Skip to contentSkip to conversation

fix redirect-gateway behaviour when an IPv4 default route does not exist

PATCH In review Antonio Quartulli 2 participants 2 messages May 9, 2017 – May 18, 2017

lore
Share & tools
lore
#0 lore raw

PATCH 1/1 fix redirect-gateway behaviour when an IPv4 default route does not exist

When no IPv4 default route exists, the "redirect-gateway" routine aborts even if the sub-option "local" was specified or if we are connecting to the remote host using IPv6.

This is not expected because in either case OpenVPN should not bother checking the existence of the default route as it is not required at all.

Therefore, skip the IPv4 default route check when "local" is specified or we are connecting to an IPv6 remote host.

---

Backport of the same patch from 2.4 to 2.3.
Compiled tested only.

 src/openvpn/route.c | 50 ++++++++++++++++++++++++++++++++------------------
 1 file changed, 32 insertions(+), 18 deletions(-)
src/openvpn/route.c +32 -18
index 74f0a011..4ae0d6a4 100644
@@ -840,11 +840,18 @@ redirect_default_route_to_vpn (struct route_list *rl, const struct tuntap *tt, u
 
   if ( rl && rl->flags & RG_ENABLE )
     {
+      bool local = BOOL_CAST(rl->flags & RG_LOCAL);
       if (!(rl->spec.flags & RTSA_REMOTE_ENDPOINT) && (rl->flags & RG_REROUTE_GW))
 	{
 	  msg (M_WARN, "%s VPN gateway parameter (--route-gateway or --ifconfig) is missing", err);
 	}
-      else if (!(rl->rgi.flags & RGI_ADDR_DEFINED))
+      /*
+       * check if a default route is defined, unless:
+       * - we are connecting to a remote host in our network
+       * - we are connecting to a non-IPv4 remote host (i.e. we use IPv6)
+       */
+      else if (!(rl->rgi.flags & RGI_ADDR_DEFINED) && !local
+	       && (rl->spec.remote_host != IPV4_INVALID_ADDR))
 	{
 	  msg (M_WARN, "%s Cannot read current default gateway from system", err);
 	}
@@ -854,7 +861,6 @@ redirect_default_route_to_vpn (struct route_list *rl, const struct tuntap *tt, u
 	}
       else
 	{
-	  bool local = BOOL_CAST(rl->flags & RG_LOCAL);
 	  if (rl->flags & RG_AUTO_LOCAL) {
 	    const int tla = rl->spec.remote_host_local;
 	    if (tla == TLA_NONLOCAL)
@@ -914,14 +920,18 @@ redirect_default_route_to_vpn (struct route_list *rl, const struct tuntap *tt, u
 		}
 	      else
 		{
-		  /* delete default route */
-		  del_route3 (0,
-			      0,
-			      rl->rgi.gateway.addr,
-			      tt,
-			      flags | ROUTE_REF_GW,
-			      &rl->rgi,
-			      es);
+		  /* don't try to remove the def route if it does not exist */
+		  if (rl->rgi.flags & RGI_ADDR_DEFINED)
+		  {
+		      /* delete default route */
+		      del_route3 (0,
+				  0,
+				  rl->rgi.gateway.addr,
+				  tt,
+				  flags | ROUTE_REF_GW,
+				  &rl->rgi,
+				  es);
+		  }
 
 		  /* add new default route */
 		  add_route3 (0,
@@ -994,14 +1004,18 @@ undo_redirect_default_route_to_vpn (struct route_list *rl, const struct tuntap *
 			  &rl->rgi,
 			  es);
 
-	      /* restore original default route */
-	      add_route3 (0,
-			  0,
-			  rl->rgi.gateway.addr,
-			  tt,
-			  flags | ROUTE_REF_GW,
-			  &rl->rgi,
-			  es);
+	      /* restore original default route if there was any */
+	      if (rl->rgi.flags & RGI_ADDR_DEFINED)
+	        {
+		  /* restore original default route */
+		  add_route3 (0,
+			      0,
+			      rl->rgi.gateway.addr,
+			      tt,
+			      flags | ROUTE_REF_GW,
+			      &rl->rgi,
+			      es);
+	        }
 	    }
 	}
 
Signature · 1 line
2.12.2
#1 lore raw

ACK, thanks.

For reference, this is the same patch as 14670a9d654b in master, just adapted to the different code style in 2.3. Tested on FreeBSD 11.

Your patch has been applied to the release/2.3 branch.

commit 0b339bf9588a8bca70b74926f03f8be05f06faa6

Author: Antonio Quartulli
Date:   Tue May 9 23:24:22 2017 +0800
     fix redirect-gateway behaviour when an IPv4 default route does not exist

     Signed-off-by: Antonio Quartulli <[email protected]...>
     Acked-by: Gert Doering <[email protected]...>
     Message-Id: <[email protected]...>
     URL: https://www.mail-archive.com/[email protected]/msg14602.html
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering