From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4jFHJ55s8Nz30LN for ; Wed, 28 Oct 2026 19:20:21 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4jFHJ22793z2xHd for ; Wed, 28 Oct 2026 19:20:18 +0000 (UTC) Received: from mout-b-110.mailbox.org (mout-b-110.mailbox.org [IPv6:2001:67c:2050:102:465::110]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bit raw public key) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "*.mailbox.org", Issuer "Thawte TLS RSA CA G1" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4jFHHv4byyz1mM for ; Wed, 28 Oct 2026 19:20:11 +0000 (UTC) Authentication-Results: mail01.ipfire.org; dkim=pass header.d=mandelbit.com header.s=MBO0001 header.b=hhQxzNd8; spf=pass (mail01.ipfire.org: domain of antonio@mandelbit.com designates 2001:67c:2050:102:465::110 as permitted sender) smtp.mailfrom=antonio@mandelbit.com; dmarc=none ARC-Seal: i=1; a=rsa-sha256; d=lists.ipfire.org; s=202003rsa; cv=none; t=1793215217; b=vkyWR0Yux17S4VuODCr9Sg3mLHZybOL6L7bWKxnk3Vqq7GBblwvD2/vjxzi7JI9woYKcjI vElHiqfR6NDRuY7wfExGMPOfnnDstrFN22YZgAROrhthVBTylTAPomzA76kPsGZd78l0Jv 966wvIvYt2pboTFRg8ig1IiQ4myHsMb9vxfxARJ6wDM8Betyp/os7Cjr7uiOFbXx/OqDhU dVfbg/Etbp7g9E9uXNitxZ+iUGy8596OwIzmXwqFmODK4EodMhEDKYf2GEjtUTI4cDgiJn f1Qz37LMUIYowC/yQ9BxNqEvc6f8BzEs6IKiy+/tQLCfDT7c7URHX2cJqPP9gg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.ipfire.org; s=202003rsa; t=1793215217; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=BScv4IB0JQd1LXX4e6UKH0FVAFZopEWhplqvVDw+Ci0=; b=TinpqzFRzi9Z+XRlu1ThjGj0RENHR2GvT8Sjy7X2nZLJyZGEnOtJOki/ryaFjkz+WvR6fK g5Cy+ho5bAcWOFZ+HB8HVorWgsQXF9H7IU1ov+8sl9INVtOdDIgE3ZRcz18FSPZ15bsTVZ U1MTwF+X5WbjPBWtnSRVEJDJZIQ6kV6jLkgzvJrGEeZ2IFi3CrTVmijNyycW9IIBn2PNZD mTAQIDW5YZCkGt0DKzB/bpM8yU8crxniBgt85KRpd/SwsLLDeXGySQM6eSYh0ovEtE482N k1V++be4XL1Q7kg5usjeWtqHpgQH3L4n5OZoE9dkvN1rB8ZNQY6AKmIh6rRmBQ== ARC-Authentication-Results: i=1; mail01.ipfire.org; dkim=pass header.d=mandelbit.com header.s=MBO0001 header.b=hhQxzNd8; spf=pass (mail01.ipfire.org: domain of antonio@mandelbit.com designates 2001:67c:2050:102:465::110 as permitted sender) smtp.mailfrom=antonio@mandelbit.com; dmarc=none Received: from smtp1.mailbox.org (smtp1.mailbox.org [IPv6:2001:67c:2050:b231:465::1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519MLKEM768 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-b-110.mailbox.org (Postfix) with ESMTPS id 4jFHHr4C6SzNlnj; Wed, 28 Oct 2026 20:20:08 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandelbit.com; s=MBO0001; t=1793215208; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=BScv4IB0JQd1LXX4e6UKH0FVAFZopEWhplqvVDw+Ci0=; b=hhQxzNd8yhLRrpHl2Lkya9rlOPqMPy2ekfY0K0OrlJuiZghD6ybaQI9eyoyQBm2yojjoIa NbXAdnwZByz6Cz2zNa/NCjd4WZWq5iJ63mPCAAy1HZtXr6rXX0tzraJ6sHF93DAkargz/C Il6Jpldd3mHN5Cr1vKgLnav3JvxLkdsci1Fv5O/Pr0LZr/LoQJGsNV57CT1q0RMVCq8AGQ Td0CYYLSeDJAIiz5yP0al2DzHJktrtFn8O/LHeD+wiiq9b9eZ8xSFNpbigeeC4uoNkAQjr kzVqlD+FKNI7OHqsfsBAto3aFE1um6p1aueBd26HwAtrQYKBqS1O9bcKaTEt8g== Message-ID: Date: Wed, 28 Oct 2026 20:20:02 +0100 Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH 0/3] OpenVPN: Fix N2N connections shown as DISCONNECTED while up To: Michael Tremer Cc: development@lists.ipfire.org References: <20261027222110.2642078-1-antonio@mandelbit.com> <8707D8AE-46F3-466E-A604-20C95B64BD88@ipfire.org> Content-Language: en-US From: Antonio Quartulli Organization: Mandelbit SRL In-Reply-To: <8707D8AE-46F3-466E-A604-20C95B64BD88@ipfire.org> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Rspamd-Action: no action X-Spamd-Result: default: False [-6.49 / 11.00]; BAYES_HAM(-3.00)[100.00%]; R_DKIM_ALLOW(-1.34)[mandelbit.com:s=MBO0001]; SPF_REPUTATION_HAM(-0.72)[-0.7238298293576]; DKIM_REPUTATION(-0.72)[-0.7238298293576]; R_SPF_ALLOW(-0.20)[+ip6:2001:67c:2050::/48]; RCVD_IN_DNSWL_LOW(-0.20)[2001:67c:2050:b231:465::1:received,2001:67c:2050:102:465::110:from]; MIME_GOOD(-0.10)[text/plain]; R_DKIM_ALIGNED(-0.10)[strict]; MX_GOOD(-0.10)[mxext1.mailbox.org]; DMARC_NA(0.00)[mandelbit.com]; IP_REPUTATION_HAM(0.00)[asn: 199118(-0.31), country: DE(-0.01), ip: 2001:67c:2050:102::(0.00)]; ARC_NA(0.00)[]; RCPT_COUNT_TWO(0.00)[2]; MIME_TRACE(0.00)[0:+]; HAS_ORG_HEADER(0.00)[]; FROM_HAS_DN(0.00)[]; DKIM_TRACE(0.00)[mandelbit.com:+]; TO_DN_SOME(0.00)[]; TO_MATCH_ENVRCPT_SOME(0.00)[]; FROM_EQ_ENVFROM(0.00)[]; RCVD_TLS_ALL(0.00)[]; MID_RHS_MATCH_FROM(0.00)[]; RCVD_COUNT_ONE(0.00)[1]; ASN(0.00)[asn:199118, ipnet:2001:67c:2050::/48, country:DE]; ARC_SIGNED(0.00)[lists.ipfire.org:s=202003rsa:i=1] X-Rspamd-Server: mail01.haj.ipfire.org X-Rspamd-Queue-Id: 4jFHHv4byyz1mM Hi Michael, On 28/10/2026 18:28, Michael Tremer wrote: > Hello Antonio, > > Thank you so much for your patch. Thanks for considering it! :) > > I am happy to merge this and create a separate file with the function so that it can be re-used properly. > > From which version of OpenVPN will this work? This code aims at working around the existing OpenVPN (mis)behaviour and therefore works for all versions. When my fix will be merged in upstream OpenVPN (see my comment in bug #13897) this code in IPFire will become mostly a no-op, but nothing will break. I hope this helps clarifying the scenario. Regards, > > All the best, > -Michael > >> On 27 Oct 2026, at 22:21, Antonio Quartulli wrote: >> >> Hi all! >> >> This is my first contribution to IPFire, so bear with me if I am doing >> things the wrong way :) >> >> This is what this small series addresses: >> >> In P2P mode OpenVPN leaves its management state at AUTH/WAIT when a new >> session attempt never completes (e.g. a stray packet from the internet), >> although the tunnel keeps working. The WUI then shows the N2N connection >> as DISCONNECTED (bug #13897). >> >> A fix for OpenVPN has already been published for review [1], but it is >> not integrated yet. These patches fix IPFire while OpenVPN still >> misbehaves. >> >> A test harness is included to verify the fix and possibly perform >> regression testing in the future. >> >> Notes: >> - index.cgi and ovpnmain.cgi now require the new >> /var/ipfire/ovpn-functions.pl, so it needs to be shipped with the next >> Core Update. I left the filelists to you. >> - wio.cgi (WIO addon) still uses the old check and has the same problem; >> I can send a follow-up if wanted. >> >> [1] https://gerrit.openvpn.net/c/openvpn/+/2040 >> >> Antonio Quartulli (3): >> ovpn-functions.pl: Add a helper to get the status of N2N connections >> ovpnmain.cgi/index.cgi: Use OpenVPN::n2n_status() >> tests: Add tests for OpenVPN::n2n_status() >> >> config/cfgroot/ovpn-functions.pl | 96 +++++++++++++++++++ >> config/rootfiles/common/configroot | 1 + >> html/cgi-bin/index.cgi | 12 +-- >> html/cgi-bin/ovpnmain.cgi | 58 +---------- >> lfs/configroot | 1 + >> .../ovpn-functions.pl/data/auth_pending | 6 ++ >> .../cfgroot/ovpn-functions.pl/data/connected | 7 ++ >> .../data/connected_stray_session | 8 ++ >> .../cfgroot/ovpn-functions.pl/data/empty | 1 + >> .../cfgroot/ovpn-functions.pl/data/exiting | 7 ++ >> .../ovpn-functions.pl/data/never_connected | 6 ++ >> .../ovpn-functions.pl/data/notifications | 11 +++ >> .../ovpn-functions.pl/data/reconnected | 11 +++ >> .../ovpn-functions.pl/data/reconnecting | 9 ++ >> .../cfgroot/ovpn-functions.pl/data/truncated | 3 + >> .../cfgroot/ovpn-functions.pl/n2n_status.pl | 73 ++++++++++++++ >> .../config/cfgroot/ovpn-functions.pl/test.sh | 70 ++++++++++++++ >> 17 files changed, 315 insertions(+), 65 deletions(-) >> create mode 100644 config/cfgroot/ovpn-functions.pl >> create mode 100644 tests/config/cfgroot/ovpn-functions.pl/data/auth_pending >> create mode 100644 tests/config/cfgroot/ovpn-functions.pl/data/connected >> create mode 100644 tests/config/cfgroot/ovpn-functions.pl/data/connected_stray_session >> create mode 100644 tests/config/cfgroot/ovpn-functions.pl/data/empty >> create mode 100644 tests/config/cfgroot/ovpn-functions.pl/data/exiting >> create mode 100644 tests/config/cfgroot/ovpn-functions.pl/data/never_connected >> create mode 100644 tests/config/cfgroot/ovpn-functions.pl/data/notifications >> create mode 100644 tests/config/cfgroot/ovpn-functions.pl/data/reconnected >> create mode 100644 tests/config/cfgroot/ovpn-functions.pl/data/reconnecting >> create mode 100644 tests/config/cfgroot/ovpn-functions.pl/data/truncated >> create mode 100644 tests/config/cfgroot/ovpn-functions.pl/n2n_status.pl >> create mode 100755 tests/config/cfgroot/ovpn-functions.pl/test.sh >> >> -- >> 2.55.0 >> >> > -- Antonio Quartulli CEO and Co-Founder Mandelbit Srl https://www.mandelbit.com