xref: /linux/drivers/net/ovpn/netlink.c (revision f2c53ea949c5048f96b3dbb5a5ee7131ce4ff2de)
1 // SPDX-License-Identifier: GPL-2.0
2 /*  OpenVPN data channel offload
3  *
4  *  Copyright (C) 2020-2025 OpenVPN, Inc.
5  *
6  *  Author:	Antonio Quartulli <antonio@openvpn.net>
7  */
8 
9 #include <linux/netdevice.h>
10 #include <linux/types.h>
11 #include <net/genetlink.h>
12 
13 #include <uapi/linux/ovpn.h>
14 
15 #include "ovpnpriv.h"
16 #include "main.h"
17 #include "netlink.h"
18 #include "netlink-gen.h"
19 #include "bind.h"
20 #include "crypto.h"
21 #include "peer.h"
22 #include "socket.h"
23 
24 MODULE_ALIAS_GENL_FAMILY(OVPN_FAMILY_NAME);
25 
26 /**
27  * ovpn_get_dev_from_attrs - retrieve the ovpn private data from the netdevice
28  *			     a netlink message is targeting
29  * @net: network namespace where to look for the interface
30  * @info: generic netlink info from the user request
31  * @tracker: tracker object to be used for the netdev reference acquisition
32  *
33  * Return: the ovpn private data, if found, or an error otherwise
34  */
35 static struct ovpn_priv *
ovpn_get_dev_from_attrs(struct net * net,const struct genl_info * info,netdevice_tracker * tracker)36 ovpn_get_dev_from_attrs(struct net *net, const struct genl_info *info,
37 			netdevice_tracker *tracker)
38 {
39 	struct ovpn_priv *ovpn;
40 	struct net_device *dev;
41 	int ifindex;
42 
43 	if (GENL_REQ_ATTR_CHECK(info, OVPN_A_IFINDEX))
44 		return ERR_PTR(-EINVAL);
45 
46 	ifindex = nla_get_u32(info->attrs[OVPN_A_IFINDEX]);
47 
48 	rcu_read_lock();
49 	dev = dev_get_by_index_rcu(net, ifindex);
50 	if (!dev) {
51 		rcu_read_unlock();
52 		NL_SET_ERR_MSG_MOD(info->extack,
53 				   "ifindex does not match any interface");
54 		return ERR_PTR(-ENODEV);
55 	}
56 
57 	if (!ovpn_dev_is_valid(dev)) {
58 		rcu_read_unlock();
59 		NL_SET_ERR_MSG_MOD(info->extack,
60 				   "specified interface is not ovpn");
61 		NL_SET_BAD_ATTR(info->extack, info->attrs[OVPN_A_IFINDEX]);
62 		return ERR_PTR(-EINVAL);
63 	}
64 
65 	ovpn = netdev_priv(dev);
66 	netdev_hold(dev, tracker, GFP_ATOMIC);
67 	rcu_read_unlock();
68 
69 	return ovpn;
70 }
71 
ovpn_nl_pre_doit(const struct genl_split_ops * ops,struct sk_buff * skb,struct genl_info * info)72 int ovpn_nl_pre_doit(const struct genl_split_ops *ops, struct sk_buff *skb,
73 		     struct genl_info *info)
74 {
75 	netdevice_tracker *tracker = (netdevice_tracker *)&info->user_ptr[1];
76 	struct ovpn_priv *ovpn = ovpn_get_dev_from_attrs(genl_info_net(info),
77 							 info, tracker);
78 
79 	if (IS_ERR(ovpn))
80 		return PTR_ERR(ovpn);
81 
82 	info->user_ptr[0] = ovpn;
83 
84 	return 0;
85 }
86 
ovpn_nl_post_doit(const struct genl_split_ops * ops,struct sk_buff * skb,struct genl_info * info)87 void ovpn_nl_post_doit(const struct genl_split_ops *ops, struct sk_buff *skb,
88 		       struct genl_info *info)
