)]}'
{"id":"openvpn~1478","triplet_id":"openvpn~master~I704c560fa23c03237d0f8adc30908a617265a5a1","project":"openvpn","branch":"master","full_branch":"refs/heads/master","attention_set":{},"removed_from_attention_set":{"1000041":{"account":{"_account_id":1000041,"name":"Ralf Lici","display_name":"Ralf Lici","email":"ralf@mandelbit.com","username":"ralf_lici"},"last_update":"2026-11-12 18:52:40.000000000","reason":"Change was submitted"},"1000007":{"account":{"_account_id":1000007,"name":"Antonio Quartulli","display_name":"Antonio Quartulli","email":"antonio@mandelbit.com","username":"ordex"},"last_update":"2026-11-12 18:52:40.000000000","reason":"Change was submitted"},"1000003":{"account":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"last_update":"2026-11-10 11:49:25.000000000","reason":"removed on reply"}},"hashtags":["mailsubmitted"],"change_id":"I704c560fa23c03237d0f8adc30908a617265a5a1","subject":"tls: reject incoming reneg request if primary key is not fully valid","status":"MERGED","created":"2026-01-19 18:40:03.000000000","updated":"2026-11-12 18:52:40.000000000","submitted":"2026-11-12 18:52:40.000000000","submitter":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"total_comment_count":7,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"1478","meta_rev_id":"75ded473194ef7a56cb0539459fad2f788b7e86d","_number":1478,"virtual_id_number":1478,"owner":{"_account_id":1000041,"name":"Ralf Lici","display_name":"Ralf Lici","email":"ralf@mandelbit.com","username":"ralf_lici"},"actions":{},"labels":{"Code-Review":{"all":[{"value":0,"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},{"value":0,"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"}],"values":{"-2":"This shall not be submitted","-1":"I would prefer this is not submitted as is"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me, approved"},"description":"","default_value":0}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"}],"CC":[{"_account_id":1000007,"name":"Antonio Quartulli","display_name":"Antonio Quartulli","email":"antonio@mandelbit.com","username":"ordex"},{"_account_id":1000026,"name":"openvpn-devel","email":"openvpn-devel@lists.sourceforge.net","username":"openvpn-devel"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-01-19 18:40:04.000000000","updated_by":{"_account_id":1000041,"name":"Ralf Lici","display_name":"Ralf Lici","email":"ralf@mandelbit.com","username":"ralf_lici"},"real_updated_by":{"_account_id":1000041,"name":"Ralf Lici","display_name":"Ralf Lici","email":"ralf@mandelbit.com","username":"ralf_lici"},"reviewer":{"_account_id":1000026,"name":"openvpn-devel","email":"openvpn-devel@lists.sourceforge.net","username":"openvpn-devel"},"state":"CC"},{"updated":"2026-01-19 18:40:04.000000000","updated_by":{"_account_id":1000041,"name":"Ralf Lici","display_name":"Ralf Lici","email":"ralf@mandelbit.com","username":"ralf_lici"},"real_updated_by":{"_account_id":1000041,"name":"Ralf Lici","display_name":"Ralf Lici","email":"ralf@mandelbit.com","username":"ralf_lici"},"reviewer":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"state":"REVIEWER"},{"updated":"2026-07-07 08:36:04.000000000","updated_by":{"_account_id":1000007,"name":"Antonio Quartulli","display_name":"Antonio Quartulli","email":"antonio@mandelbit.com","username":"ordex"},"real_updated_by":{"_account_id":1000007,"name":"Antonio Quartulli","display_name":"Antonio Quartulli","email":"antonio@mandelbit.com","username":"ordex"},"reviewer":{"_account_id":1000007,"name":"Antonio Quartulli","display_name":"Antonio Quartulli","email":"antonio@mandelbit.com","username":"ordex"},"state":"CC"}],"messages":[{"id":"9ca01e92491ba9a7952f853d3833ff9e6b9ec5e0","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1000041,"name":"Ralf Lici","display_name":"Ralf Lici","email":"ralf@mandelbit.com","username":"ralf_lici"},"date":"2026-01-19 18:40:03.