From patchwork Wed Jul 29 15:37:39 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ralf Lici X-Patchwork-Id: 5183 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:fd0b:b0:87d:ab56:3700 with SMTP id cw11csp2131964mac; Wed, 29 Jul 2026 08:42:37 -0700 (PDT) X-Forwarded-Encrypted: i=2; AHgh+RouKFXUw3GbeBesicC9hBXF2xbOuwpLL0faQqSPhWdgGfGM2FguVxnwih+DR17G2DgnaEGq39xptXo=@openvpn.net X-Received: by 2002:a05:6870:3c07:b0:44d:133f:dd78 with SMTP id 586e51a60fabf-4586d1d67cbmr3959886fac.43.1785339757599; Wed, 29 Jul 2026 08:42:37 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1785339757; cv=none; d=google.com; s=arc-20260327; b=C4Sp9cYYdmtWCyz+1FCxeAPcxlhBw5M15ExsGZ8g0GHQUQZ9KhhoBTvSCOoG9uW6jm 7WgKuEOtQjWcCr17G/7IZLuMKX9/T5C/Bm7nxOjEsg//V5Db7tjjXJAg2b/iyb0rbZR2 x22lEIyl+HZ7HN08lArsC8NnnYt6wDNH3eclqcW+K/Xrpp1PKtrSVGKVh8KODTVlJOJa OaEG5pG+JvoX6/SdqLE+8CtcZYSBbKoEhIsJdrYyP2X4v5oa5iGrFyng2pSIJSm9lQGV I5IGfjNeEV0RdebVXTdhlpuS0BJFnIZ07E1T2zcR0BE3/2iMLk8hsDOYtNiKgV24lihj fYmQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature:dkim-signature; bh=8cGRYLl9DNQAa1p+DdGbUHxB2O8lL7fkPJrSV01Cyzc=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=SBR2tf7IJ1/ZH5zNorMGz/a68D/6ybnjua8FJ5Fu9CUJs5YwyctcBqWoZ371ImnBq9 cAVtCJETuNMWQl+wb7KSJma1mDg9+1tY4fW095MkrCr/YjEcmvHURZW/QcuVCICnI7CD Xfnuly94gVjUbKGciQStu2es8FLWltx4g1XOSZagi+JR4y6pB7EIzzMp7isL0NAkMJa7 NIi8M+89cEm9y6+hwfgvUwA/pNdKev9l1rOSFBc+fg27Wr8FdUklfgnqWXpRbo8Jh1oK S7y1jiDDIY7DLRXvdSE/LeRXwIRVFciCZqcGwfMZJBOymUvk9UbDdNJaHe10YcVlYgW4 8dNg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=k1Ni4IjL; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=YhMRyRIj; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=NKVRWm9A; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=hHKkNcIj; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 586e51a60fabf-45886498708si2925863fac.102.2026.07.29.08.42.37 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 29 Jul 2026 08:42:37 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=k1Ni4IjL; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=YhMRyRIj; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=NKVRWm9A; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=hHKkNcIj; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=8cGRYLl9DNQAa1p+DdGbUHxB2O8lL7fkPJrSV01Cyzc=; b=k1Ni4IjLo3Ha4z+mfK2nUOkG5G EdIWUF7fO7sAoprwty0sHU2T+GS7J11wCpnkuSH6lhFq6okrXmaVKGzH1bYSBiQeMv5wBLlGYYfWH n+utaUF4zmCQ7fxSnTRrKeFtTfhEwivyWegGTk33nuqixXJSFOPQ8Q+aFG9ZAuLtxegg=; Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1wp6QU-0002WH-Tp; Wed, 29 Jul 2026 15:42:34 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1wp6QE-0002Vh-Nn for openvpn-devel@lists.sourceforge.net; Wed, 29 Jul 2026 15:42:18 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=2vjgLsDKJbs5n1mVWaNjla9Xm1S5OTNt2up56irwDqk=; b=YhMRyRIjji5J4Z1nsPdKmpYgYR a2aEo7bz9TFotPm0IxNwlLeBClx0MQmPd/bG/URgSI/ub2Ihm8pvH/8TdNkgqhRwwrxi+PJyzRy2O tXNg3giXRbOoMKospp259bv90AQIaEH7M9Mm62J904ttFcRUnbucjKII8/ltQqWnZm5U=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=2vjgLsDKJbs5n1mVWaNjla9Xm1S5OTNt2up56irwDqk=; b=NKVRWm9AcRUq/x6d6ZHlb93toV yemxanD++ZrfPnWHskXFigNL5PzZHFGdRBVRjOBHMW28ZxRZW0AjxZKUVNJyNdJkx5CEp3Ey7JjwQ JpM9Ju5TbIUZ52hIaa7dJ7YA0kX4e6EisuGMcjDd14iUQMfD9S0u9uw/ZBBrfxyZD7gw=; Received: from mout-b-110.mailbox.org ([195.10.208.55]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1wp6QD-0002tz-9O for openvpn-devel@lists.sourceforge.net; Wed, 29 Jul 2026 15:42:18 +0000 Received: from smtp2.mailbox.org (smtp2.mailbox.org [IPv6:2001:67c:2050:b231:465::2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-b-110.mailbox.org (Postfix) with ESMTPS id 4h9GmK3b83zNlmH; Wed, 29 Jul 2026 17:42:09 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandelbit.com; s=MBO0001; t=1785339729; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=2vjgLsDKJbs5n1mVWaNjla9Xm1S5OTNt2up56irwDqk=; b=hHKkNcIjxRopzPbYfiYVcBqXYrAssZ/Sejv0hAt6qhZVlX2KKBJB4moyPTPPv07dIkVEPB BifP4R1/CI4P3s+/i6tUQSezQUmsODyVig0yyd99sZcWXLdfQxAW93fSo4dznbpd9vK+ef yUQXnnEY9i1uEq3JCGH6sRIRgqx1+clmqjDMo3ZSI+Vzr/a1IP005Advw/Kv9xjOheSUDV 5dj0qBmCf6gFMRtNB+k5JV5o5ek6yeQj6gCoPEv+qlJ0XpU9UDBqhRIkSckoS1tF8cwNct KE1NUSlvuVvJl2XxSFmEy2VRICtXGcHpu2AbPfL37XWDcldcirk2TLmD6QH2zA== Authentication-Results: outgoing_mbo_mout; dkim=none; spf=pass (outgoing_mbo_mout: domain of ralf@mandelbit.com designates 2001:67c:2050:b231:465::2 as permitted sender) smtp.mailfrom=ralf@mandelbit.com From: Ralf Lici To: openvpn-devel@lists.sourceforge.net Date: Wed, 29 Jul 2026 17:37:39 +0200 Message-ID: In-Reply-To: References: MIME-Version: 1.0 X-Rspamd-Queue-Id: 4h9GmK3b83zNlmH X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-1.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: ovpn_peer_hash_vpn_ip updates the per-peer VPN address hash entries after userspace changes a peer VPN address. The current code removes an old hash entry only when the new address for that family is [...] Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid X-Headers-End: 1wp6QD-0002tz-9O Subject: [Openvpn-devel] [PATCH ovpn net 1/5] ovpn: always unhash old VPN addresses before rehashing X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1872064422020742006 X-GMAIL-MSGID: 1872064422020742006 ovpn_peer_hash_vpn_ip updates the per-peer VPN address hash entries after userspace changes a peer VPN address. The current code removes an old hash entry only when the new address for that family is not the unspecified address. When an address is cleared to 0.0.0.0 or ::, its hash node therefore remains linked in the bucket selected by the old address. The address comparison performed during lookup prevents the old address from matching, but the table retains a stale entry until the peer is removed or another address is configured for that family. Always remove both old VPN address hash entries before conditionally adding the currently configured addresses back. This ensures that a cleared address leaves its hash node unhashed. Fixes: 1d36a36f6d53 ("ovpn: implement peer add/get/dump/delete via netlink") Signed-off-by: Ralf Lici --- drivers/net/ovpn/peer.