netdev - Re: [PATCH net 2/3] ovpn: explicitly reject netlink attr PEER_LOCAL_PORT in CMD_PEER

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d063c580-9e52-4f2b-ada2-7ca097cb9b85@openvpn.net>
Date: Tue, 15 Jul 2025 16:36:40 +0200
From: Antonio Quartulli <antonio@...nvpn.net>
To: Sabrina Dubroca <sd@...asysnail.net>, Jakub Kicinski <kuba@...nel.org>
Cc: Donald Hunter <donald.hunter@...il.com>, netdev@...r.kernel.org,
 "David S . Miller" <davem@...emloft.net>, Eric Dumazet
 <edumazet@...gle.com>, Paolo Abeni <pabeni@...hat.com>,
 Ralf Lici <ralf@...delbit.com>
Subject: Re: [PATCH net 2/3] ovpn: explicitly reject netlink attr
 PEER_LOCAL_PORT in CMD_PEER_NEW/SET

On 08/07/2025 12:20, Sabrina Dubroca wrote:
[...]
> In ovpn we should also reject attributes from GET and DEL that aren't
> currently used to match the peer we want to get/delete (ie everything
> except PEER_ID), while still being able to parse all possible peer
> attributes from the kernel's reply (only for GET). So I guess we'd
> want a different variant of the nested attribute "peer" for the
> request and reply here:
> 
>      -
>        name: peer-get
>        attribute-set: ovpn
>        flags: [admin-perm]
>        doc: Retrieve data about existing remote peers (or a specific one)
>        do:
>          pre: ovpn-nl-pre-doit
>          post: ovpn-nl-post-doit
>          request:
>            attributes:
>              - ifindex
>              - peer
>          reply:
>            attributes:
>              - peer
>        dump:
>          request:
>            attributes:
>              - ifindex
>          reply:
>            attributes:
>              - peer
> 
> 

As Jakub predicted, I am hitting a problem with PEER_GET: the 
attribute-set is one for the entire op, therefore I can't specify two 
different sets for request and reply.

I presume I need to leave PEER_GET on the main 'ovpn' set and then 
opencode the restriction of having only the ID in the request.

Similarly goes for KEY_GET.

Sabrina, Jakub, does it make sense to you?

Regards,

-- 
Antonio Quartulli
OpenVPN Inc.