1 /* SPDX-License-Identifier: GPL-2.0-only */ 2 /* OpenVPN data channel offload 3 * 4 * Copyright (C) 2020-2025 OpenVPN, Inc. 5 * 6 * Author: James Yonan <james@openvpn.net> 7 * Antonio Quartulli <antonio@openvpn.net> 8 */ 9 10 #ifndef _NET_OVPN_OVPNPEER_H_ 11 #define _NET_OVPN_OVPNPEER_H_ 12 13 #include <linux/seqlock.h> 14 #include <net/dst_cache.h> 15 #include <net/strparser.h> 16 17 #include "crypto.h" 18 #include "socket.h" 19 #include "stats.h" 20 21 /** 22 * struct ovpn_route_key - route key used for the peer dst cache 23 * @mark: fwmark used for route lookup 24 * @sport: UDP source port used for route lookup 25 */ 26 struct ovpn_route_key { 27 u32 mark; 28 __be16 sport; 29 }; 30 31 /** 32 * struct ovpn_peer - the main remote peer object 33 * @ovpn: main openvpn instance this peer belongs to 34 * @dev_tracker: reference tracker for associated dev 35 * @id: unique identifier, used to match incoming packets 36 * @tx_id: identifier to be used in TX packets 37 * @vpn_addrs: IP addresses assigned over the tunnel 38 * @vpn_addrs.ipv4: IPv4 assigned to peer on the tunnel 39 * @vpn_addrs.ipv6: IPv6 assigned to peer on the tunnel 40 * @hash_entry_id: entry in the peer ID hashtable 41 * @hash_entry_addr4: entry in the peer IPv4 hashtable 42 * @hash_entry_addr6: entry in the peer IPv6 hashtable 43 * @hash_entry_transp_addr: entry in the peer transport address hashtable 44 * @sock: the socket being used to talk to this peer 45 * @tcp: keeps track of TCP specific state 46 * @tcp.strp: stream parser context (TCP only) 47 * @tcp.user_queue: received packets that have to go to userspace (TCP only) 48 * @tcp.out_queue: packets on hold while socket is taken by user (TCP only) 49 * @tcp.tx_in_progress: true if TX is already ongoing (TCP only) 50 * @tcp.out_msg.skb: packet scheduled for sending (TCP only) 51 * @tcp.out_msg.offset: offset where next send should start (TCP only) 52 * @tcp.out_msg.len: remaining data to send within packet (TCP only) 53 * @tcp.sk_cb.sk_data_ready: pointer to original cb (TCP only) 54 * @tcp.sk_cb.sk_write_space: pointer to original cb (TCP only) 55 * @tcp.sk_cb.prot: pointer to original prot object (TCP only) 56 * @tcp.sk_cb.ops: pointer to the original prot_ops object (TCP only) 57 * @crypto: the crypto configuration (ciphers, keys, etc..) 58 * @dst_cache: cache for dst_entry used to send to peer 59 * @route_key: route key matching the current dst cache contents 60 * @route_key_seq: seqcount protecting lockless route_key reads 61 * @bind: remote peer binding 62 * @keepalive_interval: seconds after which a new keepalive should be sent 63 * @keepalive_xmit_exp: future timestamp when next keepalive should be sent 64 * @last_sent: timestamp of the last successfully sent packet 65 * @keepalive_timeout: seconds after which an inactive peer is considered dead 66 * @keepalive_recv_exp: future timestamp when the peer should expire 67 * @last_recv: timestamp of the last authenticated received packet 68 * @vpn_stats: per-peer in-VPN TX/RX stats 69 * @link_stats: per-peer link/transport TX/RX stats 70 * @delete_reason: why peer was deleted (i.e. timeout, transport error, ..) 