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/drivers/net/ovpn/peer.c b/drivers/net/ovpn/peer.c index a21d02ac715e..6b1f176433d9 100644 --- a/drivers/net/ovpn/peer.c +++ b/drivers/net/ovpn/peer.c @@ -906,10 +906,11 @@ void ovpn_peer_hash_vpn_ip(struct ovpn_peer *peer) if (peer->ovpn->mode != OVPN_MODE_MP) return; - if (peer->vpn_addrs.ipv4.s_addr != htonl(INADDR_ANY)) { - /* remove potential old hashing */ - hlist_nulls_del_init_rcu(&peer->hash_entry_addr4); + /* remove potential old hashing */ + hlist_nulls_del_init_rcu(&peer->hash_entry_addr4); + hlist_nulls_del_init_rcu(&peer->hash_entry_addr6); + if (peer->vpn_addrs.ipv4.s_addr != htonl(INADDR_ANY)) { nhead = ovpn_get_hash_head(peer->ovpn->peers->by_vpn_addr4, &peer->vpn_addrs.ipv4, sizeof(peer->vpn_addrs.ipv4)); @@ -917,9 +918,6 @@ void ovpn_peer_hash_vpn_ip(struct ovpn_peer *peer) } if (!ipv6_addr_any(&peer->vpn_addrs.ipv6)) { - /* remove potential old hashing */ - hlist_nulls_del_init_rcu(&peer->hash_entry_addr6); - nhead = ovpn_get_hash_head(peer->ovpn->peers->by_vpn_addr6, &peer->vpn_addrs.ipv6, sizeof(peer->vpn_addrs.ipv6)); From patchwork Wed Jul 29 15:37:40 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ralf Lici X-Patchwork-Id: 5182 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:fd0b:b0:87d:ab56:3700 with SMTP id cw11csp2131939mac; Wed, 29 Jul 2026 08:42:36 -0700 (PDT) X-Forwarded-Encrypted: i=2; AHgh+RrqR/D5eI2QWSBFbNUzdmTkNHrnSzExbET6KEI+MWxR+n89j2FV5oLx9UUJBS6H6rXVhpbKcwK9RKo=@openvpn.net X-Received: by 2002:a05:6870:934b:b0:456:ce37:7f7 with SMTP id 586e51a60fabf-4586cc62952mr3920980fac.4.1785339756121; Wed, 29 Jul 2026 08:42:36 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1785339756; cv=none; d=google.com; s=arc-20260327; b=FBEts2Z0gPXWfRH/Y8BEL0E8U84LwDdDRHz+0EyzF3SwXlb+Z5nzSFPKj2ZxmXRcxA BnKl408f7r4TTMwr9tv6vt0BtExQAhvQ9ZCFoRWZlF9aOhLYV7A95zCauUnEINLapg3j EY6vciJeeF3t0UVRfd4XGFCgbn/zW5ERrNP4TgGI2fASmcS7ufh/U5qQbFexNIA04UHz 6iyV7+QJuCF46jdDTwGLCoQbiU25Ena18jNBdtu2Ej1yDmDOAgQQC45Cr9NgiQvKwEgi gGs0gYBnwpxEib4BlF/czvS2DzAMEZj2qykF+J+TH1aOmlplOLv3ZXe5IhrcdY1Ul5KB YOgA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature:dkim-signature; bh=QKPqnSHnJdtzHUpsCU99Vs8LNJO+RUkPOBQjeweWZaY=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=g9fXD2tO32oHnrP4nGBydWkqSv7jZSGCYMEoU6ESaYwOiKem/0SHwARubvFa2xTn/u xz3chsvWQPTXHl9VYcgYdznP+Q/kEXBPhBnkfKjcG7SC9+8hyV7TWKvCVT3ROup6iN5t VTXtozGLBgritoRsJJfob1NoCAmWho/tu5KFoGZj0C1c7/ZWL66zaWWYhKAMNgNXfgPk u6qKcpb5plemU9KhjlCBpchLRau1t0caHyM6RIN752y/2ZfMNKQfpoCgpnTlb0Xo5v0d SfuKzob+1ja4VjfmRmLtDwshzS5t3jWNWDUjgpJF51uf2Xi+CJs38Bb/InieHENaHMHX SekA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=anjyja7c; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=ZK6M+TeR; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=cg61Zs+Z; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=IyrehkFG; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 586e51a60fabf-45886c03c41si2878561fac.288.2026.07.29.08.42.35 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 29 Jul 2026 08:42:36 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=anjyja7c; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=ZK6M+TeR; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=cg61Zs+Z; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=IyrehkFG; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=QKPqnSHnJdtzHUpsCU99Vs8LNJO+RUkPOBQjeweWZaY=; b=anjyja7chFpbVLqMX8jEFdnXrj Fhnsn9CMyEw/J9CLjs+3VhC+zn4mtCq3R1lTT8Z30SJ9PVjCqcnuKChMBOE8DMplRXIqb1U0LCiSS 3fpayMz+0ABPL+jyxYbld2E1WyoM6cKOMyRCTpgsS6mKGcglye9aNmULRtDcFBKE0fsU=; Received: from [127.0.0.1] (helo=sfs-ml-2.v29.lw.sourceforge.com) by sfs-ml-2.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1wp6QS-000261-CW; Wed, 29 Jul 2026 15:42:33 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-2.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1wp6QE-00025c-EW for openvpn-devel@lists.sourceforge.net; Wed, 29 Jul 2026 15:42:19 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=yioZm92fLiFn6C4gYvyKN6K6/h5OYEmJfXJdl0DvpPs=; b=ZK6M+TeRTyMgOdFfpPyFO6J5qq soMvgSX776l5SAnrF7DSKxMPw53/w9UiZ7qy+VlMTOrQ5jEUj2cpLM9qicFfRcdFdhx6ztUsTUGPc w70NUCtropONZnF4S5zmHUUr+CajZLBSqCNmTmy0HM2VZGKblruTK+1YlKhO5x2RuC0M=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=yioZm92fLiFn6C4gYvyKN6K6/h5OYEmJfXJdl0DvpPs=; b=cg61Zs+ZywELElUofSzlBrNrml KDj7SOaha4Hco/5Dd7YuSs9YV76icJI9cmoKCxim5te1Fh/KvQahVSrYoJ01tJzkU11u5TdQpZent EvH0Jnr214tDefmhD77/vksDVuVWiimQvGZ+VussY6KNHjkOsQ/PYyzMgzUbziIXm8cc=; Received: from mout-b-210.mailbox.org ([195.10.208.40]) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1wp6QH-0001TC-2y for openvpn-devel@lists.sourceforge.net; Wed, 29 Jul 2026 15:42:19 +0000 Received: from smtp2.mailbox.org (unknown [10.196.197.2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-b-210.mailbox.org (Postfix) with ESMTPS id 4h9GmL1685zFr0N; Wed, 29 Jul 2026 17:42:10 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandelbit.com; s=MBO0001; t=1785339730; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=yioZm92fLiFn6C4gYvyKN6K6/h5OYEmJfXJdl0DvpPs=; b=IyrehkFGcD5+45kq5PdXdeA+VehyuTTuXY7OsASx4/oCtwGoZjWo3L3z6EenFUvuyfWUFS fF5t6MVI73nGsi7F5A6mPWC6ly01BSOVh2axIH3SxnoCSDr0bZ1Rj0AF6t14I+umsODGIq W6n1NFk40ZXk1XBkgkPeW0Si6ugR6ZBdpV0KyIsf/lEJ57jR8RnKS/Yz0f4Z55V7M6mGNR Fd2fQCgtNR2G/H9FnAzwnOIcuIiNIDtI2S1rNnmJ1ZwGx3KXnFJ/2a8SoKzns8hr7Im86/ nvmLQaaquRQC/VtBZdhYAOCC+y3VUHW216sUF6Y/WDq1cR9eEAW5HmNA5ob0LQ== From: Ralf Lici To: openvpn-devel@lists.sourceforge.net Date: Wed, 29 Jul 2026 17:37:40 +0200 Message-ID: <872f401e31dae10388fe65b45463c5c55b96ac86.1785338921.git.ralf@mandelbit.com> In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-1.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: In MP mode, ovpn uses the peer VPN addresses as lookup keys for selecting the peer that should receive an outgoing tunnel packet. However, the netlink peer configuration path does not currently reject [...] Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid X-Headers-End: 1wp6QH-0001TC-2y Subject: [Openvpn-devel] [PATCH ovpn net 2/5] ovpn: reject duplicate peer VPN addresses X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1872064420064401485 X-GMAIL-MSGID: 1872064420064401485 In MP mode, ovpn uses the peer VPN addresses as lookup keys for selecting the peer that should receive an outgoing tunnel packet. However, the netlink peer configuration path does not currently reject duplicate VPN addresses. If two peers are configured with the same VPN address, both can be inserted in the VPN address hash table and lookups return whichever peer is found first. This makes peer selection ambiguous and dependent on hash insertion order. Reject peer creation or update when the resulting VPN address is already assigned to another peer. Ignore unspecified addresses because those are not inserted in the VPN address hash tables. Fixes: 1d36a36f6d53 ("ovpn: implement peer add/get/dump/delete via netlink") Signed-off-by: Ralf Lici --- drivers/net/ovpn/netlink.c | 37 ++++++++++++++++++++++------- drivers/net/ovpn/peer.c | 48 +++++++++++++++++++++++++++++++++++++- drivers/net/ovpn/peer.h | 4 ++++ 3 files changed, 80 insertions(+), 9 deletions(-) diff --git a/drivers/net/ovpn/netlink.c b/drivers/net/ovpn/netlink.c index 4c66c1ec497e..79775af26fda 100644 --- a/drivers/net/ovpn/netlink.c +++ b/drivers/net/ovpn/netlink.c @@ -474,8 +474,10 @@ int ovpn_nl_peer_new_doit(struct sk_buff *skb, struct genl_info *info) int ovpn_nl_peer_set_doit(struct sk_buff *skb, struct genl_info *info) { - struct nlattr *attrs[OVPN_A_PEER_MAX + 1]; struct ovpn_priv *ovpn = info->user_ptr[0]; + struct nlattr *attrs[OVPN_A_PEER_MAX + 1]; + struct in6_addr vpn_addr6; + struct in_addr vpn_addr4; struct ovpn_socket *sock; struct ovpn_peer *peer; u32 peer_id; @@ -522,22 +524,41 @@ int ovpn_nl_peer_set_doit(struct sk_buff *skb, struct genl_info *info) rcu_read_unlock(); spin_lock_bh(&ovpn->lock); - ret = ovpn_nl_peer_modify(peer, info, attrs); - if (ret < 0) { - spin_unlock_bh(&ovpn->lock); - ovpn_peer_put(peer); - return ret; + + vpn_addr4 = peer->vpn_addrs.ipv4; + vpn_addr6 = peer->vpn_addrs.ipv6; + + if (attrs[OVPN_A_PEER_VPN_IPV4]) + vpn_addr4.s_addr = nla_get_in_addr(attrs[OVPN_A_PEER_VPN_IPV4]); + + if (attrs[OVPN_A_PEER_VPN_IPV6]) + vpn_addr6 = nla_get_in6_addr(attrs[OVPN_A_PEER_VPN_IPV6]); + + /* reject peer with conflicting VPN address */ + if ((attrs[OVPN_A_PEER_VPN_IPV4] || attrs[OVPN_A_PEER_VPN_IPV6]) && + ovpn_peer_vpn_addr_conflict(ovpn, peer, &vpn_addr4, &vpn_addr6)) { + NL_SET_ERR_MSG_FMT_MOD(info->extack, + "VPN IP is already assigned to another peer"); + ret = -EADDRINUSE; + goto unlock; } + ret = ovpn_nl_peer_modify(peer, info, attrs); + if (ret < 0) + goto unlock; + /* ret == 1 means that VPN IPv4/6 has been modified and rehashing * is required */ - if (ret > 0) + if (ret > 0) { ovpn_peer_hash_vpn_ip(peer); + ret = 0; + } +unlock: spin_unlock_bh(&ovpn->lock); ovpn_peer_put(peer); - return 0; + return ret; } static int ovpn_nl_send_peer(struct sk_buff *skb, const struct genl_info *info, diff --git a/drivers/net/ovpn/peer.c b/drivers/net/ovpn/peer.c index 6b1f176433d9..e68699e58a1b 100644 --- a/drivers/net/ovpn/peer.c +++ b/drivers/net/ovpn/peer.c @@ -484,7 +484,7 @@ static struct ovpn_peer *ovpn_peer_get_by_vpn_addr4(struct ovpn_priv *ovpn, * Return: the peer if found or NULL otherwise */ static struct ovpn_peer *ovpn_peer_get_by_vpn_addr6(struct ovpn_priv *ovpn, - struct in6_addr *addr) + const struct in6_addr *addr) { struct hlist_nulls_head *nhead; struct hlist_nulls_node *ntmp; @@ -509,6 +509,45 @@ static struct ovpn_peer *ovpn_peer_get_by_vpn_addr6(struct ovpn_priv *ovpn, return NULL; } +/** + * ovpn_peer_vpn_addr_conflict - check if VPN addresses are already in use + * @ovpn: the openvpn instance to search + * @peer: peer being added or updated, or NULL + * @addr4: VPN IPv4 address to check + * @addr6: VPN IPv6 address to check + * + * Check whether @addr4 or @addr6 is already assigned to another peer. @peer is + * ignored when found, allowing peer updates that keep an existing address. + * Unspecified addresses are ignored. + * + * Note: the caller must hold @ovpn->lock. + * + * Return: true on conflict, false otherwise. + */ +bool ovpn_peer_vpn_addr_conflict(struct ovpn_priv *ovpn, + const struct ovpn_peer *peer, + const struct in_addr *addr4, + const struct in6_addr *addr6) +{ + struct ovpn_peer *tmp; + + lockdep_assert_held(&ovpn->lock); + + if (addr4->s_addr != htonl(INADDR_ANY)) { + tmp = ovpn_peer_get_by_vpn_addr4(ovpn, addr4->s_addr); + if (tmp && tmp != peer) + return true; + } + + if (!ipv6_addr_any(addr6)) { + tmp = ovpn_peer_get_by_vpn_addr6(ovpn, addr6); + if (tmp && tmp != peer) + return true; + } + + return false; +} + /** * ovpn_peer_transp_match - check if sockaddr and peer binding match * @peer: the peer to get the binding from @@ -952,6 +991,13 @@ static int ovpn_peer_add_mp(struct ovpn_priv *ovpn, struct ovpn_peer *peer) goto out; } + /* reject peer with conflicting VPN address */ + if (ovpn_peer_vpn_addr_conflict(ovpn, NULL, &peer->vpn_addrs.ipv4, + &peer->vpn_addrs.ipv6)) { + ret = -EADDRINUSE; + goto out; + } + bind = rcu_dereference_protected(peer->bind, true); /* peers connected via TCP have bind == NULL */ if (bind) { diff --git a/drivers/net/ovpn/peer.h b/drivers/net/ovpn/peer.h index 86c8cffada6d..6f7df9ae8fe4 100644 --- a/drivers/net/ovpn/peer.h +++ b/drivers/net/ovpn/peer.h @@ -149,6 +149,10 @@ struct ovpn_peer *ovpn_peer_get_by_transp_addr(struct ovpn_priv *ovpn, struct ovpn_peer *ovpn_peer_get_by_id(struct ovpn_priv *ovpn, u32 peer_id); struct ovpn_peer *ovpn_peer_get_by_dst(struct ovpn_priv *ovpn, struct sk_buff *skb); +bool ovpn_peer_vpn_addr_conflict(struct ovpn_priv *ovpn, + const struct ovpn_peer *peer, + const struct in_addr *addr4, + const struct