netdev - Re: [PATCH net 2/3] ovpn: explicitly reject netlink attr PEER_LOCAL_PORT in CMD_PEER

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <6e676755-e104-49d0-8fee-5bf12d7f9ecd@openvpn.net>
Date: Tue, 15 Jul 2025 17:08:33 +0200
From: Antonio Quartulli <antonio@...nvpn.net>
To: Jakub Kicinski <kuba@...nel.org>
Cc: Sabrina Dubroca <sd@...asysnail.net>,
 Donald Hunter <donald.hunter@...il.com>, netdev@...r.kernel.org,
 "David S . Miller" <davem@...emloft.net>, Eric Dumazet
 <edumazet@...gle.com>, Paolo Abeni <pabeni@...hat.com>,
 Ralf Lici <ralf@...delbit.com>
Subject: Re: [PATCH net 2/3] ovpn: explicitly reject netlink attr
 PEER_LOCAL_PORT in CMD_PEER_NEW/SET

On 15/07/2025 17:06, Jakub Kicinski wrote:
> On Tue, 15 Jul 2025 16:36:40 +0200 Antonio Quartulli wrote:
>> As Jakub predicted, I am hitting a problem with PEER_GET: the
>> attribute-set is one for the entire op, therefore I can't specify two
>> different sets for request and reply.
>>
>> I presume I need to leave PEER_GET on the main 'ovpn' set and then
>> opencode the restriction of having only the ID in the request.
>>
>> Similarly goes for KEY_GET.
>>
>> Sabrina, Jakub, does it make sense to you?
> 
> Yes :( Sorry for the mixed solution but I think using the spec to its
> full capabilities is worthwhile, even if it doesn't cover all the needs.

I totally agree - at least we can limit the opencoding only to a few ops.

Thanks for confirming - I'll go with the mixed approach.

Regards,

-- 
Antonio Quartulli
OpenVPN Inc.