)]}'
{"id":"openvpn~1881","triplet_id":"openvpn~master~Iacd56d245e9ab30cfb25b2b364ca661fa289dc55","project":"openvpn","branch":"master","full_branch":"refs/heads/master","attention_set":{"1000055":{"account":{"_account_id":1000055,"name":"srkyn","email":"david@srkyn.com","username":"srkyn"},"last_update":"2026-09-23 10:36:15.000000000","reason":"\u003cGERRIT_ACCOUNT_1000001\u003e replied on the change","reason_account":{"_account_id":1000001,"name":"Frank Lichtenheld","display_name":"Frank Lichtenheld","email":"frank@lichtenheld.com","username":"flichtenheld","status":"OpenVPN Inc."}},"1000002":{"account":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"last_update":"2026-09-07 09:56:18.000000000","reason":"\u003cGERRIT_ACCOUNT_1000053\u003e replied on the change","reason_account":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"}}},"removed_from_attention_set":{"1000053":{"account":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"last_update":"2026-08-29 14:19:58.000000000","reason":"\u003cGERRIT_ACCOUNT_1000053\u003e replied on the change","reason_account":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"}},"1000003":{"account":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"last_update":"2026-08-29 19:46:44.000000000","reason":"\u003cGERRIT_ACCOUNT_1000003\u003e replied on the change","reason_account":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"}}},"hashtags":[],"change_id":"Iacd56d245e9ab30cfb25b2b364ca661fa289dc55","subject":"compat: close all unrelated fds in forked helpers","status":"NEW","created":"2026-08-27 16:54:38.000000000","updated":"2026-09-23 10:36:15.000000000","submit_type":"CHERRY_PICK","total_comment_count":36,"unresolved_comment_count":2,"has_review_started":true,"meta_rev_id":"265f144767370a0196d21271e242bfcf6db9e8ce","_number":1881,"virtual_id_number":1881,"owner":{"_account_id":1000055,"name":"srkyn","email":"david@srkyn.com","username":"srkyn"},"actions":{},"labels":{"Code-Review":{"approved":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"all":[{"value":2,"date":"2026-09-07 14:55:15.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},{"value":0,"permitted_voting_range":{"min":-2,"max":2},"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"}],"values":{"-2":"This shall not be submitted","-1":"I would prefer this is not submitted as is"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me, approved"},"description":"","default_value":0}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"}],"CC":[{"_account_id":1000001,"name":"Frank Lichtenheld","display_name":"Frank Lichtenheld","email":"frank@lichtenheld.com","username":"flichtenheld","status":"OpenVPN Inc."},{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},{"_account_id":1000026,"name":"openvpn-devel","email":"openvpn-devel@lists.sourceforge.net","username":"openvpn-devel"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-08-27 16:54:38.000000000","updated_by":{"_account_id":1000055,"name":"srkyn","email":"david@srkyn.com","username":"srkyn"},"real_updated_by":{"_account_id":1000055,"name":"srkyn","email":"david@srkyn.com","username":"srkyn"},"reviewer":{"_account_id":1000026,"name":"openvpn-devel","email":"openvpn-devel@lists.sourceforge.net","username":"openvpn-devel"},"state":"CC"},{"updated":"2026-08-27 16:54:38.000000000","updated_by":{"_account_id":1000055,"name":"srkyn","email":"david@srkyn.com","username":"srkyn"},"real_updated_by":{"_account_id":1000055,"name":"srkyn","email":"david@srkyn.com","username":"srkyn"},"reviewer":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"state":"REVIEWER"},{"updated":"2026-08-28 07:05:56.000000000","updated_by":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"real_updated_by":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"reviewer":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"state":"REVIEWER"},{"updated":"2026-08-29 16:37:49.000000000","updated_by":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"real_updated_by":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"reviewer":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"state":"CC"},{"updated":"2026-09-23 10:36:15.000000000","updated_by":{"_account_id":1000001,"name":"Frank Lichtenheld","display_name":"Frank Lichtenheld","email":"frank@lichtenheld.com","username":"flichtenheld","status":"OpenVPN Inc."