in6_addr *addr6); void ovpn_peer_hash_vpn_ip(struct ovpn_peer *peer); bool ovpn_peer_check_by_src(struct ovpn_priv *ovpn, struct sk_buff *skb, struct ovpn_peer *peer); From patchwork Wed Jul 29 15:37:41 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ralf Lici X-Patchwork-Id: 5180 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:fd0b:b0:87d:ab56:3700 with SMTP id cw11csp2131935mac; Wed, 29 Jul 2026 08:42:36 -0700 (PDT) X-Forwarded-Encrypted: i=2; AHgh+RpXkFNeU2hNlxtQtLMytjCXSKL7BEtuMKg6HLMsnFUIcaYMtSLnsn+1RBZ4BQ5Waiu9VOUBG/1Du/k=@openvpn.net X-Received: by 2002:a05:6830:1215:b0:7e9:e961:92e9 with SMTP id 46e09a7af769-7f01410b49bmr1052973a34.4.1785339755914; Wed, 29 Jul 2026 08:42:35 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1785339755; cv=none; d=google.com; s=arc-20260327; b=HUPUwaGPchgX+G2HKQRxxXyK/n8p/mzcl/wT16/O4l0NnCdG/85XW7voDPCqgXZvUV WwZokKVT1qqQ16LlmU/HRsa83wFR36Orpp/hvZkoirdV/CL5Ur9Yv1JT5qaGvKRrsOSE L5SkSANEidEw3fi83LBoALNyv+h5jlZ1TKL7JRq7fRbNFVd8tEPU9fqJJgDqrz/spflJ USQIBCvwOR3rSbtmtShcKn/6r9nGv8SDU/JU15vaIM5Q5toZ8IilRsX0iiOxuUOkRS17 uJ02NjfRcZE3/opk49GrYrQCcZJkinxdQph378OYbD5cj35knbHJRl6AwK42n6X6a+DF OYsA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature:dkim-signature; bh=txNzFFfVBQkWDYR3vfhax3izHp5zZDYU5EDvjpSsYW0=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=SD1sN/GSt2+B0p99TYWTVbMTdVcc2PZapgWarAcuL9I02ioD+mt7qpPANDkmFbSJsk Q6SVuF1CPBPs1IIrsihEgRaoPA/oZboG3uuJtlOvI/LD/7xfUAK6/ErjvPFOaM50WfYh /RR1AKLUJ71Q60n1kdrDRTKNtFrRHAarTlMSS5UbDdN3biSSHh1xTcf3ScsXutSP8cOX YzGtWp9sVnvGj+fuvOYYpLqhONG+DM1rwvY3vCcg7Lzl+beGqzlYSCaU+ZV+u5P5U46r RQzHdxJpZxom1RN0A1Q9IDakIQIqJFlKDUhuiFIuGfhD5zFMDDqohObwlJ0m5qIduni/ 8V8w==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=LTQBMGJu; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=FvnUf76b; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=YJFwLuVr; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=yd+q9AMw; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 46e09a7af769-7f00d5df29fsi2478376a34.11.2026.07.29.08.42.35 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 29 Jul 2026 08:42:35 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=LTQBMGJu; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=FvnUf76b; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=YJFwLuVr; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=yd+q9AMw; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=txNzFFfVBQkWDYR3vfhax3izHp5zZDYU5EDvjpSsYW0=; b=LTQBMGJuheETKX9uXUXyC70PV7 OirFpuEgwfom/fAIwLQLv/JGdurSJ0dh9fRilJc1UO4eIgg+IF+KixtVJFNMzVD71NVWAhbs4aMu9 M6KZlfB5nm1eK9mIv+uURSWFn9wV43j16eF4ir2P4/pZs9kuTFbiMPWYzLwaq59wtCug=; Received: from [127.0.0.1] (helo=sfs-ml-1.v29.lw.sourceforge.com) by sfs-ml-1.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1wp6QV-0000HI-Ki; Wed, 29 Jul 2026 15:42:33 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-1.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1wp6QH-0000Gm-7W for openvpn-devel@lists.sourceforge.net; Wed, 29 Jul 2026 15:42:18 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=WapK7H1NDi6EtOG50cprXW6e9N5mJDrFi0U+8naQrBk=; b=FvnUf76biez6V5iKS+MV2dDnDh bVZujNj03eHYzDagNdEvFe3j2WJIGrx+St4CYPTmGhDPXxRe8TsfTtoyjARAORJwtjQWOg2mgXo+C Z3nv+Y9vNKupwg4UJV5IgVM+jjgUQ4BdoaaD/dYLPdlqDMVBrUc2pGAoO210x9NH+9/8=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=WapK7H1NDi6EtOG50cprXW6e9N5mJDrFi0U+8naQrBk=; b=YJFwLuVrRk03YIJEnKs1EHROH1 Rus1N+k4OVmHZbjW7i+vJ2p7hY5kdBi6HuBYaXy8Yx1EQdfGEjWl0EzASxgvFx53v3V27rQQyFhuI j4/f6gX3ywR9Z68McJ0uxSdQjnrc55cNI9a1sy8nTfwy1JgMQFA6occViI9zvKf/b/XQ=; Received: from mout-b-206.mailbox.org ([195.10.208.51]) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1wp6QH-0001TD-JU for openvpn-devel@lists.sourceforge.net; Wed, 29 Jul 2026 15:42:18 +0000 Received: from smtp2.mailbox.org (unknown [10.196.197.2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-b-206.mailbox.org (Postfix) with ESMTPS id 4h9GmL5713zXb; Wed, 29 Jul 2026 17:42:10 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandelbit.com; s=MBO0001; t=1785339730; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=WapK7H1NDi6EtOG50cprXW6e9N5mJDrFi0U+8naQrBk=; b=yd+q9AMwqB+ArkwOkdvwEOo2Y158MgikpViOtHIuZjMYIpBFpia3dj0nBXYjrQgoCkktCR xr9JqRbZl44FnmnrMos9bZdYf+UM1bPdGn2tQ/lPELK/TKovjItwO3NM9m7/IcnumaxjI2 b91L0OsVqccG+QAKwxNPQHe8IQJxXLKOfx6vQf1SiuQsd0gisuUMMBteMe0Ckqmm+Yujo0 6OzMs9ILhiA/KStVyMq9BbyfktvkVL6Nw8Y97MaIhTohP0MGSVFouBRgz5vpHofAdNMiDv Gk1vXLtoeiwRUFYPtSfsVUmTzDPXvFm+/JuUf8pcO5vRH2cb3Z5tkHrUFQ5RGg== From: Ralf Lici To: openvpn-devel@lists.sourceforge.net Date: Wed, 29 Jul 2026 17:37:41 +0200 Message-ID: <17ced9a7caee691e602e3c02f5e399aa9a35067c.1785338921.git.ralf@mandelbit.com> In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: In MP mode, ovpn uses the peer VPN addresses to select the peer for outgoing tunnel packets. Peer creation currently requires a VPN IPv4 or IPv6 attribute, but it only checks for the presence of the a [...] Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.0 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2) [195.10.208.51 listed in wl.mailspike.net] X-Headers-End: 1wp6QH-0001TD-JU Subject: [Openvpn-devel] [PATCH ovpn net 3/5] ovpn: reject multipeer peers without VPN addresses X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1872064419713721038 X-GMAIL-MSGID: 1872064419713721038 In MP mode, ovpn uses the peer VPN addresses to select the peer for outgoing tunnel packets. Peer creation currently requires a VPN IPv4 or IPv6 attribute, but it only checks for the presence of the attribute and not for a usable address value. This allows userspace to create an MP peer with only unspecified VPN addresses, or to update an existing peer so that both VPN address families become unspecified. Such a peer cannot be selected through the VPN address hash tables. Reject MP peer creation or update when the resulting peer would not have at least one VPN address configured. Fixes: 1d36a36f6d53 ("ovpn: implement peer