FreeBSD ovpn(4) DCO module doesn't support "multihome" option correctly
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 14.6k
- Forks
- 3.4k
- PR merge metrics
- No merged PRs in 30d
Description
From my observation, when ovpn(4) DCO driver is used, the outgoing interface for encrypted traffic is chosen on the basis of the FIB lookup instead of preserving the IP address of the VPN connection socket and sending the traffic from the same interface and address it was received on. Such a flaw breaks the "multihome" server since encrypted incoming and outgoing packets don't match the destination/source IP and thus can't pass firewall processing. The tun(4) driver supports this mode still fine in the recent FreeBSD stable/14.
I have no possibility of testing it on Linux with DCO on a "multihome" server.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The report names the FreeBSD ovpn(4) DCO path and compares it with tun(4), but no source file or test is identified. Start by reproducing multihome traffic on FreeBSD stable/14 and compare DCO with tun(4). Done means encrypted packets preserve the VPN socket's receiving interface and source address so firewall processing accepts matching incoming and outgoing traffic.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100