},"real_updated_by":{"_account_id":1000001,"name":"Frank Lichtenheld","display_name":"Frank Lichtenheld","email":"frank@lichtenheld.com","username":"flichtenheld","status":"OpenVPN Inc."},"reviewer":{"_account_id":1000001,"name":"Frank Lichtenheld","display_name":"Frank Lichtenheld","email":"frank@lichtenheld.com","username":"flichtenheld","status":"OpenVPN Inc."},"state":"CC"}],"messages":[{"id":"bc541dd49dc05f7e8f6e05deaec88a400c334b41","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1000055,"name":"srkyn","email":"david@srkyn.com","username":"srkyn"},"date":"2026-08-27 16:54:38.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"d8be5a6bd174e415f609f15358faa3aeeb3f9e16","author":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"date":"2026-08-28 07:05:56.000000000","message":"Patch Set 1: Code-Review-1\n\n(7 comments)","accounts_in_message":[],"_revision_number":1},{"id":"bb0fda2926cd3af7d1f15f9be5ae93f62551509a","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1000055,"name":"srkyn","email":"david@srkyn.com","username":"srkyn"},"date":"2026-08-28 11:05:25.000000000","message":"Uploaded patch set 2.\n\nOutdated Votes:\n* Code-Review-1 (copy condition: \"changekind:NO_CHANGE OR changekind:TRIVIAL_REBASE OR is:MIN\")\n","accounts_in_message":[],"_revision_number":2},{"id":"06ce56b2f8b59a1e35a235e6b4286e279be86c58","author":{"_account_id":1000055,"name":"srkyn","email":"david@srkyn.com","username":"srkyn"},"date":"2026-08-28 11:06:44.000000000","message":"Patch Set 2:\n\nPatch set 2 adds the missing CMake source and non-Windows test target, converts the driver to cmocka, verifies descriptors 0, 1, and 2 survive, restores the full license headers, and documents the helper. The CMake main and focused targets build, CTest passes, and the Clang native and GCC forced-fallback tests both pass.","accounts_in_message":[],"_revision_number":2},{"id":"a9818a68d9a9f67d041bc61bc096dc0687aaa2f0","author":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"date":"2026-08-29 14:19:58.000000000","message":"Patch Set 2:\n\n(5 comments)","accounts_in_message":[],"_revision_number":2},{"id":"d33cb8c17c852510e48e6a6cb83492f06716c0fb","author":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"date":"2026-08-29 16:37:49.000000000","message":"Patch Set 2:\n\n(2 comments)","accounts_in_message":[],"_revision_number":2},{"id":"9c2c5d6f40296d8c301ffb70c8d43d8b60b35446","author":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"date":"2026-08-29 19:46:44.000000000","message":"Patch Set 2:\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"a5afa4baa66ec48d949376e8daf79c73d1f2a454","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1000055,"name":"srkyn","email":"david@srkyn.com","username":"srkyn"},"date":"2026-08-30 20:48:53.000000000","message":"Uploaded patch set 3.","accounts_in_message":[],"_revision_number":3},{"id":"72fa39f6f7a95093801391dfe1e7fdae7fe70f7c","author":{"_account_id":1000055,"name":"srkyn","email":"david@srkyn.com","username":"srkyn"},"date":"2026-09-02 08:31:28.000000000","message":"Patch Set 3:\n\nPatch set 3 addresses the review comments: it folds the descriptor checks into test_misc, adds CMake close_range detection, and simplifies the native and fallback paths. I reran the CMake main and test_misc targets, the forced-fallback test_misc case, and the Autotools suite. All 17 OpenVPN unit tests and both runnable system tests pass; three environment-dependent system tests skip. Please take another look when convenient.","accounts_in_message":[],"_revision_number":3},{"id":"00eefa6276abf97b564161fbd33fe7fa3e3086a8","author":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"date":"2026-09-04 08:29:24.000000000","message":"Patch Set 3:\n\n(3 comments)","accounts_in_message":[],"_revision_number":3},{"id":"e2ae78bff6e809012da4bb798f5456ce43e4c6ea","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1000055,"name":"srkyn","email":"david@srkyn.com","username":"srkyn"},"date":"2026-09-05 18:16:55.000000000","message":"Uploaded patch set 4.","accounts_in_message":[],"_revision_number":4},{"id":"4540615862ab1243dfffaf06b481900cc28a619f","author":{"_account_id":1000055,"name":"srkyn","email":"david@srkyn.com","username":"srkyn"},"date":"2026-09-05 