OpenVPN / OpenVPN/openvpn

FreeBSD ovpn(4) DCO module doesn't support "multihome" option correctly

Open
#409 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement FreeBSD
Dominant language
C
Stars
14.6k
Forks
3.4k
PR merge metrics
No merged PRs in 30d

Description

From my observation, when ovpn(4) DCO driver is used, the outgoing interface for encrypted traffic is chosen on the basis of the FIB lookup instead of preserving the IP address of the VPN connection socket and sending the traffic from the same interface and address it was received on. Such a flaw breaks the "multihome" server since encrypted incoming and outgoing packets don't match the destination/source IP and thus can't pass firewall processing. The tun(4) driver supports this mode still fine in the recent FreeBSD stable/14.
I have no possibility of testing it on Linux with DCO on a "multihome" server.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The report names the FreeBSD ovpn(4) DCO path and compares it with tun(4), but no source file or test is identified. Start by reproducing multihome traffic on FreeBSD stable/14 and compare DCO with tun(4). Done means encrypted packets preserve the VPN socket's receiving interface and source address so firewall processing accepts matching incoming and outgoing traffic.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.