From: Ralf Lici <ralf@mandelbit.com>
To: openvpn-devel@lists.sourceforge.net
Date: Wed, 29 Jul 2026 17:37:38 +0200
Message-ID: <cover.1785338921.git.ralf@mandelbit.com>
MIME-Version: 1.0
Subject: [Openvpn-devel] [PATCH ovpn net 0/5] ovpn: validate peer VPN
 addresses
Precedence: list
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: openvpn-devel-bounces@lists.sourceforge.net

Hi,

In MP mode, ovpn uses peer VPN addresses as lookup keys when selecting
the peer for an outgoing packet. The peer configuration path should
therefore maintain a few basic invariants around those addresses.

This series ensures that cleared addresses are removed from the hash
tables, prevents the same address from being assigned to multiple peers,
requires every MP peer to have at least one configured VPN address, and
rejects addresses that cannot identify a unicast peer.

The final patch extends the existing selftests to exercise these rules
through both peer creation and update, including transitions between
single-stack and dual-stack configurations.

Regards,

Ralf Lici
Mandelbit Srl

---
Ralf Lici (5):
  ovpn: always unhash old VPN addresses before rehashing
  ovpn: reject duplicate peer VPN addresses
  ovpn: reject multipeer peers without VPN addresses
  ovpn: reject invalid peer VPN addresses
  selftests: ovpn: validate peer VPN addresses

 drivers/net/ovpn/netlink.c                  | 100 +++++++++++++++++---
 drivers/net/ovpn/peer.c                     |  58 ++++++++++--
 drivers/net/ovpn/peer.h                     |   4 +
 tools/testing/selftests/net/ovpn/common.sh  |  13 +++
 tools/testing/selftests/net/ovpn/ovpn-cli.c |  54 +++++++----
 tools/testing/selftests/net/ovpn/test.sh    |  75 ++++++++++++++-
 6 files changed, 264 insertions(+), 40 deletions(-)

-- 
2.55.0


_______________________________________________
Openvpn-devel mailing list
Openvpn-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/openvpn-devel