Re: [PATCH net 2/3] ovpn: explicitly reject netlink attr PEER_LOCAL_PORT in CMD_PEER_NEW/SET

Antonio Quartulli
2025-07-15T14:36:43Z

On 08/07/2025 12:20, Sabrina Dubroca wrote:
[...]
> In ovpn we should also reject attributes from GET and DEL that aren't
> currently used to match the peer we want to get/delete (ie everything
> except PEER_ID), while still being able to parse all possible peer
> attributes from the kernel's reply (only for GET). So I guess we'd
> want a different variant of the nested attribute "peer" for the
> request and reply here:
>
> -
> name: peer-get
> attribute-set: ovpn
> flags: [admin-perm]
> doc: Retrieve data about existing remote peers (or a specific one)
> do:
> pre: ovpn-nl-pre-doit
> post: ovpn-nl-post-doit
> request:
> attributes:
> - ifindex
> - peer
> reply:
> attributes:
> - peer
> dump:
> request:
> attributes:
> - ifindex
> reply:
> attributes:
> - peer
>
>

As Jakub predicted, I am hitting a problem with PEER_GET: the
attribute-set is one for the entire op, therefore I can't specify two
different sets for request and reply.

I presume I need to leave PEER_GET on the main 'ovpn' set and then
opencode the restriction of having only the ID in the request.

Similarly goes for KEY_GET.

Sabrina, Jakub, does it make sense to you?

Regards,

--
Antonio Quartulli
OpenVPN Inc.