[Openvpn-devel,5/9] Also drop incoming dco packet content when dropping the packet

Message ID 20221224194253.3202231-6-arne@rfc2549.org
State Accepted
Headers show
Series Various patches to improve DCO behaviour | expand

Commit Message

Arne Schwabe Dec. 24, 2022, 7:42 p.m. UTC
If we get a message from a mismatched packet we need to clear
the incoming message buffer to ensure we can receive another

Signed-off-by: Arne Schwabe <arne@rfc2549.org>
 src/openvpn/forward.c | 2 ++
 src/openvpn/multi.c   | 2 ++
 2 files changed, 4 insertions(+)


Gert Doering Dec. 25, 2022, 5:14 p.m. UTC | #1
Acked-by: Gert Doering <gert@greenie.muc.de>

I'm not sure if my gremlins have ever seen this particular problem, but
it seems yours have been more active :-)

Stare-at-code confirms that "buf_init()" is the way we clear dco_packet_in
in the existing code paths, "if a packet has been consumed", and doing so
in these two places ("we do not want any packet, go away") sounds like the
right thing to do (otherwise dco_linux::ovpn_handle_msg() will get very
upset trying to read the next incoming message).

Tested on the Linux/DCO test rig, client+server.  FreeBSD never sends
data packets via the DCO interface, and Windows does not even have this
structure element.

Your patch has been applied to the master and release/2.6 branch.

commit 7433618cb4bea017ae7c360da42093f49cf014b4 (master)
commit 474fe4df7d04de0eaa4cfe48b06497008275451a (release/2.6)
Author: Arne Schwabe
Date:   Sat Dec 24 20:42:49 2022 +0100

     Also drop incoming dco packet content when dropping the packet

     Signed-off-by: Arne Schwabe <arne@rfc2549.org>
     Acked-by: Gert Doering <gert@greenie.muc.de>
     Message-Id: <20221224194253.3202231-6-arne@rfc2549.org>
     URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25797.html
     Signed-off-by: Gert Doering <gert@greenie.muc.de>

kind regards,

Gert Doering


diff --git a/src/openvpn/forward.c b/src/openvpn/forward.c
index 17a14f0bd..61caf1146 100644
--- a/src/openvpn/forward.c
+++ b/src/openvpn/forward.c
@@ -1194,6 +1194,8 @@  process_incoming_dco(struct context *c)
         msg(D_DCO_DEBUG, "%s: received message for mismatching peer-id %d, "
             "expected %d", __func__, dco->dco_message_peer_id,
+        /* ensure we also drop a message if there is one in the buffer */
+        buf_init(&dco->dco_packet_in, 0);
diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c
index fcb308151..9a20112e2 100644
--- a/src/openvpn/multi.c
+++ b/src/openvpn/multi.c
@@ -3276,6 +3276,8 @@  multi_process_incoming_dco(struct multi_context *m)
         msg(D_DCO, "Received packet for peer-id unknown to OpenVPN: %d", peer_id);
+        /* Also clear the buffer if this was incoming packet for a dropped peer */
+        buf_init(&dco->dco_packet_in, 0);
     dco->dco_message_type = 0;