1 // SPDX-License-Identifier: GPL-2.0
2 /* OpenVPN data channel offload
3 *
4 * Copyright (C) 2020-2025 OpenVPN, Inc.
5 *
6 * Author: Antonio Quartulli <antonio@openvpn.net>
7 */
8
9 #include <linux/netdevice.h>
10 #include <linux/types.h>
11 #include <net/genetlink.h>
12
13 #include <uapi/linux/ovpn.h>
14
15 #include "ovpnpriv.h"
16 #include "main.h"
17 #include "netlink.h"
18 #include "netlink-gen.h"
19 #include "bind.h"
20 #include "crypto.h"
21 #include "peer.h"
22 #include "socket.h"
23
24 MODULE_ALIAS_GENL_FAMILY(OVPN_FAMILY_NAME);
25
26 /**
27 * ovpn_get_dev_from_attrs - retrieve the ovpn private data from the netdevice
28 * a netlink message is targeting
29 * @net: network namespace where to look for the interface
30 * @info: generic netlink info from the user request
31 * @tracker: tracker object to be used for the netdev reference acquisition
32 *
33 * Return: the ovpn private data, if found, or an error otherwise
34 */
35 static struct ovpn_priv *
ovpn_get_dev_from_attrs(struct net * net,const struct genl_info * info,netdevice_tracker * tracker)36 ovpn_get_dev_from_attrs(struct net *net, const struct genl_info *info,
37 netdevice_tracker *tracker)
38 {
39 struct ovpn_priv *ovpn;
40 struct net_device *dev;
41 int ifindex;
42
43 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_IFINDEX))
44 return ERR_PTR(-EINVAL);
45
46 ifindex = nla_get_u32(info->attrs[OVPN_A_IFINDEX]);
47
48 rcu_read_lock();
49 dev = dev_get_by_index_rcu(net, ifindex);
50 if (!dev) {
51 rcu_read_unlock();
52 NL_SET_ERR_MSG_MOD(info->extack,
53 "ifindex does not match any interface");
54 return ERR_PTR(-ENODEV);
55 }
56
57 if (!ovpn_dev_is_valid(dev)) {
58 rcu_read_unlock();
59 NL_SET_ERR_MSG_MOD(info->extack,
60 "specified interface is not ovpn");
61 NL_SET_BAD_ATTR(info->extack, info->attrs[OVPN_A_IFINDEX]);
62 return ERR_PTR(-EINVAL);
63 }
64
65 ovpn = netdev_priv(dev);
66 netdev_hold(dev, tracker, GFP_ATOMIC);
67 rcu_read_unlock();
68
69 return ovpn;
70 }
71
ovpn_nl_pre_doit(const struct genl_split_ops * ops,struct sk_buff * skb,struct genl_info * info)72 int ovpn_nl_pre_doit(const struct genl_split_ops *ops, struct sk_buff *skb,
73 struct genl_info *info)
74 {
75 netdevice_tracker *tracker = (netdevice_tracker *)&info->user_ptr[1];
76 struct ovpn_priv *ovpn = ovpn_get_dev_from_attrs(genl_info_net(info),
77 info, tracker);
78
79 if (IS_ERR(ovpn))
80 return PTR_ERR(ovpn);
81
82 info->user_ptr[0] = ovpn;
83
84 return 0;
85 }
86
ovpn_nl_post_doit(const struct genl_split_ops * ops,struct sk_buff * skb,struct genl_info * info)87 void ovpn_nl_post_doit(const struct genl_split_ops *ops, struct sk_buff *skb,
88 struct genl_info *info)
89 {
90 netdevice_tracker *tracker = (netdevice_tracker *)&info->user_ptr[1];
91 struct ovpn_priv *ovpn = info->user_ptr[0];
92
93 if (ovpn)
94 netdev_put(ovpn->dev, tracker);
95 }
96
ovpn_nl_attr_sockaddr_remote(struct nlattr ** attrs,struct sockaddr_storage * ss)97 static bool ovpn_nl_attr_sockaddr_remote(struct nlattr **attrs,
98 struct sockaddr_storage *ss)
99 {
100 struct sockaddr_in6 *sin6;
101 struct sockaddr_in *sin;
102 struct in6_addr *in6;
103 __be16 port = 0;
104 __be32 *in;
105
106 ss->ss_family = AF_UNSPEC;
107
108 if (attrs[OVPN_A_PEER_REMOTE_PORT])
109 port = nla_get_be16(attrs[OVPN_A_PEER_REMOTE_PORT]);
110
111 if (attrs[OVPN_A_PEER_REMOTE_IPV4]) {
112 ss->ss_family = AF_INET;
113 in = nla_data(attrs[OVPN_A_PEER_REMOTE_IPV4]);
114 } else if (attrs[OVPN_A_PEER_REMOTE_IPV6]) {
115 ss->ss_family = AF_INET6;
116 in6 = nla_data(attrs[OVPN_A_PEER_REMOTE_IPV6]);
117 } else {
118 return false;
119 }
120
121 switch (ss->ss_family) {
122 case AF_INET6:
123 /* If this is a regular IPv6 just break and move on,
124 * otherwise switch to AF_INET and extract the IPv4 accordingly
125 */
126 if (!ipv6_addr_v4mapped(in6)) {
127 sin6 = (struct sockaddr_in6 *)ss;
128 sin6->sin6_port = port;
129 memcpy(&sin6->sin6_addr, in6, sizeof(*in6));
130 break;
131 }
132
133 /* v4-mapped-v6 address */
134 ss->ss_family = AF_INET;
135 in = &in6->s6_addr32[3];
136 fallthrough;
137 case AF_INET:
138 sin = (struct sockaddr_in *)ss;
139 sin->sin_port = port;
140 sin->sin_addr.s_addr = *in;
141 break;
142 }
143
144 return true;
145 }
146
ovpn_nl_attr_local_ip(struct nlattr ** attrs)147 static u8 *ovpn_nl_attr_local_ip(struct nlattr **attrs)
148 {
149 u8 *addr6;
150
151 if (!attrs[OVPN_A_PEER_LOCAL_IPV4] && !attrs[OVPN_A_PEER_LOCAL_IPV6])
152 return NULL;
153
154 if (attrs[OVPN_A_PEER_LOCAL_IPV4])
155 return nla_data(attrs[OVPN_A_PEER_LOCAL_IPV4]);
156
157 addr6 = nla_data(attrs[OVPN_A_PEER_LOCAL_IPV6]);
158 /* this is an IPv4-mapped IPv6 address, therefore extract the actual
159 * v4 address from the last 4 bytes
160 */
161 if (ipv6_addr_v4mapped((struct in6_addr *)addr6))
162 return addr6 + 12;
163
164 return addr6;
165 }
166
ovpn_nl_family_get(struct nlattr * addr4,struct nlattr * addr6)167 static sa_family_t ovpn_nl_family_get(struct nlattr *addr4,
168 struct nlattr *addr6)
169 {
170 if (addr4)
171 return AF_INET;
172
173 if (addr6) {
174 if (ipv6_addr_v4mapped((struct in6_addr *)nla_data(addr6)))
175 return AF_INET;
176 return AF_INET6;
177 }
178
179 return AF_UNSPEC;
180 }
181
ovpn_nl_peer_precheck(struct ovpn_priv * ovpn,struct genl_info * info,struct nlattr ** attrs)182 static int ovpn_nl_peer_precheck(struct ovpn_priv *ovpn,
183 struct genl_info *info,
184 struct nlattr **attrs)
185 {
186 sa_family_t local_fam, remote_fam;
187
188 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_PEER], attrs,
189 OVPN_A_PEER_ID))
190 return -EINVAL;
191
192 if (attrs[OVPN_A_PEER_REMOTE_IPV4] && attrs[OVPN_A_PEER_REMOTE_IPV6]) {
193 NL_SET_ERR_MSG_MOD(info->extack,
194 "cannot specify both remote IPv4 or IPv6 address");
195 return -EINVAL;
196 }
197
198 if (!attrs[OVPN_A_PEER_REMOTE_IPV4] &&
199 !attrs[OVPN_A_PEER_REMOTE_IPV6] && attrs[OVPN_A_PEER_REMOTE_PORT]) {
200 NL_SET_ERR_MSG_MOD(info->extack,
201 "cannot specify remote port without IP address");
202 return -EINVAL;
203 }
204
205 if ((attrs[OVPN_A_PEER_REMOTE_IPV4] ||
206 attrs[OVPN_A_PEER_REMOTE_IPV6]) &&
207 !attrs[OVPN_A_PEER_REMOTE_PORT]) {
208 NL_SET_ERR_MSG_MOD(info->extack,
209 "cannot specify remote IP address without port");
210 return -EINVAL;
211 }
212
213 if (!attrs[OVPN_A_PEER_REMOTE_IPV4] &&
214 attrs[OVPN_A_PEER_LOCAL_IPV4]) {
215 NL_SET_ERR_MSG_MOD(info->extack,
216 "cannot specify local IPv4 address without remote");
217 return -EINVAL;
218 }
219
220 if (!attrs[OVPN_A_PEER_REMOTE_IPV6] &&
221 attrs[OVPN_A_PEER_LOCAL_IPV6]) {
222 NL_SET_ERR_MSG_MOD(info->extack,
223 "cannot specify local IPV6 address without remote");
224 return -EINVAL;
225 }
226
227 /* check that local and remote address families are the same even
228 * after parsing v4mapped IPv6 addresses.
