[PR #2287] [CLOSED] fix(linux): netlink buffer overflow in gateway detection breaks VPN routing #2746

New issue

Closed

opened 2026-10-14 21:04:27 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-14 21:04:27 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/amnezia-vpn/amnezia-client/pull/2287
Author: @pavelzak
Created: 2/27/2026
Status: ❌ Closed

Base: dev ← Head: gateway-fix

📝 Commits (2)

8ede5b6 fix(linux): netlink buffer overflow in gateway detection breaks VPN routing
819ddc9 fix: address static analysis issues in networkUtilities.cpp

📊 Changes

3 files changed (+145 additions, -57 deletions)

View changed files

📝 client/core/networkUtilities.cpp (+115 -54)
📝 client/daemon/daemon.cpp (+6 -1)
📝 client/platforms/linux/daemon/linuxroutemonitor.cpp (+24 -2)

📄 Description

Summary

getGatewayAndIface() used a 100-byte buffer for the netlink route dump, but the kernel returns all routes from all tables (~60-120 bytes each). Any system with VPNs (Tailscale, WireGuard) or multiple network interfaces overflows this buffer, causing silent gateway detection failure.
Without the gateway, VPN server exclusion routes fail to be created, routing VPN server traffic back into the tunnel — causing a routing loop and sendmmsg: message too long errors that break all connectivity.
Fixes buffer size (100 → 16384), adds AF_INET filter, fixes validation bugs, adds proper error logging for all failure paths.

Changes

client/core/networkUtilities.cpp: Increase netlink receive buffer, separate request/response buffers, add AF_INET filter, fix validation (was checking request instead of response), fix parsing loop, fix socket fd leaks, initialize struct timeval properly, add nlmsg_seq validation
client/platforms/linux/daemon/linuxroutemonitor.cpp: Validate gateway address before creating exclusion routes, log gateway/interface used, upgrade netlink errors to warning level
client/daemon/daemon.cpp: Check and log addExclusionRoute() return value to detect routing loop risk

Test plan

Connect VPN on Linux system with multiple network interfaces or other VPNs (e.g., Tailscale) running
Verify websites load after VPN connection
Check service logs for "Gateway X.X.X.X for interface Y" confirming gateway detection
Check no "sendmmsg: message too long" or "Network is unreachable" errors in logs

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/amnezia-vpn/amnezia-client/pull/2287 **Author:** [@pavelzak](https://github.com/pavelzak) **Created:** 2/27/2026 **Status:** ❌ Closed **Base:** `dev` ← **Head:** `gateway-fix` --- ### 📝 Commits (2) - [`8ede5b6`](https://github.com/amnezia-vpn/amnezia-client/commit/8ede5b6c292e237d8dae24c55fb04b36f18b19c3) fix(linux): netlink buffer overflow in gateway detection breaks VPN routing - [`819ddc9`](https://github.com/amnezia-vpn/amnezia-client/commit/819ddc999f2bd45965755e4a79537fae2fb0a943) fix: address static analysis issues in networkUtilities.cpp ### 📊 Changes **3 files changed** (+145 additions, -57 deletions) <details> <summary>View changed files</summary> 📝 `client/core/networkUtilities.cpp` (+115 -54) 📝 `client/daemon/daemon.cpp` (+6 -1) 📝 `client/platforms/linux/daemon/linuxroutemonitor.cpp` (+24 -2) </details> ### 📄 Description ## Summary - `getGatewayAndIface()` used a 100-byte buffer for the netlink route dump, but the kernel returns all routes from all tables (~60-120 bytes each). Any system with VPNs (Tailscale, WireGuard) or multiple network interfaces overflows this buffer, causing silent gateway detection failure. - Without the gateway, VPN server exclusion routes fail to be created, routing VPN server traffic back into the tunnel — causing a routing loop and `sendmmsg: message too long` errors that break all connectivity. - Fixes buffer size (100 → 16384), adds AF_INET filter, fixes validation bugs, adds proper error logging for all failure paths. ## Changes - **`client/core/networkUtilities.cpp`**: Increase netlink receive buffer, separate request/response buffers, add AF_INET filter, fix validation (was checking request instead of response), fix parsing loop, fix socket fd leaks, initialize `struct timeval` properly, add `nlmsg_seq` validation - **`client/platforms/linux/daemon/linuxroutemonitor.cpp`**: Validate gateway address before creating exclusion routes, log gateway/interface used, upgrade netlink errors to warning level - **`client/daemon/daemon.cpp`**: Check and log `addExclusionRoute()` return value to detect routing loop risk ## Test plan - [ ] Connect VPN on Linux system with multiple network interfaces or other VPNs (e.g., Tailscale) running - [ ] Verify websites load after VPN connection - [ ] Check service logs for "Gateway X.X.X.X for interface Y" confirming gateway detection - [ ] Check no "sendmmsg: message too long" or "Network is unreachable" errors in logs --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-14 21:04:27 +00:00

closed this issue
added the
pull-request
label

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

amnezia-vpn/amnezia-client#2746

No description provided.

Rows
Columns