From patchwork Wed Jul 29 15:37:42 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ralf Lici X-Patchwork-Id: 5184 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:fd0b:b0:87d:ab56:3700 with SMTP id cw11csp2131978mac; Wed, 29 Jul 2026 08:42:38 -0700 (PDT) X-Forwarded-Encrypted: i=2; AHgh+Rot0qBEljL/R2Zu0sT2P+9swAaxyfpSjSES1WhrmJ94i5ePu3Lfr/Ur4LIrzQ1Lsq8cmaJ0Llz4b3A=@openvpn.net X-Received: by 2002:a05:687c:41c8:20b0:456:b63e:658a with SMTP id 586e51a60fabf-4586cd2820emr2728561fac.18.1785339758294; Wed, 29 Jul 2026 08:42:38 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1785339758; cv=none; d=google.com; s=arc-20260327; b=d5FQFNdwoIZN0zy7WxMcqQ4gfSp8vtO2oBz5xqlpYpefr21iMGNFS+il1AC/iDxpks JRMB7HV9g4zc6DS/kbHeNOPHBvGjkxQTlf7qCeHqLFbojbr17tngVK8fddmtDEfTUlCh y4rZeRWXXXU4+GRFYkBVGYEYAmRA9gh7ZEcsbd9OBqJ+JkJuUD9hQoOcLxw54VaM6unC gtjSQkN4joEVODHot3UQBwXTxw4h9rLjHHAuyj5lUftWjv5p7xd8eK2jLp2vN9AdxGoQ BhP9/Mql8CGvLfv9nr+4VJMiHbjl+mRL5suww7LIk1cZFzeMzi4qZp17kFJVXp8Rfxpd 1/AA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature:dkim-signature; bh=jj/mWuysYByh5XYW82uBnbUvdDoErBPDd7MDWKVZRTk=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=TGO3tz9ry4cOXjjsN5NIj+yxN5tXsb96JLF7tXfOz5RhWULVUmOAnY7CmQx30fSZ/+ ZlBXPCpTMK8nvWpK8yEGJR3yt3qf0WshtkHJIKp+kB0AUSIkmphRSbsQ7z7RVTu5GrtU +XWLdStBdKz6BK8l6hLJvHYlXBYujNoRQ2r59mpJY34lCLiVt3SOMPwkH4cBTn6Af65V g6QnZ72AYwHxLOsdIAobI3qt2R+e9/V9AX5Be5KBrqQY6GcFLq9zdK/6zqTqbNz24sQJ 9lGshnYEAJF19U5MhBVibZswOVK5Yr6XFUZ5+FvvO9tqfOkVHm5G5Pf8W2zbS3jbKYfX mHpA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=DZO+CFfi; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=IsfABJ16; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=YWYrjhto; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=SIV4qATO; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 586e51a60fabf-45886c41accsi2780491fac.313.2026.07.29.08.42.38 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 29 Jul 2026 08:42:38 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=DZO+CFfi; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=IsfABJ16; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=YWYrjhto; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=SIV4qATO; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=jj/mWuysYByh5XYW82uBnbUvdDoErBPDd7MDWKVZRTk=; b=DZO+CFfiHemSOV90yMDnXtTrpt YL4Du+pTIdsZClc8f/+BZOuwVq/JNxAmUrupX8l2X+yHB4l/SgrAML83ICCmkpEmYZJ8+baMpVfAJ naVsFFzEwfxTzm4cnk3kiczP/8tBLGIxF7JekHUXYKzbLZYSxgP6zz7/yDwdnAprAG2M=; Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1wp6QV-0002WU-7m; Wed, 29 Jul 2026 15:42:35 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1wp6QG-0002Vr-1C for openvpn-devel@lists.sourceforge.net; Wed, 29 Jul 2026 15:42:20 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=gkiR86nWJ5KqIffl2XADuoX6NqgPodYASX0slnIbrSs=; b=IsfABJ168zCTwXzdtc+LpxCiIm 3icEO2btCPsFd9Qt4Oiyq3sD5gS5CCaSiMkFwTOuLS44/DrbkKmcb9bPteVaLCMsCGh5hnkDhG8lv qOW/Yoq1yQ7XaCd7OwBaNubgYO8uGK63GiHiMFlo5tGw6esxPQICPxfMpLDNYAeSTYq4=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=gkiR86nWJ5KqIffl2XADuoX6NqgPodYASX0slnIbrSs=; b=YWYrjhtoeZe4EdbcCZh46AHWFv qXDfi6tkZEQwnEc/DP8DyrPhQ4wVLs/fmDEK01vfftJa27jRrIToaEnew1OoNV9WcOQv6aHDn7Q48 bnjoJluAZcpR8A22FcpGdJwOpiH96tphrIuKd7e070XksqQxl0H12j8bPK5HiNLvNRTA=; Received: from mout-b-107.mailbox.org ([195.10.208.47]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1wp6QF-0002u5-7O for openvpn-devel@lists.sourceforge.net; Wed, 29 Jul 2026 15:42:19 +0000 Received: from smtp2.mailbox.org (unknown [10.196.197.2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-b-107.mailbox.org (Postfix) with ESMTPS id 4h9GmM368sz3y60; Wed, 29 Jul 2026 17:42:11 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandelbit.com; s=MBO0001; t=1785339731; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=gkiR86nWJ5KqIffl2XADuoX6NqgPodYASX0slnIbrSs=; b=SIV4qATOqdw7Y+vc4QdGXW+eBDn9M9eZ/GXjkvbawug50GzLIIl9Q+xnxAIZK14RsuC1WK BlOrI50lr6hTGDs26yab88VQEQt65O94d1nFnWVFqCXXNBQFvt2JhPdpiiqyXRtY82f0XD 