18:18:04.000000000","message":"Patch Set 4:\n\nPatch set 4 renames the helper to compat-close-fds, applies the suggested close_range simplification, and makes the descriptor tests adapt to RLIMIT_NOFILE. Verified current master with native and forced-fallback CMake builds, both low-limit test_misc runs, the Autotools main build, and all 17 OpenVPN unit tests.","accounts_in_message":[],"_revision_number":4},{"id":"4d37216e572d51d00a1a3bee359215961db807ac","author":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"date":"2026-09-07 09:56:18.000000000","message":"Patch Set 4:\n\n(15 comments)","accounts_in_message":[],"_revision_number":4},{"id":"893e7a6cae478c6ea6390320ed862ff142d04c95","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1000055,"name":"srkyn","email":"david@srkyn.com","username":"srkyn"},"date":"2026-09-07 14:40:32.000000000","message":"Uploaded patch set 5.","accounts_in_message":[],"_revision_number":5},{"id":"2de1fef1bca1f216259e8590941ebf15ec8651f3","author":{"_account_id":1000055,"name":"srkyn","email":"david@srkyn.com","username":"srkyn"},"date":"2026-09-07 14:42:35.000000000","message":"Patch Set 5:\n\nGood catch. Patch set 5 now creates FD 101 when the limit permits. The test fails against the previous 3 through 100 loop and passes with the new helper. Native and fallback runs also pass with ulimit 64.","accounts_in_message":[],"_revision_number":5},{"id":"9d150759fda79f292f54300f81d71e4648fd6472","author":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"date":"2026-09-07 14:55:15.000000000","message":"Patch Set 5: Code-Review+2\n\n(1 comment)","accounts_in_message":[],"_revision_number":5},{"id":"3837bc6fdd41f886d48cfdafd348bb51f429e45d","author":{"_account_id":1000055,"name":"srkyn","email":"david@srkyn.com","username":"srkyn"},"date":"2026-09-22 20:17:51.000000000","message":"Patch Set 5:\n\n(1 comment)","accounts_in_message":[],"_revision_number":5},{"id":"265f144767370a0196d21271e242bfcf6db9e8ce","author":{"_account_id":1000001,"name":"Frank Lichtenheld","display_name":"Frank Lichtenheld","email":"frank@lichtenheld.com","username":"flichtenheld","status":"OpenVPN Inc."},"date":"2026-09-23 10:36:15.000000000","message":"Patch Set 5:\n\n(1 comment)","accounts_in_message":[],"_revision_number":5}],"current_revision_number":5,"current_revision":"67bc78c7f97e197fe98ce901e36edb13709376c2","revisions":{"af300510350e2496a17f0e3e07ae22107bb42d5a":{"kind":"REWORK","_number":1,"created":"2026-08-27 16:54:38.000000000","uploader":{"_account_id":1000055,"name":"srkyn","email":"david@srkyn.com","username":"srkyn"},"ref":"refs/changes/81/1881/1","fetch":{"anonymous http":{"url":"https://gerrit.openvpn.net/openvpn","ref":"refs/changes/81/1881/1","commands":{"Branch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/81/1881/1 \u0026\u0026 git checkout -b change-1881 FETCH_HEAD","Checkout":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/81/1881/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/81/1881/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/81/1881/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://gerrit.openvpn.net/openvpn refs/changes/81/1881/1","Reset To":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/81/1881/1 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"2508b2d749f3cd4d951867156700af30c0db7eae","subject":"init: Fix conversion warnings"}],"author":{"name":"David Sarkisyan","email":"david@srkyn.com","date":"2026-08-21 10:10:04.000000000","tz":-240},"committer":{"name":"David Sarkisyan","email":"david@srkyn.com","date":"2026-08-27 16:16:19.000000000","tz":-240},"subject":"compat: close all unrelated fds in forked helpers","message":"compat: close all unrelated fds in forked helpers\n\nThe forked auth-pam, down-root, and port-share helpers only closed\ndescriptor numbers 3 through 100. Descriptors above that range could\nremain open in long-lived helper processes, including helpers that\nintentionally retain privilege.\n\nAdd a shared compatibility helper that uses close_range() when available\nand falls back to the process descriptor limit. Preserve the helper\ncommand socket and add coverage for both low and high preserved\ndescriptors.