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"669aecf67481645b4c62a581012d7736cf13e49a","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1000041,"name":"Ralf Lici","display_name":"Ralf Lici","email":"ralf@mandelbit.com","username":"ralf_lici"},"date":"2026-02-16 08:41:46.000000000","message":"Uploaded patch set 2.","accounts_in_message":[],"_revision_number":2},{"id":"f897d3a5284e7b9dffb8b81d00b64820efbc2aab","author":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"date":"2026-02-16 14:32:19.000000000","message":"Patch Set 2: Code-Review+2\n\n(2 comments)","accounts_in_message":[],"_revision_number":2},{"id":"d215c0c848653c6ad37aa66be6630a2508369892","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1000041,"name":"Ralf Lici","display_name":"Ralf Lici","email":"ralf@mandelbit.com","username":"ralf_lici"},"date":"2026-02-17 08:10:25.000000000","message":"Uploaded patch set 3.\n\nOutdated Votes:\n* Code-Review+2 (copy condition: \"changekind:NO_CHANGE OR changekind:TRIVIAL_REBASE OR is:MIN\")\n","accounts_in_message":[],"_revision_number":3},{"id":"c8820a5b3cb6984be08bd80f58f0ec24e9e210ed","author":{"_account_id":1000041,"name":"Ralf Lici","display_name":"Ralf Lici","email":"ralf@mandelbit.com","username":"ralf_lici"},"date":"2026-02-17 08:10:55.000000000","message":"Patch Set 3:\n\n(2 comments)","accounts_in_message":[],"_revision_number":3},{"id":"abcb5152be1fad99da9517bd930a9e2184d66a63","author":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"date":"2026-03-02 15:06:28.000000000","message":"Patch Set 3: Code-Review+2","accounts_in_message":[],"_revision_number":3},{"id":"b433451096a456128eacca8bae3d101b93ee41d9","tag":"autogenerated:gerrit:setHashtag","author":{"_account_id":1000001,"name":"Frank Lichtenheld","display_name":"Frank Lichtenheld","email":"frank@lichtenheld.com","username":"flichtenheld","status":"OpenVPN Inc."},"date":"2026-03-09 13:33:48.000000000","message":"Hashtag added: mailsubmitted","accounts_in_message":[],"_revision_number":3},{"id":"6433871a7b324753e72520642967f9922e572b50","author":{"_account_id":1000041,"name":"Ralf Lici","display_name":"Ralf Lici","email":"ralf@mandelbit.com","username":"ralf_lici"},"date":"2026-07-07 06:47:13.000000000","message":"Patch Set 3:\n\n(1 comment)","accounts_in_message":[],"_revision_number":3},{"id":"2bb1eb60b1eff057108c5b625c5f83c217c50ade","author":{"_account_id":1000007,"name":"Antonio Quartulli","display_name":"Antonio Quartulli","email":"antonio@mandelbit.com","username":"ordex"},"date":"2026-07-07 08:36:04.000000000","message":"Patch Set 3:\n\n(1 comment)","accounts_in_message":[],"_revision_number":3},{"id":"728051056969512b41b9b40aeb719950f4170d80","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1000041,"name":"Ralf Lici","display_name":"Ralf Lici","email":"ralf@mandelbit.com","username":"ralf_lici"},"date":"2026-07-10 15:11:55.000000000","message":"Uploaded patch set 4.\n\nOutdated Votes:\n* Code-Review+2 (copy condition: \"changekind:NO_CHANGE OR changekind:TRIVIAL_REBASE OR is:MIN\")\n","accounts_in_message":[],"_revision_number":4},{"id":"8c8649fa0687fb8c5efe1e4b69823a8b8c40b326","author":{"_account_id":1000041,"name":"Ralf Lici","display_name":"Ralf Lici","email":"ralf@mandelbit.com","username":"ralf_lici"},"date":"2026-07-10 15:12:58.000000000","message":"Patch Set 4:\n\n(1 comment)","accounts_in_message":[],"_revision_number":4},{"id":"d86ad0070f279b26bafee6f25a199fbb42dacaeb","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1000041,"name":"Ralf Lici","display_name":"Ralf Lici","email":"ralf@mandelbit.com","username":"ralf_lici"},"date":"2026-07-10 15:26:41.000000000","message":"Uploaded patch set 5: Patch Set 4 was rebased.","accounts_in_message":[],"_revision_number":5},{"id":"20170920ae3aa41979b0b4c098913f3fcc2b88bb","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1000041,"name":"Ralf Lici","display_name":"Ralf Lici","email":"ralf@mandelbit.com","username":"ralf_lici"},"date":"2026-11-10 11:20:41.000000000","message":"Uploaded patch set 6.","accounts_in_message":[],"_revision_number":6},{"id":"31b07679a4ce6c1570c1ed0d23a25665321df0d0","author":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"date":"2026-11-10 