From patchwork Fri Aug 28 13:00:05 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ralf Lici X-Patchwork-Id: 39 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:2a5c:b0:87d:ab56:3700 with SMTP id l28csp1142261maz; Fri, 28 Aug 2026 06:01:21 -0700 (PDT) X-Forwarded-Encrypted: i=2; AHgh+RqT+MbK3peufduAhV3BZ1VQM8vXZyDd+DpcV8TMc/YX7mWbE7YIoer1NpEK3EVMP8QFd/2Mhwn9HSw=@openvpn.net X-Received: by 2002:a05:6820:2c91:b0:6b1:7141:75f3 with SMTP id 006d021491bc7-6b1c6626bd8mr4130504eaf.13.1787922073623; Fri, 28 Aug 2026 06:01:13 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1787922073; cv=none; d=google.com; s=arc-20260327; b=Qi5BK0oaDF4syil+ROlcf2emEbKICg1BNfKPgITpuPY/P3Sk9iWhyuBZl/EpuAZjg/ MAZ0HsEkFy7SjwBYqFHt8CBUC9YtXFl6zfyA5P1k6HBlf4VtYwWxqm2PctKe2XkH+8gd SLaO3Lza4mLM6Qqp3ZhWgT0regtlGeIYFuBYz93hdd4N9UPJxenB9dyMZ4VHOURfHMeA aFevDcItKVze7ZJCp5IuGItJ0bzqMEOaq2IPuGSj3JPylG8U1CHT5RmEaJKv0yriWiV7 hnVvwV6gBCItVUTs5dTVRpjzBS/aPsYz1xFxqPFpH5JJlzTQC+geCdxpWT5G1feQXMnz WCRw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:message-id:date:to:from:dkim-signature:dkim-signature :dkim-signature:dkim-signature; bh=2xEqvg6jU2Ku7VyPpKbWX66KqQSodytAp6h0npbYP/w=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=nD25TXY3vOnwcgTTBTnpkxXJ7ZG+IbNOdpvZXar/lT/xCT3DQVk0sTe6ec1+vwZ6cz jcUw0t+saojKdrJg+Qn0mkk5g++E2l++H1PLmQvEngDefMeG8OiNJQ6iDpsPpNzla/Vq ysa++lDjCfvL7z3wdGcjNxdEldTlNU1zKfhyvhdhRAQoPro1l/GDCkA6xDwSPlEwCBWu FD4rkAAul5gna04Bk2BJcfCgCXLCQAmsdYt/T7ga8Agc3oKCP3IP5g3WxX6eXg2a7rnR Hcq3ilXx1CrXGG9Py3jsFMjIjQhvgrRYUjGyMMKqAFeJlHxGMJK+341Loffyhze+hO5B RSWw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b="X/2UtrCN"; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=JWP2mseX; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=PsCFGqGX; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=iX890W9M; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 006d021491bc7-6b1ce152439si2060484eaf.37.2026.08.28.06.01.12 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Fri, 28 Aug 2026 06:01:13 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b="X/2UtrCN"; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=JWP2mseX; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=PsCFGqGX; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=iX890W9M; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:Message-ID:Date:To:From:Sender:Reply-To:Cc:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Owner; bh=2xEqvg6jU2Ku7VyPpKbWX66KqQSodytAp6h0npbYP/w=; b=X/2UtrCN8Mzr5w1kGSsF0F/rlB DPuD1JHz+eP/FGAeDHhcogsjOICWGrf2uZ55YXjJysreJUm6bNSv5XyqGfpAzL2Z8ERqxCx8neXt9 hS3jCo2+noT5Jyh2BU8+xYaBxeZmeedWG1U1aT5rgbI+bg9KO6pYSVuGevMreN0j01dk=; Received: from [127.0.0.1] (helo=sfs-ml-2.v29.lw.sourceforge.com) by sfs-ml-2.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1wzwCh-0002kS-8v; Fri, 28 Aug 2026 13:01:08 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-2.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1wzwCM-0002jc-H9 for openvpn-devel@lists.sourceforge.net; Fri, 28 Aug 2026 13:00:48 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=l8lYx8FhBw6tw2sTbA1NWOYv3ApdkNUQru8M4LdMFd8=; b=JWP2mseXij3GJSRZ9pnvFQwjPH LUGMys6PeDycqAJMQ9sHczpx7iKNgGxie1Chi0qSh6m9YAbgCxCw8H6O66Mrl9Pb8iA5uNq0UmwgO h/T/SiffJNH5epsYL337IP3DE//SFLbI50kym72lp0QGLnKZIovsU0JXCVSundF/ReRk=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:Message-ID:Date:Subject:Cc:To:From :Sender:Reply-To:Content-Type:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To: References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post: List-Owner:List-Archive; bh=l8lYx8FhBw6tw2sTbA1NWOYv3ApdkNUQru8M4LdMFd8=; b=P sCFGqGXc4xloV+pNPLKyjXUkTjVkWzcuZRBL3SJkAMroCz+9NxIkVEztybRR9C9p/8I71aadXG66/ BHeb9WHiVSdcfazz1mELDJS44aEEN/nY+HKbdxSmITiUDjU2IZOHxrB/eMGNKtZdrE2m1dgU6eYLV frm0thWp1krztE5Y=; Received: from mout-b-105.mailbox.org ([195.10.208.50]) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1wzwC9-0003Wg-Ma for openvpn-devel@lists.sourceforge.net; Fri, 28 Aug 2026 13:00:37 +0000 Received: from smtp102.mailbox.org (smtp102.mailbox.org [IPv6:2001:67c:2050:b231:465::102]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-b-105.mailbox.org (Postfix) with ESMTPS id 4hWdlr15Nzz9t6M; Fri, 28 Aug 2026 15:00:24 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandelbit.com; s=MBO0001; t=1787922024; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=l8lYx8FhBw6tw2sTbA1NWOYv3ApdkNUQru8M4LdMFd8=; b=iX890W9McDGM0tbsFXKHHcFRuF2+9uceCwCtwogYNSklm4uDGa2QF5TbocX0our65hMh30 tGEzO3oYZkRZHVEZPE/zGlV1zg/qRkOR0N4+mHGG6PFAZtty3FXKz9HtibXBD6QgspKwVc c/6MmwlzxVRRwVU88kzHu5UoFO9uJl5kajapg3TPr/0uj/CYRYooLbFZi4EPvq7vvSqzRk PKaBNyTz324r5t2L8BDw9GOse8TGSV89YtO9EcPx5uqw21RM/g4pJbdE06MVY82ec/7XeI UXNQnxzApfo384sJLp2b/UvYHkrOiVEH9utOzn1slTeWYmU1lRjbIoU1S+8aYw== Authentication-Results: outgoing_mbo_mout; dkim=none; spf=pass (outgoing_mbo_mout: domain of ralf@mandelbit.com designates 2001:67c:2050:b231:465::102 as permitted sender) smtp.mailfrom=ralf@mandelbit.com From: Ralf Lici To: openvpn-devel@lists.sourceforge.net Date: Fri, 28 Aug 2026 15:00:05 +0200 Message-ID: MIME-Version: 1.0 X-Rspamd-Queue-Id: 4hWdlr15Nzz9t6M X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Hi, This is a respin of the series that enforces explicit policy rules for VPN addresses, taking into account Sabrina's suggestions. In MP mode, ovpn uses peer VPN addresses as lookup keys when selecting the peer for an outgoing packet. The peer configuration path should therefore maintain a few basic invariants around those addres [...] Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid X-Headers-End: 1wzwC9-0003Wg-Ma Subject: [Openvpn-devel] [PATCH ovpn net v2 0/5] ovpn: validate peer VPN addresses X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1874772176301091008 X-GMAIL-MSGID: 1874772176301091008 Hi, This is a respin of the series that enforces explicit policy rules for VPN addresses, taking into account Sabrina's suggestions. In MP mode, ovpn uses peer VPN addresses as lookup keys when selecting the peer for an outgoing packet. The peer configuration path should therefore maintain a few basic invariants around those addresses. This series ensures that cleared addresses are removed from the hash tables, prevents the same address from being assigned to multiple peers, requires every MP peer to have at least one configured VPN address, and rejects addresses that cannot identify a unicast peer. The final patch extends the existing selftests to exercise these rules through both peer creation and update, including transitions between single-stack and dual-stack configurations. Regards, Ralf Lici Mandelbit Srl --- Changes since v1 https://lore.kernel.org/openvpn-devel/cover.1785338921.git.ralf@mandelbit.com/ - Rebased on net/main. - Reworded 2/5 and 3/5 to explain why the newly rejected configurations were never usable/reliable. (Sabrina) - Refactored 2/5 by splitting ovpn_peer_vpn_addr_conflict into two separate helpers for v4 and v6. (Sabrina) - Switched to != htonl(INADDR_ANY) for consistency, rather than !s_addr in 3/5. (Sabrina) Ralf Lici (5): ovpn: always unhash old VPN addresses before rehashing ovpn: reject duplicate peer VPN addresses ovpn: reject multipeer peers without VPN addresses ovpn: reject invalid peer VPN addresses selftests: ovpn: validate peer VPN addresses drivers/net/ovpn/netlink.c | 102 +++++++++++++++++--- drivers/net/ovpn/peer.c | 77 +++++++++++++-- drivers/net/ovpn/peer.h | 6 ++ tools/testing/selftests/net/ovpn/common.sh | 13 +++ tools/testing/selftests/net/ovpn/ovpn-cli.c | 54 +++++++---- tools/testing/selftests/net/ovpn/test.sh | 75 +++++++++++++- 6 files changed, 287 insertions(+), 40 deletions(-) base-commit: 1b78070aaef63512688aebfbc82365ef9d6660f1