From patchwork Tue Jul 28 15:50:11 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ralf Lici X-Patchwork-Id: 5150 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:fd0b:b0:87d:ab56:3700 with SMTP id cw11csp806159mac; Tue, 28 Jul 2026 08:50:47 -0700 (PDT) X-Forwarded-Encrypted: i=2; AHgh+RqLzdGZV4FjOWgrN86dM3BtEoY12zLJOsVOx/IN3sZyauP72nhE7cYyUE0h5Ix7iuPrQy3jA8ewqyU=@openvpn.net X-Received: by 2002:a05:6830:67d8:b0:7e6:e1d2:3bd0 with SMTP id 46e09a7af769-7efff0df270mr1625081a34.10.1785253847556; Tue, 28 Jul 2026 08:50:47 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1785253847; cv=none; d=google.com; s=arc-20260327; b=NNliB5T7DUonL9OboIEWB3HlFWI7qMzM//xSE4g4J9Cmw1RDlxkzaWXPb2/orcYRTT U516SPHjVN8XnQGZsKXBAC1kXgUePN2bUo86cS/QgjUkAv5cU5ubWeXUgOpPkikTwZ9o 9cGhjlGrBhGBaPT6VVU/CXzOh4pg3YwnDbq40Jvy9rI+Y05N2YZHXm7GP2mXoCPwnn7b o5TWCvo0jVG7+55lQGxZNXK/wgOJ2w08Y1rqgkIm8ClZyXmi0Lhnlz5nt5NmlGfHB9o0 Xio/eBM3IpCf6mo05ZbaQlqmcwpQAgHIjbKvU5/Rvce6VT3RQ1VBzXfJN0k3GJWIP2jD fd6w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature:dkim-signature; bh=VzBUHeVkeT7BjJODdYr3iLIx+16OAfSSM60E7zIbo8s=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=YZZLgu59DFsVumG3kKXvP5gOgGlb22mP2jyEU3AYaarB2RHE9SDolG8lp1aYTCEZYF EH6ne6xPZWqJHfiToV1HgH1fJRUIAZ6t8xr2yqka/rm9XpXv9NAb8APQJdw78Iss0jkt FFPUp/zo7a5rx95kgHrcN+lXwbYeXPxJYvMWQEiLpszIfM/KCExZRw9eej8YNZK7mXdz 8u7CQnynSrkahtVtp9vH/ocNdAqDam8uAIoNfn0WHmeSUqRCh9p8die9MJUiDWmn9F69 nKcsjtuyHHUuB243Ipx5uN7fgJx1d9UyWb0P8cJA3JntiwCaUQ9VocSjJfPJ+crf1M0H Hidw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=e9r+jDAE; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=ktitMwWX; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=f7PZNXJC; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=kDiJusjY; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 46e09a7af769-7f00da0c478si27073a34.72.2026.07.28.08.50.47 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 28 Jul 2026 08:50:47 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=e9r+jDAE; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=ktitMwWX; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=f7PZNXJC; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=kDiJusjY; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=VzBUHeVkeT7BjJODdYr3iLIx+16OAfSSM60E7zIbo8s=; b=e9r+jDAEHN8cGmhA5XdGei9aRM rtIHtkLmK1Va2l5ePmtEhrw91iQikkyuAP700RM0SPanmJAseZ2FsuMkm2AUPRE9HkK8GgJVLWUZK 7ORRiBrYuVA+x0w6pNb3Rf0N2kBgUG7gLCQN7St+WkJuRFQJGTHvwVa8zhEKjkjnStB0=; Received: from [127.0.0.1] (helo=sfs-ml-3.v29.lw.sourceforge.com) by sfs-ml-3.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1wok4n-000316-Ju; Tue, 28 Jul 2026 15:50:42 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-3.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1wok4k-00030w-Vl for openvpn-devel@lists.sourceforge.net; Tue, 28 Jul 2026 15:50:40 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=Ugkvjvevx4m9D1KSWtMsQVP4RsNSZmE4wESHbgcDJg0=; b=ktitMwWXQJl2gcOrXEOGw6f3V/ tmtu60uglYFFeuLYM4oAfI7aGp9YL6ebVWMXeWbPYXB4BNhvGCkbE7cTf8IfNSADx/6sOCEkHzWxK 8w4IjkI6/PkSBkL3Jiuo/WlguOqBQ8ZjOfyGRogZI7pZc4V1KrspsTBBn2MUNWhqIeZM=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=Ugkvjvevx4m9D1KSWtMsQVP4RsNSZmE4wESHbgcDJg0=; b=f7PZNXJCalgJVK2apw04GC8Ont aArULoA3WI7soq4peXb2hCBXasqKkrgHidmqwpnUbgmtQY9wMLwPlxORD6kWQ8njZtSGNDYUt+D8a 3URrbLYMn3GTIw58Wq0hZHb6AEY/H609Ba1iskxgyxZBki9Gbat67Mo5XIRxvpPP6Uek=; Received: from mout-b-110.mailbox.org ([195.10.208.55]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1wok4k-00027M-By for openvpn-devel@lists.sourceforge.net; Tue, 28 Jul 2026 15:50:39 +0000 Received: from smtp202.mailbox.org (smtp202.mailbox.org [IPv6:2001:67c:2050:b231:465::202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-b-110.mailbox.org (Postfix) with ESMTPS id 4h8g0Q4G2BzNlfb; Tue, 28 Jul 2026 17:50:30 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandelbit.com; s=MBO0001; t=1785253830; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Ugkvjvevx4m9D1KSWtMsQVP4RsNSZmE4wESHbgcDJg0=; b=kDiJusjYd0Jm4ggFTmwRf3z6c6sc0BxkVrKinmKWYuhmk7iafzKm5BgnWzb4dPBc+rVZNc 7GriZ8ftFXzKVhAVYaXQf8ZRusuB1AeLqu5KK/uubDaX8ZYUFhR+N267/q5yYitCnXODku NSS5/TymExPR3jTQt6JSoUuEauYOeBN1o25v1WtlKq4EBiJALDFhBr8ogUb3G8cPytoXbQ pwkfrZ+E6dyeDI6WgQpncohPeV6JrOyA6dgfmp/dx7zHJv22V32uNHwtRNTeM62ns+kZYc 3YvISMTp8q/MytzxYcCVwK4op+QxWg/S4aoqLHV2p/VQ/kxh8f0o1KtK1LtDfw== Authentication-Results: outgoing_mbo_mout; dkim=none; spf=pass (outgoing_mbo_mout: domain of ralf@mandelbit.com designates 2001:67c:2050:b231:465::202 as permitted sender) smtp.mailfrom=ralf@mandelbit.com From: Ralf Lici To: openvpn-devel@lists.sourceforge.net Date: Tue, 28 Jul 2026 17:50:11 +0200 Message-ID: <87f7c1a6eea0005a067889e9b6f73fc6bd4f40e1.1785253480.git.ralf@mandelbit.com> In-Reply-To: References: MIME-Version: 1.0 X-Rspamd-Queue-Id: 4h8g0Q4G2BzNlfb X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-1.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: ovpn accepts OVPN_A_PEER_REMOTE_IPV6_SCOPE_ID and reports bind->remote.in6.sin6_scope_id in peer dumps, but the netlink endpoint parser never copied the attribute into the sockaddr_in6 used to create [...] Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature X-Headers-End: 1wok4k-00027M-By Subject: [Openvpn-devel] [PATCH ovpn net 1/5] ovpn: preserve IPv6 scope id for netlink peer endpoints X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1871974337934050586 X-GMAIL-MSGID: 1871974337934050586 ovpn accepts OVPN_A_PEER_REMOTE_IPV6_SCOPE_ID and reports bind->remote.in6.sin6_scope_id in peer dumps, but the netlink endpoint parser never copied the attribute into the sockaddr_in6 used to create or update the peer bind. As a result, an IPv6 link-local remote endpoint configured through netlink loses its interface scope, unlike on the peer float path where ipv6_iface_scope_id populates the field. The UDPv6 output path then builds a flow with flowi6_oif set to zero and route lookup can fail or select the wrong interface. Copy the scope id when parsing non-v4-mapped IPv6 remote endpoints. The existing precheck already rejects the scope-id attribute for IPv4 and v4-mapped IPv6 remotes. Fixes: 1d36a36f6d53 ("ovpn: implement peer add/get/dump/delete via netlink") Signed-off-by: Ralf Lici --- drivers/net/ovpn/netlink.