89 {
90 	netdevice_tracker *tracker = (netdevice_tracker *)&info->user_ptr[1];
91 	struct ovpn_priv *ovpn = info->user_ptr[0];
92 
93 	if (ovpn)
94 		netdev_put(ovpn->dev, tracker);
95 }
96 
ovpn_nl_attr_sockaddr_remote(struct nlattr ** attrs,struct sockaddr_storage * ss)97 static bool ovpn_nl_attr_sockaddr_remote(struct nlattr **attrs,
98 					 struct sockaddr_storage *ss)
99 {
100 	struct sockaddr_in6 *sin6;
101 	struct sockaddr_in *sin;
102 	struct in6_addr *in6;
103 	struct nlattr *scope;
104 	u32 scope_id = 0;
105 	__be16 port = 0;
106 	__be32 *in;
107 
108 	ss->ss_family = AF_UNSPEC;
109 
110 	if (attrs[OVPN_A_PEER_REMOTE_PORT])
111 		port = nla_get_be16(attrs[OVPN_A_PEER_REMOTE_PORT]);
112 
113 	if (attrs[OVPN_A_PEER_REMOTE_IPV4]) {
114 		ss->ss_family = AF_INET;
115 		in = nla_data(attrs[OVPN_A_PEER_REMOTE_IPV4]);
116 	} else if (attrs[OVPN_A_PEER_REMOTE_IPV6]) {
117 		ss->ss_family = AF_INET6;
118 		in6 = nla_data(attrs[OVPN_A_PEER_REMOTE_IPV6]);
119 		scope = attrs[OVPN_A_PEER_REMOTE_IPV6_SCOPE_ID];
120 		if (scope)
121 			scope_id = nla_get_u32(scope);
122 	} else {
123 		return false;
124 	}
125 
126 	switch (ss->ss_family) {
127 	case AF_INET6:
128 		/* If this is a regular IPv6 just break and move on,
129 		 * otherwise switch to AF_INET and extract the IPv4 accordingly
130 		 */
131 		if (!ipv6_addr_v4mapped(in6)) {
132 			sin6 = (struct sockaddr_in6 *)ss;
133 			sin6->sin6_port = port;
134 			sin6->sin6_scope_id = scope_id;
135 			memcpy(&sin6->sin6_addr, in6, sizeof(*in6));
136 			break;
137 		}
138 
139 		/* v4-mapped-v6 address */
140 		ss->ss_family = AF_INET;
141 		in = &in6->s6_addr32[3];
142 		fallthrough;
143 	case AF_INET:
144 		sin = (struct sockaddr_in *)ss;
145 		sin->sin_port = port;
146 		sin->sin_addr.s_addr = *in;
147 		break;
148 	}
149 
150 	return true;
151 }
152 
ovpn_nl_attr_local_ip(struct nlattr ** attrs)153 static u8 *ovpn_nl_attr_local_ip(struct nlattr **attrs)
154 {
155 	u8 *addr6;
156 
157 	if (!attrs[OVPN_A_PEER_LOCAL_IPV4] && !attrs[OVPN_A_PEER_LOCAL_IPV6])
158 		return NULL;
159 
160 	if (attrs[OVPN_A_PEER_LOCAL_IPV4])
161 		return nla_data(attrs[OVPN_A_PEER_LOCAL_IPV4]);
162 
163 	addr6 = nla_data(attrs[OVPN_A_PEER_LOCAL_IPV6]);
164 	/* this is an IPv4-mapped IPv6 address, therefore extract the actual
165 	 * v4 address from the last 4 bytes
166 	 */
167 	if (ipv6_addr_v4mapped((struct in6_addr *)addr6))
168 		return addr6 + 12;
169 
170 	return addr6;
171 }
172 
ovpn_nl_family_get(struct nlattr * addr4,struct nlattr * addr6)173 static sa_family_t ovpn_nl_family_get(struct nlattr *addr4,
174 				      struct nlattr *addr6)
175 {
176 	if (addr4)
177 		return AF_INET;
178 
179 	if (addr6) {
180 		if (ipv6_addr_v4mapped((struct in6_addr *)nla_data(addr6)))
181 			return AF_INET;
182 		return AF_INET6;
183 	}
184 
185 	return AF_UNSPEC;
186 }