add/get/dump/delete via netlink") Signed-off-by: Ralf Lici --- drivers/net/ovpn/netlink.c | 47 +++++++++++++++++++++++++++----------- 1 file changed, 34 insertions(+), 13 deletions(-) diff --git a/drivers/net/ovpn/netlink.c b/drivers/net/ovpn/netlink.c index 79775af26fda..43e6c7a29a6f 100644 --- a/drivers/net/ovpn/netlink.c +++ b/drivers/net/ovpn/netlink.c @@ -346,8 +346,10 @@ static int ovpn_nl_peer_modify(struct ovpn_peer *peer, struct genl_info *info, int ovpn_nl_peer_new_doit(struct sk_buff *skb, struct genl_info *info) { - struct nlattr *attrs[OVPN_A_PEER_MAX + 1]; + struct in_addr vpn_addr4 = { .s_addr = INADDR_ANY }; + struct in6_addr vpn_addr6 = IN6ADDR_ANY_INIT; struct ovpn_priv *ovpn = info->user_ptr[0]; + struct nlattr *attrs[OVPN_A_PEER_MAX + 1]; struct ovpn_socket *ovpn_sock; struct socket *sock = NULL; struct ovpn_peer *peer; @@ -371,11 +373,19 @@ int ovpn_nl_peer_new_doit(struct sk_buff *skb, struct genl_info *info) return -EINVAL; /* in MP mode VPN IPs are required for selecting the right peer */ - if (ovpn->mode == OVPN_MODE_MP && !attrs[OVPN_A_PEER_VPN_IPV4] && - !attrs[OVPN_A_PEER_VPN_IPV6]) { - NL_SET_ERR_MSG_FMT_MOD(info->extack, - "VPN IP must be provided in MP mode"); - return -EINVAL; + if (ovpn->mode == OVPN_MODE_MP) { + if (attrs[OVPN_A_PEER_VPN_IPV4]) + vpn_addr4.s_addr = + nla_get_in_addr(attrs[OVPN_A_PEER_VPN_IPV4]); + if (attrs[OVPN_A_PEER_VPN_IPV6]) + vpn_addr6 = + nla_get_in6_addr(attrs[OVPN_A_PEER_VPN_IPV6]); + + if (!vpn_addr4.s_addr && ipv6_addr_any(&vpn_addr6)) { + NL_SET_ERR_MSG_FMT_MOD(info->extack, + "VPN IP must be provided in MP mode"); + return -EINVAL; + } } peer_id = nla_get_u32(attrs[OVPN_A_PEER_ID]); @@ -534,13 +544,24 @@ int ovpn_nl_peer_set_doit(struct sk_buff *skb, struct genl_info *info) if (attrs[OVPN_A_PEER_VPN_IPV6]) vpn_addr6 = nla_get_in6_addr(attrs[OVPN_A_PEER_VPN_IPV6]); - /* reject peer with conflicting VPN address */ - if ((attrs[OVPN_A_PEER_VPN_IPV4] || attrs[OVPN_A_PEER_VPN_IPV6]) && - ovpn_peer_vpn_addr_conflict(ovpn, peer, &vpn_addr4, &vpn_addr6)) { - NL_SET_ERR_MSG_FMT_MOD(info->extack, - "VPN IP is already assigned to another peer"); - ret = -EADDRINUSE; - goto unlock; + /* in MP mode VPN IPs are required for selecting the right peer */ + if (ovpn->mode == OVPN_MODE_MP && + (attrs[OVPN_A_PEER_VPN_IPV4] || attrs[OVPN_A_PEER_VPN_IPV6])) { + if (!vpn_addr4.s_addr && ipv6_addr_any(&vpn_addr6)) { + NL_SET_ERR_MSG_FMT_MOD(info->extack, + "MP peer must have at least one valid VPN IP"); + ret = -EINVAL; + goto unlock; + } + + /* reject peer with conflicting VPN address */ + if (ovpn_peer_vpn_addr_conflict(ovpn, peer, &vpn_addr4, + &vpn_addr6)) { + NL_SET_ERR_MSG_FMT_MOD(info->extack, + "VPN IP is already assigned to another peer"); + ret = -EADDRINUSE; + goto unlock; + } } ret = ovpn_nl_peer_modify(peer, info, attrs); From patchwork Wed Jul 29 15:37:42 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ralf Lici X-Patchwork-Id: 5184 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:fd0b:b0:87d:ab56:3700 with SMTP id cw11csp2131978mac; Wed, 29 Jul 2026 08:42:38 -0700 (PDT) X-Forwarded-Encrypted: i=2; AHgh+Rot0qBEljL/R2Zu0sT2P+9swAaxyfpSjSES1WhrmJ94i5ePu3Lfr/Ur4LIrzQ1Lsq8cmaJ0Llz4b3A=@openvpn.net X-Received: by 2002:a05:687c:41c8:20b0:456:b63e:658a with SMTP id 586e51a60fabf-4586cd2820emr2728561fac.18.1785339758294; Wed, 29 Jul 2026 08:42:38 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1785339758; cv=none; d=google.com; s=arc-20260327; b=d5FQFNdwoIZN0zy7WxMcqQ4gfSp8vtO2oBz5xqlpYpefr21iMGNFS+il1AC/iDxpks JRMB7HV9g4zc6DS/kbHeNOPHBvGjkxQTlf7qCeHqLFbojbr17tngVK8fddmtDEfTUlCh y4rZeRWXXXU4+GRFYkBVGYEYAmRA9gh7ZEcsbd9OBqJ+JkJuUD9hQoOcLxw54VaM6unC gtjSQkN4joEVODHot3UQBwXTxw4h9rLjHHAuyj5lUftWjv5p7xd8eK2jLp2vN9AdxGoQ BhP9/Mql8CGvLfv9nr+4VJMiHbjl+mRL5suww7LIk1cZFzeMzi4qZp17kFJVXp8Rfxpd 1/AA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature:dkim-signature; bh=jj/mWuysYByh5XYW82uBnbUvdDoErBPDd7MDWKVZRTk=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=TGO3tz9ry4cOXjjsN5NIj+yxN5tXsb96JLF7tXfOz5RhWULVUmOAnY7CmQx30fSZ/+ ZlBXPCpTMK8nvWpK8yEGJR3yt3qf0WshtkHJIKp+kB0AUSIkmphRSbsQ7z7RVTu5GrtU +XWLdStBdKz6BK8l6hLJvHYlXBYujNoRQ2r59mpJY34lCLiVt3SOMPwkH4cBTn6Af65V g6QnZ72AYwHxLOsdIAobI3qt2R+e9/V9AX5Be5KBrqQY6GcFLq9zdK/6zqTqbNz24sQJ 9lGshnYEAJF19U5MhBVibZswOVK5Yr6XFUZ5+FvvO9tqfOkVHm5G5Pf8W2zbS3jbKYfX mHpA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=DZO+CFfi; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=IsfABJ16; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=YWYrjhto; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=SIV4qATO; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 586e51a60fabf-45886c41accsi2780491fac.313.2026.07.29.08.42.38 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 29 Jul 2026 08:42:38 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=DZO+CFfi; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=IsfABJ16; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=YWYrjhto; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=SIV4qATO; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=jj/mWuysYByh5XYW82uBnbUvdDoErBPDd7MDWKVZRTk=; b=DZO+CFfiHemSOV90yMDnXtTrpt YL4Du+pTIdsZClc8f/+BZOuwVq/JNxAmUrupX8l2X+yHB4l/SgrAML83ICCmkpEmYZJ8+baMpVfAJ naVsFFzEwfxTzm4cnk3kiczP/8tBLGIxF7JekHUXYKzbLZYSxgP6zz7/yDwdnAprAG2M=; Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1wp6QV-0002WU-7m; Wed, 29 Jul 2026 15:42:35 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1wp6QG-0002Vr-1C for openvpn-devel@lists.sourceforge.net; Wed, 29 Jul 2026 15:42:20 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=gkiR86nWJ5KqIffl2XADuoX6NqgPodYASX0slnIbrSs=; b=IsfABJ168zCTwXzdtc+LpxCiIm 3icEO2btCPsFd9Qt4Oiyq3sD5gS5CCaSiMkFwTOuLS44/DrbkKmcb9bPteVaLCMsCGh5hnkDhG8lv qOW/Yoq1yQ7XaCd7OwBaNubgYO8uGK63GiHiMFlo5tGw6esxPQICPxfMpLDNYAeSTYq4=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=gkiR86nWJ5KqIffl2XADuoX6NqgPodYASX0slnIbrSs=; b=YWYrjhtoeZe4EdbcCZh46AHWFv