0dJOB7iOMNIs7HmLRU/ipLBU+4fe1ZSQZndyRcPThJAdkjZnIniT4xLukzbvNnYEX+I3cu wUNblq9dyIi6C2xDdOZifEwxTtFcBHDFqlDuLh+TwLEK96fkRwAimGMXXHZgIM8/FOgUQ0 V2lgW6lnPGlb/ZXUYbQL8STlHvf5JScLGg/f9udww2LeGbJfaT5BCyzxzjedPg== From: Ralf Lici To: openvpn-devel@lists.sourceforge.net Date: Wed, 29 Jul 2026 17:37:42 +0200 Message-ID: <934f840c132e350415369712806b3d9d77957ca5.1785338921.git.ralf@mandelbit.com> In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: In MP mode, ovpn uses peer VPN addresses as lookup keys for selecting the peer that should receive outgoing tunnel packets. The netlink configuration path currently accepts address values that cannot [...] Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature X-Headers-End: 1wp6QF-0002u5-7O Subject: [Openvpn-devel] [PATCH ovpn net 4/5] ovpn: reject invalid peer VPN addresses X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1872064422687290893 X-GMAIL-MSGID: 1872064422687290893 In MP mode, ovpn uses peer VPN addresses as lookup keys for selecting the peer that should receive outgoing tunnel packets. The netlink configuration path currently accepts address values that cannot sensibly identify a VPN peer, such as multicast, broadcast or loopback addresses. Reject invalid peer VPN addresses when creating or updating an MP peer. Keep accepting the unspecified address as the internal unset value, provided that at least one VPN address family remains configured. Fixes: 1d36a36f6d53 ("ovpn: implement peer add/get/dump/delete via netlink") Signed-off-by: Ralf Lici --- drivers/net/ovpn/netlink.c | 50 ++++++++++++++++++++++++++++++-------- 1 file changed, 40 insertions(+), 10 deletions(-) diff --git a/drivers/net/ovpn/netlink.c b/drivers/net/ovpn/netlink.c index 43e6c7a29a6f..333e9237e594 100644 --- a/drivers/net/ovpn/netlink.c +++ b/drivers/net/ovpn/netlink.c @@ -179,6 +179,39 @@ static sa_family_t ovpn_nl_family_get(struct nlattr *addr4, return AF_UNSPEC; } +static int ovpn_nl_peer_check_vpn_addrs(const struct in_addr *addr4, + const struct in6_addr *addr6, + struct genl_info *info) +{ + int addr6_type; + + if (addr4->s_addr == htonl(INADDR_ANY) && ipv6_addr_any(addr6)) { + NL_SET_ERR_MSG_MOD(info->extack, + "at least one VPN IP must be configured"); + return -EINVAL; + } + + if (ipv4_is_multicast(addr4->s_addr) || ipv4_is_lbcast(addr4->s_addr) || + ipv4_is_loopback(addr4->s_addr)) { + NL_SET_ERR_MSG_MOD(info->extack, + "VPN IPv4 address must be valid unicast or any"); + return -EADDRNOTAVAIL; + } + + if (!ipv6_addr_any(addr6)) { + addr6_type = ipv6_addr_type(addr6); + + if (!(addr6_type & IPV6_ADDR_UNICAST) || + (addr6_type & (IPV6_ADDR_LOOPBACK | IPV6_ADDR_COMPATv4))) { + NL_SET_ERR_MSG_MOD(info->extack, + "VPN IPv6 address must be valid unicast or any"); + return -EADDRNOTAVAIL; + } + } + + return 0; +} + static int ovpn_nl_peer_precheck(struct ovpn_priv *ovpn, struct genl_info *info, struct nlattr **attrs) @@ -381,11 +414,10 @@ int ovpn_nl_peer_new_doit(struct sk_buff *skb, struct genl_info *info) vpn_addr6 = nla_get_in6_addr(attrs[OVPN_A_PEER_VPN_IPV6]); - if (!vpn_addr4.s_addr && ipv6_addr_any(&vpn_addr6)) { - NL_SET_ERR_MSG_FMT_MOD(info->extack, - "VPN IP must be provided in MP mode"); - return -EINVAL; - } + ret = ovpn_nl_peer_check_vpn_addrs(&vpn_addr4, &vpn_addr6, + info); + if (ret < 0) + return ret; } peer_id = nla_get_u32(attrs[OVPN_A_PEER_ID]); @@ -547,12 +579,10 @@ int ovpn_nl_peer_set_doit(struct sk_buff *skb, struct genl_info *info) /* in MP mode VPN IPs are required for selecting the right peer */ if (ovpn->mode == OVPN_MODE_MP && (attrs[OVPN_A_PEER_VPN_IPV4] || attrs[OVPN_A_PEER_VPN_IPV6])) { - if (!vpn_addr4.s_addr && ipv6_addr_any(&vpn_addr6)) { - NL_SET_ERR_MSG_FMT_MOD(info->extack, - "MP peer must have at least one valid VPN IP"); - ret = -EINVAL; + ret = ovpn_nl_peer_check_vpn_addrs(&vpn_addr4, &vpn_addr6, + info); + if (ret < 0) goto unlock; - } /* reject peer with conflicting VPN address */ if (ovpn_peer_vpn_addr_conflict(ovpn, peer, &vpn_addr4,