_number":429,"context_line":"        multi-\u003euse_asymmetric_peer_id \u003d true;"},{"line_number":430,"context_line":"        multi-\u003erx_peer_id \u003d 0x76706e; /* \u0027v\u0027 \u0027p\u0027 \u0027n\u0027 */"},{"line_number":431,"context_line":"        multi-\u003etx_peer_id \u003d  2033;"},{"line_number":432,"context_line":"    }"},{"line_number":433,"context_line":""},{"line_number":434,"context_line":"    if (iv_proto_peer \u0026 IV_PROTO_CC_EXIT_NOTIFY)"}],"source_content_type":"text/x-csrc","patch_set":2,"id":"5800ddd8_05764f00","line":431,"updated":"2025-07-17 09:43:55.000000000","message":"Why the hardcoded 2033 here? Shouldn\u0027t be also  0x76706e; /* \u0027v\u0027 \u0027p\u0027 \u0027n\u0027 */ ?","commit_id":"a768e1ae7690a3eefb1c118b1fe40d1b7a9f0354"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"2055e30e29b4776a5f310d0cf95344bba10d41f5","unresolved":false,"context_lines":[{"line_number":428,"context_line":"        multi-\u003euse_peer_id \u003d true;"},{"line_number":429,"context_line":"        multi-\u003euse_asymmetric_peer_id \u003d true;"},{"line_number":430,"context_line":"        multi-\u003erx_peer_id \u003d 0x76706e; /* \u0027v\u0027 \u0027p\u0027 \u0027n\u0027 */"},{"line_number":431,"context_line":"        multi-\u003etx_peer_id \u003d  2033;"},{"line_number":432,"context_line":"    }"},{"line_number":433,"context_line":""},{"line_number":434,"context_line":"    if (iv_proto_peer \u0026 IV_PROTO_CC_EXIT_NOTIFY)"}],"source_content_type":"text/x-csrc","patch_set":2,"id":"4e416967_34f098a3","line":431,"in_reply_to":"1f01bfff_92f0595e","updated":"2025-09-29 09:37:04.000000000","message":"Done","commit_id":"a768e1ae7690a3eefb1c118b1fe40d1b7a9f0354"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"fb2a91f5448bca36d7a956fd0c96c3bd455c7e57","unresolved":true,"context_lines":[{"line_number":428,"context_line":"        multi-\u003euse_peer_id \u003d true;"},{"line_number":429,"context_line":"        multi-\u003euse_asymmetric_peer_id \u003d true;"},{"line_number":430,"context_line":"        multi-\u003erx_peer_id \u003d 0x76706e; /* \u0027v\u0027 \u0027p\u0027 \u0027n\u0027 */"},{"line_number":431,"context_line":"        multi-\u003etx_peer_id \u003d  2033;"},{"line_number":432,"context_line":"    }"},{"line_number":433,"context_line":""},{"line_number":434,"context_line":"    if (iv_proto_peer \u0026 IV_PROTO_CC_EXIT_NOTIFY)"}],"source_content_type":"text/x-csrc","patch_set":2,"id":"1f01bfff_92f0595e","line":431,"in_reply_to":"5800ddd8_05764f00","updated":"2025-08-05 07:56:28.000000000","message":"yeah that was just for testing purposes, will fix this.","commit_id":"a768e1ae7690a3eefb1c118b1fe40d1b7a9f0354"},{"author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"df4dff61d6219b83285cee7f52de8682bb3e347f","unresolved":true,"context_lines":[{"line_number":471,"context_line":"            }"},{"line_number":472,"context_line":"            else"},{"line_number":473,"context_line":"            {"},{"line_number":474,"context_line":"                multi-\u003erx_peer_id \u003d (peerid[0] \u003c\u003c 16) + (peerid[1] \u003c\u003c 8) + peerid[2];"},{"line_number":475,"context_line":"            }"},{"line_number":476,"context_line":""},{"line_number":477,"context_line":"        }"}],"source_content_type":"text/x-csrc","patch_set":2,"id":"5a725408_1afd7517","line":474,"updated":"2025-07-17 09:43:55.000000000","message":"Shouldn\u0027t there be code here","commit_id":"a768e1ae7690a3eefb1c118b1fe40d1b7a9f0354"},{"author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"8390654e74e78b1c6c5f074bf1b49d08a5521628","unresolved":true,"context_lines":[{"line_number":471,"context_line":"            }"},{"line_number":472,"context_line":"            else"},{"line_number":473,"context_line":"            {"},{"line_number":474,"context_line":"                multi-\u003erx_peer_id \u003d (peerid[0] \u003c\u003c 16) + (peerid[1] \u003c\u003c 8) + peerid[2];"},{"line_number":475,"context_line":"            }"},{"line_number":476,"context_line":""},{"line_number":477,"context_line":"        }"}],"source_content_type":"text/x-csrc","patch_set":2,"id":"d2c5201c_e34ffb2d","line":474,"in_reply_to":"32efaf15_5871df14","updated":"2025-08-05 12:22:11.000000000","message":"I missing the code that implements the asymmetric peer-id here completely is what I am saying. Either the code to parse the ID\u003dxyz of the peer is completely missing or I overlooked it.","commit_id":"a768e1ae7690a3eefb1c118b1fe40d1b7a9f0354"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"fb2a91f5448bca36d7a956fd0c96c3bd455c7e57","unresolved":true,"context_lines":[{"line_number":471,"context_line":"            }"},{"line_number":472,"context_line":"            else"},{"line_number":473,"context_line":"            {"},{"line_number":474,"context_line":"                multi-\u003erx_peer_id \u003d (peerid[0] \u003c\u003c 16) + (peerid[1] \u003c\u003c 8) + peerid[2];"},{"line_number":475,"context_line":"            }"},{"line_number":476,"context_line":""},{"line_number":477,"context_line":"        }"}],"source_content_type":"text/x-csrc","patch_set":2,"id":"32efaf15_5871df14","line":474,"in_reply_to":"5a725408_1afd7517","updated":"2025-08-05 07:56:28.000000000","message":"So you\u0027re saying we should keep the peer_id field and also the rx_peer_id and tx_peer_id but use them only if supported?","commit_id":"a768e1ae7690a3eefb1c118b1fe40d1b7a9f0354"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"2055e30e29b4776a5f310d0cf95344bba10d41f5","unresolved":false,"context_lines":[{"line_number":471,"context_line":"            }"},{"line_number":472,"context_line":"            else"},{"line_number":473,"context_line":"            {"},{"line_number":474,"context_line":"                multi-\u003erx_peer_id \u003d (peerid[0] \u003c\u003c 16) + (peerid[1] \u003c\u003c 8) + peerid[2];"},{"line_number":475,"context_line":"            }"},{"line_number":476,"context_line":""},{"line_number":477,"context_line":"        }"}],"source_content_type":"text/x-csrc","patch_set":2,"id":"110f46aa_7a264227","line":474,"in_reply_to":"d2c5201c_e34ffb2d","updated":"2025-09-29 09:37:04.000000000","message":"Done","commit_id":"a768e1ae7690a3eefb1c118b1fe40d1b7a9f0354"},{"author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"334f152f34aa95ea6819e4a33b0196f499fa7dfa","unresolved":true,"context_lines":[{"line_number":422,"context_line":"        multi-\u003etx_peer_id \u003d 0x76706e; /* \u0027v\u0027 \u0027p\u0027 \u0027n\u0027 */"},{"line_number":423,"context_line":"    }"},{"line_number":424,"context_line":""},{"line_number":425,"context_line":"    if (tx_peer_id)"},{"line_number":426,"context_line":"    {"},{"line_number":427,"context_line":"        multi-\u003etx_peer_id \u003d tx_peer_id;"},{"line_number":428,"context_line":"    }"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"c5df3a60_53fab78f","line":425,"updated":"2025-10-07 15:50:10.000000000","message":"This also need to take DCO capability into account.","commit_id":"816b0f141c576aa0348d75ce5f23de29812c28de"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"2da8d2c9c39b513cbbc31f5cb192b313ae6ebdbb","unresolved":false,"context_lines":[{"line_number":422,"context_line":"        multi-\u003etx_peer_id \u003d 0x76706e; /* \u0027v\u0027 \u0027p\u0027 \u0027n\u0027 */"},{"line_number":423,"context_line":"    }"},{"line_number":424,"context_line":""},{"line_number":425,"context_line":"    if (tx_peer_id)"},{"line_number":426,"context_line":"    {"},{"line_number":427,"context_line":"        multi-\u003etx_peer_id \u003d tx_peer_id;"},{"line_number":428,"context_line":"    }"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"74331eed_c592a014","line":425,"in_reply_to":"c5df3a60_53fab78f","updated":"2025-10-27 13:47:02.000000000","message":"Done","commit_id":"816b0f141c576aa0348d75ce5f23de29812c28de"},{"author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"334f152f34aa95ea6819e4a33b0196f499fa7dfa","unresolved":true,"context_lines":[{"line_number":447,"context_line":"    {"},{"line_number":448,"context_line":"        session-\u003eopt-\u003ecrypto_flags |\u003d CO_USE_TLS_KEY_MATERIAL_EXPORT;"},{"line_number":449,"context_line":""},{"line_number":450,"context_line":"        if (multi-\u003euse_peer_id)"},{"line_number":451,"context_line":"        {"},{"line_number":452,"context_line":"            /* Using a non hardcoded peer-id makes a tiny bit harder to"},{"line_number":453,"context_line":"             * fingerprint packets and also gives each connection a unique"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"1a14b321_0b6cf1e1","line":450,"updated":"2025-10-07 15:50:10.000000000","message":"I think this parts needs to be skipped if we are using/negotiated asymmetric peer-id as it would overwrite both rx and tx ids with the EKM generated ones. Probably move the if (tx_peer_id) above and have this as else path with a comment that asymmetric peer id trumps EKM","commit_id":"816b0f141c576aa0348d75ce5f23de29812c28de"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"2da8d2c9c39b513cbbc31f5cb192b313ae6ebdbb","unresolved":false,"context_lines":[{"line_number":447,"context_line":"    {"},{"line_number":448,"context_line":"        session-\u003eopt-\u003ecrypto_flags |\u003d CO_USE_TLS_KEY_MATERIAL_EXPORT;"},{"line_number":449,"context_line":""},{"line_number":450,"context_line":"        if (multi-\u003euse_peer_id)"},{"line_number":451,"context_line":"        {"},{"line_number":452,"context_line":"            /* Using a non hardcoded peer-id makes a tiny bit harder to"},{"line_number":453,"context_line":"             * fingerprint packets and also gives each connection a unique"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"c5e954b4_8a6a0a93","line":450,"in_reply_to":"1a14b321_0b6cf1e1","updated":"2025-10-27 13:47:02.000000000","message":"Done","commit_id":"816b0f141c576aa0348d75ce5f23de29812c28de"},{"author":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"change_message_id":"7c1275e4fa13744c6ff76220b878e4f6f1a3d663","unresolved":true,"context_lines":[{"line_number":454,"context_line":"        else"},{"line_number":455,"context_line":"        {"},{"line_number":456,"context_line":"            multi-\u003erx_peer_id \u003d 0x76706e; /* \u0027v\u0027 \u0027p\u0027 \u0027n\u0027 */"},{"line_number":457,"context_line":"            multi-\u003etx_peer_id \u003d 0x76706e; /* \u0027v\u0027 \u0027p\u0027 \u0027n\u0027 */"},{"line_number":458,"context_line":"            /* Using a non hardcoded peer-id makes a tiny bit harder to"},{"line_number":459,"context_line":"             * fingerprint packets and also gives each connection a unique"},{"line_number":460,"context_line":"             * peer-id that can be useful for NAT tracking etc. */"}],"source_content_type":"text/x-csrc","patch_set":18,"id":"b36f67ed_37e3a663","line":457,"updated":"2026-07-17 21:31:48.000000000","message":"setting the magic number for p2p peer-id should be done once.  The way this is written now, with the new condition further up, it\u0027s increasingly confusing when and why this would be set.","commit_id":"71a6b89896a36a08adac3b61bcccd949bcf149c1"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"57c436a594a87308c46dd5389b607fb82a2ccf7f","unresolved":false,"context_lines":[{"line_number":454,"context_line":"        else"},{"line_number":455,"context_line":"        {"},{"line_number":456,"context_line":"            multi-\u003erx_peer_id \u003d 0x76706e; /* \u0027v\u0027 \u0027p\u0027 \u0027n\u0027 */"},{"line_number":457,"context_line":"            multi-\u003etx_peer_id \u003d 0x76706e; /* \u0027v\u0027 \u0027p\u0027 \u0027n\u0027 */"},{"line_number":458,"context_line":"            /* Using a non hardcoded peer-id makes a tiny bit harder to"},{"line_number":459,"context_line":"             * fingerprint packets and also gives each connection a unique"},{"line_number":460,"context_line":"             * peer-id that can be useful for NAT tracking etc. */"}],"source_content_type":"text/x-csrc","patch_set":18,"id":"40aeeff6_de002fe1","line":457,"in_reply_to":"b36f67ed_37e3a663","updated":"2026-07-20 