187 
ovpn_nl_peer_check_vpn_addrs(const struct in_addr * addr4,const struct in6_addr * addr6,struct genl_info * info)188 static int ovpn_nl_peer_check_vpn_addrs(const struct in_addr *addr4,
189 					const struct in6_addr *addr6,
190 					struct genl_info *info)
191 {
192 	int addr6_type;
193 
194 	if (addr4->s_addr == htonl(INADDR_ANY) && ipv6_addr_any(addr6)) {
195 		NL_SET_ERR_MSG_MOD(info->extack,
196 				   "at least one VPN IP must be configured in MP mode");
197 		return -EINVAL;
198 	}
199 
200 	if (ipv4_is_multicast(addr4->s_addr) || ipv4_is_lbcast(addr4->s_addr) ||
201 	    ipv4_is_loopback(addr4->s_addr)) {
202 		NL_SET_ERR_MSG_MOD(info->extack,
203 				   "VPN IPv4 address must be valid unicast or any");
204 		return -EADDRNOTAVAIL;
205 	}
206 
207 	if (!ipv6_addr_any(addr6)) {
208 		addr6_type = ipv6_addr_type(addr6);
209 
210 		if (!(addr6_type & IPV6_ADDR_UNICAST) ||
211 		    (addr6_type & (IPV6_ADDR_LOOPBACK | IPV6_ADDR_COMPATv4))) {
212 			NL_SET_ERR_MSG_MOD(info->extack,
213 					   "VPN IPv6 address must be valid unicast or any");
214 			return -EADDRNOTAVAIL;
215 		}
216 	}
217 
218 	return 0;
219 }
220 
ovpn_nl_peer_precheck(struct ovpn_priv * ovpn,struct genl_info * info,struct nlattr ** attrs)221 static int ovpn_nl_peer_precheck(struct ovpn_priv *ovpn,
222 				 struct genl_info *info,
223 				 struct nlattr **attrs)
224 {
225 	sa_family_t local_fam, remote_fam;
226 
227 	if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_PEER], attrs,
228 			      OVPN_A_PEER_ID))
229 		return -EINVAL;
230 
231 	if (attrs[OVPN_A_PEER_REMOTE_IPV4] && attrs[OVPN_A_PEER_REMOTE_IPV6]) {
232 		NL_SET_ERR_MSG_MOD(info->extack,
233 				   "cannot specify both remote IPv4 or IPv6 address");
234 		return -EINVAL;
235 	}
236 
237 	if (!attrs[OVPN_A_PEER_REMOTE_IPV4] &&
238 	    !attrs[OVPN_A_PEER_REMOTE_IPV6] && attrs[OVPN_A_PEER_REMOTE_PORT]) {
239 		NL_SET_ERR_MSG_MOD(info->extack,
240 				   "cannot specify remote port without IP address");
241 		return -EINVAL;
242 	}
243 
244 	if ((attrs[OVPN_A_PEER_REMOTE_IPV4] ||
245 	     attrs[OVPN_A_PEER_REMOTE_IPV6]) &&
246 	    !attrs[OVPN_A_PEER_REMOTE_PORT]) {
247 		NL_SET_ERR_MSG_MOD(info->extack,
248 				   "cannot specify remote IP address without port");
249 		return -EINVAL;
250 	}
251 
252 	if (!attrs[OVPN_A_PEER_REMOTE_IPV4] &&
253 	    attrs[OVPN_A_PEER_LOCAL_IPV4]) {
254 		NL_SET_ERR_MSG_MOD(info->extack,
255 				   "cannot specify local IPv4 address without remote");
256 		return -EINVAL;
257 	}
258 
259 	if (!attrs[OVPN_A_PEER_REMOTE_IPV6] &&
260 	    attrs[OVPN_A_PEER_LOCAL_IPV6]) {
261 		NL_SET_ERR_MSG_MOD(info->extack,
262 				   "cannot specify local IPV6 address without remote");
263 		return -EINVAL;
264 	}
265 
266 	/* check that local and remote address families are the same even
267 	 * after parsing v4mapped IPv6 addresses.
