mbox series

[Openvpn-devel,net,v2,0/5] ovpn: validate peer VPN addresses

Message ID cover.1787919082.git.ralf@mandelbit.com
Headers
Series ovpn: validate peer VPN addresses |

Message

Ralf Lici Aug. 28, 2026, 1 p.m. UTC 
  Hi,

This is a respin of the series that enforces explicit policy rules for
VPN addresses, taking into account Sabrina's suggestions.

In MP mode, ovpn uses peer VPN addresses as lookup keys when selecting
the peer for an outgoing packet. The peer configuration path should
therefore maintain a few basic invariants around those addresses.

This series ensures that cleared addresses are removed from the hash
tables, prevents the same address from being assigned to multiple peers,
requires every MP peer to have at least one configured VPN address, and
rejects addresses that cannot identify a unicast peer.

The final patch extends the existing selftests to exercise these rules
through both peer creation and update, including transitions between
single-stack and dual-stack configurations.

Regards,

Ralf Lici
Mandelbit Srl

---
Changes since v1 https://lore.kernel.org/openvpn-devel/cover.1785338921.git.ralf@mandelbit.com/
- Rebased on net/main.
- Reworded 2/5 and 3/5 to explain why the newly rejected configurations
  were never usable/reliable. (Sabrina)
- Refactored 2/5 by splitting ovpn_peer_vpn_addr_conflict into two
  separate helpers for v4 and v6. (Sabrina)
- Switched to != htonl(INADDR_ANY) for consistency, rather than !s_addr
  in 3/5. (Sabrina)

Ralf Lici (5):
  ovpn: always unhash old VPN addresses before rehashing
  ovpn: reject duplicate peer VPN addresses
  ovpn: reject multipeer peers without VPN addresses
  ovpn: reject invalid peer VPN addresses
  selftests: ovpn: validate peer VPN addresses

 drivers/net/ovpn/netlink.c                  | 102 +++++++++++++++++---
 drivers/net/ovpn/peer.c                     |  77 +++++++++++++--
 drivers/net/ovpn/peer.h                     |   6 ++
 tools/testing/selftests/net/ovpn/common.sh  |  13 +++
 tools/testing/selftests/net/ovpn/ovpn-cli.c |  54 +++++++----
 tools/testing/selftests/net/ovpn/test.sh    |  75 +++++++++++++-
 6 files changed, 287 insertions(+), 40 deletions(-)


base-commit: 1b78070aaef63512688aebfbc82365ef9d6660f1