From 437812d4eac9ac892fbfd2fd97c50384b2d2ec07 Mon Sep 17 00:00:00 2001 From: Antonio Quartulli Date: Tue, 28 Jun 2022 10:20:24 +0200 Subject: [PATCH] do not push route-ipv6 entries that are also in the iroute-ipv6 list A server should push a route to a client only if there is no matching iroute for the same client. While this logic works fine for IPv4, there is no IPv6 counterpart. Implement the same check for IPv6 routes and discard matching ones from the push list. Trac: #354 Cc: Gert Doering Signed-off-by: Antonio Quartulli Acked-by: Heiko Hund Message-Id: <20220628082024.19059-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24577.html Signed-off-by: Gert Doering --- src/openvpn/push.c | 28 ++++++++++++++++++++++++++-- 1 file changed, 26 insertions(+), 2 deletions(-) diff --git a/src/openvpn/push.c b/src/openvpn/push.c index 9193b3775..26259c6b8 100644 --- a/src/openvpn/push.c +++ b/src/openvpn/push.c @@ -1054,7 +1054,7 @@ process_incoming_push_msg(struct context *c, void remove_iroutes_from_push_route_list(struct options *o) { - if (o && o->push_list.head && o->iroutes) + if (o && o->push_list.head && (o->iroutes || o->iroutes_ipv6)) { struct gc_arena gc = gc_new(); struct push_entry *e = o->push_list.head; @@ -1071,7 +1071,7 @@ remove_iroutes_from_push_route_list(struct options *o) && parse_line(e->option, p, SIZE(p), "[PUSH_ROUTE_REMOVE]", 1, D_ROUTE_DEBUG, &gc)) { /* is the push item a route directive? */ - if (p[0] && !strcmp(p[0], "route") && !p[3]) + if (p[0] && !strcmp(p[0], "route") && !p[3] && o->iroutes) { /* get route parameters */ bool status1, status2; @@ -1094,6 +1094,30 @@ remove_iroutes_from_push_route_list(struct options *o) } } } + else if (p[0] && !strcmp(p[0], "route-ipv6") && !p[2] + && o->iroutes_ipv6) + { + /* get route parameters */ + struct in6_addr network; + unsigned int netbits; + + /* parse route-ipv6 arguments */ + if (get_ipv6_addr(p[1], &network, &netbits, D_ROUTE_DEBUG)) + { + struct iroute_ipv6 *ir; + + /* does this route-ipv6 match an iroute-ipv6? */ + for (ir = o->iroutes_ipv6; ir != NULL; ir = ir->next) + { + if (!memcmp(&network, &ir->network, sizeof(network)) + && netbits == ir->netbits) + { + enable = false; + break; + } + } + } + } /* should we copy the push item? */ e->enable = enable; -- 2.47.2