Hi, This is a respin of the series that enforces explicit policy rules for VPN addresses, taking into account Sabrina's suggestions.
In MP mode, ovpn uses peer VPN addresses as lookup keys when selecting the peer for an outgoing packet. The peer configuration path should therefore maintain a few basic invariants around those addresses. This series ensures that cleared addresses are removed from the hash tables, prevents the same address from being assigned to multiple peers, requires every MP peer to have at least one configured VPN address, and rejects addresses that cannot identify a unicast peer. The final patch extends the existing selftests to exercise these rules through both peer creation and update, including transitions between single-stack and dual-stack configurations. Regards, Ralf Lici Mandelbit Srl --- Changes since v1 https://lore.kernel.org/openvpn-devel/[email protected]/ - Rebased on net/main. - Reworded 2/5 and 3/5 to explain why the newly rejected configurations were never usable/reliable. (Sabrina) - Refactored 2/5 by splitting ovpn_peer_vpn_addr_conflict into two separate helpers for v4 and v6. (Sabrina) - Switched to != htonl(INADDR_ANY) for consistency, rather than !s_addr in 3/5. (Sabrina) Ralf Lici (5): ovpn: always unhash old VPN addresses before rehashing ovpn: reject duplicate peer VPN addresses ovpn: reject multipeer peers without VPN addresses ovpn: reject invalid peer VPN addresses selftests: ovpn: validate peer VPN addresses drivers/net/ovpn/netlink.c | 102 +++++++++++++++++--- drivers/net/ovpn/peer.c | 77 +++++++++++++-- drivers/net/ovpn/peer.h | 6 ++ tools/testing/selftests/net/ovpn/common.sh | 13 +++ tools/testing/selftests/net/ovpn/ovpn-cli.c | 54 +++++++---- tools/testing/selftests/net/ovpn/test.sh | 75 +++++++++++++- 6 files changed, 287 insertions(+), 40 deletions(-) base-commit: 1b78070aaef63512688aebfbc82365ef9d6660f1 -- 2.55.0 _______________________________________________ Openvpn-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-devel