268 	 * (if addresses are not provided, family will be AF_UNSPEC and
269 	 * the check is skipped)
270 	 */
271 	local_fam = ovpn_nl_family_get(attrs[OVPN_A_PEER_LOCAL_IPV4],
272 				       attrs[OVPN_A_PEER_LOCAL_IPV6]);
273 	remote_fam = ovpn_nl_family_get(attrs[OVPN_A_PEER_REMOTE_IPV4],
274 					attrs[OVPN_A_PEER_REMOTE_IPV6]);
275 	if (local_fam != AF_UNSPEC && remote_fam != AF_UNSPEC &&
276 	    local_fam != remote_fam) {
277 		NL_SET_ERR_MSG_MOD(info->extack,
278 				   "mismatching local and remote address families");
279 		return -EINVAL;
280 	}
281 
282 	if (remote_fam != AF_INET6 && attrs[OVPN_A_PEER_REMOTE_IPV6_SCOPE_ID]) {
283 		NL_SET_ERR_MSG_MOD(info->extack,
284 				   "cannot specify scope id without remote IPv6 address");
285 		return -EINVAL;
286 	}
287 
288 	/* VPN IPs are needed only in MP mode for selecting the right peer */
289 	if (ovpn->mode == OVPN_MODE_P2P && (attrs[OVPN_A_PEER_VPN_IPV4] ||
290 					    attrs[OVPN_A_PEER_VPN_IPV6])) {
291 		NL_SET_ERR_MSG_FMT_MOD(info->extack,
292 				       "unexpected VPN IP in P2P mode");
293 		return -EINVAL;
294 	}
295 
296 	if ((attrs[OVPN_A_PEER_KEEPALIVE_INTERVAL] &&
297 	     !attrs[OVPN_A_PEER_KEEPALIVE_TIMEOUT]) ||
298 	    (!attrs[OVPN_A_PEER_KEEPALIVE_INTERVAL] &&
299 	     attrs[OVPN_A_PEER_KEEPALIVE_TIMEOUT])) {
300 		NL_SET_ERR_MSG_FMT_MOD(info->extack,
301 				       "keepalive interval and timeout are required together");
302 		return -EINVAL;
303 	}
304 
305 	return 0;
306 }
307 
308 /**
309  * ovpn_nl_peer_modify - modify the peer attributes according to the incoming msg
310  * @peer: the peer to modify
311  * @info: generic netlink info from the user request
312  * @attrs: the attributes from the user request
313  *
314  * Return: a negative error code in case of failure, 0 on success or 1 on
315  *	   success and the VPN IPs have been modified (requires rehashing in MP
316  *	   mode)
317  */
ovpn_nl_peer_modify(struct ovpn_peer * peer,struct genl_info * info,struct nlattr ** attrs)318 static int ovpn_nl_peer_modify(struct ovpn_peer *peer, struct genl_info *info,
319 			       struct nlattr **attrs)
320 {
321 	struct sockaddr_storage ss = {};
322 	void *local_ip = NULL;
323 	u32 interv, timeout;
324 	bool rehash = false;
325 	int ret;
326 
327 	spin_lock_bh(&peer->lock);
328 
329 	if (ovpn_nl_attr_sockaddr_remote(attrs, &ss)) {
330 		/* we carry the local IP in a generic container.
331 		 * ovpn_peer_reset_sockaddr() will properly interpret it
332 		 * based on ss.ss_family
333 		 */
334 		local_ip = ovpn_nl_attr_local_ip(attrs);
335 
336 		/* set peer sockaddr */
337 		ret = ovpn_peer_reset_sockaddr(peer, &ss, local_ip);
338 		if (ret < 0) {
339 			NL_SET_ERR_MSG_FMT_MOD(info->extack,
340 					       "cannot set peer sockaddr: %d",
341 					       ret);
342 			goto err_unlock;
343 		}
344 		dst_cache_reset(&peer->dst_cache);
345 	}
346 
347 	/* In a multipeer-to-multipeer setup we may have asymmetric peer IDs,
348 	 * that is peer->id might be different from peer->tx_id.