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/ovpn/netlink.c b/drivers/net/ovpn/netlink.c index 291e2e5bb450..883a28d69d8e 100644 --- a/drivers/net/ovpn/netlink.c +++ b/drivers/net/ovpn/netlink.c @@ -100,6 +100,8 @@ static bool ovpn_nl_attr_sockaddr_remote(struct nlattr **attrs, struct sockaddr_in6 *sin6; struct sockaddr_in *sin; struct in6_addr *in6; + struct nlattr *scope; + u32 scope_id = 0; __be16 port = 0; __be32 *in; @@ -114,6 +116,9 @@ static bool ovpn_nl_attr_sockaddr_remote(struct nlattr **attrs, } else if (attrs[OVPN_A_PEER_REMOTE_IPV6]) { ss->ss_family = AF_INET6; in6 = nla_data(attrs[OVPN_A_PEER_REMOTE_IPV6]); + scope = attrs[OVPN_A_PEER_REMOTE_IPV6_SCOPE_ID]; + if (scope) + scope_id = nla_get_u32(scope); } else { return false; } @@ -126,6 +131,7 @@ static bool ovpn_nl_attr_sockaddr_remote(struct nlattr **attrs, if (!ipv6_addr_v4mapped(in6)) { sin6 = (struct sockaddr_in6 *)ss; sin6->sin6_port = port; + sin6->sin6_scope_id = scope_id; memcpy(&sin6->sin6_addr, in6, sizeof(*in6)); break; } From patchwork Tue Jul 28 15:50:12 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ralf Lici X-Patchwork-Id: 5151 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:fd0b:b0:87d:ab56:3700 with SMTP id cw11csp806165mac; Tue, 28 Jul 2026 08:50:48 -0700 (PDT) X-Forwarded-Encrypted: i=2; AHgh+RqfoxJlQa/bokv5uj+G9dgXInTXbRpd1/wPoNHpFpyqyOBDdbop7AVij57Xi/T+NygGYHEJOruhYeE=@openvpn.net X-Received: by 2002:a05:6830:8389:b0:7e6:cfd0:42de with SMTP id 46e09a7af769-7efff247f64mr1589310a34.15.1785253847753; Tue, 28 Jul 2026 08:50:47 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1785253847; cv=none; d=google.com; s=arc-20260327; b=rtHZYcxlKVEcSAYxg5f8/W4rxl8UYhSVfHhUhHp3f7V84jTUp7d/3fmpH74bRA2+F1 46OirdPpyIYVYqhi0Q4dTLUFI6RleDSKxFPiyvrZ6DgoEbW62HOcdwUKZvl0jFwACib3 3RHTh+AyjT5R5CLQ09kkMd9PeED5FreYXuFKMHa4YbhWODJrbbLkYOWG2855Qk+6rC/T 7LOsbRS6pmW222N8992lWbUxQwCe83QQMhIRxTkH0grJU262hZtho2qK/H65BHjJnZSu 0X1mPNW4YqV8JpeKp3kmoz7emhuaxJsUI+FZl0AjO72AoftswWj7lhA8rnEFbqHxakL9 G3cQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature:dkim-signature; bh=2lbSjbl2tjujzETWgMO75R0nGRuM614xzT3wzcX5CXQ=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=ABChGyCqP101zPVr8seV9WEWm+8KvX2WcEL4T2jVyVexuuwSMwxc3LdF2Tsd6ogmoH Ba1/Tq8oVm6yzBwcWgbSTkzSTkcfj67bfQIH8I3oxkGVuEWCro2lm6LSE5IPB113Vfvw td9Y5BhZ8dYhagQxu868vrD/TI9kErLQ0ACrXBklJLaCX9Oa4X1OLOMLpDv80zRAxQMH EufrCb/taWhYQG0v7HewjlUpYt9LuzUyNAXFXnoM53erzUDt30bB8crXCMGiMl5qoV+Z zBfj+m7bLseZsHNyxxd79oaF5c6OPbWulhO3VCPF06m0dmHv/xCK7wE+aN+8DquM9Eb6 OzIg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=JOuc0ZV8; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=lPeE36H1; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=PuKcrOXG; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=Yo2UgsXI; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 46e09a7af769-7f00d66b7casi48820a34.53.2026.07.28.08.50.47 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 28 Jul 2026 08:50:47 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=JOuc0ZV8; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=lPeE36H1; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=PuKcrOXG; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=Yo2UgsXI; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=2lbSjbl2tjujzETWgMO75R0nGRuM614xzT3wzcX5CXQ=; b=JOuc0ZV8r2uxoav5rZ3MYUOj2f c7BdAhQJJdOLjnp6Jih5T+aDVDQlJdOaPdQUeGrtxzve4AgkEgu0OiotdEE8rV2IuR2G8kHCk+oMW 7OehZlEQJga9aBObtMQN2wPAZQkZOGyB6lCCL2cZzfUkm23J4pAiu4i3Phk2cT9R4rTE=; Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1wok4o-0007yd-Sz; Tue, 28 Jul 2026 15:50:42 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1wok4n-0007yV-0u for openvpn-devel@lists.sourceforge.net; Tue, 28 Jul 2026 15:50:41 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=/lAS7AeX2AF9eFFaDtOcSZRextZWWfNUwogcEusO2yM=; b=lPeE36H1NgwUs95vJGQ0clF7Gu wLiWsiVo3yQ7qsdm4Bh+PhkUDIdXSjce077ni+572Lnj8uStT2so7FWKqXd6oYm14mMBsp2DgS2gb eAS4aZstBRhToi6ubKQb+QGNNO6gz/MWSv7HOl8QfRXYUMxX7wbsLOj6ntjwrE9rw+J4=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=/lAS7AeX2AF9eFFaDtOcSZRextZWWfNUwogcEusO2yM=; b=PuKcrOXGlOD1VZf6IUY4RA2FH1 DyJX+HXTw0BhscrwyWghlwcl0WqyjcXmfi70YElM8QeR9qcqJ8w9oD3HGvvllirkqsLc9GaQ0aIrE xoAL6ezz63R7101SYt2oIfRQJ4ZluRXL2Sz50E7saIIop0KPc3gkwDM28hksY082FFPc=; Received: from mout-b-110.mailbox.org ([195.10.208.55]) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1wok4o-00026e-PB for openvpn-devel@lists.sourceforge.net; Tue, 28 Jul 2026 15:50:40 +0000 Received: from smtp202.mailbox.org (smtp202.mailbox.org [IPv6:2001:67c:2050:b231:465::202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-b-110.mailbox.org (Postfix) with ESMTPS id 4h8g0R21w9zNlj8; Tue, 28 Jul 2026 17:50:31 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandelbit.com; s=MBO0001; t=1785253831; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=/lAS7AeX2AF9eFFaDtOcSZRextZWWfNUwogcEusO2yM=; b=Yo2UgsXILPEpgGcHbegN0iTVRLjD0mLhm33ArNvkvdru7vE8SDwLwnYW9oxDb1UjoRo/wz EZoY5RNZI9jyq6rRGcwWX27NYWTLFFvquTUYyOlh5nVLcTqtBfBUOULjeIMMZKDoroN92e u+5xnMS/L3fzIpl43BGjCc7ggDLOu4LgF6t98iLeLdLzZ3cxbmj+x8UhYzjKRvdEo1ZF2J dFgAEtAfC53UudWM3Fs0QwC7tQ3dL6e9Q1YZAj/r6w8sGi2LFqNCrnoCDwk1S8S30qD0Sm meVbSdW3VgUDqmf1W1lCsv9rxocP3LxsDuYxM5C5k/t7wj27CPvL0tY53xfB2g== Authentication-Results: outgoing_mbo_mout; dkim=none; spf=pass (outgoing_mbo_mout: domain of ralf@mandelbit.com designates 2001:67c:2050:b231:465::202 as permitted sender) smtp.mailfrom=ralf@mandelbit.com From: Ralf Lici To: openvpn-devel@lists.sourceforge.net Date: Tue, 28 Jul 2026 17:50:12 +0200 Message-ID: In-Reply-To: References: MIME-Version: 1.0 X-Rspamd-Queue-Id: 4h8g0R21w9zNlj8 X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-1.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: ovpn validates the cached local UDP source address before reusing or refreshing a peer dst cache. This is only meaningful when a concrete source address is selected. For IPv6, calling ipv6_chk_addr with :: checks whether the unspecified address itself is configured on the host. A peer may legitimately have bind->local.ipv6 set to :: when no local endpoint was conf [...] Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature X-Headers-End: 1wok4o-00026e-PB Subject: [Openvpn-devel] [PATCH ovpn net 2/5] ovpn: skip UDP source validation for unspecified addresses X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1871974338924995155 X-GMAIL-MSGID: 1871974338924995155 ovpn validates the cached local UDP source address before reusing or refreshing a peer dst cache. This is only meaningful when a concrete source address is selected. For IPv6, calling ipv6_chk_addr with :: checks whether the unspecified address itself is configured on the host. A peer may legitimately have bind->local.ipv6 set to :: when no local endpoint was configured or after a stale learned address was cleared. In that case the source should be left unspecified and selected by ip6_dst_lookup_flow(). For IPv4, inet_confirm_addr(..., local = 0, ...) asks for local address autoselection rather than validating a chosen source. Skip the precheck there as well and let ip_route_output_flow select or reject the source. Only validate non-zero/non-any source addresses. Fixes: 08857b5ec5d9 ("ovpn: implement basic TX path (UDP)") Signed-off-by: Ralf Lici --- drivers/net/ovpn/udp.