229 * (if addresses are not provided, family will be AF_UNSPEC and
230 * the check is skipped)
231 */
232 local_fam = ovpn_nl_family_get(attrs[OVPN_A_PEER_LOCAL_IPV4],
233 attrs[OVPN_A_PEER_LOCAL_IPV6]);
234 remote_fam = ovpn_nl_family_get(attrs[OVPN_A_PEER_REMOTE_IPV4],
235 attrs[OVPN_A_PEER_REMOTE_IPV6]);
236 if (local_fam != AF_UNSPEC && remote_fam != AF_UNSPEC &&
237 local_fam != remote_fam) {
238 NL_SET_ERR_MSG_MOD(info->extack,
239 "mismatching local and remote address families");
240 return -EINVAL;
241 }
242
243 if (remote_fam != AF_INET6 && attrs[OVPN_A_PEER_REMOTE_IPV6_SCOPE_ID]) {
244 NL_SET_ERR_MSG_MOD(info->extack,
245 "cannot specify scope id without remote IPv6 address");
246 return -EINVAL;
247 }
248
249 /* VPN IPs are needed only in MP mode for selecting the right peer */
250 if (ovpn->mode == OVPN_MODE_P2P && (attrs[OVPN_A_PEER_VPN_IPV4] ||
251 attrs[OVPN_A_PEER_VPN_IPV6])) {
252 NL_SET_ERR_MSG_FMT_MOD(info->extack,
253 "unexpected VPN IP in P2P mode");
254 return -EINVAL;
255 }
256
257 if ((attrs[OVPN_A_PEER_KEEPALIVE_INTERVAL] &&
258 !attrs[OVPN_A_PEER_KEEPALIVE_TIMEOUT]) ||
259 (!attrs[OVPN_A_PEER_KEEPALIVE_INTERVAL] &&
260 attrs[OVPN_A_PEER_KEEPALIVE_TIMEOUT])) {
261 NL_SET_ERR_MSG_FMT_MOD(info->extack,
262 "keepalive interval and timeout are required together");
263 return -EINVAL;
264 }
265
266 return 0;
267 }
268
269 /**
270 * ovpn_nl_peer_modify - modify the peer attributes according to the incoming msg
271 * @peer: the peer to modify
272 * @info: generic netlink info from the user request
273 * @attrs: the attributes from the user request
274 *
275 * Return: a negative error code in case of failure, 0 on success or 1 on
276 * success and the VPN IPs have been modified (requires rehashing in MP
277 * mode)
278 */
ovpn_nl_peer_modify(struct ovpn_peer * peer,struct genl_info * info,struct nlattr ** attrs)279 static int ovpn_nl_peer_modify(struct ovpn_peer *peer, struct genl_info *info,
280 struct nlattr **attrs)
281 {
282 struct sockaddr_storage ss = {};
283 void *local_ip = NULL;
284 u32 interv, timeout;
285 bool rehash = false;
286 int ret;
287
288 spin_lock_bh(&peer->lock);
289
290 if (ovpn_nl_attr_sockaddr_remote(attrs, &ss)) {
291 /* we carry the local IP in a generic container.
292 * ovpn_peer_reset_sockaddr() will properly interpret it
293 * based on ss.ss_family
294 */
295 local_ip = ovpn_nl_attr_local_ip(attrs);
296
297 /* set peer sockaddr */
298 ret = ovpn_peer_reset_sockaddr(peer, &ss, local_ip);
299 if (ret < 0) {
300 NL_SET_ERR_MSG_FMT_MOD(info->extack,
301 "cannot set peer sockaddr: %d",
302 ret);
303 goto err_unlock;
304 }
305 dst_cache_reset(&peer->dst_cache);
306 }
307
308 /* In a multipeer-to-multipeer setup we may have asymmetric peer IDs,
309 * that is peer->id might be different from peer->tx_id.
