This is more a theoretical attack, with netlink replies received that
do not match the request, and our state machine getting confused as
a consequence... but that extra check won't do harm, and might catch
possible errors elsewhere. Antonio and Ralf are the ones who understand
Linux kernel, who am I to argue :-)
I have only lightly stared at the code (complained, got a v3 in return),
and tested on an oldish Ubuntu with and without DCO (works).
Your patch has been applied to the master and release/2.7 branch.
commit 90ab7be00e73d06f7a5bf72e6a454fcfd5f2818c (master).
commit fbcf3c449787ba200731ff65b3ffa8fb4118a8e5 (release/2.7)
Author: Antonio Quartulli
Date: Tue Sep 1 17:10:10 2026 +0200
networking_sitnl: validate netlink replies against the request
Signed-off-by: Antonio Quartulli <[email protected]>
Acked-by: Ralf Lici <[email protected]>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1782
Message-Id: <[email protected]>
URL:
https://www.mail-archive.com/[email protected]/msg38879.html
Signed-off-by: Gert Doering <[email protected]>
--
kind regards,
Gert Doering
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
