1 /* SPDX-License-Identifier: GPL-2.0-only */
2 /* OpenVPN data channel offload
3 *
4 * Copyright (C) 2020-2025 OpenVPN, Inc.
5 *
6 * Author: James Yonan <james@openvpn.net>
7 * Antonio Quartulli <antonio@openvpn.net>
8 */
9
10 #ifndef _NET_OVPN_OVPNPEER_H_
11 #define _NET_OVPN_OVPNPEER_H_
12
13 #include <linux/seqlock.h>
14 #include <net/dst_cache.h>
15 #include <net/strparser.h>
16
17 #include "crypto.h"
18 #include "socket.h"
19 #include "stats.h"
20
21 /**
22 * struct ovpn_route_key - route key used for the peer dst cache
23 * @mark: fwmark used for route lookup
24 * @sport: UDP source port used for route lookup
25 */
26 struct ovpn_route_key {
27 u32 mark;
28 __be16 sport;
29 };
30
31 /**
32 * struct ovpn_peer - the main remote peer object
33 * @ovpn: main openvpn instance this peer belongs to
34 * @dev_tracker: reference tracker for associated dev
35 * @id: unique identifier, used to match incoming packets
36 * @tx_id: identifier to be used in TX packets
37 * @vpn_addrs: IP addresses assigned over the tunnel
38 * @vpn_addrs.ipv4: IPv4 assigned to peer on the tunnel
39 * @vpn_addrs.ipv6: IPv6 assigned to peer on the tunnel
40 * @hash_entry_id: entry in the peer ID hashtable
41 * @hash_entry_addr4: entry in the peer IPv4 hashtable
42 * @hash_entry_addr6: entry in the peer IPv6 hashtable
43 * @hash_entry_transp_addr: entry in the peer transport address hashtable
44 * @sock: the socket being used to talk to this peer
45 * @tcp: keeps track of TCP specific state
46 * @tcp.strp: stream parser context (TCP only)
47 * @tcp.user_queue: received packets that have to go to userspace (TCP only)
48 * @tcp.out_queue: packets on hold while socket is taken by user (TCP only)
49 * @tcp.tx_in_progress: true if TX is already ongoing (TCP only)
50 * @tcp.out_msg.skb: packet scheduled for sending (TCP only)
51 * @tcp.out_msg.offset: offset where next send should start (TCP only)
52 * @tcp.out_msg.len: remaining data to send within packet (TCP only)
53 * @tcp.sk_cb.sk_data_ready: pointer to original cb (TCP only)
54 * @tcp.sk_cb.sk_write_space: pointer to original cb (TCP only)
55 * @tcp.sk_cb.prot: pointer to original prot object (TCP only)
56 * @tcp.sk_cb.ops: pointer to the original prot_ops object (TCP only)
57 * @crypto: the crypto configuration (ciphers, keys, etc..)
58 * @dst_cache: cache for dst_entry used to send to peer
59 * @route_key: route key matching the current dst cache contents
60 * @route_key_seq: seqcount protecting lockless route_key reads
61 * @bind: remote peer binding
62 * @keepalive_interval: seconds after which a new keepalive should be sent
63 * @keepalive_xmit_exp: future timestamp when next keepalive should be sent
64 * @last_sent: timestamp of the last successfully sent packet
65 * @keepalive_timeout: seconds after which an inactive peer is considered dead
66 * @keepalive_recv_exp: future timestamp when the peer should expire
67 * @last_recv: timestamp of the last authenticated received packet
68 * @vpn_stats: per-peer in-VPN TX/RX stats
69 * @link_stats: per-peer link/transport TX/RX stats
70 * @delete_reason: why peer was deleted (i.e. timeout, transport error, ..)