310 */
311 if (attrs[OVPN_A_PEER_TX_ID])
312 peer->tx_id = nla_get_u32(attrs[OVPN_A_PEER_TX_ID]);
313
314 if (attrs[OVPN_A_PEER_VPN_IPV4]) {
315 rehash = true;
316 peer->vpn_addrs.ipv4.s_addr =
317 nla_get_in_addr(attrs[OVPN_A_PEER_VPN_IPV4]);
318 }
319
320 if (attrs[OVPN_A_PEER_VPN_IPV6]) {
321 rehash = true;
322 peer->vpn_addrs.ipv6 =
323 nla_get_in6_addr(attrs[OVPN_A_PEER_VPN_IPV6]);
324 }
325
326 /* when setting the keepalive, both parameters have to be configured */
327 if (attrs[OVPN_A_PEER_KEEPALIVE_INTERVAL] &&
328 attrs[OVPN_A_PEER_KEEPALIVE_TIMEOUT]) {
329 interv = nla_get_u32(attrs[OVPN_A_PEER_KEEPALIVE_INTERVAL]);
330 timeout = nla_get_u32(attrs[OVPN_A_PEER_KEEPALIVE_TIMEOUT]);
331 ovpn_peer_keepalive_set(peer, interv, timeout);
332 }
333
334 netdev_dbg(peer->ovpn->dev,
335 "modify peer id=%u tx_id=%u endpoint=%pIScp VPN-IPv4=%pI4 VPN-IPv6=%pI6c\n",
336 peer->id, peer->tx_id, &ss,
337 &peer->vpn_addrs.ipv4.s_addr, &peer->vpn_addrs.ipv6);
338
339 spin_unlock_bh(&peer->lock);
340
341 return rehash ? 1 : 0;
342 err_unlock:
343 spin_unlock_bh(&peer->lock);
344 return ret;
345 }
346
ovpn_nl_peer_new_doit(struct sk_buff * skb,struct genl_info * info)347 int ovpn_nl_peer_new_doit(struct sk_buff *skb, struct genl_info *info)
348 {
349 struct nlattr *attrs[OVPN_A_PEER_MAX + 1];
350 struct ovpn_priv *ovpn = info->user_ptr[0];
351 struct ovpn_socket *ovpn_sock;
352 struct socket *sock = NULL;
353 struct ovpn_peer *peer;
354 u32 sockfd, peer_id;
355 int ret;
356
357 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_PEER))
358 return -EINVAL;
359
360 ret = nla_parse_nested(attrs, OVPN_A_PEER_MAX, info->attrs[OVPN_A_PEER],
361 ovpn_peer_new_input_nl_policy, info->extack);
362 if (ret)
363 return ret;
364
365 ret = ovpn_nl_peer_precheck(ovpn, info, attrs);
366 if (ret < 0)
367 return ret;
368
369 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_PEER], attrs,
370 OVPN_A_PEER_SOCKET))
371 return -EINVAL;
372
373 /* in MP mode VPN IPs are required for selecting the right peer */
374 if (ovpn->mode == OVPN_MODE_MP && !attrs[OVPN_A_PEER_VPN_IPV4] &&
375 !attrs[OVPN_A_PEER_VPN_IPV6]) {
376 NL_SET_ERR_MSG_FMT_MOD(info->extack,
377 "VPN IP must be provided in MP mode");
378 return -EINVAL;
379 }
380
381 peer_id = nla_get_u32(attrs[OVPN_A_PEER_ID]);
382
383 peer = ovpn_peer_new(ovpn, peer_id);
384 if (IS_ERR(peer)) {
385 NL_SET_ERR_MSG_FMT_MOD(info->extack,
386 "cannot create new peer object for peer %u: %ld",
387 peer_id, PTR_ERR(peer));
388 return PTR_ERR(peer);
389 }
390
391 /* lookup the fd in the kernel table and extract the socket object */
392 sockfd = nla_get_u32(attrs[OVPN_A_PEER_SOCKET]);
393 /* sockfd_lookup() increases sock's refcounter */
394 sock = sockfd_lookup(sockfd, &ret);
395 if (!sock) {
396 NL_SET_ERR_MSG_FMT_MOD(info->extack,
397 "cannot lookup peer socket (fd=%u): %d",
398 sockfd, ret);
399 ret = -ENOTSOCK;
400 goto peer_release;
401 }
402
403 /* Only when using UDP as transport protocol the remote endpoint
404 * can be configured so that ovpn knows where to send packets to.
405 */
406 if (sock->sk->sk_protocol == IPPROTO_UDP &&
407 !attrs[OVPN_A_PEER_REMOTE_IPV4] &&
408 !attrs[OVPN_A_PEER_REMOTE_IPV6]) {
409 NL_SET_ERR_MSG_FMT_MOD(info->extack,
410 "missing remote IP address for UDP socket");
411 sockfd_put(sock);
412 ret = -EINVAL;
413 goto peer_release;
414 }
415
416 /* In case of TCP, the socket is connected to the peer and ovpn
417 * will just send bytes over it, without the need to specify a
418 * destination.
419 */
420 if (sock->sk->sk_protocol == IPPROTO_TCP &&
421 (attrs[OVPN_A_PEER_REMOTE_IPV4] ||
422 attrs[OVPN_A_PEER_REMOTE_IPV6])) {
423 NL_SET_ERR_MSG_FMT_MOD(info->extack,
424 "unexpected remote IP address with TCP socket");
425 sockfd_put(sock);
426 ret = -EINVAL;
427 goto peer_release;
428 }
429
430 ovpn_sock = ovpn_socket_new(sock, peer);
431 /* at this point we unconditionally drop the reference to the socket:
432 * - in case of error, the socket has to be dropped
433 * - if case of success, the socket is configured and let
434 * userspace own the reference, so that the latter can
435 * trigger the final close()
436 */
437 sockfd_put(sock);
438 if (IS_ERR(ovpn_sock)) {
439 NL_SET_ERR_MSG_FMT_MOD(info->extack,
440 "cannot encapsulate socket: %ld",
441 PTR_ERR(ovpn_sock));
442 ret = -ENOTSOCK;
443 goto peer_release;
444 }
445
446 rcu_assign_pointer(peer->sock, ovpn_sock);
447
448 ret = ovpn_nl_peer_modify(peer, info, attrs);
449 if (ret < 0)
450 goto sock_release;
451
452 ret = ovpn_peer_add(ovpn, peer);
453 if (ret < 0) {
454 NL_SET_ERR_MSG_FMT_MOD(info->extack,
455 "cannot add new peer (id=%u) to hashtable: %d",
456 peer->id, ret);
457 goto sock_release;
458 }
459
460 return 0;
461
462 sock_release:
463 ovpn_socket_release(peer);
464 peer_release:
465 /* For UDP, the peer is unreachable until added to the hashtables, so
466 * dropping the initial reference is enough. For TCP, the peer may be
467 * concurrently reachable via sk_user_data->peer until
468 * ovpn_socket_release() detaches; rely on the refcount.