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/net/ovpn/udp.c b/drivers/net/ovpn/udp.c index 493a5a0744af..eb342c7eef29 100644 --- a/drivers/net/ovpn/udp.c +++ b/drivers/net/ovpn/udp.c @@ -161,8 +161,8 @@ static int ovpn_udp4_output(struct ovpn_peer *peer, struct ovpn_bind *bind, if (rt) goto transmit; - if (unlikely(!inet_confirm_addr(sock_net(sk), NULL, 0, fl.saddr, - RT_SCOPE_HOST))) { + if (fl.saddr && unlikely(!inet_confirm_addr(sock_net(sk), NULL, 0, + fl.saddr, RT_SCOPE_HOST))) { /* we may end up here when the cached address is not usable * anymore. In this case we reset address/cache and perform a * new look up @@ -238,7 +238,8 @@ static int ovpn_udp6_output(struct ovpn_peer *peer, struct ovpn_bind *bind, if (dst) goto transmit; - if (unlikely(!ipv6_chk_addr(sock_net(sk), &fl.saddr, NULL, 0))) { + if (!ipv6_addr_any(&fl.saddr) && + unlikely(!ipv6_chk_addr(sock_net(sk), &fl.saddr, NULL, 0))) { /* we may end up here when the cached address is not usable * anymore. In this case we reset address/cache and perform a * new look up From patchwork Tue Jul 28 15:50:13 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ralf Lici X-Patchwork-Id: 5153 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:fd0b:b0:87d:ab56:3700 with SMTP id cw11csp806168mac; Tue, 28 Jul 2026 08:50:48 -0700 (PDT) X-Forwarded-Encrypted: i=2; AHgh+Rqv4W8coeBy/2P1zXGWGgDmfmBUZcjyPGgLrXgOYwRfw88xPGUzJCt8cPrcVCsIidrHgxi3vF7XR5M=@openvpn.net X-Received: by 2002:a05:6830:270e:b0:7e6:c819:22e9 with SMTP id 46e09a7af769-7efff03695bmr2329973a34.17.1785253848138; Tue, 28 Jul 2026 08:50:48 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1785253848; cv=none; d=google.com; s=arc-20260327; b=UnXi81enBJhWIT6dT3iYri2ExmLjWHONjG9Cb15GHH6wstLU0fkcQlhQi4LbAH1eIJ Hvkhzbk5nom/qfkci9vnHrTYzZQWyhylbPtrM1/vNJowPxt09Td/Yub1BNJd3xiPf9Rw KzLXQSEMlXsaNRK0iyJ9E1cCBTooaLYseG46W0bG8pw0PejJULgZU/qjJ0hyp+9qpIGH 0G48myQ7S+rafF4jR2K0QKCOQdAIFZr/fyeZAFsnL8qZBEw4K9wZyl895m6a4caQ10aJ MC1KmQ3vC0sIG2OORpeoHWLl8ny61dFPKBqaJnGGdVHcWEYEXkHImz3Yr+Lca5yF28U8 fRjA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature:dkim-signature; bh=RvpXuCV+43cafGZhfOJdx2YClk+G6EwsqRHG7pqXvsU=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=VOiDy+refZzWt/QwM5YsWb+qtY2dNtmy/s4g/gYlmgGdKa2oyB3TdYlHugvEqBECSY OJVRBgjUEepMN/NfTQmmYXTCSSICXSw3EN8b25T1VM0hYrnGWtEiUmDqCGgzCUanYeMJ Sdb6+G/Mf9bNgke4nq5fBebgkkKJzmGsK7OjubICh/coHy/EhOVhSfOTTlOiyy+8NRdR NerBWgRg/1TXK9aQKv7ZOWHU2Y+6iVwZ6Eej/0M6MIzerOBx/RPpeQG9za5EYPLYeAYK qNe+QvWWOxaWEI7d4nFZ9DQohDQ1SLiArsU3iBaWQV8HuqWSO8hyucBWkhq7epioFhol Fujg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=GJeLNw37; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=XXpdyvGX; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=iqwxndyz; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=NylkSPp9; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 46e09a7af769-7f00da0c3cfsi26683a34.74.2026.07.28.08.50.47 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 28 Jul 2026 08:50:48 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=GJeLNw37; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=XXpdyvGX; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=iqwxndyz; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=NylkSPp9; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=RvpXuCV+43cafGZhfOJdx2YClk+G6EwsqRHG7pqXvsU=; b=GJeLNw37UuOIyPsO2BPU/mKrOW pdrqwz/AeewwgVSXDY8zJ/eYTANK90/7/K9InR9pQvVIIAyzmMhxJf093tt1dTkZqqT9YaDB9s1a4 HaIQbFN/mIiNioe6fHclnqSXsMF4j8c71THliDbqacHzmyFI7KkN0H2JfzvtGWoDYFUo=; Received: from [127.0.0.1] (helo=sfs-ml-2.v29.lw.sourceforge.com) by sfs-ml-2.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1wok4q-0005re-1i; Tue, 28 Jul 2026 15:50:44 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-2.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1wok4o-0005rC-1x for openvpn-devel@lists.sourceforge.net; Tue, 28 Jul 2026 15:50:42 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=vGLH3UkLe1bhVNcVYueoL5qteIhy5p9NOkNUDMU/duA=; b=XXpdyvGX5QNyMPrUOpWVCDgVsB IpiKQ3tPzKksStWvtf6WibrdZXU1bulCDQs0q0kcZXP7igeDPjx2M5j57JRAo3F1HHcvrTNzXwylJ sR8nFWr3ctWyQMAOE8yWgv5To3AvBEHZk7yrQ7EwhJXPyclIw9QzOIn8thiIqSN/F2b8=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=vGLH3UkLe1bhVNcVYueoL5qteIhy5p9NOkNUDMU/duA=; b=iqwxndyz2fhseO8dtWDyS03DZh nYCQNCuVbOZg5B7ZrruHoe+8mtlJx04kh+Y7oIhiFMbG6pw10QC+bCTZfAjU1eS7xRPek6n/ZTYH5 8PMDdllhixHUTIUUe+0lYe6/uMnQKjvgZq465WfshOHo6NpjPo/VPOTGOY1dbk7c1TNk=; Received: from mout-b-201.mailbox.org ([195.10.208.61]) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1wok4p-00026f-FG for openvpn-devel@lists.sourceforge.net; Tue, 28 Jul 2026 15:50:42 +0000 Received: from smtp202.mailbox.org (smtp202.mailbox.org [IPv6:2001:67c:2050:b231:465::202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-b-201.mailbox.org (Postfix) with ESMTPS id 4h8g0S06z5zLlnh; Tue, 28 Jul 2026 17:50:32 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandelbit.com; s=MBO0001; t=1785253832; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=vGLH3UkLe1bhVNcVYueoL5qteIhy5p9NOkNUDMU/duA=; b=NylkSPp9fxTKpgDf4+b9upFamENuDe1oKJ5ud+STd0RSMcuIZtjUDFEctw68lKwtvH3Am2 xkBfaYW0e8xAEmlRZwdlO4oV9T5j48FjeM0lN+3QMfwJ4AQF6ABK5ELEn7OqPrHgBPm2um HLYQqGncr9MAiz8z8Jyvclb5rvgEql0EVlqwFRO5hzf6rxvo8qUf4XL75fD3Erd32LT7HG td4WYA6xbDTrIqFH/cNDVR7IfKJVMMsUwuU1N4P9JynqYhshZqLh8rpqxzibNKIOVMX4uL MhSbhSjC18682d4j32Ws6D+juUpGYU/vDXG1KYRbKZDRIe1boczNVnyTdgf5Lw== Authentication-Results: outgoing_mbo_mout; dkim=none; spf=pass (outgoing_mbo_mout: domain of ralf@mandelbit.com designates 2001:67c:2050:b231:465::202 as permitted sender) smtp.mailfrom=ralf@mandelbit.com From: Ralf Lici To: openvpn-devel@lists.sourceforge.net Date: Tue, 28 Jul 2026 17:50:13 +0200 Message-ID: <15a79f79de3cf192bc862acfd07534c1995f7ad8.1785253480.git.ralf@mandelbit.com> In-Reply-To: References: MIME-Version: 1.0 X-Rspamd-Queue-Id: 4h8g0S06z5zLlnh X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: ovpn stores the route used to transmit UDP packets in a per-peer dst cache. A cached dst is only valid for the route lookup inputs used when it was resolved. Some of those inputs are mutable while userspace still owns the UDP socket. In particular, changes to the socket mark or UDP source port do not invalidate ovpn's peer dst cache, so ovpn can keep using [...] Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature X-Headers-End: 1wok4p-00026f-FG Subject: [Openvpn-devel] [PATCH ovpn net 3/5] ovpn: track UDP socket route key for peer dst cache X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1871974339276166707 X-GMAIL-MSGID: 1871974339276166707 ovpn stores the route used to transmit UDP packets in a per-peer dst cache. A cached dst is only valid for the route lookup inputs used when it was resolved. Some of those inputs are mutable while userspace still owns the UDP socket. In particular, changes to the socket mark or UDP source port do not invalidate ovpn's peer dst cache, so ovpn can keep using a route selected with an old socket route key. Replace the cached mark with a route key containing the socket-owned lookup inputs currently used by ovpn, and reset the peer dst cache when the key changes. Before storing a newly looked-up dst, recheck the route key under the peer lock so a dst resolved for stale socket state is not published. Fixes: 08857b5ec5d9 ("ovpn: implement basic TX path (UDP)") Signed-off-by: Ralf Lici --- drivers/net/ovpn/peer.c | 1 + drivers/net/ovpn/peer.h | 19 ++++++++- drivers/net/ovpn/udp.c | 90 +++++++++++++++++++++++++++++++++++------ 3 files changed, 95 insertions(+), 15 deletions(-) diff --git a/drivers/net/ovpn/peer.c