71 * @lock: protects binding to peer (bind), route_key and keepalive* fields
72 * @refcount: reference counter
73 * @rcu: used to free peer in an RCU safe way
74 * @release_entry: entry for the socket release list
75 * @keepalive_work: used to schedule keepalive sending
76 */
77 struct ovpn_peer {
78 struct ovpn_priv *ovpn;
79 netdevice_tracker dev_tracker;
80 u32 id;
81 u32 tx_id;
82 struct {
83 struct in_addr ipv4;
84 struct in6_addr ipv6;
85 } vpn_addrs;
86 struct hlist_node hash_entry_id;
87 struct hlist_nulls_node hash_entry_addr4;
88 struct hlist_nulls_node hash_entry_addr6;
89 struct hlist_nulls_node hash_entry_transp_addr;
90 struct ovpn_socket __rcu *sock;
91
92 struct {
93 struct strparser strp;
94 struct sk_buff_head user_queue;
95 struct sk_buff_head out_queue;
96 bool tx_in_progress;
97
98 struct {
99 struct sk_buff *skb;
100 int offset;
101 int len;
102 } out_msg;
103
104 struct {
105 void (*sk_data_ready)(struct sock *sk);
106 void (*sk_write_space)(struct sock *sk);
107 struct proto *prot;
108 const struct proto_ops *ops;
109 } sk_cb;
110
111 struct work_struct defer_del_work;
112 } tcp;
113 struct ovpn_crypto_state crypto;
114 struct dst_cache dst_cache;
115 struct ovpn_route_key route_key;
116 seqcount_spinlock_t route_key_seq;
117 struct ovpn_bind __rcu *bind;
118 unsigned long keepalive_interval;
119 unsigned long keepalive_xmit_exp;
120 time64_t last_sent;
121 unsigned long keepalive_timeout;
122 unsigned long keepalive_recv_exp;
123 time64_t last_recv;
124 struct ovpn_peer_stats vpn_stats;
125 struct ovpn_peer_stats link_stats;
126 enum ovpn_del_peer_reason delete_reason;
127 spinlock_t lock; /* protects bind, route_key and keepalive* */
128 struct kref refcount;
129 struct rcu_head rcu;
130 struct llist_node release_entry;
131 struct work_struct keepalive_work;
132 };
133
134 /**
135 * ovpn_peer_hold - increase reference counter
136 * @peer: the peer whose counter should be increased
137 *
138 * Return: true if the counter was increased or false if it was zero already
139 */
ovpn_peer_hold(struct ovpn_peer * peer)140 static inline bool ovpn_peer_hold(struct ovpn_peer *peer)
141 {
142 return kref_get_unless_zero(&peer->refcount);
143 }
144
145 void ovpn_peer_release_kref(struct kref *kref);
146
147 /**
148 * ovpn_peer_put - decrease reference counter
149 * @peer: the peer whose counter should be decreased
150 */
ovpn_peer_put(struct ovpn_peer * peer)151 static inline void ovpn_peer_put(struct ovpn_peer *peer)
152 {
153 kref_put(&peer->refcount, ovpn_peer_release_kref);
154 }
155
156 struct ovpn_peer *ovpn_peer_new(struct ovpn_priv *ovpn, u32 id);
157 int ovpn_peer_add(struct ovpn_priv *ovpn, struct ovpn_peer *peer);
158 int ovpn_peer_del(struct ovpn_peer *peer, enum ovpn_del_peer_reason reason);
159 void ovpn_peers_free(struct ovpn_priv *ovpn, struct sock *sock,
160 enum ovpn_del_peer_reason reason);
161
162 struct ovpn_peer *ovpn_peer_get_by_transp_addr(struct ovpn_priv *ovpn,
163 struct sk_buff *skb);
164 struct ovpn_peer *ovpn_peer_get_by_id(struct ovpn_priv *ovpn, u32 peer_id);
165 struct ovpn_peer *ovpn_peer_get_by_dst(struct ovpn_priv *ovpn,
166 struct sk_buff *skb);
167 bool ovpn_peer_vpn_addr_conflict4(struct ovpn_priv *ovpn,
168 const struct ovpn_peer *peer,
169 const struct in_addr *addr);
170 bool ovpn_peer_vpn_addr_conflict6(struct ovpn_priv *ovpn,
171 const struct ovpn_peer *peer,
172 const struct in6_addr *addr);
173 void ovpn_peer_hash_vpn_ip(struct ovpn_peer *peer);
174 void ovpn_peer_hash_transp_addr(struct ovpn_peer *peer);
175 bool ovpn_peer_check_by_src(struct ovpn_priv *ovpn, struct sk_buff *skb,
176 struct ovpn_peer *peer);
177
178 void ovpn_peer_keepalive_set(struct ovpn_peer *peer, u32 interval, u32 timeout);
179 void ovpn_peer_keepalive_work(struct work_struct *work);
180
181 void ovpn_peer_endpoints_update(struct ovpn_peer *peer, struct sk_buff *skb);
182 int ovpn_peer_reset_sockaddr(struct ovpn_peer *peer,
183 const struct sockaddr_storage *ss,
184 const void *local_ip);
185
186 #endif /* _NET_OVPN_OVPNPEER_H_ */
187