qXDfi6tkZEQwnEc/DP8DyrPhQ4wVLs/fmDEK01vfftJa27jRrIToaEnew1OoNV9WcOQv6aHDn7Q48 bnjoJluAZcpR8A22FcpGdJwOpiH96tphrIuKd7e070XksqQxl0H12j8bPK5HiNLvNRTA=; Received: from mout-b-107.mailbox.org ([195.10.208.47]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1wp6QF-0002u5-7O for openvpn-devel@lists.sourceforge.net; Wed, 29 Jul 2026 15:42:19 +0000 Received: from smtp2.mailbox.org (unknown [10.196.197.2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-b-107.mailbox.org (Postfix) with ESMTPS id 4h9GmM368sz3y60; Wed, 29 Jul 2026 17:42:11 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandelbit.com; s=MBO0001; t=1785339731; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=gkiR86nWJ5KqIffl2XADuoX6NqgPodYASX0slnIbrSs=; b=SIV4qATOqdw7Y+vc4QdGXW+eBDn9M9eZ/GXjkvbawug50GzLIIl9Q+xnxAIZK14RsuC1WK BlOrI50lr6hTGDs26yab88VQEQt65O94d1nFnWVFqCXXNBQFvt2JhPdpiiqyXRtY82f0XD 0dJOB7iOMNIs7HmLRU/ipLBU+4fe1ZSQZndyRcPThJAdkjZnIniT4xLukzbvNnYEX+I3cu wUNblq9dyIi6C2xDdOZifEwxTtFcBHDFqlDuLh+TwLEK96fkRwAimGMXXHZgIM8/FOgUQ0 V2lgW6lnPGlb/ZXUYbQL8STlHvf5JScLGg/f9udww2LeGbJfaT5BCyzxzjedPg== From: Ralf Lici To: openvpn-devel@lists.sourceforge.net Date: Wed, 29 Jul 2026 17:37:42 +0200 Message-ID: <934f840c132e350415369712806b3d9d77957ca5.1785338921.git.ralf@mandelbit.com> In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: In MP mode, ovpn uses peer VPN addresses as lookup keys for selecting the peer that should receive outgoing tunnel packets. The netlink configuration path currently accepts address values that cannot [...] Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature X-Headers-End: 1wp6QF-0002u5-7O Subject: [Openvpn-devel] [PATCH ovpn net 4/5] ovpn: reject invalid peer VPN addresses X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1872064422687290893 X-GMAIL-MSGID: 1872064422687290893 In MP mode, ovpn uses peer VPN addresses as lookup keys for selecting the peer that should receive outgoing tunnel packets. The netlink configuration path currently accepts address values that cannot sensibly identify a VPN peer, such as multicast, broadcast or loopback addresses. Reject invalid peer VPN addresses when creating or updating an MP peer. Keep accepting the unspecified address as the internal unset value, provided that at least one VPN address family remains configured. Fixes: 1d36a36f6d53 ("ovpn: implement peer add/get/dump/delete via netlink") Signed-off-by: Ralf Lici --- drivers/net/ovpn/netlink.c | 50 ++++++++++++++++++++++++++++++-------- 1 file changed, 40 insertions(+), 10 deletions(-) diff --git a/drivers/net/ovpn/netlink.c b/drivers/net/ovpn/netlink.c index 43e6c7a29a6f..333e9237e594 100644 --- a/drivers/net/ovpn/netlink.c +++ b/drivers/net/ovpn/netlink.c @@ -179,6 +179,39 @@ static sa_family_t ovpn_nl_family_get(struct nlattr *addr4, return AF_UNSPEC; } +static int ovpn_nl_peer_check_vpn_addrs(const struct in_addr *addr4, + const struct in6_addr *addr6, + struct genl_info *info) +{ + int addr6_type; + + if (addr4->s_addr == htonl(INADDR_ANY) && ipv6_addr_any(addr6)) { + NL_SET_ERR_MSG_MOD(info->extack, + "at least one VPN IP must be configured"); + return -EINVAL; + } + + if (ipv4_is_multicast(addr4->s_addr) || ipv4_is_lbcast(addr4->s_addr) || + ipv4_is_loopback(addr4->s_addr)) { + NL_SET_ERR_MSG_MOD(info->extack, + "VPN IPv4 address must be valid unicast or any"); + return -EADDRNOTAVAIL; + } + + if (!ipv6_addr_any(addr6)) { + addr6_type = ipv6_addr_type(addr6); + + if (!(addr6_type & IPV6_ADDR_UNICAST) || + (addr6_type & (IPV6_ADDR_LOOPBACK | IPV6_ADDR_COMPATv4))) { + NL_SET_ERR_MSG_MOD(info->extack, + "VPN IPv6 address must be valid unicast or any"); + return -EADDRNOTAVAIL; + } + } + + return 0; +} + static int ovpn_nl_peer_precheck(struct ovpn_priv *ovpn, struct genl_info *info, struct nlattr **attrs) @@ -381,11 +414,10 @@ int ovpn_nl_peer_new_doit(struct sk_buff *skb, struct genl_info *info) vpn_addr6 = nla_get_in6_addr(attrs[OVPN_A_PEER_VPN_IPV6]); - if (!vpn_addr4.s_addr && ipv6_addr_any(&vpn_addr6)) { - NL_SET_ERR_MSG_FMT_MOD(info->extack, - "VPN IP must be provided in MP mode"); - return -EINVAL; - } + ret = ovpn_nl_peer_check_vpn_addrs(&vpn_addr4, &vpn_addr6, + info); + if (ret < 0) + return ret; } peer_id = nla_get_u32(attrs[OVPN_A_PEER_ID]); @@ -547,12 +579,10 @@ int ovpn_nl_peer_set_doit(struct sk_buff *skb, struct genl_info *info) /* in MP mode VPN IPs are required for selecting the right peer */ if (ovpn->mode == OVPN_MODE_MP && (attrs[OVPN_A_PEER_VPN_IPV4] || attrs[OVPN_A_PEER_VPN_IPV6])) { - if (!vpn_addr4.s_addr && ipv6_addr_any(&vpn_addr6)) { - NL_SET_ERR_MSG_FMT_MOD(info->extack, - "MP peer must have at least one valid VPN IP"); - ret = -EINVAL; + ret = ovpn_nl_peer_check_vpn_addrs(&vpn_addr4, &vpn_addr6, + info); + if (ret < 0) goto unlock; - } /* reject peer with conflicting VPN address */ if (ovpn_peer_vpn_addr_conflict(ovpn, peer, &vpn_addr4, From patchwork Wed Jul 29 15:37:43 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ralf Lici X-Patchwork-Id: 5181 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:fd0b:b0:87d:ab56:3700 with SMTP id cw11csp2131940mac; Wed, 29 Jul 2026 08:42:36 -0700 (PDT) X-Forwarded-Encrypted: i=2; AHgh+RqY/u8szG5D1t5/29xipD5mR/tcIFfxiXywAmgCK5iiNeV9lW+g3mM1L+3cPuzWXqKqKX4klh4OOkM=@openvpn.net X-Received: by 2002:a05:6830:67f6:b0:7e9:b4d0:53a2 with SMTP id 46e09a7af769-7efff2d6c92mr4236525a34.27.1785339756223; Wed, 29 Jul 2026 08:42:36 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1785339756; cv=none; d=google.com; s=arc-20260327; b=CdW+Myh/3w+c0SFH2Y3Z5JUkx88+cZExFf7iuYF2ahgOWnCWfA3odO/aKVVt7IIUKT K4Sh5qMy4w6s2UuYAoVQ/FHPc7aPkH4br0A6qUb8VIKm3vBwhsFBxVgHRUfERPzV6yxF ifwFKvvzue3PjLArtyNg0h51SEtmwUAXbRXnNllvXrg5TN3p4HdIC9WIAjPNQXeCOc8Z R6E2lxvB+RmQdCcYRKG3pWGsPQzaELanRT7GJkgOVthHKqujifZZF51TNQKERu+nYqy/ q/gevXXHjBgH9JBVVqK4rWwlMRCpRoEyurJ6r3UDLh5nZOx3CvqJsVtw/2T4tV9Kpqbk rzvA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature:dkim-signature; bh=QTsz+spzJRkHM0UTqOWWgkhKoTIc+PEa2ysX7bD/OdE=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=oNUXMUtVNw4g/uyNHFOWgi+5lj+qf6wKyfZsnmW5MHcj8DQb4+hL/ZbqpSLNBVPf4g