11:49:25.000000000","message":"Patch Set 6: Code-Review+2","accounts_in_message":[],"_revision_number":6},{"id":"75ded473194ef7a56cb0539459fad2f788b7e86d","tag":"autogenerated:gerrit:merged","author":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"date":"2026-11-12 18:52:40.000000000","message":"Change has been successfully pushed.","accounts_in_message":[],"_revision_number":7}],"current_revision_number":7,"current_revision":"95e4fd0f905fea3decfdbdd28caeee901009d250","revisions":{"1f2912ab74d78d347dc4e89e4bf31872f63ea0fb":{"kind":"REWORK","_number":1,"created":"2026-01-19 18:40:03.000000000","uploader":{"_account_id":1000041,"name":"Ralf Lici","display_name":"Ralf Lici","email":"ralf@mandelbit.com","username":"ralf_lici"},"ref":"refs/changes/78/1478/1","fetch":{"anonymous http":{"url":"https://gerrit.openvpn.net/openvpn","ref":"refs/changes/78/1478/1","commands":{"Branch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/78/1478/1 \u0026\u0026 git checkout -b change-1478 FETCH_HEAD","Checkout":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/78/1478/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/78/1478/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/78/1478/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://gerrit.openvpn.net/openvpn refs/changes/78/1478/1","Reset To":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/78/1478/1 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"2cc00e80bca26c1c7129fa45e48714ca68b56b28","subject":"socket: Avoid conversion warning in get_addr_generic"}],"author":{"name":"Ralf Lici","email":"ralf@mandelbit.com","date":"2026-01-19 18:16:42.000000000","tz":60},"committer":{"name":"Ralf Lici","email":"ralf@mandelbit.com","date":"2026-01-19 18:39:48.000000000","tz":60},"subject":"tls_multi_process: promote lame duck key to primary after reneg","message":"tls_multi_process: promote lame duck key to primary after reneg\n\nWhen a key is negotiated, the transition window logic imposes a delay\nbefore fully adopting the new key. The auth_deferred_expire field\nindicates the interval we must wait before considering the key fully\nusable (see tls_select_encryption_key). However, in an unfortunate\nscenario where the remote peer uses a reneg-sec interval lower than our\nhandshake window or lower than half of our reneg-sec interval, we end up\ninitializing every key with an auth_deferred_expire value that never\nexpires. This leads to selecting the wrong key when invoking\ntls_select_encryption_key.\n\nTo ensure we always have a fully valid key, whenever a renegotiation\nhappens, promote the old key even if its auth_deferred_expire has not\nyet expired.\n\nChange-Id: I704c560fa23c03237d0f8adc30908a617265a5a1\n"},"branch":"refs/heads/master"},"4993426e50a4a0f2a29cc5dc901927518029a30b":{"kind":"REWORK","_number":2,"created":"2026-02-16 08:41:46.000000000","uploader":{"_account_id":1000041,"name":"Ralf Lici","display_name":"Ralf Lici","email":"ralf@mandelbit.com","username":"ralf_lici"},"ref":"refs/changes/78/1478/2","fetch":{"anonymous http":{"url":"https://gerrit.openvpn.net/openvpn","ref":"refs/changes/78/1478/2","commands":{"Branch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/78/1478/2 \u0026\u0026 git checkout -b change-1478 FETCH_HEAD","Checkout":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/78/1478/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/78/1478/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/78/1478/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://gerrit.openvpn.net/openvpn refs/changes/78/1478/2","Reset To":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/78/1478/2 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"6f9ab9647cf0a3bc53e42e609437f892ce009e7a","subject":"port-share: log incoming connections at verb 3 only"}],"author":{"name":"Ralf Lici","email":"ralf@mandelbit.com","date":"2026-01-19 18:16:42.000000000","tz":60},"committer":{"name":"Ralf Lici","email":"ralf@mandelbit.com","date":"2026-02-16 08:11:11.000000000","tz":60},"subject":"tls: reject incoming reneg request if primary key is not fully valid","message":"tls: reject incoming reneg request if primary key is not fully valid\n\nAn incoming P_CONTROL_SOFT_RESET_V1 can arrive while the primary key is\nalready in S_GENERATED_KEYS but no longer fully authorized. This can\nhappen when deferred auth later expires/fails, or when mid-session auth\nchecks deauthenticate the key without demoting its TLS state.