Re: [PATCH net 2/3] ovpn: explicitly reject netlink attr PEER_LOCAL_PORT in CMD_PEER_NEW/SET

Jakub Kicinski
2025-07-07T21:48:29Z

On Thu, 3 Jul 2025 15:07:51 +0200 Sabrina Dubroca wrote:
> > The OVPN_A_PEER_LOCAL_PORT is designed to be a read-only attribute
> > that ovpn sends back to userspace to show the local port being used
> > to talk to that specific peer.
>
> Seems like we'd want NLA_REJECT in the nla_policy instead of
> NLA_POLICY_MIN, but my quick grepping in ynl and specs doesn't show
> anything like that. Donald/Jakub, does it already exist? If not, does
> it seem possible to extend the specs and ynl with something like:
>
> name: local-port
> type: reject(u16)
>
> or maybe:
>
> name: local-port
> type: u16
> checks:
> reject: true

There's no way to explicitly reject, because we expect that only what's
needed will be listed (IOW we depend on NLA_UNSPEC rather than
NLA_REJECT). It gets complicated at times but I think it should work
here. Key mechanism is to define subsets of the nests:

diff --git a/Documentation/netlink/specs/ovpn.yaml b/Documentation/netlink/specs/ovpn.yaml
index 17e5e9b7f5a5..15309201e7ca 100644
--- a/Documentation/netlink/specs/ovpn.yaml
+++ b/Documentation/netlink/specs/ovpn.yaml
@@ -160,6 +160,36 @@ doc: Netlink protocol to control OpenVPN network devices
name: link-tx-packets
type: uint
doc: Number of packets transmitted at the transport level
+ -
+ name: peer-input
+ subset-of: peer
+ attributes:
+ -
+ name: id
+ -
+ name: remote-ipv4
+ -
+ name: remote-ipv6
+ -
+ name: remote-ipv6-scope-id
+ -
+ name: remote-port
+ -
+ name: socket
+ -
+ name: socket-netnsid
+ -
+ name: vpn-ipv4
+ -
+ name: vpn-ipv6
+ -
+ name: local-ipv4
+ -
+ name: local-ipv6
+ -
+ name: keepalive-interval
+ -
+ name: keepalive-timeout
-
name: keyconf
attributes:
@@ -235,12 +265,21 @@ doc: Netlink protocol to control OpenVPN network devices
type: nest
doc: Peer specific cipher configuration
nested-attributes: keyconf
+ -
+ name: ovpn-peer-input
+ subset-of: ovpn
+ attributes:
+ -
+ name: ifindex
+ -
+ name: peer
+ nested-attributes: peer-input

operations:
list:
-
name: peer-new
- attribute-set: ovpn
+ attribute-set: ovpn-peer-input
flags: [admin-perm]
doc: Add a remote peer
do:
@@ -252,7 +291,7 @@ doc: Netlink protocol to control OpenVPN network devices
- peer
-
name: peer-set
- attribute-set: ovpn
+ attribute-set: ovpn-peer-input
flags: [admin-perm]
doc: modify a remote peer