mbox series

[Openvpn-devel,net,0/5] ovpn: validate peer VPN addresses

Message ID cover.1785338921.git.ralf@mandelbit.com
Headers
Series ovpn: validate peer VPN addresses |

Message

Ralf Lici July 29, 2026, 3:37 p.m. UTC 
  Hi,

In MP mode, ovpn uses peer VPN addresses as lookup keys when selecting
the peer for an outgoing packet. The peer configuration path should
therefore maintain a few basic invariants around those addresses.

This series ensures that cleared addresses are removed from the hash
tables, prevents the same address from being assigned to multiple peers,
requires every MP peer to have at least one configured VPN address, and
rejects addresses that cannot identify a unicast peer.

The final patch extends the existing selftests to exercise these rules
through both peer creation and update, including transitions between
single-stack and dual-stack configurations.

Regards,

Ralf Lici
Mandelbit Srl

---
Ralf Lici (5):
  ovpn: always unhash old VPN addresses before rehashing
  ovpn: reject duplicate peer VPN addresses
  ovpn: reject multipeer peers without VPN addresses
  ovpn: reject invalid peer VPN addresses
  selftests: ovpn: validate peer VPN addresses

 drivers/net/ovpn/netlink.c                  | 100 +++++++++++++++++---
 drivers/net/ovpn/peer.c                     |  58 ++++++++++--
 drivers/net/ovpn/peer.h                     |   4 +
 tools/testing/selftests/net/ovpn/common.sh  |  13 +++
 tools/testing/selftests/net/ovpn/ovpn-cli.c |  54 +++++++----
 tools/testing/selftests/net/ovpn/test.sh    |  75 ++++++++++++++-
 6 files changed, 264 insertions(+), 40 deletions(-)