469 */
470 ovpn_peer_put(peer);
471
472 return ret;
473 }
474
ovpn_nl_peer_set_doit(struct sk_buff * skb,struct genl_info * info)475 int ovpn_nl_peer_set_doit(struct sk_buff *skb, struct genl_info *info)
476 {
477 struct nlattr *attrs[OVPN_A_PEER_MAX + 1];
478 struct ovpn_priv *ovpn = info->user_ptr[0];
479 struct ovpn_socket *sock;
480 struct ovpn_peer *peer;
481 u32 peer_id;
482 int ret;
483
484 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_PEER))
485 return -EINVAL;
486
487 ret = nla_parse_nested(attrs, OVPN_A_PEER_MAX, info->attrs[OVPN_A_PEER],
488 ovpn_peer_set_input_nl_policy, info->extack);
489 if (ret)
490 return ret;
491
492 ret = ovpn_nl_peer_precheck(ovpn, info, attrs);
493 if (ret < 0)
494 return ret;
495
496 if (attrs[OVPN_A_PEER_SOCKET]) {
497 NL_SET_ERR_MSG_FMT_MOD(info->extack,
498 "socket cannot be modified");
499 return -EINVAL;
500 }
501
502 peer_id = nla_get_u32(attrs[OVPN_A_PEER_ID]);
503 peer = ovpn_peer_get_by_id(ovpn, peer_id);
504 if (!peer) {
505 NL_SET_ERR_MSG_FMT_MOD(info->extack,
506 "cannot find peer with id %u", peer_id);
507 return -ENOENT;
508 }
509
510 /* when using a TCP socket the remote IP is not expected */
511 rcu_read_lock();
512 sock = rcu_dereference(peer->sock);
513 if (sock && sock->sk->sk_protocol == IPPROTO_TCP &&
514 (attrs[OVPN_A_PEER_REMOTE_IPV4] ||
515 attrs[OVPN_A_PEER_REMOTE_IPV6])) {
516 rcu_read_unlock();
517 NL_SET_ERR_MSG_FMT_MOD(info->extack,
518 "unexpected remote IP address with TCP socket");
519 ovpn_peer_put(peer);
520 return -EINVAL;
521 }
522 rcu_read_unlock();
523
524 spin_lock_bh(&ovpn->lock);
525 ret = ovpn_nl_peer_modify(peer, info, attrs);
526 if (ret < 0) {
527 spin_unlock_bh(&ovpn->lock);
528 ovpn_peer_put(peer);
529 return ret;
530 }
531
532 /* ret == 1 means that VPN IPv4/6 has been modified and rehashing
533 * is required
534 */
535 if (ret > 0)
536 ovpn_peer_hash_vpn_ip(peer);
537 /* if the remote endpoint was updated, the by_transp_addr hash bucket
538 * also needs to be refreshed, otherwise incoming packets from the new
539 * remote address would fail the lockless lookup
540 */
541 if (attrs[OVPN_A_PEER_REMOTE_IPV4] || attrs[OVPN_A_PEER_REMOTE_IPV6])
542 ovpn_peer_hash_transp_addr(peer);
543 spin_unlock_bh(&ovpn->lock);
544 ovpn_peer_put(peer);
545
546 return 0;
547 }
548
ovpn_nl_send_peer(struct sk_buff * skb,const struct genl_info * info,const struct ovpn_peer * peer,u32 portid,u32 seq,int flags)549 static int ovpn_nl_send_peer(struct sk_buff *skb, const struct genl_info *info,
550 const struct ovpn_peer *peer, u32 portid, u32 seq,
551 int flags)
552 {
553 const struct ovpn_bind *bind;
554 struct ovpn_socket *sock;
555 int ret = -EMSGSIZE;
556 struct nlattr *attr;
557 __be16 local_port;
558 void *hdr;
559 int id;
560
561 hdr = genlmsg_put(skb, portid, seq, &ovpn_nl_family, flags,
562 OVPN_CMD_PEER_GET);
563 if (!hdr)
564 return -ENOBUFS;
565
566 attr = nla_nest_start(skb, OVPN_A_PEER);
567 if (!attr)
568 goto err;
569
570 rcu_read_lock();
571 sock = rcu_dereference(peer->sock);
572 if (!sock) {
573 ret = -EINVAL;
574 goto err_unlock;
575 }
576
577 if (!net_eq(genl_info_net(info), sock_net(sock->sk))) {
578 id = peernet2id_alloc(genl_info_net(info),
579 sock_net(sock->sk),
580 GFP_ATOMIC);
581 if (nla_put_s32(skb, OVPN_A_PEER_SOCKET_NETNSID, id))
582 goto err_unlock;
583 }
584 local_port = inet_sk(sock->sk)->inet_sport;
585 rcu_read_unlock();
586
587 if (nla_put_u32(skb, OVPN_A_PEER_ID, peer->id))
588 goto err;
589
590 if (nla_put_u32(skb, OVPN_A_PEER_TX_ID, peer->tx_id))
591 goto err;
592
593 if (peer->vpn_addrs.ipv4.s_addr != htonl(INADDR_ANY))
594 if (nla_put_in_addr(skb, OVPN_A_PEER_VPN_IPV4,
595 peer->vpn_addrs.ipv4.s_addr))
596 goto err;
597
598 if (!ipv6_addr_equal(&peer->vpn_addrs.ipv6, &in6addr_any))
599 if (nla_put_in6_addr(skb, OVPN_A_PEER_VPN_IPV6,
600 &peer->vpn_addrs.ipv6))
601 goto err;
602
603 if (nla_put_u32(skb, OVPN_A_PEER_KEEPALIVE_INTERVAL,
604 peer->keepalive_interval) ||
605 nla_put_u32(skb, OVPN_A_PEER_KEEPALIVE_TIMEOUT,
606 peer->keepalive_timeout))
607 goto err;
608
609 rcu_read_lock();
610 bind = rcu_dereference(peer->bind);
611 if (bind) {
612 if (bind->remote.in4.sin_family == AF_INET) {
613 if (nla_put_in_addr(skb, OVPN_A_PEER_REMOTE_IPV4,
614 bind->remote.in4.sin_addr.s_addr) ||
615 nla_put_net16(skb, OVPN_A_PEER_REMOTE_PORT,
616 bind->remote.in4.sin_port) ||
617 nla_put_in_addr(skb, OVPN_A_PEER_LOCAL_IPV4,
618 bind->local.ipv4.s_addr))
619 goto err_unlock;
620 } else if (bind->remote.in4.sin_family == AF_INET6) {
621 if (nla_put_in6_addr(skb, OVPN_A_PEER_REMOTE_IPV6,
622 &bind->remote.in6.sin6_addr) ||
623 nla_put_u32(skb, OVPN_A_PEER_REMOTE_IPV6_SCOPE_ID,
624 bind->remote.in6.sin6_scope_id) ||
625 nla_put_net16(skb, OVPN_A_PEER_REMOTE_PORT,
626 bind->remote.in6.sin6_port) ||
627 nla_put_in6_addr(skb, OVPN_A_PEER_LOCAL_IPV6,
628 &bind->local.ipv6))
629 goto err_unlock;
630 }
631 }
632 rcu_read_unlock();
633
634 if (nla_put_net16(skb, OVPN_A_PEER_LOCAL_PORT, local_port) ||
635 /* VPN RX stats */
636 nla_put_uint(skb, OVPN_A_PEER_VPN_RX_BYTES,
637 atomic64_read(&peer->vpn_stats.rx.bytes)) ||
638 nla_put_uint(skb, OVPN_A_PEER_VPN_RX_PACKETS,
639 atomic64_read(&peer->vpn_stats.rx.packets)) ||
640 /* VPN TX stats */
641 nla_put_uint(skb, OVPN_A_PEER_VPN_TX_BYTES,
642 atomic64_read(&peer->vpn_stats.tx.bytes)) ||
643 nla_put_uint(skb, OVPN_A_PEER_VPN_TX_PACKETS,
644 atomic64_read(&peer->vpn_stats.tx.packets)) ||
645 /* link RX stats */
646 nla_put_uint(skb, OVPN_A_PEER_LINK_RX_BYTES,
647 atomic64_read(&peer->link_stats.rx.bytes)) ||
648 nla_put_uint(skb, OVPN_A_PEER_LINK_RX_PACKETS,
649 atomic64_read(&peer->link_stats.rx.packets)) ||
650 /* link TX stats */
651 nla_put_uint(skb, OVPN_A_PEER_LINK_TX_BYTES,
652 atomic64_read(&peer->link_stats.tx.bytes)) ||
653 nla_put_uint(skb, OVPN_A_PEER_LINK_TX_PACKETS,
654 atomic64_read(&peer->link_stats.tx.packets)))
655 goto err;
656
657 nla_nest_end(skb, attr);
658 genlmsg_end(skb, hdr);
659
660 return 0;
661 err_unlock:
662 rcu_read_unlock();
663 err:
664 genlmsg_cancel(skb, hdr);
665 return ret;
666 }
667
ovpn_nl_peer_get_doit(struct sk_buff * skb,struct genl_info * info)668 int ovpn_nl_peer_get_doit(struct sk_buff *skb, struct genl_info *info)
669 {
670 struct nlattr *attrs[OVPN_A_PEER_MAX + 1];
671 struct ovpn_priv *ovpn = info->user_ptr[0];
672 struct ovpn_peer *peer;
673 struct sk_buff *msg;
674 u32 peer_id;
675 int ret, i;
676
677 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_PEER))
678 return -EINVAL;
679
680 ret = nla_parse_nested(attrs, OVPN_A_PEER_MAX, info->attrs[OVPN_A_PEER],
681 ovpn_peer_nl_policy, info->extack);
682 if (ret)
683 return ret;
684
685 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_PEER], attrs,
686 OVPN_A_PEER_ID))
687 return -EINVAL;
688
689 /* OVPN_CMD_PEER_GET expects only the PEER_ID, therefore
690 * ensure that the user hasn't specified any other attribute.