12:01:06.000000000","message":"Done","commit_id":"71a6b89896a36a08adac3b61bcccd949bcf149c1"}],"src/openvpn/ssl_util.c":[{"author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"334f152f34aa95ea6819e4a33b0196f499fa7dfa","unresolved":true,"context_lines":[{"line_number":87,"context_line":"            }"},{"line_number":88,"context_line":"        }"},{"line_number":89,"context_line":"    }"},{"line_number":90,"context_line":"    return 0;"},{"line_number":91,"context_line":"}"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"const char *"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"aa5446c4_405e7c5e","line":90,"updated":"2025-10-07 15:50:10.000000000","message":"0 is a valid peer id. So I would rather have -1 (and int32_t as return type) or MAX_PEER_ID, MAX_UINT value or similar as not defined.\n\nIn fact the first client that typically connects to a p2mp server is assigned value 0.","commit_id":"816b0f141c576aa0348d75ce5f23de29812c28de"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"2da8d2c9c39b513cbbc31f5cb192b313ae6ebdbb","unresolved":false,"context_lines":[{"line_number":87,"context_line":"            }"},{"line_number":88,"context_line":"        }"},{"line_number":89,"context_line":"    }"},{"line_number":90,"context_line":"    return 0;"},{"line_number":91,"context_line":"}"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"const char *"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"c1989b67_8f07aa92","line":90,"in_reply_to":"aa5446c4_405e7c5e","updated":"2025-10-27 13:47:02.000000000","message":"Done","commit_id":"816b0f141c576aa0348d75ce5f23de29812c28de"},{"author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"88dc2d5c7f430179fa881c77f1cc8b20d01f0550","unresolved":true,"context_lines":[{"line_number":81,"context_line":"        uint32_t peer_id \u003d 0;"},{"line_number":82,"context_line":"        int r \u003d sscanf(optstr, \"ID\u003d%x\", \u0026peer_id);"},{"line_number":83,"context_line":"        {"},{"line_number":84,"context_line":"            if (r \u003d\u003d 1 \u0026\u0026 peer_id \u003c UINT32_MAX)"},{"line_number":85,"context_line":"            {"},{"line_number":86,"context_line":"                return peer_id;"},{"line_number":87,"context_line":"            }"}],"source_content_type":"text/x-csrc","patch_set":10,"id":"e69ce258_d1aeeb07","line":84,"updated":"2026-04-21 15:27:53.000000000","message":"This check should check \u003c MAX_PEER_ID instead of UINT32_MAX since we otherwise still end up with an invalid peer-id","commit_id":"d8f80ca6d924e0b5c8a9469aeee42dcd08b99af2"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"8f236b43dcff55073edb9148415e43480bf3c931","unresolved":false,"context_lines":[{"line_number":81,"context_line":"        uint32_t peer_id \u003d 0;"},{"line_number":82,"context_line":"        int r \u003d sscanf(optstr, \"ID\u003d%x\", \u0026peer_id);"},{"line_number":83,"context_line":"        {"},{"line_number":84,"context_line":"            if (r \u003d\u003d 1 \u0026\u0026 peer_id \u003c UINT32_MAX)"},{"line_number":85,"context_line":"            {"},{"line_number":86,"context_line":"                return peer_id;"},{"line_number":87,"context_line":"            }"}],"source_content_type":"text/x-csrc","patch_set":10,"id":"0c6c5f26_037956c9","line":84,"in_reply_to":"e69ce258_d1aeeb07","updated":"2026-05-27 15:17:16.000000000","message":"Done","commit_id":"d8f80ca6d924e0b5c8a9469aeee42dcd08b99af2"},{"author":{"_account_id":1000007,"name":"ordex","display_name":"Antonio Quartulli","email":"antonio@mandelbit.com","username":"ordex"},"change_message_id":"b3cafca95fab023d4cb0f8833f43f3ed2af2d90a","unresolved":true,"context_lines":[{"line_number":75,"context_line":"uint32_t"},{"line_number":76,"context_line":"extract_asymmetric_peer_id(const char *peer_info)"},{"line_number":77,"context_line":"{"},{"line_number":78,"context_line":"    const char *optstr \u003d peer_info ? strstr(peer_info, \"ID\u003d\") : NULL;"},{"line_number":79,"context_line":"    if (optstr)"},{"line_number":80,"context_line":"    {"},{"line_number":81,"context_line":"        uint32_t peer_id \u003d 0;"}],"source_content_type":"text/x-csrc","patch_set":19,"id":"9284a278_d1666f37","line":78,"updated":"2026-07-21 22:55:38.000000000","message":"could the strstr() also match substrings like \"UV_ID\u003d...