Re: [PATCH net 2/3] ovpn: explicitly reject netlink attr PEER_LOCAL_PORT in CMD_PEER_NEW/SET

[Jakub Kicinski <kuba@kernel.org>]

On Thu, 3 Jul 2025 15:07:51 +0200 Sabrina Dubroca wrote:
> > The OVPN_A_PEER_LOCAL_PORT is designed to be a read-only attribute
> > that ovpn sends back to userspace to show the local port being used
> > to talk to that specific peer.  
> 
> Seems like we'd want NLA_REJECT in the nla_policy instead of
> NLA_POLICY_MIN, but my quick grepping in ynl and specs doesn't show
> anything like that. Donald/Jakub, does it already exist? If not, does
> it seem possible to extend the specs and ynl with something like:
> 
> name: local-port
> type: reject(u16)
> 
> or maybe:
> 
> name: local-port
> type: u16
> checks:
>   reject: true

There's no way to explicitly reject, because we expect that only what's
needed will be listed (IOW we depend on NLA_UNSPEC rather than
NLA_REJECT). It gets complicated at times but I think it should work
here. Key mechanism is to define subsets of the nests:

diff --git a/Documentation/netlink/specs/ovpn.yaml b/Documentation/netlink/specs/ovpn.yaml
index 17e5e9b7f5a5..15309201e7ca 100644
--- a/Documentation/netlink/specs/ovpn.yaml
+++ b/Documentation/netlink/specs/ovpn.yaml
@@ -160,6 +160,36 @@ doc: Netlink protocol to control OpenVPN network devices
         name: link-tx-packets
         type: uint
         doc: Number of packets transmitted at the transport level
+  -
+    name: peer-input
+    subset-of: peer
+    attributes:
+      -
+        name: id
+      -
+        name: remote-ipv4
+      -
+        name: remote-ipv6
+      -
+        name: remote-ipv6-scope-id
+      -
+        name: remote-port
+      -
+        name: socket
+      -
+        name: socket-netnsid
+      -
+        name: vpn-ipv4
+      -
+        name: vpn-ipv6
+      -
+        name: local-ipv4
+      -
+        name: local-ipv6
+      -
+        name: keepalive-interval
+      -
+        name: keepalive-timeout
   -
     name: keyconf
     attributes:
@@ -235,12 +265,21 @@ doc: Netlink protocol to control OpenVPN network devices
         type: nest
         doc: Peer specific cipher configuration
         nested-attributes: keyconf
+  -
+    name: ovpn-peer-input
+    subset-of: ovpn
+    attributes:
+      -
+        name: ifindex
+      -
+        name: peer
+        nested-attributes: peer-input
 
 operations:
   list:
     -
       name: peer-new
-      attribute-set: ovpn
+      attribute-set: ovpn-peer-input
       flags: [admin-perm]
       doc: Add a remote peer
       do:
@@ -252,7 +291,7 @@ doc: Netlink protocol to control OpenVPN network devices
             - peer
     -
       name: peer-set
-      attribute-set: ovpn
+      attribute-set: ovpn-peer-input
       flags: [admin-perm]
       doc: modify a remote peer
       do: