)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":1000041,"name":"ralf_lici","display_name":"Ralf Lici","email":"ralf@mandelbit.com","username":"ralf_lici"},"change_message_id":"58b8e59132fac3ff4d29048de88856a8028ad6c1","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":1,"id":"9e004ae2_dccf89ef","updated":"2026-08-05 07:10:22.000000000","message":"The change looks good to me overall, but I wonder whether we could avoid adding the persistent bool to `tls_multi`.\n\nBasically, the error must ultimately propagate from `init_key_contexts` to `check_tls`, where the recovery action can be dispatched. The call graph branches at `tls_session_generate_data_channel_keys` whose callers are:\n\n- `tls_session_update_crypto_params_do_work`, whose failure is already propagated by its callers to paths that emit  `SIGUSR1`, and\n- `tls_multi_process` where the failed key is moved to `S_ERROR_PRE` but the failure does not currently request a connection restart from `check_tls`.\n\nSo, one possible simplification would be to add a `TLSMP_RESTART` result and return it from `tls_multi_process` when key generation fails with DCO enabled:\n\n```\nif (!tls_session_generate_data_channel_keys(multi, session))\n{\n    msg(D_TLS_ERRORS, \"TLS Error: generate_key_expansion failed\");\n    ks-\u003eauthenticated \u003d KS_AUTH_FALSE;\n    key_state_ssl_shutdown(\u0026ks-\u003eks_ssl);\n    ks-\u003estate \u003d S_ERROR_PRE;\n\n    if (session-\u003eopt-\u003edco_enabled)\n    {\n        active \u003d TLSMP_RESTART;\n    }\n}\n```\n\n`check_tls` could then emit `SIGUSR1` when it receives `TLSMP_RESTART`.\n\nThis would avoid storing a persistent cross-layer error flag in `tls_multi` and would propagate the recovery request directly through the existing `tls_multi_process` result contract.\n\nWould this approach make sense?","commit_id":"9f0e71a3741abae86ab67bd74d7530db76e1d604"},{"author":{"_account_id":1000041,"name":"ralf_lici","display_name":"Ralf Lici","email":"ralf@mandelbit.com","username":"ralf_lici"},"change_message_id":"4c1b80e94921bc7d0b5912c0c4d2fe348a581a8b","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"d3028ec0_2208e7a3","in_reply_to":"0d0a9871_c2628892","updated":"2026-08-05 16:04:40.000000000","message":"Yes, v2 is indeed a better implementation of what I was suggesting!","commit_id":"9f0e71a3741abae86ab67bd74d7530db76e1d604"},{"author":{"_account_id":1000007,"name":"ordex","display_name":"Antonio Quartulli","email":"antonio@mandelbit.com","username":"ordex"},"change_message_id":"3e24d378c0c8a3d608dbc60ed819d50740c5ead6","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":1,"id":"0d0a9871_c2628892","in_reply_to":"9e004ae2_dccf89ef","updated":"2026-08-05 11:07:11.000000000","message":"I took inspiration from your suggestion, but I did not go the full way as you described because that flow had other drawbacks.\nStill, patchset2 should be a good compromise :-) I hope you like it","commit_id":"9f0e71a3741abae86ab67bd74d7530db76e1d604"}],"src/openvpn/ssl.c":[{"author":{"_account_id":1000001,"name":"flichtenheld","display_name":"Frank Lichtenheld","email":"frank@lichtenheld.com","username":"flichtenheld","status":"OpenVPN Inc."},"change_message_id":"e13ff0a5435d6556a1dbf0e6b9a9db0f9d195efc","unresolved":true,"context_lines":[{"line_number":1399,"context_line":"            msg(M_WARN,"},{"line_number":1400,"context_line":"                \"Impossible to install key material in DCO: %s. The underlying \""},{"line_number":1401,"context_line":"                \"DCO peer may have been deleted from the kernel without \""},{"line_number":1402,"context_line":"                \"notifying userspace. Restarting the session\","},{"line_number":1403,"context_line":"                strerror(-ret));"},{"line_number":1404,"context_line":"            return KEY_GEN_DCO_DESYNC;"},{"line_number":1405,"context_line":"        }"}],"source_content_type":"text/x-csrc","patch_set":2,"id":"59d4e133_1e230ecc","line":1402,"updated":"2026-08-05 13:27:24.000000000","message":"Nipick: Missing punctuation at the end.","commit_id":"673e321220a104f42914bd04adb1968a7b2d9112"},{"author":{"_account_id":1000007,"name":"ordex","display_name":"Antonio Quartulli","email":"antonio@mandelbit.com","username":"ordex"},"change_message_id":"d8a2cf7cb8cd9c3ee08c2ef84f26de7056742348","unresolved":true,"context_lines":[{"line_number":1399,"context_line":"            msg(M_WARN,"},{"line_number":1400,"context_line":"                \"Impossible to install key material in DCO: %s. The underlying \""},{"line_number":1401,"context_line":"                \"DCO peer may have been deleted from the kernel without \""},{"line_number":1402,"context_line":"                \"notifying userspace. Restarting the session\","},{"line_number":1403,"context_line":"                strerror(-ret));"},{"line_number":1404,"context_line":"            return KEY_GEN_DCO_DESYNC;"},{"line_number":1405,"context_line":"        }"}],"source_content_type":"text/x-csrc","patch_set":2,"id":"d424b9dc_f0774760","line":1402,"in_reply_to":"59d4e133_1e230ecc","updated":"2026-08-05 15:48:17.000000000","message":"Acknowledged","commit_id":"673e321220a104f42914bd04adb1968a7b2d9112"},{"author":{"_account_id":1000007,"name":"ordex","display_name":"Antonio Quartulli","email":"antonio@mandelbit.com","username":"ordex"},"change_message_id":"f220343cdf9ca1bfb628cea356c66ac5d2024186","unresolved":false,"context_lines":[{"line_number":1399,"context_line":"            msg(M_WARN,"},{"line_number":1400,"context_line":"                \"Impossible to install key material in DCO: %s. The underlying \""},{"line_number":1401,"context_line":"                \"DCO peer may have been deleted from the kernel without \""},{"line_number":1402,"context_line":"                \"notifying userspace. Restarting the session\","},{"line_number":1403,"context_line":"                strerror(-ret));"},{"line_number":1404,"context_line":"            return KEY_GEN_DCO_DESYNC;"},{"line_number":1405,"context_line":"        }"}],"source_content_type":"text/x-csrc","patch_set":2,"id":"1411310a_dfa04e1b","line":1402,"in_reply_to":"d424b9dc_f0774760","updated":"2026-08-06 11:24:28.000000000","message":"Done","commit_id":"673e321220a104f42914bd04adb1968a7b2d9112"}],"src/openvpn/ssl.h":[{"author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"a5e2bebb8e788d732b979883f16590625e65a4e0","unresolved":true,"context_lines":[{"line_number":232,"context_line":"#define TLSMP_KILL      2"},{"line_number":233,"context_line":"#define TLSMP_RECONNECT 3"},{"line_number":234,"context_line":"/** the session cannot recover on its own and has to be restarted */"},{"line_number":235,"context_line":"#define TLSMP_RESTART   4"},{"line_number":236,"context_line":""},{"line_number":237,"context_line":"/*"},{"line_number":238,"context_line":" * Called by the top-level event loop."}],"source_content_type":"text/x-csrc","patch_set":2,"id":"72747949_f0138f5d","line":235,"updated":"2026-08-05 14:09:33.000000000","message":"Since you explicitly link that to DCO restart in forward.c maybe just give also a name like TLSMP_DCO_RESTART?","commit_id":"673e321220a104f42914bd04adb1968a7b2d9112"},{"author":{"_account_id":1000007,"name":"ordex","display_name":"Antonio Quartulli","email":"antonio@mandelbit.com","username":"ordex"},"change_message_id":"d8a2cf7cb8cd9c3ee08c2ef84f26de7056742348","unresolved":true,"context_lines":[{"line_number":232,"context_line":"#define TLSMP_KILL      2"},{"line_number":233,"context_line":"#define TLSMP_RECONNECT 3"},{"line_number":234,"context_line":"/** the session cannot recover on its own and has to be restarted */"},{"line_number":235,"context_line":"#define TLSMP_RESTART   4"},{"line_number":236,"context_line":""},{"line_number":237,"context_line":"/*"},{"line_number":238,"context_line":" * Called by the top-level event loop."