\n\nThis patch keeps read_control_auth as the first gate, then rejects the\nincoming renegotiation request unless the primary key is KS_AUTH_TRUE\nand its auth_deferred_expire gate has passed.\n\nChange-Id: I704c560fa23c03237d0f8adc30908a617265a5a1\nSigned-off-by: Ralf Lici \u003cralf@mandelbit.com\u003e\n"},"branch":"refs/heads/master"},"e3676dbba60cf1e453dae83018200bf362eb604f":{"kind":"REWORK","_number":3,"created":"2026-02-17 08:10:25.000000000","uploader":{"_account_id":1000041,"name":"Ralf Lici","display_name":"Ralf Lici","email":"ralf@mandelbit.com","username":"ralf_lici"},"ref":"refs/changes/78/1478/3","fetch":{"anonymous http":{"url":"https://gerrit.openvpn.net/openvpn","ref":"refs/changes/78/1478/3","commands":{"Branch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/78/1478/3 \u0026\u0026 git checkout -b change-1478 FETCH_HEAD","Checkout":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/78/1478/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/78/1478/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/78/1478/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://gerrit.openvpn.net/openvpn refs/changes/78/1478/3","Reset To":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/78/1478/3 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"6f9ab9647cf0a3bc53e42e609437f892ce009e7a","subject":"port-share: log incoming connections at verb 3 only"}],"author":{"name":"Ralf Lici","email":"ralf@mandelbit.com","date":"2026-01-19 18:16:42.000000000","tz":60},"committer":{"name":"Ralf Lici","email":"ralf@mandelbit.com","date":"2026-02-17 08:09:49.000000000","tz":60},"subject":"tls: reject incoming reneg request if primary key is not fully valid","message":"tls: reject incoming reneg request if primary key is not fully valid\n\nIncoming P_CONTROL_SOFT_RESET_V1 can arrive while the active key is not\nyet fully valid for renegotiation. This includes the window where we are\nstill waiting for auth_deferred_expire (derived from handshake/reneg\ntiming), as well as cases where deferred or mid-session auth later\nleaves the key non-authenticated even though state is S_GENERATED_KEYS.\n\nThis patch keeps read_control_auth as the first gate, then rejects the\nincoming renegotiation requests unless the primary key is KS_AUTH_TRUE\nand auth_deferred_expire has passed.\n\nChange-Id: I704c560fa23c03237d0f8adc30908a617265a5a1\nSigned-off-by: Ralf Lici \u003cralf@mandelbit.com\u003e\n"},"branch":"refs/heads/master"},"c28a85bbd0eaa065ca92c77676e488c2e394a3a6":{"kind":"REWORK","_number":4,"created":"2026-07-10 15:11:55.000000000","uploader":{"_account_id":1000041,"name":"Ralf Lici","display_name":"Ralf Lici","email":"ralf@mandelbit.com","username":"ralf_lici"},"ref":"refs/changes/78/1478/4","fetch":{"anonymous http":{"url":"https://gerrit.openvpn.net/openvpn","ref":"refs/changes/78/1478/4","commands":{"Branch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/78/1478/4 \u0026\u0026 git checkout -b change-1478 FETCH_HEAD","Checkout":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/78/1478/4 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/78/1478/4 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/78/1478/4 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://gerrit.openvpn.net/openvpn refs/changes/78/1478/4","Reset To":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/78/1478/4 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"6f9ab9647cf0a3bc53e42e609437f892ce009e7a","subject":"port-share: log incoming connections at verb 3 only"}],"author":{"name":"Ralf Lici","email":"ralf@mandelbit.com","date":"2026-01-19 18:16:42.000000000","tz":60},"committer":{"name":"Ralf