349 	 */
350 	if (attrs[OVPN_A_PEER_TX_ID])
351 		peer->tx_id = nla_get_u32(attrs[OVPN_A_PEER_TX_ID]);
352 
353 	if (attrs[OVPN_A_PEER_VPN_IPV4]) {
354 		rehash = true;
355 		peer->vpn_addrs.ipv4.s_addr =
356 			nla_get_in_addr(attrs[OVPN_A_PEER_VPN_IPV4]);
357 	}
358 
359 	if (attrs[OVPN_A_PEER_VPN_IPV6]) {
360 		rehash = true;
361 		peer->vpn_addrs.ipv6 =
362 			nla_get_in6_addr(attrs[OVPN_A_PEER_VPN_IPV6]);
363 	}
364 
365 	/* when setting the keepalive, both parameters have to be configured */
366 	if (attrs[OVPN_A_PEER_KEEPALIVE_INTERVAL] &&
367 	    attrs[OVPN_A_PEER_KEEPALIVE_TIMEOUT]) {
368 		interv = nla_get_u32(attrs[OVPN_A_PEER_KEEPALIVE_INTERVAL]);
369 		timeout = nla_get_u32(attrs[OVPN_A_PEER_KEEPALIVE_TIMEOUT]);
370 		ovpn_peer_keepalive_set(peer, interv, timeout);
371 	}
372 
373 	netdev_dbg(peer->ovpn->dev,
374 		   "modify peer id=%u tx_id=%u endpoint=%pIScp VPN-IPv4=%pI4 VPN-IPv6=%pI6c\n",
375 		   peer->id, peer->tx_id, &ss,
376 		   &peer->vpn_addrs.ipv4.s_addr, &peer->vpn_addrs.ipv6);
377 
378 	spin_unlock_bh(&peer->lock);
379 
380 	return rehash ? 1 : 0;
381 err_unlock:
382 	spin_unlock_bh(&peer->lock);
383 	return ret;
384 }
385 
ovpn_nl_peer_new_doit(struct sk_buff * skb,struct genl_info * info)386 int ovpn_nl_peer_new_doit(struct sk_buff *skb, struct genl_info *info)
387 {
388 	struct in_addr vpn_addr4 = { .s_addr = htonl(INADDR_ANY) };
389 	struct in6_addr vpn_addr6 = IN6ADDR_ANY_INIT;
390 	struct ovpn_priv *ovpn = info->user_ptr[0];
391 	struct nlattr *attrs[OVPN_A_PEER_MAX + 1];
392 	struct ovpn_socket *ovpn_sock;
393 	struct socket *sock = NULL;
394 	struct ovpn_peer *peer;
395 	u32 sockfd, peer_id;
396 	int ret;
397 
398 	if (GENL_REQ_ATTR_CHECK(info, OVPN_A_PEER))
399 		return -EINVAL;
400 
401 	ret = nla_parse_nested(attrs, OVPN_A_PEER_MAX, info->attrs[OVPN_A_PEER],
402 			       ovpn_peer_new_input_nl_policy, info->extack);
403 	if (ret)
404 		return ret;
405 
406 	ret = ovpn_nl_peer_precheck(ovpn, info, attrs);
407 	if (ret < 0)
408 		return ret;
409 
410 	if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_PEER], attrs,
411 			      OVPN_A_PEER_SOCKET))
412 		return -EINVAL;
413 
414 	/* in MP mode VPN IPs are required for selecting the right peer */
415 	if (ovpn->mode == OVPN_MODE_MP) {
416 		if (attrs[OVPN_A_PEER_VPN_IPV4])
417 			vpn_addr4.s_addr =
418 				nla_get_in_addr(attrs[OVPN_A_PEER_VPN_IPV4]);
419 		if (attrs[OVPN_A_PEER_VPN_IPV6])
420 			vpn_addr6 =
421 				nla_get_in6_addr(attrs[OVPN_A_PEER_VPN_IPV6]);
422 
423 		ret = ovpn_nl_peer_check_vpn_addrs(&vpn_addr4, &vpn_addr6,
424 						   info);
425 		if (ret < 0)
426 			return ret;
427 	}
428 
429 	peer_id = nla_get_u32(attrs[OVPN_A_PEER_ID]);
430 
431 	peer = ovpn_peer_new(ovpn, peer_id);
432 	if (IS_ERR(peer)) {
433 		NL_SET_ERR_MSG_FMT_MOD(info->extack,
434 				       "cannot create new peer object for peer %u: %ld",
435 				       peer_id, PTR_ERR(peer));
436 		return PTR_ERR(peer);
437 	}
438 
439 	/* lookup the fd in the kernel table and extract the socket object */
440 	sockfd = nla_get_u32(attrs[OVPN_A_PEER_SOCKET]);
441 	/* sockfd_lookup() increases sock's refcounter */
442 	sock = sockfd_lookup(sockfd, &ret);
443 	if (!sock) {
444 		NL_SET_ERR_MSG_FMT_MOD(info->extack,
445 				       "cannot lookup peer socket (fd=%u): %d",
446 				       sockfd, ret);
447 		ret = -ENOTSOCK;
448 		goto peer_release;
449 	}
450 
451 	/* Only when using UDP as transport protocol the remote endpoint
452 	 * can be configured so that ovpn knows where to send packets to.