\n\nChange-Id: Iacd56d245e9ab30cfb25b2b364ca661fa289dc55\nSigned-off-by: David Sarkisyan \u003cdavid@srkyn.com\u003e\n"},"branch":"refs/heads/master"},"af724b68aea7ad161492da8aad1cd8a5ff456bd5":{"kind":"REWORK","_number":2,"created":"2026-08-28 11:05:25.000000000","uploader":{"_account_id":1000055,"name":"srkyn","email":"david@srkyn.com","username":"srkyn"},"ref":"refs/changes/81/1881/2","fetch":{"anonymous http":{"url":"https://gerrit.openvpn.net/openvpn","ref":"refs/changes/81/1881/2","commands":{"Branch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/81/1881/2 \u0026\u0026 git checkout -b change-1881 FETCH_HEAD","Checkout":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/81/1881/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/81/1881/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/81/1881/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://gerrit.openvpn.net/openvpn refs/changes/81/1881/2","Reset To":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/81/1881/2 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"2508b2d749f3cd4d951867156700af30c0db7eae","subject":"init: Fix conversion warnings"}],"author":{"name":"David Sarkisyan","email":"david@srkyn.com","date":"2026-08-21 10:10:04.000000000","tz":-240},"committer":{"name":"David Sarkisyan","email":"david@srkyn.com","date":"2026-08-28 11:03:53.000000000","tz":-240},"subject":"compat: close all unrelated fds in forked helpers","message":"compat: close all unrelated fds in forked helpers\n\nThe forked auth-pam, down-root, and port-share helpers only closed\ndescriptor numbers 3 through 100. Descriptors above that range could\nremain open in long-lived helper processes, including helpers that\nintentionally retain privilege.\n\nAdd a shared compatibility helper that uses close_range() when available\nand falls back to the process descriptor limit. Preserve the helper\ncommand socket and add coverage for both low and high preserved\ndescriptors.\n\nChange-Id: Iacd56d245e9ab30cfb25b2b364ca661fa289dc55\nSigned-off-by: David Sarkisyan \u003cdavid@srkyn.com\u003e\n"},"branch":"refs/heads/master"},"db8854f550226474ea84c377fdbc5024620f05e4":{"kind":"REWORK","_number":3,"created":"2026-08-30 20:48:53.000000000","uploader":{"_account_id":1000055,"name":"srkyn","email":"david@srkyn.com","username":"srkyn"},"ref":"refs/changes/81/1881/3","fetch":{"anonymous http":{"url":"https://gerrit.openvpn.net/openvpn","ref":"refs/changes/81/1881/3","commands":{"Branch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/81/1881/3 \u0026\u0026 git checkout -b change-1881 FETCH_HEAD","Checkout":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/81/1881/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/81/1881/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/81/1881/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://gerrit.openvpn.net/openvpn refs/changes/81/1881/3","Reset To":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/81/1881/3 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"2508b2d749f3cd4d951867156700af30c0db7eae","subject":"init: Fix conversion warnings"}],"author":{"name":"David Sarkisyan","email":"david@srkyn.com","date":"2026-08-21 10:10:04.000000000","tz":-240},"committer":{"name":"David Sarkisyan","email":"david@srkyn.com","date":"2026-08-30 20:47:59.000000000","tz":-240},"subject":"compat: close all unrelated fds in forked helpers","message":"compat: close all unrelated fds in forked helpers\n\nThe forked auth-pam, down-root, and port-share helpers only closed\ndescriptor numbers 3 through 100. Descriptors above that range could\nremain open in long-lived helper processes, including helpers that\nintentionally retain privilege.\n\nAdd a shared compatibility helper that uses close_range() when available\nand falls back to the process descriptor limit. Preserve the helper\ncommand socket and add coverage for both low and high preserved\ndescriptors.