From patchwork Fri Aug 28 13:00:09 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ralf Lici X-Patchwork-Id: 5289 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:2a5c:b0:87d:ab56:3700 with SMTP id l28csp1142028maz; Fri, 28 Aug 2026 06:01:15 -0700 (PDT) X-Forwarded-Encrypted: i=2; AHgh+RpjjjXJSJozu23J6+/Q4J/1Z+AuiR7nONTUY1JANvblM6CBkKt+5pnZGjQeiS/pUNgAkkrfX87jmLk=@openvpn.net X-Received: by 2002:a05:6808:c173:b0:492:c9a4:2104 with SMTP id 5614622812f47-4b37c999474mr11817180b6e.10.1787922074713; Fri, 28 Aug 2026 06:01:14 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1787922074; cv=none; d=google.com; s=arc-20260327; b=jG9USipZQjQvMnoW5pX/iq2tZiutbYkEidpx5+cuu8eXCBq6kqklKmoJUVL8gzjHVE bkP3rUxpJdm3hbY8T2gKJ87HeO4p9s2GUl+el4KEEkS5qUMEekyc/H9OXuEZVDAOd01W feTtYRhrad4wyC4/4cuSk/MNHyx6J47TQ8ZglhZA3BqSNFJJURNviVVcs6jD8Q0lDXjC NxceA8jnNXE4/V0WR15aHsJbMoh0pmy0NL8scgnCAGBxGJnueRl9NoS0bhUImupQ/6Rp Dw2nbxdT4pEb1uW3zJZ5VH3L9Hd9+oExmpIg7nUAqwWPVlCLx9Uyvk/F3bfi5Ov2i5Ha +ZKA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature:dkim-signature; bh=1l+znuyS9Iq2X8+ZUk55dxxrAhapFh0acSpaa5HkgLw=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=l9FDPy5YNZyoup2SBbW7iofm4mo70GwTWi87Z6qj0a//SqvJSeRWf60K3LOl1C2+0k WCpNB3w3ZNXF4c9gSopSRue3DrlgrectqghO7n4UBAFxX9f+kXSZI9zfELgpBaV4cA2Y KGHTRNQURSSJsSP3eqyNHso/xCCaQW2hKRGzvJvBk5HTeuKiauRRRPiojhn7bTzaWTn0 VBO+S/BHrXglzR+AssoDrrZ8Clw2AoNDqww1fmzLOLK+3nSgNdMQeDOfK1BVs1Byqj3a d3tv3mmkvBcheIfO7mIp4iysoCgfQbOw8f67gsndegRyW0+W5OzWbjsjBKmfriUJBzv6 ZGKg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=A8ZERpLe; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=Zwb1iDyM; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=WQtq3vEi; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=Swe3vX+2; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 5614622812f47-4b3a1bc832asi2029383b6e.130.2026.08.28.06.01.14 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Fri, 28 Aug 2026 06:01:14 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=A8ZERpLe; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=Zwb1iDyM; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=WQtq3vEi; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=Swe3vX+2; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=1l+znuyS9Iq2X8+ZUk55dxxrAhapFh0acSpaa5HkgLw=; b=A8ZERpLeuxx4j3jXSCnUHzQbVj CFyCVj6UjVLSc2s7vVvnXmqI/83WwtLMUL9dfNRWeDujEaRB892dcYdnbkB5vS84LjKk5DX6m2Tsx vq6H7hA1W6PbSLpE+grwuOUs+8PwOrI/TR8ghTpljzz3/AjpMfsnFAdpa8giFUSAAnkU=; Received: from [127.0.0.1] (helo=sfs-ml-3.v29.lw.sourceforge.com) by sfs-ml-3.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1wzwCj-0001b4-7H; Fri, 28 Aug 2026 13:01:09 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-3.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1wzwCM-0001aM-JL for openvpn-devel@lists.sourceforge.net; Fri, 28 Aug 2026 13:00:48 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=l3kKVzpsCJJNFGYtCfLWekadyfB69gwfvzgBALJzdSw=; b=Zwb1iDyMXgw6n0g4VcrPDEGztn lM3WSjscl/9bpEPq6zhtPTdSdJ0NxtYU9Uo8JioVN+LTC39SsCRX8/eHzBohHZHpwI6NpcnOLHZ9a aJwfQgrIkfEp+Rpoe/AniJwcs8MxrsQqn5kdp5dj6TBmk8szxmC8OsnhYepMNyUt9sDA=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=l3kKVzpsCJJNFGYtCfLWekadyfB69gwfvzgBALJzdSw=; b=WQtq3vEiUUYP0HunglGQBnnYBD 42gmcMnMoSrcYvt3wpkzcJ3JxTcVLKj42EF6wW2tlZExIC5ivB0876chvTLTVGpNdaYsW3tEcP7cD 9rUxTjsI1vVuy+twFz3e1+eTJ/FgHaJ3bS4hy1FfK2Fcf3nrNMBL8MoMjB/OUa3DIRPM=; Received: from mout-b-112.mailbox.org ([195.10.208.42]) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1wzwCH-0003Ww-7C for openvpn-devel@lists.sourceforge.net; Fri, 28 Aug 2026 13:00:45 +0000 Received: from smtp102.mailbox.org (smtp102.mailbox.org [10.196.197.102]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-b-112.mailbox.org (Postfix) with ESMTPS id 4hWdlx2S8Pz5wPq; Fri, 28 Aug 2026 15:00:29 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandelbit.com; s=MBO0001; t=1787922029; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=l3kKVzpsCJJNFGYtCfLWekadyfB69gwfvzgBALJzdSw=; b=Swe3vX+2qqRES9i5QHz1w9BqUrRwOXIYf9fhPByes6If/YazAoUf3wyVpdCsE+aH5GNyGP skjx6x3lXo3KxoCFfL75aNovUEcS0FgkhgLtqxOnekxDTe806um638UrS4XzYvWRyXrwaB t+O599tP9nsCQsfLJ25hPZG1ZwNuZnf14pPn7dHHdnHcEK5gdbKPNNIJ/v60mfR0nO8tFy 19/OH3DNFSDpEw9abLKnubM4JyTPUA+lQCAMqiIKrKqUzTQaa+XKSn40aVXmh8CSX7TvzT s7XEUnCWeKpXqzyZLknpkcP0ekrJFZN/oZ23fvO1LSYg1+M+No7jdVoRoatvbA== From: Ralf Lici To: openvpn-devel@lists.sourceforge.net Date: Fri, 28 Aug 2026 15:00:09 +0200 Message-ID: <1bddf9d3f19e8d74d831526e9ce80182bcfcab73.1787919082.git.ralf@mandelbit.com> In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-1.