[PATCH applied] Re: networking_sitnl: validate netlink replies against the request

Gert Doering <[email protected]>
Newsgroups gmane.network.openvpn.devel
Message-ID <[email protected]>
This is more a theoretical attack, with netlink replies received that
do not match the request, and our state machine getting confused as
a consequence... but that extra check won't do harm, and might catch
possible errors elsewhere.  Antonio and Ralf are the ones who understand
Linux kernel, who am I to argue :-)

I have only lightly stared at the code (complained, got a v3 in return),
and tested on an oldish Ubuntu with and without DCO (works).

Your patch has been applied to the master and release/2.7 branch.

commit 90ab7be00e73d06f7a5bf72e6a454fcfd5f2818c (master).
commit fbcf3c449787ba200731ff65b3ffa8fb4118a8e5 (release/2.7)
Author: Antonio Quartulli
Date:   Tue Sep 1 17:10:10 2026 +0200

     networking_sitnl: validate netlink replies against the request

     Signed-off-by: Antonio Quartulli <[email protected]>
     Acked-by: Ralf Lici <[email protected]>
     Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1782
     Message-Id: <[email protected]>
     URL: https://www.mail-archive.com/[email protected]/msg38879.html
     Signed-off-by: Gert Doering <[email protected]>


--
kind regards,

Gert Doering
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.