The OVPN_A_PEER_LOCAL_PORT is designed to be a read-only attribute that ovpn sends back to userspace to show the local port being used to talk to that specific peer. However, we forgot to reject it when parsing CMD_PEER_NEW/SET messages. This is not a critical issue because the incoming value is just ignored, but it may fool userspace which expects some change in behaviour. Explicitly error out and send back a message if OVPN_A_PEER_LOCAL_PORT is specified in a CMD_PEER_NEW/SET message. Reported-by: Ralf Lici Closes: https://github.com/OpenVPN/ovpn-net-next/issues/19 Signed-off-by: Antonio Quartulli --- drivers/net/ovpn/netlink.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/net/ovpn/netlink.c b/drivers/net/ovpn/netlink.c index a4ec53def46e..17d23d01c6d8 100644 --- a/drivers/net/ovpn/netlink.c +++ b/drivers/net/ovpn/netlink.c @@ -224,6 +224,17 @@ static int ovpn_nl_peer_precheck(struct ovpn_priv *ovpn, return -EINVAL; } + /* the local port cannot be set by userspace because the socket + * being passed is already bound to one. + * OVPN_A_PEER_LOCAL_PORT is for sending peer status only (check + * ovpn_nl_send_peer()) + */ + if (attrs[OVPN_A_PEER_LOCAL_PORT]) { + NL_SET_ERR_MSG_MOD(info->extack, + "cannot specify local port (socket is bound already)"); + return -EINVAL; + } + /* check that local and remote address families are the same even * after parsing v4mapped IPv6 addresses. * (if addresses are not provided, family will be AF_UNSPEC and -- 2.49.0