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: In MP mode, ovpn uses peer VPN addresses as lookup keys for selecting the peer that should receive outgoing tunnel packets. The netlink configuration path currently accepts address values that cannot [...] Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid X-Headers-End: 1wzwCH-0003Ww-7C Subject: [Openvpn-devel] [PATCH ovpn net v2 4/5] ovpn: reject invalid peer VPN addresses X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1874772177544476880 X-GMAIL-MSGID: 1874772177544476880 In MP mode, ovpn uses peer VPN addresses as lookup keys for selecting the peer that should receive outgoing tunnel packets. The netlink configuration path currently accepts address values that cannot sensibly identify a VPN peer, such as multicast, broadcast or loopback addresses. Reject invalid peer VPN addresses when creating or updating an MP peer. Keep accepting the unspecified address as the internal unset value, provided that at least one VPN address family remains configured. Fixes: 1d36a36f6d53 ("ovpn: implement peer add/get/dump/delete via netlink") Signed-off-by: Ralf Lici --- Changes since v1 https://lore.kernel.org/openvpn-devel/934f840c132e350415369712806b3d9d77957ca5.1785338921.git.ralf@mandelbit.com/ - Adapted to changes in 2/5 and 3/5; no behavioral changes. drivers/net/ovpn/netlink.c | 55 +++++++++++++++++++++++++++++--------- 1 file changed, 42 insertions(+), 13 deletions(-) diff --git a/drivers/net/ovpn/netlink.c b/drivers/net/ovpn/netlink.c index a0ed09278a6b..e9fef784dfc1 100644 --- a/drivers/net/ovpn/netlink.c +++ b/drivers/net/ovpn/netlink.c @@ -179,6 +179,39 @@ static sa_family_t ovpn_nl_family_get(struct nlattr *addr4, return AF_UNSPEC; } +static int ovpn_nl_peer_check_vpn_addrs(const struct in_addr *addr4, + const struct in6_addr *addr6, + struct genl_info *info) +{ + int addr6_type; + + if (addr4->s_addr == htonl(INADDR_ANY) && ipv6_addr_any(addr6)) { + NL_SET_ERR_MSG_MOD(info->extack, + "at least one VPN IP must be configured in MP mode"); + return -EINVAL; + } + + if (ipv4_is_multicast(addr4->s_addr) || ipv4_is_lbcast(addr4->s_addr) || + ipv4_is_loopback(addr4->s_addr)) { + NL_SET_ERR_MSG_MOD(info->extack, + "VPN IPv4 address must be valid unicast or any"); + return -EADDRNOTAVAIL; + } + + if (!ipv6_addr_any(addr6)) { + addr6_type = ipv6_addr_type(addr6); + + if (!(addr6_type & IPV6_ADDR_UNICAST) || + (addr6_type & (IPV6_ADDR_LOOPBACK | IPV6_ADDR_COMPATv4))) { + NL_SET_ERR_MSG_MOD(info->extack, + "VPN IPv6 address must be valid unicast or any"); + return -EADDRNOTAVAIL; + } + } + + return 0; +} + static int ovpn_nl_peer_precheck(struct ovpn_priv *ovpn, struct genl_info *info, struct nlattr **attrs) @@ -381,12 +414,10 @@ int ovpn_nl_peer_new_doit(struct sk_buff *skb, struct genl_info *info) vpn_addr6 = nla_get_in6_addr(attrs[OVPN_A_PEER_VPN_IPV6]); - if (vpn_addr4.s_addr == htonl(INADDR_ANY) && - ipv6_addr_any(&vpn_addr6)) { - NL_SET_ERR_MSG_FMT_MOD(info->extack, - "at least one VPN IP must be configured in MP mode"); - return -EINVAL; - } + ret = ovpn_nl_peer_check_vpn_addrs(&vpn_addr4, &vpn_addr6, + info); + if (ret < 0) + return ret; } peer_id = nla_get_u32(attrs[OVPN_A_PEER_ID]); @@ -552,13 +583,11 @@ int ovpn_nl_peer_set_doit(struct sk_buff *skb, struct genl_info *info) } /* in MP mode VPN IPs are required for selecting the right peer */ - if (ovpn->mode == OVPN_MODE_MP && - vpn_addr4.s_addr == htonl(INADDR_ANY) && - ipv6_addr_any(&vpn_addr6)) { - NL_SET_ERR_MSG_FMT_MOD(info->extack, - "at least one VPN IP must be configured in MP mode"); - ret = -EINVAL; - goto unlock; + if (ovpn->mode == OVPN_MODE_MP) { + ret = ovpn_nl_peer_check_vpn_addrs(&vpn_addr4, &vpn_addr6, + info); + if (ret < 0) + goto unlock; } ret = ovpn_nl_peer_modify(peer, info, attrs);