691 *
692 * Unfortunately this check cannot be performed via netlink
693 * spec/policy and must be open-coded.
694 */
695 for (i = 0; i < OVPN_A_PEER_MAX + 1; i++) {
696 if (i == OVPN_A_PEER_ID)
697 continue;
698
699 if (attrs[i]) {
700 NL_SET_ERR_MSG_FMT_MOD(info->extack,
701 "unexpected attribute %u", i);
702 return -EINVAL;
703 }
704 }
705
706 peer_id = nla_get_u32(attrs[OVPN_A_PEER_ID]);
707 peer = ovpn_peer_get_by_id(ovpn, peer_id);
708 if (!peer) {
709 NL_SET_ERR_MSG_FMT_MOD(info->extack,
710 "cannot find peer with id %u", peer_id);
711 return -ENOENT;
712 }
713
714 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
715 if (!msg) {
716 ret = -ENOMEM;
717 goto err;
718 }
719
720 ret = ovpn_nl_send_peer(msg, info, peer, info->snd_portid,
721 info->snd_seq, 0);
722 if (ret < 0) {
723 nlmsg_free(msg);
724 goto err;
725 }
726
727 ret = genlmsg_reply(msg, info);
728 err:
729 ovpn_peer_put(peer);
730 return ret;
731 }
732
ovpn_nl_peer_get_dumpit(struct sk_buff * skb,struct netlink_callback * cb)733 int ovpn_nl_peer_get_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
734 {
735 const struct genl_info *info = genl_info_dump(cb);
736 int bkt, last_idx = cb->args[1], dumped = 0;
737 netdevice_tracker tracker;
738 struct ovpn_priv *ovpn;
739 struct ovpn_peer *peer;
740
741 ovpn = ovpn_get_dev_from_attrs(sock_net(cb->skb->sk), info, &tracker);
742 if (IS_ERR(ovpn))
743 return PTR_ERR(ovpn);
744
745 if (ovpn->mode == OVPN_MODE_P2P) {
746 /* if we already dumped a peer it means we are done */
747 if (last_idx)
748 goto out;
749
750 rcu_read_lock();
751 peer = rcu_dereference(ovpn->peer);
752 if (peer) {
753 if (ovpn_nl_send_peer(skb, info, peer,
754 NETLINK_CB(cb->skb).portid,
755 cb->nlh->nlmsg_seq,
756 NLM_F_MULTI) == 0)
757 dumped++;
758 }
759 rcu_read_unlock();
760 } else {
761 rcu_read_lock();
762 hash_for_each_rcu(ovpn->peers->by_id, bkt, peer,
763 hash_entry_id) {
764 /* skip already dumped peers that were dumped by
765 * previous invocations
766 */
767 if (last_idx > 0) {
768 last_idx--;
769 continue;
770 }
771
772 if (ovpn_nl_send_peer(skb, info, peer,
773 NETLINK_CB(cb->skb).portid,
774 cb->nlh->nlmsg_seq,
775 NLM_F_MULTI) < 0)
776 break;
777
778 /* count peers being dumped during this invocation */
779 dumped++;
780 }
781 rcu_read_unlock();
782 }
783
784 out:
785 netdev_put(ovpn->dev, &tracker);
786
787 /* sum up peers dumped in this message, so that at the next invocation
788 * we can continue from where we left
789 */
790 cb->args[1] += dumped;
791 return skb->len;
792 }
793
ovpn_nl_peer_del_doit(struct sk_buff * skb,struct genl_info * info)794 int ovpn_nl_peer_del_doit(struct sk_buff *skb, struct genl_info *info)
795 {
796 struct nlattr *attrs[OVPN_A_PEER_MAX + 1];
797 struct ovpn_priv *ovpn = info->user_ptr[0];
798 struct ovpn_peer *peer;
799 u32 peer_id;
800 int ret;
801
802 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_PEER))
803 return -EINVAL;
804
805 ret = nla_parse_nested(attrs, OVPN_A_PEER_MAX, info->attrs[OVPN_A_PEER],
806 ovpn_peer_del_input_nl_policy, info->extack);
807 if (ret)
808 return ret;
809
810 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_PEER], attrs,
811 OVPN_A_PEER_ID))
812 return -EINVAL;
813
814 peer_id = nla_get_u32(attrs[OVPN_A_PEER_ID]);
815 peer = ovpn_peer_get_by_id(ovpn, peer_id);
816 if (!peer) {
817 NL_SET_ERR_MSG_FMT_MOD(info->extack,
818 "cannot find peer with id %u", peer_id);
819 return -ENOENT;
820 }
821
822 netdev_dbg(ovpn->dev, "del peer %u\n", peer->id);
823 ret = ovpn_peer_del(peer, OVPN_DEL_PEER_REASON_USERSPACE);
824 ovpn_peer_put(peer);
825
826 return ret;
827 }
828
ovpn_nl_get_key_dir(struct genl_info * info,struct nlattr * key,enum ovpn_cipher_alg cipher,struct ovpn_key_direction * dir)829 static int ovpn_nl_get_key_dir(struct genl_info *info, struct nlattr *key,
830 enum ovpn_cipher_alg cipher,
831 struct ovpn_key_direction *dir)
832 {
833 struct nlattr *attrs[OVPN_A_KEYDIR_MAX + 1];
834 int ret;
835
836 ret = nla_parse_nested(attrs, OVPN_A_KEYDIR_MAX, key,
837 ovpn_keydir_nl_policy, info->extack);
838 if (ret)
839 return ret;
840
841 switch (cipher) {
842 case OVPN_CIPHER_ALG_AES_GCM:
843 case OVPN_CIPHER_ALG_CHACHA20_POLY1305:
844 if (NL_REQ_ATTR_CHECK(info->extack, key, attrs,
845 OVPN_A_KEYDIR_CIPHER_KEY) ||
846 NL_REQ_ATTR_CHECK(info->extack, key, attrs,
847 OVPN_A_KEYDIR_NONCE_TAIL))
848 return -EINVAL;
849
850 dir->cipher_key = nla_data(attrs[OVPN_A_KEYDIR_CIPHER_KEY]);
851 dir->cipher_key_size = nla_len(attrs[OVPN_A_KEYDIR_CIPHER_KEY]);
852
853 /* These algorithms require a 96bit nonce,
854 * Construct it by combining 4-bytes packet id and
855 * 8-bytes nonce-tail from userspace
856 */
857 dir->nonce_tail = nla_data(attrs[OVPN_A_KEYDIR_NONCE_TAIL]);
858 dir->nonce_tail_size = nla_len(attrs[OVPN_A_KEYDIR_NONCE_TAIL]);
859 break;
860 default:
861 NL_SET_ERR_MSG_MOD(info->extack, "unsupported cipher");
862 return -EINVAL;
863 }
864
865 return 0;
866 }
867
868 /**
869 * ovpn_nl_key_new_doit - configure a new key for the specified peer
870 * @skb: incoming netlink message
871 * @info: genetlink metadata
872 *
873 * This function allows the user to install a new key in the peer crypto
874 * state.
