Hi Sabrina,

On 17/09/2024 03:07, Antonio Quartulli wrote:
[...]

  int ovpn_nl_set_peer_doit(struct sk_buff *skb, struct genl_info *info)
  {

[...]

+	/* VPN IPs cannot be updated, because they are hashed */
+	if (!new_peer && (attrs[OVPN_A_PEER_VPN_IPV4] ||
+			  attrs[OVPN_A_PEER_VPN_IPV6])) {
+		NL_SET_ERR_MSG_FMT_MOD(info->extack,
+				       "VPN IPs cannot be updated");
+		ret = -EINVAL;
+		goto peer_release;
+	}

while answering some other email I realized that right now we are 
rejecting VPN IPs updates.

The reason is (as written in the comment above) that VPN IPs are used 
for hashing the peer.

I think this barrier can be lifted if I implement the VPN IP hashing 
using hlist_nulls, as I have done for the tranport_addr in case of 
floating peers.

What do you think?
Can you see any drawback in this approach?

Doing that would allow us to remove the check above and allow userspace 
to change IP to peers at runtime.


Cheers,

-- 
Antonio Quartulli
OpenVPN Inc.