b/drivers/net/ovpn/peer.c index c02dfab51a6e..4806e942be27 100644 --- a/drivers/net/ovpn/peer.c +++ b/drivers/net/ovpn/peer.c @@ -112,6 +112,7 @@ struct ovpn_peer *ovpn_peer_new(struct ovpn_priv *ovpn, u32 id) RCU_INIT_POINTER(peer->bind, NULL); ovpn_crypto_state_init(&peer->crypto); spin_lock_init(&peer->lock); + seqcount_spinlock_init(&peer->route_key_seq, &peer->lock); kref_init(&peer->refcount); ovpn_peer_stats_init(&peer->vpn_stats); ovpn_peer_stats_init(&peer->link_stats); diff --git a/drivers/net/ovpn/peer.h b/drivers/net/ovpn/peer.h index 328401570cba..72a9cbb8c31f 100644 --- a/drivers/net/ovpn/peer.h +++ b/drivers/net/ovpn/peer.h @@ -10,6 +10,7 @@ #ifndef _NET_OVPN_OVPNPEER_H_ #define _NET_OVPN_OVPNPEER_H_ +#include #include #include @@ -17,6 +18,16 @@ #include "socket.h" #include "stats.h" +/** + * struct ovpn_route_key - route key used for the peer dst cache + * @mark: fwmark used for route lookup + * @sport: UDP source port used for route lookup + */ +struct ovpn_route_key { + u32 mark; + __be16 sport; +}; + /** * struct ovpn_peer - the main remote peer object * @ovpn: main openvpn instance this peer belongs to @@ -45,6 +56,8 @@ * @tcp.sk_cb.ops: pointer to the original prot_ops object (TCP only) * @crypto: the crypto configuration (ciphers, keys, etc..) * @dst_cache: cache for dst_entry used to send to peer + * @route_key: route key matching the current dst cache contents + * @route_key_seq: seqcount protecting lockless route_key reads * @bind: remote peer binding * @keepalive_interval: seconds after which a new keepalive should be sent * @keepalive_xmit_exp: future timestamp when next keepalive should be sent @@ -55,7 +68,7 @@ * @vpn_stats: per-peer in-VPN TX/RX stats * @link_stats: per-peer link/transport TX/RX stats * @delete_reason: why peer was deleted (i.e. timeout, transport error, ..) - * @lock: protects binding to peer (bind) and keepalive* fields + * @lock: protects binding to peer (bind), route_key and keepalive* fields * @refcount: reference counter * @rcu: used to free peer in an RCU safe way * @release_entry: entry for the socket release list @@ -99,6 +112,8 @@ struct ovpn_peer { } tcp; struct ovpn_crypto_state crypto; struct dst_cache dst_cache; + struct ovpn_route_key route_key; + seqcount_spinlock_t route_key_seq; struct ovpn_bind __rcu *bind; unsigned long keepalive_interval; unsigned long keepalive_xmit_exp; @@ -109,7 +124,7 @@ struct ovpn_peer { struct ovpn_peer_stats vpn_stats; struct ovpn_peer_stats link_stats; enum ovpn_del_peer_reason delete_reason; - spinlock_t lock; /* protects bind and keepalive* */ + spinlock_t lock; /* protects bind, route_key and keepalive* */ struct kref refcount; struct rcu_head rcu; struct llist_node release_entry; diff --git a/drivers/net/ovpn/udp.c b/drivers/net/ovpn/udp.c index eb342c7eef29..e43b946c8289 100644 --- a/drivers/net/ovpn/udp.c +++ b/drivers/net/ovpn/udp.c @@ -131,6 +131,48 @@ static int ovpn_udp_encap_recv(struct sock *sk, struct sk_buff *skb) return 0; } +static bool ovpn_route_key_equal(const struct ovpn_route_key *a, + const struct ovpn_route_key *b) +{ + return a->mark == b->mark && a->sport == b->sport; +} + +/** + * ovpn_dst_cache_check_key - reset peer dst cache after key changes + * @peer: the peer owning the dst cache + * @cache: the cache that might need to be reset + * @key: the route key for the packet being transmitted + * + * Reset the peer dst cache if it was populated for a different route key. + */ +static void ovpn_dst_cache_check_key(struct ovpn_peer *peer, + struct dst_cache *cache, + const struct ovpn_route_key *key) +{ + struct ovpn_route_key old_key; + unsigned int seq; + + /* snapshot the saved key before deciding whether the cache matches */ + do { + seq = read_seqcount_begin(&peer->route_key_seq); + old_key = peer->route_key; + } while (read_seqcount_retry(&peer->route_key_seq, seq)); + + /* nothing changed: the current cache can be reused */ + if (likely(ovpn_route_key_equal(&old_key, key))) + return; + + /* recheck under lock because another path may have updated the key */ + spin_lock_bh(&peer->lock); + if (!ovpn_route_key_equal(&peer->route_key, key)) { + write_seqcount_begin(&peer->route_key_seq); + peer->route_key = *key; + dst_cache_reset(cache); + write_seqcount_end(&peer->route_key_seq); + } + spin_unlock_bh(&peer->lock); +} + /** * ovpn_udp4_output - send IPv4 packet over udp socket * @peer: the destination peer @@ -138,21 +180,23 @@ static int ovpn_udp_encap_recv(struct sock *sk, struct sk_buff *skb) * @cache: dst cache * @sk: the socket to send the packet over * @skb: the packet to send + * @key: the route key snapshot used for cache validation and flow lookup * * Return: 0 on success or a negative error code otherwise */ static int ovpn_udp4_output(struct ovpn_peer *peer, struct ovpn_bind *bind, struct dst_cache *cache, struct sock *sk, - struct sk_buff *skb) + struct sk_buff *skb, + const struct ovpn_route_key *key) { struct rtable *rt; struct flowi4 fl = { .saddr = bind->local.ipv4.s_addr, .daddr = bind->remote.in4.sin_addr.s_addr, - .fl4_sport = inet_sk(sk)->inet_sport, + .fl4_sport = key->sport, .fl4_dport = bind->remote.in4.sin_port, .flowi4_proto = sk->sk_protocol, - .flowi4_mark = sk->sk_mark, + .flowi4_mark = key->mark, }; int ret; @@ -193,7 +237,12 @@ static int ovpn_udp4_output(struct ovpn_peer *peer, struct ovpn_bind *bind, ret); goto err; } - dst_cache_set_ip4(cache, &rt->dst, fl.saddr); + + /* avoid storing a stale cache */ + spin_lock_bh(&peer->lock); + if (likely(ovpn_route_key_equal(key, &peer->route_key))) + dst_cache_set_ip4(cache, &rt->dst, fl.saddr); + spin_unlock_bh(&peer->lock); transmit: udp_tunnel_xmit_skb(rt, sk, skb, fl.saddr, fl.daddr, 0, @@ -213,12 +262,14 @@ static int ovpn_udp4_output(struct ovpn_peer *peer, struct ovpn_bind *bind, * @cache: dst cache * @sk: the socket to send the packet over * @skb: the packet to send + * @key: the route key snapshot used for cache validation and flow lookup * * Return: 0 on success or a negative error code otherwise */ static int ovpn_udp6_output(struct ovpn_peer *peer, struct ovpn_bind *bind, struct dst_cache *cache, struct sock *sk, - struct sk_buff *skb) + struct sk_buff *skb, + const struct ovpn_route_key *key) { struct dst_entry *dst; int ret; @@ -226,10 +277,10 @@ static int ovpn_udp6_output(struct ovpn_peer *peer, struct ovpn_bind *bind, struct flowi6 fl = { .saddr = bind->local.ipv6, .daddr = bind->remote.in6.sin6_addr, - .fl6_sport = inet_sk(sk)->inet_sport, + .fl6_sport = key->sport, .fl6_dport = bind->remote.in6.sin6_port, .flowi6_proto = sk->sk_protocol, - .flowi6_mark = sk->sk_mark, + .flowi6_mark = key->mark, .flowi6_oif = bind->remote.in6.sin6_scope_id, }; @@ -259,7 +310,12 @@ static int ovpn_udp6_output(struct ovpn_peer *peer, struct ovpn_bind *bind, &bind->remote.in6, ret); goto err; } - dst_cache_set_ip6(cache, dst, &fl.saddr); + + /* avoid storing a stale cache */ + spin_lock_bh(&peer->lock); + if (likely(ovpn_route_key_equal(key, &peer->route_key))) + dst_cache_set_ip6(cache, dst, &fl.saddr); + spin_unlock_bh(&peer->lock); transmit: /* user IPv6 packets may