875 * Each peer has two 'slots', namely 'primary' and 'secondary', where
876 * keys can be installed. The key in the 'primary' slot is used for
877 * encryption, while both keys can be used for decryption by matching the
878 * key ID carried in the incoming packet.
879 *
880 * The user is responsible for rotating keys when necessary. The user
881 * may fetch peer traffic statistics via netlink in order to better
882 * identify the right time to rotate keys.
883 * The renegotiation follows these steps:
884 * 1. a new key is computed by the user and is installed in the 'secondary'
885 * slot
886 * 2. at user discretion (usually after a predetermined time) 'primary' and
887 * 'secondary' contents are swapped and the new key starts being used for
888 * encryption, while the old key is kept around for decryption of late
889 * packets.
890 *
891 * Return: 0 on success or a negative error code otherwise.
892 */
ovpn_nl_key_new_doit(struct sk_buff * skb,struct genl_info * info)893 int ovpn_nl_key_new_doit(struct sk_buff *skb, struct genl_info *info)
894 {
895 struct nlattr *attrs[OVPN_A_KEYCONF_MAX + 1];
896 struct ovpn_priv *ovpn = info->user_ptr[0];
897 struct ovpn_peer_key_reset pkr;
898 struct ovpn_peer *peer;
899 u32 peer_id;
900 int ret;
901
902 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_KEYCONF))
903 return -EINVAL;
904
905 ret = nla_parse_nested(attrs, OVPN_A_KEYCONF_MAX,
906 info->attrs[OVPN_A_KEYCONF],
907 ovpn_keyconf_nl_policy, info->extack);
908 if (ret)
909 return ret;
910
911 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs,
912 OVPN_A_KEYCONF_PEER_ID))
913 return -EINVAL;
914
915 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs,
916 OVPN_A_KEYCONF_SLOT) ||
917 NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs,
918 OVPN_A_KEYCONF_KEY_ID) ||
919 NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs,
920 OVPN_A_KEYCONF_CIPHER_ALG) ||
921 NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs,
922 OVPN_A_KEYCONF_ENCRYPT_DIR) ||
923 NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs,
924 OVPN_A_KEYCONF_DECRYPT_DIR))
925 return -EINVAL;
926
927 pkr.slot = nla_get_u32(attrs[OVPN_A_KEYCONF_SLOT]);
928 pkr.key.key_id = nla_get_u32(attrs[OVPN_A_KEYCONF_KEY_ID]);
929 pkr.key.cipher_alg = nla_get_u32(attrs[OVPN_A_KEYCONF_CIPHER_ALG]);
930
931 ret = ovpn_nl_get_key_dir(info, attrs[OVPN_A_KEYCONF_ENCRYPT_DIR],
932 pkr.key.cipher_alg, &pkr.key.encrypt);
933 if (ret < 0)
934 return ret;
935
936 ret = ovpn_nl_get_key_dir(info, attrs[OVPN_A_KEYCONF_DECRYPT_DIR],
937 pkr.key.cipher_alg, &pkr.key.decrypt);
938 if (ret < 0)
939 return ret;
940
941 peer_id = nla_get_u32(attrs[OVPN_A_KEYCONF_PEER_ID]);
942 peer = ovpn_peer_get_by_id(ovpn, peer_id);
943 if (!peer) {
944 NL_SET_ERR_MSG_FMT_MOD(info->extack,
945 "no peer with id %u to set key for",
946 peer_id);
947 return -ENOENT;
948 }
949
950 ret = ovpn_crypto_state_reset(&peer->crypto, &pkr);
951 if (ret < 0) {
952 NL_SET_ERR_MSG_FMT_MOD(info->extack,
953 "cannot install new key for peer %u",
954 peer_id);
955 goto out;
956 }
957
958 netdev_dbg(ovpn->dev, "new key installed (id=%u) for peer %u\n",
959 pkr.key.key_id, peer_id);
960 out:
961 ovpn_peer_put(peer);
962 return ret;
963 }
964
ovpn_nl_send_key(struct sk_buff * skb,const struct genl_info * info,u32 peer_id,enum ovpn_key_slot slot,const struct ovpn_key_config * keyconf)965 static int ovpn_nl_send_key(struct sk_buff *skb, const struct genl_info *info,
966 u32 peer_id, enum ovpn_key_slot slot,
967 const struct ovpn_key_config *keyconf)
968 {
969 struct nlattr *attr;
970 void *hdr;
971
972 hdr = genlmsg_put(skb, info->snd_portid, info->snd_seq, &ovpn_nl_family,
973 0, OVPN_CMD_KEY_GET);
974 if (!hdr)
975 return -ENOBUFS;
976
977 attr = nla_nest_start(skb, OVPN_A_KEYCONF);
978 if (!attr)
979 goto err;
980
981 if (nla_put_u32(skb, OVPN_A_KEYCONF_PEER_ID, peer_id))
982 goto err;
983
984 if (nla_put_u32(skb, OVPN_A_KEYCONF_SLOT, slot) ||
985 nla_put_u32(skb, OVPN_A_KEYCONF_KEY_ID, keyconf->key_id) ||
986 nla_put_u32(skb, OVPN_A_KEYCONF_CIPHER_ALG, keyconf->cipher_alg))
987 goto err;
988
989 nla_nest_end(skb, attr);
990 genlmsg_end(skb, hdr);
991
992 return 0;
993 err:
994 genlmsg_cancel(skb, hdr);
995 return -EMSGSIZE;
996 }
997
ovpn_nl_key_get_doit(struct sk_buff * skb,struct genl_info * info)998 int ovpn_nl_key_get_doit(struct sk_buff *skb, struct genl_info *info)
999 {
1000 struct nlattr *attrs[OVPN_A_KEYCONF_MAX + 1];
1001 struct ovpn_priv *ovpn = info->user_ptr[0];
1002 struct ovpn_key_config keyconf = { 0 };
1003 enum ovpn_key_slot slot;
1004 struct ovpn_peer *peer;
1005 struct sk_buff *msg;
1006 u32 peer_id;
1007 int ret, i;
1008
1009 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_KEYCONF))
1010 return -EINVAL;
1011
1012 ret = nla_parse_nested(attrs, OVPN_A_KEYCONF_MAX,
1013 info->attrs[OVPN_A_KEYCONF],
1014 ovpn_keyconf_get_nl_policy, info->extack);
1015 if (ret)
1016 return ret;
1017
1018 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs,
1019 OVPN_A_KEYCONF_PEER_ID))
1020 return -EINVAL;
1021
1022 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs,
1023 OVPN_A_KEYCONF_SLOT))
1024 return -EINVAL;
1025
1026 /* OVPN_CMD_KEY_GET expects only the PEER_ID and the SLOT, therefore
1027 * ensure that the user hasn't specified any other attribute.