Lici","email":"ralf@mandelbit.com","date":"2026-07-10 15:10:20.000000000","tz":120},"subject":"tls: reject incoming reneg request if primary key is not fully valid","message":"tls: reject incoming reneg request if primary key is not fully valid\n\nIncoming P_CONTROL_SOFT_RESET_V1 can arrive while the active key is not\nyet fully valid for renegotiation. This includes the window where we are\nstill waiting for auth_deferred_expire (derived from handshake/reneg\ntiming), as well as cases where deferred or mid-session auth later\nleaves the key non-authenticated even though state is S_GENERATED_KEYS.\n\nThis patch keeps read_control_auth as the first gate, then rejects the\nincoming renegotiation requests unless the primary key is KS_AUTH_TRUE\nand auth_deferred_expire has passed.\n\nThe rejected request is not counted as a TLS error, since soft TLS\nerrors trigger an instance restart in TCP mode.\n\nChange-Id: I704c560fa23c03237d0f8adc30908a617265a5a1\nSigned-off-by: Ralf Lici \u003cralf@mandelbit.com\u003e\n"},"branch":"refs/heads/master"},"4a3e79909fe69c4d693d5e7df1dfab0853e3cb52":{"kind":"TRIVIAL_REBASE","_number":5,"created":"2026-07-10 15:26:41.000000000","uploader":{"_account_id":1000041,"name":"Ralf Lici","display_name":"Ralf Lici","email":"ralf@mandelbit.com","username":"ralf_lici"},"ref":"refs/changes/78/1478/5","fetch":{"anonymous http":{"url":"https://gerrit.openvpn.net/openvpn","ref":"refs/changes/78/1478/5","commands":{"Branch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/78/1478/5 \u0026\u0026 git checkout -b change-1478 FETCH_HEAD","Checkout":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/78/1478/5 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/78/1478/5 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/78/1478/5 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://gerrit.openvpn.net/openvpn refs/changes/78/1478/5","Reset To":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/78/1478/5 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"d41472de0144f3c483a8397dea3bb55f00dc57e4","subject":"ssl_pkt: Fix doxygen warning about read_control_auth"}],"author":{"name":"Ralf Lici","email":"ralf@mandelbit.com","date":"2026-01-19 18:16:42.000000000","tz":60},"committer":{"name":"Ralf Lici","email":"ralf@mandelbit.com","date":"2026-07-10 15:26:30.000000000","tz":120},"subject":"tls: reject incoming reneg request if primary key is not fully valid","message":"tls: reject incoming reneg request if primary key is not fully valid\n\nIncoming P_CONTROL_SOFT_RESET_V1 can arrive while the active key is not\nyet fully valid for renegotiation. This includes the window where we are\nstill waiting for auth_deferred_expire (derived from handshake/reneg\ntiming), as well as cases where deferred or mid-session auth later\nleaves the key non-authenticated even though state is S_GENERATED_KEYS.\n\nThis patch keeps read_control_auth as the first gate, then rejects the\nincoming renegotiation requests unless the primary key is KS_AUTH_TRUE\nand auth_deferred_expire has passed.\n\nThe rejected request is not counted as a TLS error, since soft TLS\nerrors trigger an instance restart in TCP mode.\n\nChange-Id: I704c560fa23c03237d0f8adc30908a617265a5a1\nSigned-off-by: Ralf Lici \u003cralf@mandelbit.com\u003e\n"},"branch":"refs/heads/master"},"f2168737871a31ecb94fcc24798e5c4d1e12fd9c":{"kind":"REWORK","_number":6,"created":"2026-11-10 11:20:41.000000000","uploader":{"_account_id":1000041,"name":"Ralf Lici","display_name":"Ralf Lici","email":"ralf@mandelbit.com","username":"ralf_lici"},"ref":"refs/changes/78/1478/6","fetch":{"anonymous http":{"url":"https://gerrit.openvpn.net/openvpn","ref":"refs/changes/78/1478/6","commands":{"Branch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/78/1478/6 \u0026\u0026 git checkout -b change-1478 FETCH_HEAD","Checkout":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/78/1478/6 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/78/1478/6 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/78/1478/6 