)]}'
{"src/openvpn/ssl_common.h":[{"author":{"_account_id":1000001,"name":"flichtenheld","display_name":"Frank Lichtenheld","email":"frank@lichtenheld.com","username":"flichtenheld","status":"OpenVPN Inc."},"change_message_id":"c28c5199a821915e158b6bd9b798127bbcb85cf3","unresolved":true,"context_lines":[{"line_number":761,"context_line":""},{"line_number":762,"context_line":"#ifdef ENABLE_MANAGEMENT"},{"line_number":763,"context_line":"/**"},{"line_number":764,"context_line":" * Gets the \\c key_state  object that belong to the management key id or"},{"line_number":765,"context_line":" * return NULL if not found."},{"line_number":766,"context_line":" */"},{"line_number":767,"context_line":"static inline struct key_state *"}],"source_content_type":"text/x-csrc","patch_set":6,"id":"e8a69349_62952bb7","line":764,"updated":"2026-08-26 12:58:01.000000000","message":"\"belongs\"","commit_id":"1e7ef53850e82f41b9691003c30f1f125e2a60fb"},{"author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"636878743d62f7ad796963d1ced70f23657582f7","unresolved":false,"context_lines":[{"line_number":761,"context_line":""},{"line_number":762,"context_line":"#ifdef ENABLE_MANAGEMENT"},{"line_number":763,"context_line":"/**"},{"line_number":764,"context_line":" * Gets the \\c key_state  object that belong to the management key id or"},{"line_number":765,"context_line":" * return NULL if not found."},{"line_number":766,"context_line":" */"},{"line_number":767,"context_line":"static inline struct key_state *"}],"source_content_type":"text/x-csrc","patch_set":6,"id":"4ac41449_d0f050da","line":764,"in_reply_to":"e8a69349_62952bb7","updated":"2026-08-26 16:27:18.000000000","message":"Done","commit_id":"1e7ef53850e82f41b9691003c30f1f125e2a60fb"},{"author":{"_account_id":1000001,"name":"flichtenheld","display_name":"Frank Lichtenheld","email":"frank@lichtenheld.com","username":"flichtenheld","status":"OpenVPN Inc."},"change_message_id":"c28c5199a821915e158b6bd9b798127bbcb85cf3","unresolved":true,"context_lines":[{"line_number":772,"context_line":"        struct key_state *ks \u003d get_key_scan(multi, i);"},{"line_number":773,"context_line":"        if (ks-\u003emda_key_id \u003d\u003d mda_key_id \u0026\u0026 ks-\u003estate \u003e S_UNDEF)"},{"line_number":774,"context_line":"        {"},{"line_number":775,"context_line":"            return ks;"},{"line_number":776,"context_line":"        }"},{"line_number":777,"context_line":"    }"},{"line_number":778,"context_line":"    return NULL;"}],"source_content_type":"text/x-csrc","patch_set":6,"id":"fef06de2_4e158fa9","line":775,"updated":"2026-08-26 12:58:01.000000000","message":"The old code did not abort on first match but always checked all three key states. Is there some state where this might make a difference?","commit_id":"1e7ef53850e82f41b9691003c30f1f125e2a60fb"},{"author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"571cd685b87db4f97b8d34da33ff8df1342c6cf8","unresolved":true,"context_lines":[{"line_number":772,"context_line":"        struct key_state *ks \u003d get_key_scan(multi, i);"},{"line_number":773,"context_line":"        if (ks-\u003emda_key_id \u003d\u003d mda_key_id \u0026\u0026 ks-\u003estate \u003e S_UNDEF)"},{"line_number":774,"context_line":"        {"},{"line_number":775,"context_line":"            return ks;"},{"line_number":776,"context_line":"        }"},{"line_number":777,"context_line":"    }"},{"line_number":778,"context_line":"    return NULL;"}],"source_content_type":"text/x-csrc","patch_set":6,"id":"af028c42_ec4c2b57","line":775,"in_reply_to":"fef06de2_4e158fa9","updated":"2026-08-26 16:23:20.000000000","message":"So each key_state has its own unique mda_key_id so there is only one valid key_state with mda_key_id, so the code does the same. But valid does a bit of heavy lifting here:\n\nIf state is S_UNDEF, mda_key_id is 0 and 0 is also a valid key id for the very first client. So we need to check for S_UNDEF to determine if the client actually the one with key-id 0 or just not initialised. \n\nAs alternative we can change the initialisation of context_2  or assignment of mda_key_id_counter to start with 1 instead of 0.\n\nE.g.\n\nsession-\u003eopt-\u003emda_context-\u003emda_key_id_counter++;\n    ks-\u003emda_key_id \u003d \n\nE.g. something like:\n\n    index de9303b30..478e4d314 100644\n    --- a/src/openvpn/manage.h\n    +++ b/src/openvpn/manage.h\n    @@ -69,6 +69,8 @@ struct man_def_auth_context\n     #define DAF_INITIAL_AUTH           (1u \u003c\u003c 2)\n         unsigned int flags;\n     \n    +    /** Identify the key id in the management interface, always 1 or\n    +     * or greater if valid */\n         unsigned int mda_key_id_counter;\n     };\n     \n    diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c\n    index 82d7daeb2..3495f9dd7 100644\n    --- a/src/openvpn/ssl.c\n    +++ b/src/openvpn/ssl.c\n    @@ -870,7 +870,10 @@ key_state_init(struct tls_session *session, struct key_state *ks)\n         ks-\u003ecrypto_options.pid_persist \u003d NULL;\n     \n     #ifdef ENABLE_MANAGEMENT\n    -    ks-\u003emda_key_id \u003d session-\u003eopt-\u003emda_context-\u003emda_key_id_counter++;\n    +    /* Increment key ID before assigning to always have a key id \u003e\u003d 1 to\n    +     * make 0 signify an invalid key id */\n    +    session-\u003eopt-\u003emda_context-\u003emda_key_id_counter++;\n    +    ks-\u003emda_key_id \u003d session-\u003eopt-\u003emda_context-\u003emda_key_id_counter;\n     #endif\n     \n         /*\n    diff --git a/src/openvpn/ssl_common.h b/src/openvpn/ssl_common.h\n    index 3b326a7c1..0270c23f2 100644\n    --- a/src/openvpn/ssl_common.h\n    +++ b/src/openvpn/ssl_common.h\n    @@ -764,7 +764,7 @@ get_primary_key(const struct tls_multi *multi)\n     \n     #ifdef ENABLE_MANAGEMENT\n     /**\n    - * Gets the \\c key_state  object that belong to the management key id or\n    + * Gets the \\c key_state object that belongs to the management key id or\n      * return NULL if not found.\n      */\n     static inline struct key_state *\n \n But that is a much bigger/more invasive change but I change the commit to do that as well to avoid this check here.","commit_id":"1e7ef53850e82f41b9691003c30f1f125e2a60fb"}]}