1028 *
1029 * Unfortunately this check cannot be performed via netlink
1030 * spec/policy and must be open-coded.
1031 */
1032 for (i = 0; i < OVPN_A_KEYCONF_MAX + 1; i++) {
1033 if (i == OVPN_A_KEYCONF_PEER_ID ||
1034 i == OVPN_A_KEYCONF_SLOT)
1035 continue;
1036
1037 if (attrs[i]) {
1038 NL_SET_ERR_MSG_FMT_MOD(info->extack,
1039 "unexpected attribute %u", i);
1040 return -EINVAL;
1041 }
1042 }
1043
1044 peer_id = nla_get_u32(attrs[OVPN_A_KEYCONF_PEER_ID]);
1045 peer = ovpn_peer_get_by_id(ovpn, peer_id);
1046 if (!peer) {
1047 NL_SET_ERR_MSG_FMT_MOD(info->extack,
1048 "cannot find peer with id %u", peer_id);
1049 return -ENOENT;
1050 }
1051
1052 slot = nla_get_u32(attrs[OVPN_A_KEYCONF_SLOT]);
1053
1054 ret = ovpn_crypto_config_get(&peer->crypto, slot, &keyconf);
1055 if (ret < 0) {
1056 NL_SET_ERR_MSG_FMT_MOD(info->extack,
1057 "cannot extract key from slot %u for peer %u",
1058 slot, peer_id);
1059 goto err;
1060 }
1061
1062 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1063 if (!msg) {
1064 ret = -ENOMEM;
1065 goto err;
1066 }
1067
1068 ret = ovpn_nl_send_key(msg, info, peer->id, slot, &keyconf);
1069 if (ret < 0) {
1070 nlmsg_free(msg);
1071 goto err;
1072 }
1073
1074 ret = genlmsg_reply(msg, info);
1075 err:
1076 ovpn_peer_put(peer);
1077 return ret;
1078 }
1079
ovpn_nl_key_swap_doit(struct sk_buff * skb,struct genl_info * info)1080 int ovpn_nl_key_swap_doit(struct sk_buff *skb, struct genl_info *info)
1081 {
1082 struct nlattr *attrs[OVPN_A_KEYCONF_MAX + 1];
1083 struct ovpn_priv *ovpn = info->user_ptr[0];
1084 struct ovpn_peer *peer;
1085 u32 peer_id;
1086 int ret;
1087
1088 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_KEYCONF))
1089 return -EINVAL;
1090
1091 ret = nla_parse_nested(attrs, OVPN_A_KEYCONF_MAX,
1092 info->attrs[OVPN_A_KEYCONF],
1093 ovpn_keyconf_swap_input_nl_policy, info->extack);
1094 if (ret)
1095 return ret;
1096
1097 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs,
1098 OVPN_A_KEYCONF_PEER_ID))
1099 return -EINVAL;
1100
1101 peer_id = nla_get_u32(attrs[OVPN_A_KEYCONF_PEER_ID]);
1102 peer = ovpn_peer_get_by_id(ovpn, peer_id);
1103 if (!peer) {
1104 NL_SET_ERR_MSG_FMT_MOD(info->extack,
1105 "no peer with id %u to swap keys for",
1106 peer_id);
1107 return -ENOENT;
1108 }
1109
1110 ovpn_crypto_key_slots_swap(&peer->crypto);
1111 ovpn_peer_put(peer);
1112
1113 return 0;
1114 }
1115
ovpn_nl_key_del_doit(struct sk_buff * skb,struct genl_info * info)1116 int ovpn_nl_key_del_doit(struct sk_buff *skb, struct genl_info *info)
1117 {
1118 struct nlattr *attrs[OVPN_A_KEYCONF_MAX + 1];
1119 struct ovpn_priv *ovpn = info->user_ptr[0];
1120 enum ovpn_key_slot slot;
1121 struct ovpn_peer *peer;
1122 u32 peer_id;
1123 int ret;
1124
1125 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_KEYCONF))
1126 return -EINVAL;
1127
1128 ret = nla_parse_nested(attrs, OVPN_A_KEYCONF_MAX,
1129 info->attrs[OVPN_A_KEYCONF],
1130 ovpn_keyconf_del_input_nl_policy, info->extack);
1131 if (ret)
1132 return ret;
1133
1134 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs,
1135 OVPN_A_KEYCONF_PEER_ID))
1136 return -EINVAL;
1137
1138 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs,
1139 OVPN_A_KEYCONF_SLOT))
1140 return -EINVAL;
1141
1142 peer_id = nla_get_u32(attrs[OVPN_A_KEYCONF_PEER_ID]);
1143 slot = nla_get_u32(attrs[OVPN_A_KEYCONF_SLOT]);
1144
1145 peer = ovpn_peer_get_by_id(ovpn, peer_id);
1146 if (!peer) {
1147 NL_SET_ERR_MSG_FMT_MOD(info->extack,
1148 "no peer with id %u to delete key for",
1149 peer_id);
1150 return -ENOENT;
1151 }
1152
1153 ovpn_crypto_key_slot_delete(&peer->crypto, slot);
1154 ovpn_peer_put(peer);
1155
1156 return 0;
1157 }
1158
1159 /**
1160 * ovpn_nl_peer_del_notify - notify userspace about peer being deleted
1161 * @peer: the peer being deleted
1162 *
1163 * Return: 0 on success or a negative error code otherwise
1164 */
ovpn_nl_peer_del_notify(struct ovpn_peer * peer)1165 int ovpn_nl_peer_del_notify(struct ovpn_peer *peer)
1166 {
1167 struct ovpn_socket *sock;
1168 struct sk_buff *msg;
1169 struct nlattr *attr;
1170 int ret = -EMSGSIZE;
1171 void *hdr;
1172
1173 netdev_info(peer->ovpn->dev, "deleting peer with id %u, reason %d\n",
1174 peer->id, peer->delete_reason);
1175
1176 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
1177 if (!msg)
1178 return -ENOMEM;
1179
1180 hdr = genlmsg_put(msg, 0, 0, &ovpn_nl_family, 0, OVPN_CMD_PEER_DEL_NTF);
1181 if (!hdr) {
1182 ret = -ENOBUFS;
1183 goto err_free_msg;
1184 }
1185
1186 if (nla_put_u32(msg, OVPN_A_IFINDEX, peer->ovpn->dev->ifindex))
1187 goto err_cancel_msg;
1188
1189 attr = nla_nest_start(msg, OVPN_A_PEER);
1190 if (!attr)
1191 goto err_cancel_msg;
1192
1193 if (nla_put_u32(msg, OVPN_A_PEER_DEL_REASON, peer->delete_reason))
1194 goto err_cancel_msg;
1195
1196 if (nla_put_u32(msg, OVPN_A_PEER_ID, peer->id))
1197 goto err_cancel_msg;
1198
1199 nla_nest_end(msg, attr);
1200
1201 genlmsg_end(msg, hdr);
1202
1203 rcu_read_lock();
1204 sock = rcu_dereference(peer->sock);
1205 if (!sock) {
1206 ret = -EINVAL;
1207 goto err_unlock;
1208 }