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://gerrit.openvpn.net/openvpn refs/changes/78/1478/6","Reset To":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/78/1478/6 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"83c988d49fddc7e0ad9c40741ab6f391f236ed45","subject":"Remove unused gc_arena variables"}],"author":{"name":"Ralf Lici","email":"ralf@mandelbit.com","date":"2026-01-19 18:16:42.000000000","tz":60},"committer":{"name":"Ralf Lici","email":"ralf@mandelbit.com","date":"2026-11-10 11:18:49.000000000","tz":60},"subject":"tls: reject incoming reneg request if primary key is not fully valid","message":"tls: reject incoming reneg request if primary key is not fully valid\n\nIncoming P_CONTROL_SOFT_RESET_V1 can arrive while the active key is not\nyet fully valid for renegotiation. This includes the window where we are\nstill waiting for auth_deferred_expire (derived from handshake/reneg\ntiming), as well as cases where deferred or mid-session auth later\nleaves the key non-authenticated even though state is S_GENERATED_KEYS.\n\nThis patch keeps read_control_auth as the first gate, then rejects the\nincoming renegotiation requests unless the primary key is KS_AUTH_TRUE\nand auth_deferred_expire has passed.\n\nThe rejected request is not counted as a TLS error, since soft TLS\nerrors trigger an instance restart in TCP mode.\n\nChange-Id: I704c560fa23c03237d0f8adc30908a617265a5a1\nSigned-off-by: Ralf Lici \u003cralf@mandelbit.com\u003e\n"},"branch":"refs/heads/master"},"95e4fd0f905fea3decfdbdd28caeee901009d250":{"kind":"TRIVIAL_REBASE_WITH_MESSAGE_UPDATE","_number":7,"created":"2026-11-12 18:52:40.000000000","uploader":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"ref":"refs/changes/78/1478/7","fetch":{"anonymous http":{"url":"https://gerrit.openvpn.net/openvpn","ref":"refs/changes/78/1478/7","commands":{"Branch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/78/1478/7 \u0026\u0026 git checkout -b change-1478 FETCH_HEAD","Checkout":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/78/1478/7 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/78/1478/7 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/78/1478/7 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://gerrit.openvpn.net/openvpn refs/changes/78/1478/7","Reset To":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/78/1478/7 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"2a59209487d37e8d28ee4394bfa4de6e011a3c05","subject":"sitnl: clear inet_address_t locals with CLEAR()"}],"author":{"name":"Ralf Lici","email":"ralf@mandelbit.com","date":"2026-11-10 11:58:22.000000000","tz":60},"committer":{"name":"Gert Doering","email":"gert@greenie.muc.de","date":"2026-11-12 17:51:12.000000000","tz":60},"subject":"tls: reject incoming reneg request if primary key is not fully valid","message":"tls: reject incoming reneg request if primary key is not fully valid\n\nIncoming P_CONTROL_SOFT_RESET_V1 can arrive while the active key is not\nyet fully valid for renegotiation. This includes the window where we are\nstill waiting for auth_deferred_expire (derived from handshake/reneg\ntiming), as well as cases where deferred or mid-session auth later\nleaves the key non-authenticated even though state is S_GENERATED_KEYS.\n\nThis patch keeps read_control_auth as the first gate, then rejects the\nincoming renegotiation requests unless the primary key is KS_AUTH_TRUE\nand auth_deferred_expire has passed.\n\nThe rejected request is not counted as a TLS error, since soft TLS\nerrors trigger an instance restart in TCP mode.\n\nChange-Id: I704c560fa23c03237d0f8adc30908a617265a5a1\nSigned-off-by: Ralf Lici \u003cralf@mandelbit.com\u003e\nAcked-by: Arne Schwabe \u003carne-openvpn@rfc2549.org\u003e\nGerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1478\nMessage-Id: \u003c20261110115827.1649-1-gert@greenie.muc.de\u003e\nURL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg41068.html\nSigned-off-by: Gert Doering \u003cgert@greenie.muc.de\u003e\n"},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[]}