CVE-2025-13086 - HMAC verification check: fix incorrect memcmp() call

Fix memcmp check for the hmac verification in the 3way handshake being inverted

Due to a program code mistake all hmac cookies are accepted, thus breaking source IP address validation. As a consequence, TLS sessions can be opened and state can be consumed in the server from IP addresses that did not initiate an initial connection.

While at it, fix check to only allow [t-2;t] timeslots, disallowing HMACs coming in from a future timeslot.

OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 are affected. This is fixed in version 2.6.16 and 2.7_rc2.

CVE Record: CVE-2025-13086

Github: OpenVPN/openvpn-private-issues#56

Release notes: openvpn-2.7_rc2 openvpn-2.6.16

Reported by: Joshua Rogers contact@joshua.hu

Found by: ZeroPath (https://zeropath.com/)

Reported by: stefan@srlabs.de