453 	 */
454 	if (sock->sk->sk_protocol == IPPROTO_UDP &&
455 	    !attrs[OVPN_A_PEER_REMOTE_IPV4] &&
456 	    !attrs[OVPN_A_PEER_REMOTE_IPV6]) {
457 		NL_SET_ERR_MSG_FMT_MOD(info->extack,
458 				       "missing remote IP address for UDP socket");
459 		sockfd_put(sock);
460 		ret = -EINVAL;
461 		goto peer_release;
462 	}
463 
464 	/* In case of TCP, the socket is connected to the peer and ovpn
465 	 * will just send bytes over it, without the need to specify a
466 	 * destination.
467 	 */
468 	if (sock->sk->sk_protocol == IPPROTO_TCP &&
469 	    (attrs[OVPN_A_PEER_REMOTE_IPV4] ||
470 	     attrs[OVPN_A_PEER_REMOTE_IPV6])) {
471 		NL_SET_ERR_MSG_FMT_MOD(info->extack,
472 				       "unexpected remote IP address with TCP socket");
473 		sockfd_put(sock);
474 		ret = -EINVAL;
475 		goto peer_release;
476 	}
477 
478 	ovpn_sock = ovpn_socket_new(sock, peer);
479 	/* at this point we unconditionally drop the reference to the socket:
480 	 * - in case of error, the socket has to be dropped
481 	 * - if case of success, the socket is configured and let
482 	 *   userspace own the reference, so that the latter can
483 	 *   trigger the final close()
484 	 */
485 	sockfd_put(sock);
486 	if (IS_ERR(ovpn_sock)) {
487 		NL_SET_ERR_MSG_FMT_MOD(info->extack,
488 				       "cannot encapsulate socket: %ld",
489 				       PTR_ERR(ovpn_sock));
490 		ret = -ENOTSOCK;
491 		goto peer_release;
492 	}
493 
494 	rcu_assign_pointer(peer->sock, ovpn_sock);
495 
496 	ret = ovpn_nl_peer_modify(peer, info, attrs);
497 	if (ret < 0)
498 		goto sock_release;
499 
500 	ret = ovpn_peer_add(ovpn, peer);
501 	if (ret < 0) {
502 		NL_SET_ERR_MSG_FMT_MOD(info->extack,
503 				       "cannot add new peer (id=%u) to hashtable: %d",
504 				       peer->id, ret);
505 		goto sock_release;
506 	}
507 
508 	return 0;
509 
510 sock_release:
511 	ovpn_socket_release(peer);
512 peer_release:
513 	/* For UDP, the peer is unreachable until added to the hashtables, so
514 	 * dropping the initial reference is enough. For TCP, the peer may be
515 	 * concurrently reachable via sk_user_data->peer until
516 	 * ovpn_socket_release() detaches; rely on the refcount.