RsO/zHk57uRARcqOCuXfX6Ey4zaUkI+aclf7v7d31EngOi5YP/71up044pubeB+ejHq0 YitIpc3WyeNtHqmyNbe6n970ugfiDaAKEmA8pUvePIXKT3OmOzNQoqyJWvEKd111/7md 1SNqlPePB2eVk2eOnocrqSrCbnqd3JRHwq/1ljg2k9tahNRtSf7xnHV6HD5v/ty0u4kE aPnCs7yeddF1F1crxwe5G6Lo5TQSCdN3TjeY0nYarpRo4ZpuPv4azIpqGUqGKU+9ysrn AcpQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=BkaFlImD; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=jN5PZi1s; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=LkGSPsLn; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=O6HGdI8N; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 46e09a7af769-7f00d5defd0si2478468a34.4.2026.07.29.08.42.35 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 29 Jul 2026 08:42:36 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=BkaFlImD; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=jN5PZi1s; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=LkGSPsLn; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=O6HGdI8N; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=QTsz+spzJRkHM0UTqOWWgkhKoTIc+PEa2ysX7bD/OdE=; b=BkaFlImDG/MzCfvI9CvGpJdEsM wHwBRUOq5SNzplG0p01cRH2eqb090n/c9zMn6qvJ/xg7drxxZ5wKztoEIEt9qsxNMsf+2Hs2WT3uB OJ0qGoaUMQWwoU88360YvSWvL5kCH/x2rm+9gLPzpK1Iq7X0Oxgbu9OAtm/BYT0//Uy4=; Received: from [127.0.0.1] (helo=sfs-ml-1.v29.lw.sourceforge.com) by sfs-ml-1.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1wp6QV-0000HX-WF; Wed, 29 Jul 2026 15:42:33 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-1.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1wp6QL-0000Gw-D5 for openvpn-devel@lists.sourceforge.net; Wed, 29 Jul 2026 15:42:22 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=qfyvVT5hMi7U1bEGiftz0J1aR0CmR0zSYLIzaNN656I=; b=jN5PZi1sHCAdI5dv6qMVxioZxG JyDBn4rsU/yqcrwCNivx2wr7of0C0kamexpQPpv+86oZyWlk3KgPjLXXzz+QHOTtAT3Y8X1w0vHmm RGPXH5qtiyDhVR/x/qs6ZG4syl4vFN8qc/NodXqRjubt/K3rRX/bo5dDyRISG9ERtC/c=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=qfyvVT5hMi7U1bEGiftz0J1aR0CmR0zSYLIzaNN656I=; b=LkGSPsLnZxFZZDp1TF+cZYutQc rtjJymLQJVFSerlArXc88qQopFUk/N9LhI1McFP1x3R1zjxst6o7dsmZcJqCGMetGjeuZlT7Yb6Uf Cm3i9pJEw22cAo22HnUfS9TsSF8KLEMK90gogW9RuQ66r82Loz/noXn6FtsOFAiLoU24=; Received: from mout-b-105.mailbox.org ([195.10.208.50]) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1wp6QJ-0001TE-EA for openvpn-devel@lists.sourceforge.net; Wed, 29 Jul 2026 15:42:22 +0000 Received: from smtp2.mailbox.org (smtp2.mailbox.org [IPv6:2001:67c:2050:b231:465::2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-b-105.mailbox.org (Postfix) with ESMTPS id 4h9GmN0flqz9tbx; Wed, 29 Jul 2026 17:42:12 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandelbit.com; s=MBO0001; t=1785339732; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=qfyvVT5hMi7U1bEGiftz0J1aR0CmR0zSYLIzaNN656I=; b=O6HGdI8N6drObt9WZ+dYvHxrMCfswC9xpuW4DLtOkOyqVqwaNBTJRfyYDfniq240YeEFaZ BwU/YrcC6xEXYeoAMlE+mpVJ43hsnl5am03EV6qHmCZtQLc6U6/ag6p0519BTTR3+FRsvd pdnkrxpWGUIVsLbTsIUNtEff/XWMNpqCovBB3/pY5fJdzgDQpuzQVgw8lt6ywmN7XwOM5K hJg+WVeHpw0WPziiu0W2ruzicl1smTI5DaOBoklr9NKgEjtvFNh3/uEJbFhDsyaINBOcAt Q3MxCOVkCUl4JeNDbDMKr/2/sIEfGDXAePqWFyeMgYcm0We3esT/MIE3Hv7+6A== Authentication-Results: outgoing_mbo_mout; dkim=none; spf=pass (outgoing_mbo_mout: domain of ralf@mandelbit.com designates 2001:67c:2050:b231:465::2 as permitted sender) smtp.mailfrom=ralf@mandelbit.com From: Ralf Lici To: openvpn-devel@lists.sourceforge.net Date: Wed, 29 Jul 2026 17:37:43 +0200 Message-ID: <7b19fd9eb8d2c2a4afc4a8d102bdfeeeec8024bf.1785338921.git.ralf@mandelbit.com> In-Reply-To: References: MIME-Version: 1.0 X-Rspamd-Queue-Id: 4h9GmN0flqz9tbx X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-1.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Exercise peer VPN address validation through both peer creation and update. Check missing, unspecified, duplicate, multicast, broadcast, loopback, IPv4-compatible and IPv4-mapped addresses. Temporarily configure a peer with both address families to verify that either family can be cleared while the other remains configured, then restore the original addresses before running the existing [...] Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid X-Headers-End: 1wp6QJ-0001TE-EA Subject: [Openvpn-devel] [PATCH ovpn net 5/5] selftests: ovpn: validate peer VPN addresses X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1872064420314779446 X-GMAIL-MSGID: 1872064420314779446 Exercise peer VPN address validation through both peer creation and update. Check missing, unspecified, duplicate, multicast, broadcast, loopback, IPv4-compatible and IPv4-mapped addresses. Temporarily configure a peer with both address families to verify that either family can be cleared while the other remains configured, then restore the original addresses before running the existing traffic tests. Extend ovpn-cli peer updates with an optional VPN address and preserve peer creation errors so the negative tests can observe rejected netlink requests. Signed-off-by: Ralf Lici --- tools/testing/selftests/net/ovpn/common.sh | 13 ++++ tools/testing/selftests/net/ovpn/ovpn-cli.c | 54 ++++++++++----- tools/testing/selftests/net/ovpn/test.sh | 75 ++++++++++++++++++++- 3 files changed, 123 insertions(+), 19 deletions(-) diff --git a/tools/testing/selftests/net/ovpn/common.sh b/tools/testing/selftests/net/ovpn/common.sh index 2d844eb3aa6e..5e9c81e885e6 100644 --- a/tools/testing/selftests/net/ovpn/common.sh +++ b/tools/testing/selftests/net/ovpn/common.sh @@ -136,6 +136,19 @@ ovpn_create_ns() { ip netns add "ovpn_peer${1}" } +ovpn_peer_vpn_addr() { + local peer="$1" + local file + + if [ "${OVPN_PROTO}" == "UDP" ]; then + file="${OVPN_UDP_PEERS_FILE}" + else + file="${OVPN_TCP_PEERS_FILE}" + fi + + awk -v peer="${peer}" '$1 == peer {print $NF; exit}' "${file}" +} + ovpn_setup_ns() { local peer="ovpn_peer${1}" local server_ns="ovpn_peer0" diff --git a/tools/testing/selftests/net/ovpn/ovpn-cli.c