Re: [PATCH net 1/1] ovpn: avoid caching stale IPv6 dst after FIB changes

[Ralf Lici <ralf@mandelbit.com>]

On Tue, 29 Sep 2026 08:09:46 -0600, David Ahern <dsahern@kernel.org> wrote:
> On 9/28/26 3:56 AM, Ralf Lici wrote:
> > Hi David,
> > 
> > Just following up on this. Does my previous example clarify why storing
> > an old dst with a new cookie defeats reuse-time validation?
> > 
> > If so, would you prefer that I pursue the kernel-wide lookup-provenance
> > approach described in the RFC, or keep the fix self-contained in ovpn?
> > The same late-cookie-sampling pattern is used by several drivers and
> > callers in the networking core, so I think fixing it generically is the
> > better architectural choice.
> > 
> > If changing the generic interfaces is not acceptable, I can rework the
> > patch as an ovpn-local fix, although that would duplicate IPv6 routing
> > details in the driver and leave the equivalent pattern elsewhere
> > unchanged.
> > 
>
> dst's are cached in lots of places. Why does ovpn need internal routing
> details that the other places do not?
>
>

Because, as explained in this thread and in the RFC, there is enough
evidence that the current IPv6 dst-caching pattern is racy. If other
kernel users are expected to live with that race, I cannot force a
generic fix, but I do not think that is a good reason to require ovpn to
do the same.

If you believe the sequence I described is safe, please explain which
invariant makes it so.

-- 
Ralf Lici
Mandelbit Srl