From 518b7c5bd51d3f652c8179594a522f6ddf93f449 Mon Sep 17 00:00:00 2001 From: Beniamino Galvani Date: Tue, 7 May 2024 17:51:19 +0200 Subject: [PATCH] vpn: allow IP configurations without addresses An IPv4-over-IPv6 (or vice-versa) IPsec VPN can return IP configurations with routes and without addresses. For example, in this scenario: +---------------+ +---------------+ | fd01::10/64 <-- VPN --> fd02::20/64 | | host1 | | host2 | +-------^-------+ +-------^-------+ | | +-------v-------+ +-------v-------+ | subnet1 | | subnet2 | | 172.16.1.0/24 | | 172.16.2.0/24 | +---------------+ +---------------+ host1 and host2 establish a IPv6 tunnel which encapsulates packets between the two IPv4 subnets. Therefore, in routed mode, host1 will need to configure a route like "172.16.2.0/24 via ipsec1" even if the host doesn't have any IPv4 address on the VPN interface. Accept IP configurations without address from the VPN; only check that the address and prefix are sane if they are provided. (cherry picked from commit 97f185e1f8e5a60d770711d8bce8bd12a205590f) --- src/core/vpn/nm-vpn-connection.c | 44 ++++++++++++++++++++------------ 1 file changed, 27 insertions(+), 17 deletions(-) diff --git a/src/core/vpn/nm-vpn-connection.c b/src/core/vpn/nm-vpn-connection.c index de0c9f7104..4f196e4a09 100644 --- a/src/core/vpn/nm-vpn-connection.c +++ b/src/core/vpn/nm-vpn-connection.c @@ -1988,6 +1988,12 @@ _dbus_signal_ip_config_cb(NMVpnConnection *self, int addr_family, GVariant *dict nm_l3_config_data_set_dns_priority(l3cd, AF_INET, NM_DNS_PRIORITY_DEFAULT_VPN); + _vardict_to_addr(addr_family, + dict, + IS_IPv4 ? NM_VPN_PLUGIN_IP4_CONFIG_INT_GATEWAY + : NM_VPN_PLUGIN_IP6_CONFIG_INT_GATEWAY, + &priv->ip_data_x[IS_IPv4].gw_internal); + if (IS_IPv4) { address.a4 = (NMPlatformIP4Address){ .plen = 24, @@ -1998,16 +2004,17 @@ _dbus_signal_ip_config_cb(NMVpnConnection *self, int addr_family, GVariant *dict }; } - _vardict_to_addr(addr_family, - dict, - IS_IPv4 ? NM_VPN_PLUGIN_IP4_CONFIG_INT_GATEWAY - : NM_VPN_PLUGIN_IP6_CONFIG_INT_GATEWAY, - &priv->ip_data_x[IS_IPv4].gw_internal); - - _vardict_to_addr(addr_family, - dict, - IS_IPv4 ? NM_VPN_PLUGIN_IP4_CONFIG_ADDRESS : NM_VPN_PLUGIN_IP6_CONFIG_ADDRESS, - address.ax.address_ptr); + if (_vardict_to_addr(addr_family, + dict, + IS_IPv4 ? NM_VPN_PLUGIN_IP4_CONFIG_ADDRESS + : NM_VPN_PLUGIN_IP6_CONFIG_ADDRESS, + address.ax.address_ptr) + && nm_ip_addr_is_null(addr_family, &address.ax.address_ptr)) { + _LOGW("invalid IP%c config received: address is zero", + nm_utils_addr_family_to_char(addr_family)); + _check_complete(self, FALSE); + return; + } if (!_vardict_to_addr(addr_family, dict, @@ -2024,17 +2031,20 @@ _dbus_signal_ip_config_cb(NMVpnConnection *self, int addr_family, GVariant *dict &u32)) address.ax.plen = u32; - if (address.ax.plen > 0 && address.ax.plen <= (IS_IPv4 ? 32 : 128) - && !nm_ip_addr_is_null(addr_family, &address.ax.address_ptr)) { - address.ax.addr_source = NM_IP_CONFIG_SOURCE_VPN; - nm_l3_config_data_add_address(l3cd, addr_family, NULL, &address.ax); - } else { - _LOGW("invalid IP%c config received: no valid IP address/prefix", - nm_utils_addr_family_to_char(addr_family)); + if (!nm_ip_addr_is_null(addr_family, &address.ax.address_ptr) + && (address.ax.plen == 0 || address.ax.plen > (IS_IPv4 ? 32 : 128))) { + _LOGW("invalid IP%c config received: invalid prefix %u", + nm_utils_addr_family_to_char(addr_family), + address.ax.plen); _check_complete(self, FALSE); return; } + if (!nm_ip_addr_is_null(addr_family, &address.ax.address_ptr)) { + address.ax.addr_source = NM_IP_CONFIG_SOURCE_VPN; + nm_l3_config_data_add_address(l3cd, addr_family, NULL, &address.ax); + } + if (IS_IPv4) { if (g_variant_lookup(dict, NM_VPN_PLUGIN_IP4_CONFIG_DNS, "au", &var_iter)) { while (g_variant_iter_next(var_iter, "u", &u32))