\n\nChange-Id: Iacd56d245e9ab30cfb25b2b364ca661fa289dc55\nSigned-off-by: David Sarkisyan \u003cdavid@srkyn.com\u003e\n"},"branch":"refs/heads/master"},"89a1011cb5d3a17d56b5fdad59531d8be8e20835":{"kind":"REWORK","_number":4,"created":"2026-09-05 18:16:55.000000000","uploader":{"_account_id":1000055,"name":"srkyn","email":"david@srkyn.com","username":"srkyn"},"ref":"refs/changes/81/1881/4","fetch":{"anonymous http":{"url":"https://gerrit.openvpn.net/openvpn","ref":"refs/changes/81/1881/4","commands":{"Branch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/81/1881/4 \u0026\u0026 git checkout -b change-1881 FETCH_HEAD","Checkout":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/81/1881/4 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/81/1881/4 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/81/1881/4 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://gerrit.openvpn.net/openvpn refs/changes/81/1881/4","Reset To":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/81/1881/4 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"c9b8ca1795957f2e22dad1589479bd32faea4fc1","subject":"reliable: add unit tests for ACK and backoff DoS hardening"}],"author":{"name":"David Sarkisyan","email":"david@srkyn.com","date":"2026-08-21 10:10:04.000000000","tz":-240},"committer":{"name":"David Sarkisyan","email":"david@srkyn.com","date":"2026-09-05 18:12:51.000000000","tz":-240},"subject":"compat: close all unrelated fds in forked helpers","message":"compat: close all unrelated fds in forked helpers\n\nThe forked auth-pam, down-root, and port-share helpers only closed\ndescriptor numbers 3 through 100. Descriptors above that range could\nremain open in long-lived helper processes, including helpers that\nintentionally retain privilege.\n\nAdd a shared compatibility helper that uses close_range() when available\nand falls back to the process descriptor limit. Preserve the helper\ncommand socket and add coverage for both low and high preserved\ndescriptors.\n\nChange-Id: Iacd56d245e9ab30cfb25b2b364ca661fa289dc55\nSigned-off-by: David Sarkisyan \u003cdavid@srkyn.com\u003e\n"},"branch":"refs/heads/master"},"67bc78c7f97e197fe98ce901e36edb13709376c2":{"kind":"REWORK","_number":5,"created":"2026-09-07 14:40:32.000000000","uploader":{"_account_id":1000055,"name":"srkyn","email":"david@srkyn.com","username":"srkyn"},"ref":"refs/changes/81/1881/5","fetch":{"anonymous http":{"url":"https://gerrit.openvpn.net/openvpn","ref":"refs/changes/81/1881/5","commands":{"Branch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/81/1881/5 \u0026\u0026 git checkout -b change-1881 FETCH_HEAD","Checkout":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/81/1881/5 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/81/1881/5 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/81/1881/5 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://gerrit.openvpn.net/openvpn refs/changes/81/1881/5","Reset To":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/81/1881/5 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"c9b8ca1795957f2e22dad1589479bd32faea4fc1","subject":"reliable: add unit tests for ACK and backoff DoS hardening"}],"author":{"name":"David Sarkisyan","email":"david@srkyn.com","date":"2026-08-21 10:10:04.000000000","tz":-240},"committer":{"name":"David Sarkisyan","email":"david@srkyn.com","date":"2026-09-07 14:39:28.000000000","tz":-240},"subject":"compat: close all unrelated fds in forked helpers","message":"compat: close all unrelated fds in forked helpers\n\nThe forked auth-pam, down-root, and port-share helpers only closed\ndescriptor numbers 3 through 100. Descriptors above that range could\nremain open in long-lived helper processes, including helpers that\nintentionally retain privilege.\n\nAdd a shared compatibility helper that uses close_range() when available\nand falls back to the process descriptor limit. Preserve the helper\ncommand socket and add coverage for both low and high preserved\ndescriptors.\n\nChange-Id: Iacd56d245e9ab30cfb25b2b364ca661fa289dc55\nSigned-off-by: David Sarkisyan \u003cdavid@srkyn.com\u003e\n"},"branch":"refs/heads/master"}},"requirements":[{"status":"NOT_READY","fallback_text":"All required checks must pass","type":"checks_pass"}],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"OK","labels":[{"label":"Code-Review","status":"OK","applied_by":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"}}]},{"rule_name":"checks~ChecksSubmitRule","status":"NOT_READY","requirements":[{"status":"NOT_READY","fallback_text":"All required checks must pass","type":"checks_pass"}]}]}