From adece45628f78aa8f1f997850095bc9a57caefbe Mon Sep 17 00:00:00 2001 From: Ralf Lici Date: Wed, 22 Apr 2026 07:56:30 +0200 Subject: [PATCH] dco-linux: enforce ifindex only for DEL_PEER notifications The unconditional ifindex check introduced by commit e78a8af2f5ce rejects legitimate kernel replies, specifically peer stats responses, because those messages do not carry OVPN_ATTR_IFINDEX. Move the check into ovpn_handle_del_peer() so it applies only to spontaneous DEL_PEER notifications from the kernel. This keeps response handling working while still filtering foreign-instance notifications. Fixes: e78a8af2f5ce ("dco: backport immediate notification processing on Linux and FreeBSD") Github: closes OpenVPN/openvpn#1020 Change-Id: I9b1f4fd06c8a02d3f51b6a3bdea2f92191669660 Signed-off-by: Ralf Lici Acked-by: Gert Doering Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1636 Message-Id: <20260422055636.20691-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg36721.html Signed-off-by: Gert Doering --- src/openvpn/dco_linux.c | 34 +++++++++++++++++----------------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/src/openvpn/dco_linux.c b/src/openvpn/dco_linux.c index 8ce7026d..1df56cfb 100644 --- a/src/openvpn/dco_linux.c +++ b/src/openvpn/dco_linux.c @@ -857,6 +857,23 @@ ovpn_handle_peer(dco_context_t *dco, struct nlattr *attrs[]) static int ovpn_handle_del_peer(dco_context_t *dco, struct nlattr *attrs[]) { + /* we must know which interface this message is referring to in order to + * avoid mixing messages for other instances + */ + if (!attrs[OVPN_ATTR_IFINDEX]) + { + msg(D_DCO, "ovpn-dco: Received message without ifindex"); + return NL_STOP; + } + + uint32_t ifindex = nla_get_u32(attrs[OVPN_ATTR_IFINDEX]); + if (ifindex != dco->ifindex) + { + msg(D_DCO_DEBUG, "ovpn-dco: ignoring message for foreign ifindex %d", + ifindex); + return NL_SKIP; + } + if (!attrs[OVPN_ATTR_DEL_PEER]) { msg(D_DCO, "ovpn-dco: no attributes in OVPN_DEL_PEER message"); @@ -930,23 +947,6 @@ ovpn_handle_msg(struct nl_msg *msg, void *arg) return NL_STOP; } - /* we must know which interface this message is referring to in order to - * avoid mixing messages for other instances - */ - if (!attrs[OVPN_ATTR_IFINDEX]) - { - msg(D_DCO, "ovpn-dco: Received message without ifindex"); - return NL_STOP; - } - - uint32_t ifindex = nla_get_u32(attrs[OVPN_ATTR_IFINDEX]); - if (ifindex != dco->ifindex) - { - msg(D_DCO_DEBUG, "ovpn-dco: ignoring message for foreign ifindex %d", - ifindex); - return NL_SKIP; - } - /* based on the message type, we parse the subobject contained in the * message, that stores the type-specific attributes. *