}],"source_content_type":"text/x-csrc","patch_set":2,"id":"9325bea6_55bf70b8","line":235,"in_reply_to":"72747949_f0138f5d","updated":"2026-08-05 15:48:17.000000000","message":"I just wanted to keep DCO out of this lower level bits where this constant is used. Ideally there might be future users for this constant, requiring the same treatment.","commit_id":"673e321220a104f42914bd04adb1968a7b2d9112"},{"author":{"_account_id":1000007,"name":"ordex","display_name":"Antonio Quartulli","email":"antonio@mandelbit.com","username":"ordex"},"change_message_id":"f220343cdf9ca1bfb628cea356c66ac5d2024186","unresolved":false,"context_lines":[{"line_number":232,"context_line":"#define TLSMP_KILL      2"},{"line_number":233,"context_line":"#define TLSMP_RECONNECT 3"},{"line_number":234,"context_line":"/** the session cannot recover on its own and has to be restarted */"},{"line_number":235,"context_line":"#define TLSMP_RESTART   4"},{"line_number":236,"context_line":""},{"line_number":237,"context_line":"/*"},{"line_number":238,"context_line":" * Called by the top-level event loop."}],"source_content_type":"text/x-csrc","patch_set":2,"id":"8ee697bc_484212ea","line":235,"in_reply_to":"9325bea6_55bf70b8","updated":"2026-08-06 11:24:28.000000000","message":"Done","commit_id":"673e321220a104f42914bd04adb1968a7b2d9112"}],"src/openvpn/ssl_common.h":[{"author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"a5e2bebb8e788d732b979883f16590625e65a4e0","unresolved":true,"context_lines":[{"line_number":199,"context_line":"    KEY_GEN_OK,         /**\u003c keys were generated and installed */"},{"line_number":200,"context_line":"    KEY_GEN_FAILED,     /**\u003c generation failed, invalidate the key state */"},{"line_number":201,"context_line":"    KEY_GEN_DCO_DESYNC, /**\u003c the DCO peer is gone from the kernel */"},{"line_number":202,"context_line":"};"},{"line_number":203,"context_line":""},{"line_number":204,"context_line":"/**"},{"line_number":205,"context_line":" * Security parameter state of one TLS and data channel %key session."}],"source_content_type":"text/x-csrc","patch_set":2,"id":"9ee4af76_5e7ca6cf","line":202,"updated":"2026-08-05 14:09:33.000000000","message":"Since that is only returned by the static method init_key_contexts inside ssl.c would it make sense to put this just above that method?","commit_id":"673e321220a104f42914bd04adb1968a7b2d9112"},{"author":{"_account_id":1000007,"name":"ordex","display_name":"Antonio Quartulli","email":"antonio@mandelbit.com","username":"ordex"},"change_message_id":"f220343cdf9ca1bfb628cea356c66ac5d2024186","unresolved":false,"context_lines":[{"line_number":199,"context_line":"    KEY_GEN_OK,         /**\u003c keys were generated and installed */"},{"line_number":200,"context_line":"    KEY_GEN_FAILED,     /**\u003c generation failed, invalidate the key state */"},{"line_number":201,"context_line":"    KEY_GEN_DCO_DESYNC, /**\u003c the DCO peer is gone from the kernel */"},{"line_number":202,"context_line":"};"},{"line_number":203,"context_line":""},{"line_number":204,"context_line":"/**"},{"line_number":205,"context_line":" * Security parameter state of one TLS and data channel %key session."}],"source_content_type":"text/x-csrc","patch_set":2,"id":"3bf1cf6c_2c5fde6d","line":202,"in_reply_to":"488131ef_aa5a6fcb","updated":"2026-08-06 11:24:28.000000000","message":"Done","commit_id":"673e321220a104f42914bd04adb1968a7b2d9112"},{"author":{"_account_id":1000007,"name":"ordex","display_name":"Antonio Quartulli","email":"antonio@mandelbit.com","username":"ordex"},"change_message_id":"d8a2cf7cb8cd9c3ee08c2ef84f26de7056742348","unresolved":true,"context_lines":[{"line_number":199,"context_line":"    KEY_GEN_OK,         /**\u003c keys were generated and installed */"},{"line_number":200,"context_line":"    KEY_GEN_FAILED,     /**\u003c generation failed, invalidate the key state */"},{"line_number":201,"context_line":"    KEY_GEN_DCO_DESYNC, /**\u003c the DCO peer is gone from the kernel */"},{"line_number":202,"context_line":"};"},{"line_number":203,"context_line":""},{"line_number":204,"context_line":"/**"},{"line_number":205,"context_line":" * Security parameter state of one TLS and data channel %key session."}],"source_content_type":"text/x-csrc","patch_set":2,"id":"488131ef_aa5a6fcb","line":202,"in_reply_to":"9ee4af76_5e7ca6cf","updated":"2026-08-05 15:48:17.000000000","message":"Oh!\nActually it is returned also by `tls_session_generate_data_channel_keys()`, that is not declared static. But after a deeper look I can see this function is called only in ssl.c....\nSo it could be made static as well and the enum could indeed live in ssl.c only.","commit_id":"673e321220a104f42914bd04adb1968a7b2d9112"}]}