[PATCH net 0/7] pull request: fixes for ovpn 2026-10-22

[Antonio Quartulli <antonio@openvpn.net>]

Hi all!

First of all, this PR includes fixes for older releases.

Given Linus' statements on our recent set of fixes, I have
not understood if this kind of fixes are supposed to still go through
net or rather via net-next (so they don't land in an -rc).

As you see I am targeting net, as I always did, but feel free to let me
know if I should do otherwise.

And this is the PR cover:

Here is a batch of seven ovpn fixes for net. Six are about hardening 
how ovpn deals with the userspace-provided transport socket, plus a
selftest fix for a NULL deref crash with musl.

The most important ones close two potential crashes, both reachable by
a CAP_NET_ADMIN user configuring a peer via netlink:

* NULL pointer dereference on TX: an IPv6 remote endpoint was accepted
  on an AF_INET UDP socket. The first packet sent to such a peer goes
  through ovpn_udp6_output() and ip6_dst_lookup_flow(), which
  dereferences inet6_sk(sk), but the latter is NULL for IPv4 sockets.
  Such remotes are now rejected via netlink and the socket family is
  rechecked on TX.

* Out-of-bounds access: the transport socket type was selected by
  sk_protocol only, therefore a raw socket with IPPROTO_UDP could be
  attached and then accessed as a struct udp_sock. Only real UDP
  datagram or TCP stream sockets are now accepted.

The remaining fixes prevent sending UDP packets with source port 0
(e.g. after connect(AF_UNSPEC) on the socket), and correct the TX
accounting for both transports: UDP byte counters did not include the
OpenVPN header and auth tag, while packets dropped locally were
accounted as sent and refreshed the keepalive timer.

The last patch fixes ovpn-cli crashing on musl, because
freeaddrinfo() was being called on NULL.


Regarding Linus' email commenting our last net PR, I think
he complained that we did not CC stable on any patch.
My (long-lasting) understanding is that for patches to net
we're not supposed to do that.
Let me know if I should do otherwise.


Please pull or let me know of any issue!

Thanks a lot,
	Antonio

The following changes since commit f4377bf85887f57b59abb5479f7660a81ffe4449:

  tipc: fix broadcast sender hang on last acker departure (2026-10-22 11:05:31 +0200)

are available in the Git repository at:

  https://github.com/OpenVPN/ovpn-net-next.git tags/ovpn-net-20261022

for you to fetch changes up to a402a88c1d53ec649c57da6d947a72154f9a6de7:

  selftests: ovpn: avoid calling freeaddrinfo() on NULL (2026-10-22 14:07:59 +0200)

----------------------------------------------------------------
Included fixes:
* fix selftest tool segfault on musl caused by calling freeaddrinfo()
  on NULL
* fix TCP TX accounting, which counted packets dropped locally as sent
  and refreshed the keepalive timer for them
* fix UDP TX byte accounting, which left out the OpenVPN data channel
  header and authentication tag
* recheck the UDP socket family on TX, since userspace can still change
  it via IPV6_ADDRFORM or IPV6_V6ONLY, and tear the peer down on
  mismatch, ensuring the IPv6 TX path never sees a socket without IPv6
  state
* reject UDP remotes incompatible with the socket family, fixing a NULL
  pointer dereference on TX when an IPv6 remote is configured on an
  IPv4 UDP socket
* reject sockets that are not real UDP or TCP sockets, preventing e.g.
  a raw socket with IPPROTO_UDP from being treated as a udp_sock and
  accessed out of bounds
* avoid sending UDP packets with source port 0, and do not account
  locally dropped UDP packets as sent

----------------------------------------------------------------
Antonio Quartulli (1):
      selftests: ovpn: avoid calling freeaddrinfo() on NULL

Ralf Lici (6):
      ovpn: avoid sending UDP packets with source port 0
      ovpn: validate sockets before attaching peer transports
      ovpn: reject UDP remotes incompatible with socket family
      ovpn: recheck UDP socket family before transmit
      ovpn: fix UDP TX byte accounting
      ovpn: fix TCP TX accounting for locally dropped packets

 drivers/net/ovpn/io.c                       |   8 +-
 drivers/net/ovpn/netlink.c                  | 129 +++++++++++++++++++++-------
 drivers/net/ovpn/peer.c                     |  19 ++++
 drivers/net/ovpn/peer.h                     |   5 +-
 drivers/net/ovpn/socket.c                   |  16 ++--
 drivers/net/ovpn/tcp.c                      |  78 +++++++++--------
 drivers/net/ovpn/tcp.h                      |  10 +--
 drivers/net/ovpn/udp.c                      |  51 ++++++++---
 drivers/net/ovpn/udp.h                      |   4 +-
 tools/testing/selftests/net/ovpn/ovpn-cli.c |   3 +-
 10 files changed, 224 insertions(+), 99 deletions(-)