b/tools/testing/selftests/net/ovpn/ovpn-cli.c index f4effa7580c0..3b612a8a18fe 100644 --- a/tools/testing/selftests/net/ovpn/ovpn-cli.c +++ b/tools/testing/selftests/net/ovpn/ovpn-cli.c @@ -650,6 +650,26 @@ static int ovpn_connect(struct ovpn_ctx *ovpn) return ret; } +static int ovpn_nl_put_vpn_addr(struct nl_msg *msg, + const struct ovpn_ctx *ovpn) +{ + if (!ovpn->peer_ip_set) + return 0; + + switch (ovpn->peer_ip.in4.sin_family) { + case AF_INET: + return nla_put_u32(msg, OVPN_A_PEER_VPN_IPV4, + ovpn->peer_ip.in4.sin_addr.s_addr); + case AF_INET6: + return nla_put(msg, OVPN_A_PEER_VPN_IPV6, + sizeof(struct in6_addr), + &ovpn->peer_ip.in6.sin6_addr); + default: + fprintf(stderr, "Invalid family for peer address\n"); + return -EAFNOSUPPORT; + } +} + static int ovpn_new_peer(struct ovpn_ctx *ovpn, bool is_tcp) { struct nlattr *attr; @@ -691,22 +711,9 @@ static int ovpn_new_peer(struct ovpn_ctx *ovpn, bool is_tcp) } } - if (ovpn->peer_ip_set) { - switch (ovpn->peer_ip.in4.sin_family) { - case AF_INET: - NLA_PUT_U32(ctx->nl_msg, OVPN_A_PEER_VPN_IPV4, - ovpn->peer_ip.in4.sin_addr.s_addr); - break; - case AF_INET6: - NLA_PUT(ctx->nl_msg, OVPN_A_PEER_VPN_IPV6, - sizeof(struct in6_addr), - &ovpn->peer_ip.in6.sin6_addr); - break; - default: - fprintf(stderr, "Invalid family for peer address\n"); - goto nla_put_failure; - } - } + ret = ovpn_nl_put_vpn_addr(ctx->nl_msg, ovpn); + if (ret) + goto nla_put_failure; nla_nest_end(ctx->nl_msg, attr); @@ -732,6 +739,10 @@ static int ovpn_set_peer(struct ovpn_ctx *ovpn) ovpn->keepalive_interval); NLA_PUT_U32(ctx->nl_msg, OVPN_A_PEER_KEEPALIVE_TIMEOUT, ovpn->keepalive_timeout); + + ret = ovpn_nl_put_vpn_addr(ctx->nl_msg, ovpn); + if (ret) + goto nla_put_failure; nla_nest_end(ctx->nl_msg, attr); ret = ovpn_nl_msg_send(ctx, NULL); @@ -1730,13 +1741,14 @@ static void usage(const char *cmd) fprintf(stderr, "\tmark: socket FW mark value\n"); fprintf(stderr, - "* set_peer : set peer attributes\n"); + "* set_peer [vpnaddr]: set peer attributes\n"); fprintf(stderr, "\tiface: ovpn interface name\n"); fprintf(stderr, "\tpeer_id: peer ID of the peer to modify\n"); fprintf(stderr, "\tkeepalive_interval: interval for sending ping messages\n"); fprintf(stderr, "\tkeepalive_timeout: time after which a peer is timed out\n"); + fprintf(stderr, "\tvpnaddr: peer VPN IP\n"); fprintf(stderr, "* del_peer : delete peer\n"); fprintf(stderr, "\tiface: ovpn interface name\n"); @@ -2090,6 +2102,8 @@ static int ovpn_run_cmd(struct ovpn_ctx *ovpn) return ret; ret = ovpn_new_peer(ovpn, false); + if (ret < 0) + return ret; ovpn_waitbg(); break; case CMD_NEW_MULTI_PEER: @@ -2331,6 +2345,12 @@ static int ovpn_parse_cmd_args(struct ovpn_ctx *ovpn, int argc, char *argv[]) "keepalive interval value out of range\n"); return -1; } + + if (argc > 6) { + ret = ovpn_parse_remote(ovpn, NULL, NULL, argv[6]); + if (ret < 0) + return -1; + } break; case CMD_DEL_PEER: if (argc < 4) diff --git a/tools/testing/selftests/net/ovpn/test.sh b/tools/testing/selftests/net/ovpn/test.sh index 9b5610837032..392109d5e14e 100755 --- a/tools/testing/selftests/net/ovpn/test.sh +++ b/tools/testing/selftests/net/ovpn/test.sh @@ -56,6 +56,76 @@ ovpn_prepare_network() { done } +ovpn_new_test_peer() { + local peer_id="$1" + + shift + ip netns exec ovpn_peer0 "${OVPN_CLI}" new_peer tun0 \ + "${peer_id}" none 65000 10.10.1.2 1 "$@" +} + +ovpn_set_peer_vpn_addr() { + ip netns exec ovpn_peer0 "${OVPN_CLI}" set_peer tun0 \ + "$1" 60 120 "$2" +} + +ovpn_run_vpn_addr_validation() { + local addr + local peer1_addr4 + local test_peer_id=$((OVPN_NUM_PEERS + 1)) + local test_peer_addr6="2001:db8::2" + # Do not include 0.0.0.0 or :: here. They are invalid on creation, but + # clear one address family on update and are valid if the other remains. + local -a invalid_addrs=( + "127.0.0.1" + "224.0.0.1" + "255.255.255.255" + "::1" + "::192.0.2.1" + "::ffff:192.0.2.1" + "ff02::1" + ) + + peer1_addr4=$(ovpn_peer_vpn_addr 1) + + ovpn_cmd_fail "reject peer without VPN address" \ + ovpn_new_test_peer "${test_peer_id}" + + for addr in "0.0.0.0" "::" "${invalid_addrs[@]}"; do + ovpn_cmd_fail "reject new peer VPN address ${addr}" \ + ovpn_new_test_peer "${test_peer_id}" "${addr}" + done + + ovpn_cmd_fail "reject duplicate IPv4 address on peer creation" \ + ovpn_new_test_peer "${test_peer_id}" "${peer1_addr4}" + ovpn_cmd_fail "reject clearing the last peer VPN address" \ + ovpn_set_peer_vpn_addr 1 0.0.0.0 + + for addr in "${invalid_addrs[@]}"; do + ovpn_cmd_fail "reject updated peer VPN address ${addr}" \ + ovpn_set_peer_vpn_addr 1 "${addr}" + done + + ovpn_cmd_fail "reject duplicate IPv4 address on peer update" \ + ovpn_set_peer_vpn_addr 2 "${peer1_addr4}" + + ovpn_cmd_ok "add peer IPv6 address" \ + ovpn_set_peer_vpn_addr 1 "${test_peer_addr6}" + ovpn_cmd_fail "reject duplicate IPv6 address on peer creation" \ + ovpn_new_test_peer "${test_peer_id}" "${test_peer_addr6}" + ovpn_cmd_fail "reject duplicate IPv6 address on peer update" \ + ovpn_set_peer_vpn_addr 2 "${test_peer_addr6}" + + ovpn_cmd_ok "clear peer IPv4 address" \ + ovpn_set_peer_vpn_addr 1 0.0.0.0 + ovpn_cmd_fail "reject clearing the remaining peer IPv6 address" \ + ovpn_set_peer_vpn_addr 1 :: + ovpn_cmd_ok "restore peer IPv4 address" \ + ovpn_set_peer_vpn_addr 1 "${peer1_addr4}" + ovpn_cmd_ok "clear peer IPv6 address" \ + ovpn_set_peer_vpn_addr 1 :: +} + ovpn_run_basic_traffic() { local p local header1 @@ -293,15 +363,16 @@ trap ovpn_stage_err ERR ktap_print_header if [ "${OVPN_FLOAT}" == "1" ]; then - ktap_set_plan 13 + ktap_set_plan 14 else - ktap_set_plan 12 + ktap_set_plan 13 fi ovpn_cleanup modprobe -q ovpn || true ovpn_run_stage "setup network topology" ovpn_prepare_network +ovpn_run_stage "validate peer VPN addresses" ovpn_run_vpn_addr_validation ovpn_run_stage "run baseline data traffic" ovpn_run_basic_traffic ovpn_run_stage "run LAN traffic behind peer1" ovpn_run_lan_traffic [ "${OVPN_FLOAT}" == "1" ] && ovpn_run_stage "run floating peer checks" \