ovpn: validate peer VPN addresses
Status from this message: Applied, thanks!
Get series with b4
b4 am [email protected]Versions newest first · linked by author and title
- v2 Latest5 patches 1 replyApplied
- v15 patches 4 repliesSuperseded
Patches in v2 Applied
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/5 | ovpn: always unhash old VPN addresses before rehashingdrivers/ | +4 | 0 replies | |
| 2/5 | ovpn: reject duplicate peer VPN addressesdrivers/ drivers/ drivers/ | +101 | 0 replies | |
| 3/5 | ovpn: reject multipeer peers without VPN addressesdrivers/ | +30 | 0 replies | |
| 4/5 | ovpn: reject invalid peer VPN addressesdrivers/ | +42 | 0 replies | |
| 5/5 | selftests: ovpn: validate peer VPN addressestools/ tools/ tools/ | +123 | 0 replies |
Reviews trailers per patch
No Reviewed-by, Acked-by or Tested-by trailers for v2 yet.
Cover letter [Openvpn-devel] [PATCH ovpn net v2 0/5] ovpn: validate peer VPN addresses
Hi,
This is a respin of the series that enforces explicit policy rules for VPN addresses, taking into account Sabrina's suggestions.
In MP mode, ovpn uses peer VPN addresses as lookup keys when selecting the peer for an outgoing packet. The peer configuration path should therefore maintain a few basic invariants around those addresses.
This series ensures that cleared addresses are removed from the hash tables, prevents the same address from being assigned to multiple peers, requires every MP peer to have at least one configured VPN address, and rejects addresses that cannot identify a unicast peer.
The final patch extends the existing selftests to exercise these rules through both peer creation and update, including transitions between single-stack and dual-stack configurations.
Regards,
Ralf Lici
Mandelbit Srl
---
Changes since v1 https://lore.kernel.org/openvpn-devel/[email protected]/
- Rebased on net/main.
- Reworded 2/5 and 3/5 to explain why the newly rejected configurations
were never usable/reliable. (Sabrina)
- Refactored 2/5 by splitting ovpn_peer_vpn_addr_conflict into two
separate helpers for v4 and v6. (Sabrina)
- Switched to != htonl(INADDR_ANY) for consistency, rather than !s_addr
in 3/5. (Sabrina)
Ralf Lici (5):
ovpn: always unhash old VPN addresses before rehashing
ovpn: reject duplicate peer VPN addresses
ovpn: reject multipeer peers without VPN addresses
ovpn: reject invalid peer VPN addresses
selftests: ovpn: validate peer VPN addresses
drivers/net/ovpn/netlink.c | 102 +++++++++++++++++--- drivers/net/ovpn/peer.c | 77 +++++++++++++-- drivers/net/ovpn/peer.h | 6 ++ tools/testing/selftests/net/ovpn/common.sh | 13 +++ tools/testing/selftests/net/ovpn/ovpn-cli.c | 54 +++++++---- tools/testing/selftests/net/ovpn/test.sh | 75 +++++++++++++- 6 files changed, 287 insertions(+), 40 deletions(-)
base-commit: 1b78070aaef63512688aebfbc82365ef9d6660f1
Signature · 8 lines
2.55.0 _______________________________________________ Openvpn-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-devel