be larger than the transport interface @@ -288,6 +344,7 @@ static int ovpn_udp6_output(struct ovpn_peer *peer, struct ovpn_bind *bind, * @cache: dst cache * @sk: the socket to send the packet over * @skb: the packet to send + * @key: route key snapshot used for cache validation and flow lookup * * rcu_read_lock should be held on entry. * On return, the skb is consumed. @@ -295,7 +352,8 @@ static int ovpn_udp6_output(struct ovpn_peer *peer, struct ovpn_bind *bind, * Return: 0 on success or a negative error code otherwise */ static int ovpn_udp_output(struct ovpn_peer *peer, struct dst_cache *cache, - struct sock *sk, struct sk_buff *skb) + struct sock *sk, struct sk_buff *skb, + struct ovpn_route_key *key) { struct ovpn_bind *bind; int ret; @@ -315,11 +373,11 @@ static int ovpn_udp_output(struct ovpn_peer *peer, struct dst_cache *cache, switch (bind->remote.in4.sin_family) { case AF_INET: - ret = ovpn_udp4_output(peer, bind, cache, sk, skb); + ret = ovpn_udp4_output(peer, bind, cache, sk, skb, key); break; #if IS_ENABLED(CONFIG_IPV6) case AF_INET6: - ret = ovpn_udp6_output(peer, bind, cache, sk, skb); + ret = ovpn_udp6_output(peer, bind, cache, sk, skb, key); break; #endif default: @@ -341,15 +399,21 @@ static int ovpn_udp_output(struct ovpn_peer *peer, struct dst_cache *cache, void ovpn_udp_send_skb(struct ovpn_peer *peer, struct sock *sk, struct sk_buff *skb) { + struct ovpn_route_key key = { + .mark = READ_ONCE(sk->sk_mark), + .sport = READ_ONCE(inet_sk(sk)->inet_sport), + }; int ret; skb->dev = peer->ovpn->dev; - skb->mark = READ_ONCE(sk->sk_mark); + skb->mark = key.mark; /* no checksum performed at this layer */ skb->ip_summed = CHECKSUM_NONE; + ovpn_dst_cache_check_key(peer, &peer->dst_cache, &key); + /* crypto layer -> transport (UDP) */ - ret = ovpn_udp_output(peer, &peer->dst_cache, sk, skb); + ret = ovpn_udp_output(peer, &peer->dst_cache, sk, skb, &key); if (unlikely(ret < 0)) kfree_skb(skb); } From patchwork Tue Jul 28 15:50:14 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ralf Lici X-Patchwork-Id: 5154 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:fd0b:b0:87d:ab56:3700 with SMTP id cw11csp806219mac; Tue, 28 Jul 2026 08:50:51 -0700 (PDT) X-Forwarded-Encrypted: i=2; AHgh+RrOabZ/heGHBkifANiHU6tHsBS89+21bPK+G6o8gs+aRptNW4Wvj08b34ZQap3OxCaZfkuySFB2uVc=@openvpn.net X-Received: by 2002:a05:6870:8906:b0:456:4dc2:d94e with SMTP id 586e51a60fabf-4586cd67845mr1616170fac.37.1785253850999; Tue, 28 Jul 2026 08:50:50 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1785253850; cv=none; d=google.com; s=arc-20260327; b=kyHp2GUWtFsw0OCQ/j3iaAja85DGtjX0dt6lvE9oZv0ewJzMxpy69nKK25D1Qik/Lx o1WbkZ7xQO53mjixufb0oa6yEMkg7x5VZbcsTEgkl3pRIhGPrGLjhI/WB7MP3+5E+PkL a+PiFrp8cEzMCJ6mV84ET6ZwVKxPjcK36E/E7O38eh/Pb8F/Dt4+Du3/D2XplXO9zbzp G5cFi1UYyekghm77KIpxMjeCoIhfJL0Sd83l+c27gNBPrsHcRc9ZUS4r6ZfPBGWHg5GB q2IBzP2QLN5arOOc6EbXanb+5CNqTRp7eqpFp/J6jtMQ33HkvwBzq4uNkbWesZxJgcNk haxw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature:dkim-signature; bh=OwQp8eu25PJ6IZbJmB0VcQLgk6sfQqaiunUsFBTwmpI=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=GoGiHlxXGoC6MZN8iiM0L55qMnM6TVtYP+zuXS2v2cLqL8qFD+2QUaecPFiR3y7+50 QOg9BLGq9qN6hOytI6rRx+Z1z1iCTWiWJuPYkIvQXB5Yx8/K46GvNNeG01Zuc46yXgEW ryMKQkp62VmfMQ1SeGrBQUgg0qNQlZGRx+Yv9jl6svin40ch9UDBqVH2BT4C1vUJGziM p0x623nSVaM8Ihtg8iGAhVo6dDdvnH3Na0wxsnUixyfwLKW5nSGfP8Uw1Q3ynPr9sjzF D7cWRuArvd7I95OYuQyN+f1E+S2PTGko3PSX2e261NP1BoJHvtMAqmdPIccttAzVk/yZ Y76g==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=R0Q3sCy+; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b="F/3N6dOU"; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=IeEIJ3Yg; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=C8bc5yrl; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 586e51a60fabf-45886ccbd52si187574fac.367.2026.07.28.08.50.50 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 28 Jul 2026 08:50:50 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=R0Q3sCy+; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b="F/3N6dOU"; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=IeEIJ3Yg; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=C8bc5yrl; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=OwQp8eu25PJ6IZbJmB0VcQLgk6sfQqaiunUsFBTwmpI=; b=R0Q3sCy++DlbZon29Yy8D6jcY3 uMvla5H3iiFOdRrJAvoIzQzxZaNt7lIQvyGXo/zht45K1q0fV8xibSppr5gChK0bLQ6oVkAIfd41D pYGRFDigrXUhvm6GFQ+JIKvbuAshYxlv26Wo6k7tU/YJFnWef5Ax9mAneYFI02V/SyVw=; Received: from [127.0.0.1] (helo=sfs-ml-3.v29.lw.sourceforge.com) by sfs-ml-3.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1wok4s-00031Z-UV; Tue, 28 Jul 2026 15:50:47 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-3.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1wok4r-00031M-7V for openvpn-devel@lists.sourceforge.net; Tue, 28 Jul 2026 15:50:45 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=Qsp08g55trqf8aKQYWH1lajPuOiZlhiBrAgqh+hRgMw=; b=F/3N6dOUl5341VOUGXs29A8L2S 9PotIygkkxM35DWXJv4oxucgr5SFBZKBbkrb1ZsRjFZF1spTvMblFrcZ1gm1AJA2FtnNh9glLU2aH f2taviqvwcf9GBkcUWkdDR76xtQuv94Ik9cTRB9eCChJq2XaCNcnRfczj+MK4WmKt6tY=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=Qsp08g55trqf8aKQYWH1lajPuOiZlhiBrAgqh+hRgMw=; b=IeEIJ3YgUTIcfWwl4znhl451ic tJVZrc077N84Rmzgoltm5QjjNN9qoN8kzX7kAX0X9Hhk6nk1qULh8mkw1eD8jbZem7A04jeW2C5/H fnZri3VuxzC8qkNKVfAdh6CfzxwX8QV2q8u7cLvXiOi1IIiMRfX8e6Do2S8vE/qFaao0=; Received: from mout-b-105.mailbox.org ([195.10.208.50]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1wok4m-00027P-IF for openvpn-devel@lists.sourceforge.net; Tue, 28 Jul 2026 15:50:45 +0000 Received: from smtp202.mailbox.org (smtp202.mailbox.org [IPv6:2001:67c:2050:b231:465::202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-b-105.mailbox.org (Postfix) with ESMTPS id 4h8g0S4lBJz9s7V; Tue, 28 Jul 2026 17:50:32 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandelbit.com; s=MBO0001; t=1785253832; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Qsp08g55trqf8aKQYWH1lajPuOiZlhiBrAgqh+hRgMw=; b=C8bc5yrlXVAVw0SnwK79stX3KNXF5E18CBqlzH1pFXDYW9XyXhK4US3Fx9f1sn/apIj2D/ lYEpUUbFCa1/Pa0tn8RWFDr96o9kqy0RC/FhuBu44bBJgmd+1RuuQ84rbcHJPEXL6dcjhL ds4U5AboOQzctXbjsiqEp4VNt8rfrz3pRd+dYx/wm+tAanAH4ZpFtouJrNM0r2Wc3Anxh/ cJCUkK5Tflsi+mLBY9JwMznHJ7/Jao15VU+aOy0OwfoJlGdvDKqizGiMDazUiffJC9ya+A Nr37UNsTnq5JQJ7Z8PcefMN2zswlYO+DajeNy1/s7n0Ije8C/HcNrgOEJyoYgQ== Authentication-Results: outgoing_mbo_mout; dkim=none; spf=pass (outgoing_mbo_mout: domain of ralf@mandelbit.com designates 2001:67c:2050:b231:465::202 as permitted sender) smtp.mailfrom=ralf@mandelbit.com From: Ralf Lici To: openvpn-devel@lists.sourceforge.net Date: Tue, 28 Jul 2026 17:50:14 +0200 Message-ID: <082540583b9145d89e1cdd5a74c485ea3a53d285.1785253480.git.ralf@mandelbit.com> In-Reply-To: References: MIME-Version: 1.0 X-Rspamd-Queue-Id: 4h8g0S4lBJz9s7V X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: struct ovpn_bind is published through peer->bind with RCU. Remote endpoint changes already replace the whole bind object, but local endpoint learning and UDP source fallback still updated bind->local [...] Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.0 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2) [195.10.208.50 listed in wl.mailspike.net] X-Headers-End: 1wok4m-00027P-IF Subject: [Openvpn-devel] [PATCH ovpn net 4/5] ovpn: avoid in-place updates of peer bind local address X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1871974341964309312 X-GMAIL-MSGID: 1871974341964309312 struct ovpn_bind is published through peer->bind with RCU. Remote endpoint changes already replace the whole bind object, but local endpoint learning and UDP source fallback still updated bind->local in place. UDP TX can read it locklessly while another CPU updates it under peer->lock. For IPv6, that can produce torn reads of the address field. Fix this by making the local endpoint immutable after publication too: build a new bind object with the updated local address and publish it through peer->bind. When UDP TX discovers that the remembered local source is no longer usable, retry route lookup with a wildcard source. If the lookup succeeds and the bind used for the lookup is still current, invalidate the peer dst cache and best-effort publish a replacement bind with wildcard local address. The current packet can still be transmitted with the resolved route even if that bind replacement fails; a later cache miss will retry the repair. Only store the resolved dst when the local address did not need to be reset. A local address change invalidates all per-CPU dst cache entries, while dst_cache_set_ip4 and dst_cache_set_ip6 only update the current CPU slot. Avoid the old reset-then-set pattern and let the next TX repopulate the cache from the new bind state. Fixes: f0281c1d3732 ("ovpn: add support for updating local or remote UDP endpoint") Fixes: 08857b5ec5d9 ("ovpn: implement basic TX path (UDP)") Signed-off-by: Ralf Lici --- drivers/net/ovpn/peer.c | 36 +++++++++----- drivers/net/ovpn/udp.c | 108 +++++++++++++++++++++++++++++++--------- 2 files changed, 107 insertions(+), 37 deletions(-) diff --git a/drivers/net/ovpn/peer.c b/drivers/net/ovpn/peer.c index 4806e942be27..383d712582c9 100644 --- a/drivers/net/ovpn/peer.c +++ b/drivers/net/ovpn/peer.c @@ -197,12 +197,11 @@ int ovpn_peer_reset_sockaddr(struct ovpn_peer *peer, void ovpn_peer_endpoints_update(struct ovpn_peer *peer, struct sk_buff *skb) { struct hlist_nulls_head *nhead; + const void *local_ip = NULL; struct sockaddr_storage ss; struct sockaddr_in6 *sa6; - bool reset_cache = false; struct sockaddr_in *sa; struct ovpn_bind *bind; - const void *local_ip; size_t salen = 0; spin_lock_bh(&peer->lock); @@ -224,7 +223,6 @@ void ovpn_peer_endpoints_update(struct ovpn_peer *peer, struct sk_buff *skb) sa->sin_addr.s_addr = ip_hdr(skb)->saddr; sa->sin_port = udp_hdr(skb)->source; salen = sizeof(*sa); - reset_cache = true; break; } @@ -236,8 +234,7 @@ void ovpn_peer_endpoints_update(struct ovpn_peer *peer, struct sk_buff *skb) netdev_name(peer->ovpn->dev), peer->id, &bind->local.ipv4.s_addr, &ip_hdr(skb)->daddr); - bind->local.ipv4.s_addr = ip_hdr(skb)->daddr; - reset_cache = true; + local_ip = &ip_hdr(skb)->daddr; } break; case htons(ETH_P_IPV6): @@ -254,7 +251,6 @@ void ovpn_peer_endpoints_update(struct ovpn_peer *peer, struct sk_buff *skb) sa6->sin6_scope_id = ipv6_iface_scope_id(&ipv6_hdr(skb)->saddr, skb->skb_iif); salen = sizeof(*sa6); - reset_cache = true; break; } @@ -267,26 +263,40 @@ void ovpn_peer_endpoints_update(struct ovpn_peer *peer, struct sk_buff *skb) netdev_name(peer->ovpn->dev), peer->id, &bind->local.ipv6, &ipv6_hdr(skb)->daddr); - bind->local.ipv6 = ipv6_hdr(skb)->daddr; - reset_cache = true; + local_ip = &ipv6_hdr(skb)->daddr; } break; default: goto unlock; } - if (unlikely(reset_cache)) - dst_cache_reset(&peer->dst_cache); - - /* if the peer did not float, we can bail out now */ - if (likely(!salen)) + /* if there was no float and the local address is unchanged, bail out */ + if (likely(!salen && !local_ip)) goto unlock; + /* if only the local address changed, populate ss with the current + * remote + */ + if (!salen) + memcpy(&ss, &bind->remote, + bind->remote.in4.sin_family == AF_INET ? + sizeof(struct sockaddr_in) : + sizeof(struct sockaddr_in6)); + if (unlikely(ovpn_peer_reset_sockaddr(peer, (struct sockaddr_storage *)&ss, local_ip) < 0)) goto unlock; + /* reset the cache only after a successful bind update to avoid useless + * cache misses on concurrent TX + */ + dst_cache_reset(&peer->dst_cache); + + /* if the peer did not float, we can bail out now */ + if (!salen) + goto unlock; + net_dbg_ratelimited("%s: peer %d floated to %pIScp", netdev_name(peer->ovpn->dev), peer->id, &ss); diff --git a/drivers/net/ovpn/udp.c b/drivers/net/ovpn/udp.c index e43b946c8289..ced4f9ff4a08 100644 --- a/drivers/net/ovpn/udp.c +++ b/drivers/net/ovpn/udp.c @@ -173,6 +173,35 @@ static void ovpn_dst_cache_check_key(struct ovpn_peer *peer, spin_unlock_bh(&peer->lock); } +/** + * ovpn_dst_cache_current - check whether a route lookup matches peer state + * @peer: the peer owning the bind and dst cache + * @bind: the RCU bind used for the route lookup + * @key: the route key used for the route lookup + * + * Check that @bind is still the current peer bind and that @key still matches + * the peer route key. The caller must hold @peer->lock. The TX path keeps + * @bind inside an RCU read-side critical section, so pointer identity is enough + * to detect whether the bind was replaced while the route lookup was running. + * + * Return: true if the lookup result still matches the current peer state and + * may update the dst cache or replace the bind. + */ +static bool ovpn_dst_cache_current(const struct ovpn_peer *peer, + const struct ovpn_bind *bind, + const struct ovpn_route_key *key) +{ + const struct ovpn_bind *curr_bind; + + lockdep_assert_held(&peer->lock); + + curr_bind = rcu_dereference_protected(peer->bind, + lockdep_is_held(&peer->lock)); + + return curr_bind == bind && + ovpn_route_key_equal(key, &peer->route_key); +} + /** * ovpn_udp4_output - send IPv4 packet over udp socket * @peer: the destination peer @@ -189,6 +218,9 @@ static int ovpn_udp4_output(struct ovpn_peer *peer, struct ovpn_bind *bind, struct sk_buff *skb, const struct ovpn_route_key *key) { + struct sockaddr_storage remote; + struct in_addr local = {}; + bool reset_local = false; struct rtable *rt; struct flowi4 fl = { .saddr = bind->local.ipv4.s_addr, @@ -207,24 +239,17 @@ static int ovpn_udp4_output(struct ovpn_peer *peer, struct ovpn_bind *bind, if (fl.saddr && unlikely(!inet_confirm_addr(sock_net(sk), NULL, 0, fl.saddr, RT_SCOPE_HOST))) { - /* we may end up here when the cached address is not usable - * anymore. In this case we reset address/cache and perform a - * new look up + /* The learned local address is not usable anymore. + * Retry with source address autoselection. */ fl.saddr = 0; - spin_lock_bh(&peer->lock); - bind->local.ipv4.s_addr = 0; - spin_unlock_bh(&peer->lock); - dst_cache_reset(cache); + reset_local = true; } rt = ip_route_output_flow(sock_net(sk), &fl, sk); if (IS_ERR(rt) && PTR_ERR(rt) == -EINVAL) { fl.saddr = 0; - spin_lock_bh(&peer->lock); - bind->local.ipv4.s_addr = 0; - spin_unlock_bh(&peer->lock); - dst_cache_reset(cache); + reset_local = true; rt = ip_route_output_flow(sock_net(sk), &fl, sk); } @@ -238,10 +263,28 @@ static int ovpn_udp4_output(struct ovpn_peer *peer, struct ovpn_bind *bind, goto err; } - /* avoid storing a stale cache */ + /* avoid storing a stale cache or local address */ spin_lock_bh(&peer->lock); - if (likely(ovpn_route_key_equal(key, &peer->route_key))) - dst_cache_set_ip4(cache, &rt->dst, fl.saddr); + if (likely(ovpn_dst_cache_current(peer, bind, key))) { + if (!reset_local) { + dst_cache_set_ip4(cache, &rt->dst, fl.saddr); + spin_unlock_bh(&peer->lock); + goto transmit; + } + + /* invalidate per-CPU dst entries that may still carry + * the stale source + */ + dst_cache_reset(cache); + + /* preserve the current remote */ + memcpy(&remote, &bind->remote, sizeof(struct sockaddr_in)); + /* The current packet already has a valid wildcard-source route. + * If replacing the bind fails, leave the stale local in place; + * a later cache miss will retry the repair. + */ + ovpn_peer_reset_sockaddr(peer, &remote, &local); + } spin_unlock_bh(&peer->lock); transmit: @@ -271,6 +314,9 @@ static int ovpn_udp6_output(struct ovpn_peer *peer, struct ovpn_bind *bind, struct sk_buff *skb, const struct ovpn_route_key *key) { + struct in6_addr local = in6addr_any; + struct sockaddr_storage remote; + bool reset_local = false; struct dst_entry *dst; int ret; @@ -291,15 +337,11 @@ static int ovpn_udp6_output(struct ovpn_peer *peer, struct ovpn_bind *bind, if (!ipv6_addr_any(&fl.saddr) && unlikely(!ipv6_chk_addr(sock_net(sk), &fl.saddr, NULL, 0))) { - /* we may end up here when the cached address is not usable - * anymore. In this case we reset address/cache and perform a - * new look up + /* The learned local address is not usable anymore. + * Retry with source address autoselection. */ fl.saddr = in6addr_any; - spin_lock_bh(&peer->lock); - bind->local.ipv6 = in6addr_any; - spin_unlock_bh(&peer->lock); - dst_cache_reset(cache); + reset_local = true; } dst = ip6_dst_lookup_flow(sock_net(sk), sk, &fl, NULL); @@ -311,10 +353,28 @@ static int ovpn_udp6_output(struct ovpn_peer *peer, struct ovpn_bind *bind, goto err; } - /* avoid storing a stale cache */ + /* avoid storing a stale cache or local address */ spin_lock_bh(&peer->lock); - if (likely(ovpn_route_key_equal(key, &peer->route_key))) - dst_cache_set_ip6(cache, dst, &fl.saddr); + if (likely(ovpn_dst_cache_current(peer, bind, key))) { + if (!reset_local) { + dst_cache_set_ip6(cache, dst, &fl.saddr); + spin_unlock_bh(&peer->lock); + goto transmit; + } + + /* invalidate per-CPU dst entries that may still carry + * the stale source + */ + dst_cache_reset(cache); + + /* preserve the current remote */ + memcpy(&remote, &bind->remote, sizeof(struct sockaddr_in6)); + /* The current packet already has a valid wildcard-source route. + * If replacing the bind fails, leave the stale local in place; + * a later cache miss will retry the repair. + */ + ovpn_peer_reset_sockaddr(peer, &remote, &local); + } spin_unlock_bh(&peer->lock); transmit: From patchwork Tue Jul 28 15:50:15 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ralf Lici X-Patchwork-Id: 5152 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:fd0b:b0:87d:ab56:3700 with SMTP id cw11csp806160mac; Tue, 28 Jul 2026 08:50:47 -0700 (PDT) X-Forwarded-Encrypted: i=2; AHgh+RrgFwQkAJFq4UkSsV28k7eNtiNKXpbg92jwnE52yGNQ+dwwh9LbxWw4JgQczrA5KT9wT3ozGUEQ66c=@openvpn.net X-Received: by 2002:a05:6820:1905:b0:6aa:ed21:6c95 with SMTP id 006d021491bc7-6ac9657f73dmr1623708eaf.0.1785253847520; Tue, 28 Jul 2026 08:50:47 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1785253847; cv=none; d=google.com; s=arc-20260327; b=suD7vV0srPCdCtEagRlrn3RMfPZbdc8INz95+7R1HbfMZqnKlY3sz8i9VeSzMvg6sN nlX67T7BqLIfb69Wj8lxjxE8PZ/g80dsa/s9BgTGdYPPLmOd1Hxlol0J/JOWSJ1EXU/5 FIxX6nUr6H6QyiJt7N4vxHo/gr720Giie/UBf/v/+kBKkTa01/+F4gjRnL8jwsWqetPj a0nPccNdww3WZ1Cn4t5Jc+Sm++9wT8DMoybcqJwA63QB+nRQTMRgENkPZ0mh/jMHo9B4 3TN2UEuMbR8QTBds9YVRsTosEJPf6SY6yW50YPCcdlmRILDf2jPZkVAWzx4x2+CLPIBz EefA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature:dkim-signature; bh=K216Sjk2DkKQSXWOUDTIwDK2wKyQgVUhaOlqO6tSw2g=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=E22icEaj45quZik9k0eNIclNZlznaLZiiies1f4sjKOEIB07INOrK6Z+BQJ/zxQAHf xD/8F1O5GkwNdHs7uG2Gg0GmeUJ18GH/OqCHzWp8CJmepGy2LNwWp7K0sctY5BB6EyKG 96MokNuhRoEYMZHuqrJHMAOUKRY7vPareaZRnOnNM9LEtlpjLKy26mggAY+5jEJQEsv8 G271bIsLUJvVGkzeuOKi3YtXyY71/RRouEaofzNC6EBRekcBpE3ZtYeUfVokYId8ZZZE v0dXP6nExQW3cDMm5PFlaag72AvUVQl1Yd+MTMOHDSl3Jokh7UCszrIkYtBAAMedhpsF 4/mg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=hQe6Efpn; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=djYzUANz; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=SSzVzEHZ; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b="L5dXKb/p"; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 586e51a60fabf-45886b39af3si194468fac.210.2026.07.28.08.50.47 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 28 Jul 2026 08:50:47 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=hQe6Efpn; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=djYzUANz; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=SSzVzEHZ; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b="L5dXKb/p"; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=K216Sjk2DkKQSXWOUDTIwDK2wKyQgVUhaOlqO6tSw2g=; b=hQe6Efpny0KU+7qzDsV8m1K9/l mqeKACRSYfYAq/C7j9WG8Z0VbmJ/dxVBqsENhF7xcYs4xWUOSS003Yl6XaQtecviVIYx7nnXu8EGi E4kKLjPEJ/oZdOKrwYqUpAj83AX1MF1Md6WMZUmVdJ2yvIrLZQJ77L4GhSlSVgaaZw28=; Received: from [127.0.0.1] (helo=sfs-ml-1.v29.lw.sourceforge.com) by sfs-ml-1.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1wok4r-0004UF-Vl; Tue, 28 Jul 2026 15:50:43 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-1.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1wok4q-0004U8-D6 for openvpn-devel@lists.sourceforge.net; Tue, 28 Jul 2026 15:50:41 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=h3R94BIa6T4sHhhoIFIPjKvtQjV0NDogkGPAf30HLDQ=; b=djYzUANzcQw3SlxGljn1lSJhAE JHhaYuJm27J4X/jeiP0lsQpHsoaNClhhU53CJiOjK8A4wiGTP8N3xTvyA/wbjSvlRgN/RGbbBEGUR SujsuWPMNqBp0EE5O3G5TR53h8rrGwuGN6VUQhc53uLI5yUJwnMdnsCpdEvULlZw8Lfc=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=h3R94BIa6T4sHhhoIFIPjKvtQjV0NDogkGPAf30HLDQ=; b=SSzVzEHZXuELHcazVsBP87PE5s 1duAw/NsNRpiMLNb7rQj/+AgHYAJDpYuH3jwbIXcYzM5DYz8ufoZASZKilJ87OcDRpnuaiIQBPV8p +PHMd0YYVHgPEIHvnkFFVv/dz53IlL6IzvMlih31woELNx6hZ12bDjbG/J6FN0jcWYo0=; Received: from mout-b-110.mailbox.org ([195.10.208.55]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1wok4n-00027T-55 for openvpn-devel@lists.sourceforge.net; Tue, 28 Jul 2026 15:50:41 +0000 Received: from smtp202.mailbox.org (unknown [10.196.197.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-b-110.mailbox.org (Postfix) with ESMTPS id 4h8g0T3pmTzNkRw; Tue, 28 Jul 2026 17:50:33 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandelbit.com; s=MBO0001; t=1785253833; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=h3R94BIa6T4sHhhoIFIPjKvtQjV0NDogkGPAf30HLDQ=; b=L5dXKb/p/ilHj2zR40D7OuGGXZ/9zWNc8j37h2tJHI6NoTJ97WhD+FVzKeVeejAvTUD1nZ cyPVDLfetBrVU/t38Y5UZFSDFM6Gq4O/8U9w41D2ZKabQRdHtm9pIhoysi0QHktHJV6hfr lFTydcsaK3pdRRICUCNWTsvNCWqt78iMsqNocgngq2ZnuTH2WaiDF/wyFH2ZeD//XCB3GO q8oSiFsXFCOEsFS6WPdHqqYUJef/yaWoGnCxuTdhIeKwwp1p49incMRbLb+uj3qHKdoCnQ GR5rQPR5ux95o5lggeIFDctzWIj058A614r/J0n2Dsl/VFh3UJM+VF2sRAJJbQ== From: Ralf Lici To: openvpn-devel@lists.sourceforge.net Date: Tue, 28 Jul 2026 17:50:15 +0200 Message-ID: In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-1.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: ovpn stores the IPv6 route used for UDP transmission in a per-peer dst cache. IPv6 dst validation uses a cookie derived from the route itself, or, for routes without their own sernum, from the associa [...] Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature X-Headers-End: 1wok4n-00027T-55 Subject: [Openvpn-devel] [PATCH ovpn net 5/5] ovpn: avoid caching stale IPv6 dst after FIB changes X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1871974337973141837 X-GMAIL-MSGID: 1871974337973141837 ovpn stores the IPv6 route used for UDP transmission in a per-peer dst cache. IPv6 dst validation uses a cookie derived from the route itself, or, for routes without their own sernum, from the associated fib6 node. If the IPv6 FIB changes after ip6_dst_lookup_flow returns but before dst_cache_set_ip6 reads the cookie, ovpn can store an old dst with a new cookie. Later dst_cache_get_ip6 can then consider that stale dst valid because the stored cookie matches the updated fib6 node sernum. Sample the IPv6 FIB generation before and after route lookup, and only populate ovpn's peer dst cache if the generation did not change while the lookup was in flight. Also add a dst_cache helper that stores a caller-provided IPv6 cookie, so the cached dst carries the cookie sampled from the lookup result instead of one read after a concurrent FIB update. The current packet may still be transmitted with the route returned by the lookup if the FIB changes before TX completion. This patch only prevents that potentially stale route from being preserved in ovpn's peer dst cache and reused for later packets. Fixes: 08857b5ec5d9 ("ovpn: implement basic TX path (UDP)") Signed-off-by: Ralf Lici --- drivers/net/ovpn/udp.c | 45 +++++++++++++++++++++++++++-------------- include/net/dst_cache.h | 13 ++++++++++++ net/core/dst_cache.c | 16 +++++++++++---- 3 files changed, 55 insertions(+), 19 deletions(-) diff --git a/drivers/net/ovpn/udp.c b/drivers/net/ovpn/udp.c index ced4f9ff4a08..e2b94888474c 100644 --- a/drivers/net/ovpn/udp.c +++ b/drivers/net/ovpn/udp.c @@ -316,9 +316,11 @@ static int ovpn_udp6_output(struct ovpn_peer *peer, struct ovpn_bind *bind, { struct in6_addr local = in6addr_any; struct sockaddr_storage remote; + struct net *net = sock_net(sk); bool reset_local = false; struct dst_entry *dst; - int ret; + int gen0, gen1, ret; + u32 cookie; struct flowi6 fl = { .saddr = bind->local.ipv6, @@ -344,7 +346,9 @@ static int ovpn_udp6_output(struct ovpn_peer *peer, struct ovpn_bind *bind, reset_local = true; } - dst = ip6_dst_lookup_flow(sock_net(sk), sk, &fl, NULL); + gen0 = rt_genid_ipv6(net); + + dst = ip6_dst_lookup_flow(net, sk, &fl, NULL); if (IS_ERR(dst)) { ret = PTR_ERR(dst); net_dbg_ratelimited("%s: no route to host %pISpc: %d\n", @@ -353,27 +357,38 @@ static int ovpn_udp6_output(struct ovpn_peer *peer, struct ovpn_bind *bind, goto err; } + cookie = rt6_get_cookie(dst_rt6_info(dst)); + gen1 = rt_genid_ipv6(net); + /* avoid storing a stale cache or local address */ spin_lock_bh(&peer->lock); if (likely(ovpn_dst_cache_current(peer, bind, key))) { - if (!reset_local) { - dst_cache_set_ip6(cache, dst, &fl.saddr); + /* cache the dst with the original cookie only if the learned + * local source was not reset and the FIB did not change + */ + if (!reset_local && likely(gen0 == gen1)) { + dst_cache_set_ip6_cookie(cache, dst, &fl.saddr, cookie); spin_unlock_bh(&peer->lock); goto transmit; } - /* invalidate per-CPU dst entries that may still carry - * the stale source - */ - dst_cache_reset(cache); + if (reset_local) { + /* invalidate per-CPU dst entries that may still carry + * the stale source + */ + dst_cache_reset(cache); + + /* preserve the current remote */ + memcpy(&remote, &bind->remote, + sizeof(struct sockaddr_in6)); + /* The current packet already has a valid + * wildcard-source route. If replacing the bind fails, + * leave the stale local in place; a later cache miss + * will retry the repair. + */ + ovpn_peer_reset_sockaddr(peer, &remote, &local); + } - /* preserve the current remote */ - memcpy(&remote, &bind->remote, sizeof(struct sockaddr_in6)); - /* The current packet already has a valid wildcard-source route. - * If replacing the bind fails, leave the stale local in place; - * a later cache miss will retry the repair. - */ - ovpn_peer_reset_sockaddr(peer, &remote, &local); } spin_unlock_bh(&peer->lock); diff --git a/include/net/dst_cache.h b/include/net/dst_cache.h index 1961699598e2..5f9cc4fe926c 100644 --- a/include/net/dst_cache.h +++ b/include/net/dst_cache.h @@ -45,6 +45,19 @@ void dst_cache_set_ip4(struct dst_cache *dst_cache, struct dst_entry *dst, #if IS_ENABLED(CONFIG_IPV6) +/** + * dst_cache_set_ip6_cookie - store ipv6 dst with caller-provided cookie + * @dst_cache: the cache + * @dst: the entry to be cached + * @saddr: the source address to be stored inside the cache + * @cookie: the route validation cookie to store with @dst + * + * local BH must be disabled. + */ +void dst_cache_set_ip6_cookie(struct dst_cache *dst_cache, + struct dst_entry *dst, + const struct in6_addr *saddr, u32 cookie); + /** * dst_cache_set_ip6 - store the ipv6 dst into the cache * @dst_cache: the cache diff --git a/net/core/dst_cache.c b/net/core/dst_cache.c index 9ab4902324e1..1b5e825818ab 100644 --- a/net/core/dst_cache.c +++ b/net/core/dst_cache.c @@ -117,8 +117,9 @@ void dst_cache_set_ip4(struct dst_cache *dst_cache, struct dst_entry *dst, EXPORT_SYMBOL_GPL(dst_cache_set_ip4); #if IS_ENABLED(CONFIG_IPV6) -void dst_cache_set_ip6(struct dst_cache *dst_cache, struct dst_entry *dst, - const struct in6_addr *saddr) +void dst_cache_set_ip6_cookie(struct dst_cache *dst_cache, + struct dst_entry *dst, + const struct in6_addr *saddr, u32 cookie) { struct dst_cache_pcpu *idst; @@ -128,11 +129,18 @@ void dst_cache_set_ip6(struct dst_cache *dst_cache, struct dst_entry *dst, local_lock_nested_bh(&dst_cache->cache->bh_lock); idst = this_cpu_ptr(dst_cache->cache); - dst_cache_per_cpu_dst_set(idst, dst, - rt6_get_cookie(dst_rt6_info(dst))); + dst_cache_per_cpu_dst_set(idst, dst, cookie); idst->in6_saddr = *saddr; local_unlock_nested_bh(&dst_cache->cache->bh_lock); } +EXPORT_SYMBOL_GPL(dst_cache_set_ip6_cookie); + +void dst_cache_set_ip6(struct dst_cache *dst_cache, struct dst_entry *dst, + const struct in6_addr *saddr) +{ + dst_cache_set_ip6_cookie(dst_cache, dst, saddr, + rt6_get_cookie(dst_rt6_info(dst))); +} EXPORT_SYMBOL_GPL(dst_cache_set_ip6); struct dst_entry *dst_cache_get_ip6(struct dst_cache *dst_cache,