1209 genlmsg_multicast_netns(&ovpn_nl_family, sock_net(sock->sk), msg, 0,
1210 OVPN_NLGRP_PEERS, GFP_ATOMIC);
1211 rcu_read_unlock();
1212
1213 return 0;
1214
1215 err_unlock:
1216 rcu_read_unlock();
1217 err_cancel_msg:
1218 genlmsg_cancel(msg, hdr);
1219 err_free_msg:
1220 nlmsg_free(msg);
1221 return ret;
1222 }
1223
1224 /**
1225 * ovpn_nl_peer_float_notify - notify userspace about peer floating
1226 * @peer: the floated peer
1227 * @ss: sockaddr representing the new remote endpoint
1228 *
1229 * Return: 0 on success or a negative error code otherwise
1230 */
ovpn_nl_peer_float_notify(struct ovpn_peer * peer,const struct sockaddr_storage * ss)1231 int ovpn_nl_peer_float_notify(struct ovpn_peer *peer,
1232 const struct sockaddr_storage *ss)
1233 {
1234 struct ovpn_socket *sock;
1235 struct sockaddr_in6 *sa6;
1236 struct sockaddr_in *sa;
1237 struct sk_buff *msg;
1238 struct nlattr *attr;
1239 int ret = -EMSGSIZE;
1240 void *hdr;
1241
1242 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
1243 if (!msg)
1244 return -ENOMEM;
1245
1246 hdr = genlmsg_put(msg, 0, 0, &ovpn_nl_family, 0,
1247 OVPN_CMD_PEER_FLOAT_NTF);
1248 if (!hdr) {
1249 ret = -ENOBUFS;
1250 goto err_free_msg;
1251 }
1252
1253 if (nla_put_u32(msg, OVPN_A_IFINDEX, peer->ovpn->dev->ifindex))
1254 goto err_cancel_msg;
1255
1256 attr = nla_nest_start(msg, OVPN_A_PEER);
1257 if (!attr)
1258 goto err_cancel_msg;
1259
1260 if (nla_put_u32(msg, OVPN_A_PEER_ID, peer->id))
1261 goto err_cancel_msg;
1262
1263 if (ss->ss_family == AF_INET) {
1264 sa = (struct sockaddr_in *)ss;
1265 if (nla_put_in_addr(msg, OVPN_A_PEER_REMOTE_IPV4,
1266 sa->sin_addr.s_addr) ||
1267 nla_put_net16(msg, OVPN_A_PEER_REMOTE_PORT, sa->sin_port))
1268 goto err_cancel_msg;
1269 } else if (ss->ss_family == AF_INET6) {
1270 sa6 = (struct sockaddr_in6 *)ss;
1271 if (nla_put_in6_addr(msg, OVPN_A_PEER_REMOTE_IPV6,
1272 &sa6->sin6_addr) ||
1273 nla_put_u32(msg, OVPN_A_PEER_REMOTE_IPV6_SCOPE_ID,
1274 sa6->sin6_scope_id) ||
1275 nla_put_net16(msg, OVPN_A_PEER_REMOTE_PORT, sa6->sin6_port))
1276 goto err_cancel_msg;
1277 } else {
1278 ret = -EAFNOSUPPORT;
1279 goto err_cancel_msg;
1280 }
1281
1282 nla_nest_end(msg, attr);
1283 genlmsg_end(msg, hdr);
1284
1285 rcu_read_lock();
1286 sock = rcu_dereference(peer->sock);
1287 if (!sock) {
1288 ret = -EINVAL;
1289 goto err_unlock;
1290 }
1291 genlmsg_multicast_netns(&ovpn_nl_family, sock_net(sock->sk), msg,
1292 0, OVPN_NLGRP_PEERS, GFP_ATOMIC);
1293 rcu_read_unlock();
1294
1295 return 0;
1296
1297 err_unlock:
1298 rcu_read_unlock();
1299 err_cancel_msg:
1300 genlmsg_cancel(msg, hdr);
1301 err_free_msg:
1302 nlmsg_free(msg);
1303 return ret;
1304 }
1305
1306 /**
1307 * ovpn_nl_key_swap_notify - notify userspace peer's key must be renewed
1308 * @peer: the peer whose key needs to be renewed
1309 * @key_id: the ID of the key that needs to be renewed
1310 *
1311 * Return: 0 on success or a negative error code otherwise
1312 */
ovpn_nl_key_swap_notify(struct ovpn_peer * peer,u8 key_id)1313 int ovpn_nl_key_swap_notify(struct ovpn_peer *peer, u8 key_id)
1314 {
1315 struct ovpn_socket *sock;
1316 struct nlattr *k_attr;
1317 struct sk_buff *msg;
1318 int ret = -EMSGSIZE;
1319 void *hdr;
1320
1321 netdev_info(peer->ovpn->dev, "peer with id %u must rekey - primary key unusable.\n",
1322 peer->id);
1323
1324 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
1325 if (!msg)
1326 return -ENOMEM;
1327
1328 hdr = genlmsg_put(msg, 0, 0, &ovpn_nl_family, 0, OVPN_CMD_KEY_SWAP_NTF);
1329 if (!hdr) {
1330 ret = -ENOBUFS;
1331 goto err_free_msg;
1332 }
1333
1334 if (nla_put_u32(msg, OVPN_A_IFINDEX, peer->ovpn->dev->ifindex))
1335 goto err_cancel_msg;
1336
1337 k_attr = nla_nest_start(msg, OVPN_A_KEYCONF);
1338 if (!k_attr)
1339 goto err_cancel_msg;
1340
1341 if (nla_put_u32(msg, OVPN_A_KEYCONF_PEER_ID, peer->id))
1342 goto err_cancel_msg;
1343
1344 if (nla_put_u16(msg, OVPN_A_KEYCONF_KEY_ID, key_id))
1345 goto err_cancel_msg;
1346
1347 nla_nest_end(msg, k_attr);
1348 genlmsg_end(msg, hdr);
1349
1350 rcu_read_lock();
1351 sock = rcu_dereference(peer->sock);
1352 if (!sock) {
1353 ret = -EINVAL;
1354 goto err_unlock;
1355 }
1356 genlmsg_multicast_netns(&ovpn_nl_family, sock_net(sock->sk), msg, 0,
1357 OVPN_NLGRP_PEERS, GFP_ATOMIC);
1358 rcu_read_unlock();
1359
1360 return 0;
1361 err_unlock:
1362 rcu_read_unlock();
1363 err_cancel_msg:
1364 genlmsg_cancel(msg, hdr);
1365 err_free_msg:
1366 nlmsg_free(msg);
1367 return ret;
1368 }
1369
1370 /**
1371 * ovpn_nl_register - perform any needed registration in the NL subsustem
1372 *
1373 * Return: 0 on success, a negative error code otherwise
1374 */
ovpn_nl_register(void)1375 int __init ovpn_nl_register(void)
1376 {
1377 int ret = genl_register_family(&ovpn_nl_family);
1378
1379 if (ret) {
1380 pr_err("ovpn: genl_register_family failed: %d\n", ret);
1381 return ret;
1382 }
1383
1384 return 0;
1385 }
1386
1387 /**
1388 * ovpn_nl_unregister - undo any module wide netlink registration
1389 */
ovpn_nl_unregister(void)1390 void ovpn_nl_unregister(void)
1391 {
1392 genl_unregister_family(&ovpn_nl_family);
1393 }
1394