71 * @lock: protects binding to peer (bind), route_key and keepalive* fields 72 * @refcount: reference counter 73 * @rcu: used to free peer in an RCU safe way 74 * @release_entry: entry for the socket release list 75 * @keepalive_work: used to schedule keepalive sending 76 */ 77 struct ovpn_peer { 78 struct ovpn_priv *ovpn; 79 netdevice_tracker dev_tracker; 80 u32 id; 81 u32 tx_id; 82 struct { 83 struct in_addr ipv4; 84 struct in6_addr ipv6; 85 } vpn_addrs; 86 struct hlist_node hash_entry_id; 87 struct hlist_nulls_node hash_entry_addr4; 88 struct hlist_nulls_node hash_entry_addr6; 89 struct hlist_nulls_node hash_entry_transp_addr; 90 struct ovpn_socket __rcu *sock; 91 92 struct { 93 struct strparser strp; 94 struct sk_buff_head user_queue; 95 struct sk_buff_head out_queue; 96 bool tx_in_progress; 97 98 struct { 99 struct sk_buff *skb; 100 int offset; 101 int len; 102 } out_msg; 103 104 struct { 105 void (*sk_data_ready)(struct sock *sk); 106 void (*sk_write_space)(struct sock *sk); 107 struct proto *prot; 108 const struct proto_ops *ops; 109 } sk_cb; 110 111 struct work_struct defer_del_work; 112 } tcp; 113 struct ovpn_crypto_state crypto; 114 struct dst_cache dst_cache; 115 struct ovpn_route_key route_key; 116 seqcount_spinlock_t route_key_seq; 117 struct ovpn_bind __rcu *bind; 118 unsigned long keepalive_interval; 119 unsigned long keepalive_xmit_exp; 120 time64_t last_sent; 121 unsigned long keepalive_timeout; 122 unsigned long keepalive_recv_exp; 123 time64_t last_recv; 124 struct ovpn_peer_stats vpn_stats; 125 struct ovpn_peer_stats link_stats; 126 enum ovpn_del_peer_reason delete_reason; 127 spinlock_t lock; /* protects bind, route_key and keepalive* */ 128 struct kref refcount; 129 struct rcu_head rcu; 130 struct llist_node release_entry; 131 struct work_struct keepalive_work; 132 }; 133 134 /** 135 * ovpn_peer_hold - increase reference counter 136 * @peer: the peer whose counter should be increased 137 * 138 * Return: true if the counter was increased or false if it was zero already 139 */ 140 static inline bool ovpn_peer_hold(struct ovpn_peer *peer) 141 { 142 return kref_get_unless_zero(&peer->refcount); 143 } 144 145 void ovpn_peer_release_kref(struct kref *kref); 146 147 /** 148 * ovpn_peer_put - decrease reference counter 149 * @peer: the peer whose counter should be decreased 150 */ 151 static inline void ovpn_peer_put(struct ovpn_peer *peer) 152 { 153 kref_put(&peer->refcount, ovpn_peer_release_kref); 154 } 155 156 struct ovpn_peer *ovpn_peer_new(struct ovpn_priv *ovpn, u32 id); 157 int ovpn_peer_add(struct ovpn_priv *ovpn, struct ovpn_peer *peer); 158 int ovpn_peer_del(struct ovpn_peer *peer, enum ovpn_del_peer_reason reason); 159 void ovpn_peers_free(struct ovpn_priv *ovpn, struct sock *sock, 160 enum ovpn_del_peer_reason reason); 161 162 struct ovpn_peer *ovpn_peer_get_by_transp_addr(struct ovpn_priv *ovpn, 163 struct sk_buff *skb); 164 struct ovpn_peer *ovpn_peer_get_by_id(struct ovpn_priv *ovpn, u32 peer_id); 165 struct ovpn_peer *ovpn_peer_get_by_dst(struct ovpn_priv *ovpn, 166 struct sk_buff *skb); 167 bool ovpn_peer_vpn_addr_conflict4(struct ovpn_priv *ovpn, 168 const struct ovpn_peer *peer, 169 const struct in_addr *addr); 170 bool ovpn_peer_vpn_addr_conflict6(struct ovpn_priv *ovpn, 171 const struct ovpn_peer *peer, 172 const struct in6_addr *addr); 173 void ovpn_peer_hash_vpn_ip(struct ovpn_peer *peer); 174 void ovpn_peer_hash_transp_addr(struct ovpn_peer *peer); 175 bool ovpn_peer_check_by_src(struct ovpn_priv *ovpn, struct sk_buff *skb, 176 struct ovpn_peer *peer); 177 178 void ovpn_peer_keepalive_set(struct ovpn_peer *peer, u32 interval, u32 timeout); 179 void ovpn_peer_keepalive_work(struct work_struct *work); 180 181 void ovpn_peer_endpoints_update(struct ovpn_peer *peer, struct sk_buff *skb); 182 int ovpn_peer_reset_sockaddr(struct ovpn_peer *peer, 183 const struct sockaddr_storage *ss, 184 const void *local_ip); 185 186 #endif /* _NET_OVPN_OVPNPEER_H_ */ 187