\" or \"GUID\u003d...\"?","commit_id":"5738669616b166a39c7b91d031672c8e7fabb5c8"},{"author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"5bfb5e10b37bd13a979f9502b2eb13f23947ad72","unresolved":false,"context_lines":[{"line_number":75,"context_line":"uint32_t"},{"line_number":76,"context_line":"extract_asymmetric_peer_id(const char *peer_info)"},{"line_number":77,"context_line":"{"},{"line_number":78,"context_line":"    const char *optstr \u003d peer_info ? strstr(peer_info, \"ID\u003d\") : NULL;"},{"line_number":79,"context_line":"    if (optstr)"},{"line_number":80,"context_line":"    {"},{"line_number":81,"context_line":"        uint32_t peer_id \u003d 0;"}],"source_content_type":"text/x-csrc","patch_set":19,"id":"6b579e61_ac56b5e3","line":78,"in_reply_to":"6ea823d8_43425e06","updated":"2026-07-22 12:20:20.000000000","message":"I noticed this issue and already prepared a patch for that. That also fixes that for all the other peer info extraction: https://gerrit.openvpn.net/c/openvpn/+/1800","commit_id":"5738669616b166a39c7b91d031672c8e7fabb5c8"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"73e2db927c34f4884ef1363f9dc1a6d2f003fd30","unresolved":false,"context_lines":[{"line_number":75,"context_line":"uint32_t"},{"line_number":76,"context_line":"extract_asymmetric_peer_id(const char *peer_info)"},{"line_number":77,"context_line":"{"},{"line_number":78,"context_line":"    const char *optstr \u003d peer_info ? strstr(peer_info, \"ID\u003d\") : NULL;"},{"line_number":79,"context_line":"    if (optstr)"},{"line_number":80,"context_line":"    {"},{"line_number":81,"context_line":"        uint32_t peer_id \u003d 0;"}],"source_content_type":"text/x-csrc","patch_set":19,"id":"6ea823d8_43425e06","line":78,"in_reply_to":"9284a278_d1666f37","updated":"2026-07-22 11:37:25.000000000","message":"It can, yes. peer_info also carries the client\u0027s UV_* vars, so something like UV_ID\u003d... (or GUID\u003d...) has ID\u003d as a substring and strstr will match it. The other extract helpers get away with a plain strstr only because their keys are long enough to never appear inside another token. Changed it to accept ID\u003d only.","commit_id":"5738669616b166a39c7b91d031672c8e7fabb5c8"}],"src/openvpn/ssl_util.h":[{"author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"334f152f34aa95ea6819e4a33b0196f499fa7dfa","unresolved":true,"context_lines":[{"line_number":53,"context_line":" */"},{"line_number":54,"context_line":"unsigned int extract_iv_proto(const char *peer_info);"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"uint32_t extract_asymmetric_peer_id(const char *peer_info);"},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"/**"},{"line_number":59,"context_line":" * Takes a locally produced OCC string for TLS server mode and modifies as"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"17f8e5bb_aeb5d80c","line":56,"updated":"2025-10-07 15:50:10.000000000","message":"Add doxygen please","commit_id":"816b0f141c576aa0348d75ce5f23de29812c28de"},{"author":{"_account_id":1000034,"name":"its_Giaan","display_name":"Gianmarco De Gregori","email":"gianmarco@mandelbit.com","username":"its_Giaan"},"change_message_id":"2da8d2c9c39b513cbbc31f5cb192b313ae6ebdbb","unresolved":false,"context_lines":[{"line_number":53,"context_line":" */"},{"line_number":54,"context_line":"unsigned int extract_iv_proto(const char *peer_info);"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"uint32_t extract_asymmetric_peer_id(const char *peer_info);"},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"/**"},{"line_number":59,"context_line":" * Takes a locally produced OCC string for TLS server mode and modifies as"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"be89150e_3068de2f","line":56,"in_reply_to":"17f8e5bb_aeb5d80c","updated":"2025-10-27 13:47:02.000000000","message":"Done","commit_id":"816b0f141c576aa0348d75ce5f23de29812c28de"}]}