517 	 */
518 	ovpn_peer_put(peer);
519 
520 	return ret;
521 }
522 
ovpn_nl_peer_set_doit(struct sk_buff * skb,struct genl_info * info)523 int ovpn_nl_peer_set_doit(struct sk_buff *skb, struct genl_info *info)
524 {
525 	struct ovpn_priv *ovpn = info->user_ptr[0];
526 	struct nlattr *attrs[OVPN_A_PEER_MAX + 1];
527 	struct in6_addr vpn_addr6;
528 	struct in_addr vpn_addr4;
529 	struct ovpn_socket *sock;
530 	struct ovpn_peer *peer;
531 	u32 peer_id;
532 	int ret;
533 
534 	if (GENL_REQ_ATTR_CHECK(info, OVPN_A_PEER))
535 		return -EINVAL;
536 
537 	ret = nla_parse_nested(attrs, OVPN_A_PEER_MAX, info->attrs[OVPN_A_PEER],
538 			       ovpn_peer_set_input_nl_policy, info->extack);
539 	if (ret)
540 		return ret;
541 
542 	ret = ovpn_nl_peer_precheck(ovpn, info, attrs);
543 	if (ret < 0)
544 		return ret;
545 
546 	if (attrs[OVPN_A_PEER_SOCKET]) {
547 		NL_SET_ERR_MSG_FMT_MOD(info->extack,
548 				       "socket cannot be modified");
549 		return -EINVAL;
550 	}
551 
552 	peer_id = nla_get_u32(attrs[OVPN_A_PEER_ID]);
553 	peer = ovpn_peer_get_by_id(ovpn, peer_id);
554 	if (!peer) {
555 		NL_SET_ERR_MSG_FMT_MOD(info->extack,
556 				       "cannot find peer with id %u", peer_id);
557 		return -ENOENT;
558 	}
559 
560 	/* when using a TCP socket the remote IP is not expected */
561 	rcu_read_lock();
562 	sock = rcu_dereference(peer->sock);
563 	if (sock && sock->sk->sk_protocol == IPPROTO_TCP &&
564 	    (attrs[OVPN_A_PEER_REMOTE_IPV4] ||
565 	     attrs[OVPN_A_PEER_REMOTE_IPV6])) {
566 		rcu_read_unlock();
567 		NL_SET_ERR_MSG_FMT_MOD(info->extack,
568 				       "unexpected remote IP address with TCP socket");
569 		ovpn_peer_put(peer);
570 		return -EINVAL;
571 	}
572 	rcu_read_unlock();
573 
574 	spin_lock_bh(&ovpn->lock);
575 
576 	vpn_addr4 = peer->vpn_addrs.ipv4;
577 	vpn_addr6 = peer->vpn_addrs.ipv6;
578 
579 	/* reject peer with conflicting VPN address */
580 	if (attrs[OVPN_A_PEER_VPN_IPV4]) {
581 		vpn_addr4.s_addr = nla_get_in_addr(attrs[OVPN_A_PEER_VPN_IPV4]);
582 		if (ovpn_peer_vpn_addr_conflict4(ovpn, peer, &vpn_addr4))
583 			goto addr_conflict;
584 	}
585 	if (attrs[OVPN_A_PEER_VPN_IPV6]) {
586 		vpn_addr6 = nla_get_in6_addr(attrs[OVPN_A_PEER_VPN_IPV6]);
587 		if (ovpn_peer_vpn_addr_conflict6(ovpn, peer, &vpn_addr6))
588 			goto addr_conflict;
589 	}
590 
591 	/* in MP mode VPN IPs are required for selecting the right peer */
592 	if (ovpn->mode == OVPN_MODE_MP) {
593 		ret = ovpn_nl_peer_check_vpn_addrs(&vpn_addr4, &vpn_addr6,
594 						   info);
595 		if (ret < 0)
596 			goto unlock;
597 	}
598 
599 	ret = ovpn_nl_peer_modify(peer, info, attrs);
600 	if (ret < 0)
601 		goto unlock;
602 
603 	/* ret == 1 means that VPN IPv4/6 has been modified and rehashing
604 	 * is required
605 	 */
606 	if (ret > 0) {
607 		ovpn_peer_hash_vpn_ip(peer);
608 		ret = 0;
609 	}
610 	/* if the remote endpoint was updated, the by_transp_addr hash bucket
611 	 * also needs to be refreshed, otherwise incoming packets from the new
612 	 * remote address would fail the lockless lookup
613 	 */
614 	if (attrs[OVPN_A_PEER_REMOTE_IPV4] || attrs[OVPN_A_PEER_REMOTE_IPV6])
615 		ovpn_peer_hash_transp_addr(peer);
616 
617 unlock:
618 	spin_unlock_bh(&ovpn->lock);
619 	ovpn_peer_put(peer);
620 
621 	return ret;
622 addr_conflict:
623 	NL_SET_ERR_MSG_FMT_MOD(info->extack,
624 			       "VPN IP is already assigned to another peer");
625 	ret = -EADDRINUSE;
626 	goto unlock;
627 }
628 
ovpn_nl_send_peer(struct sk_buff * skb,const struct genl_info * info,const struct ovpn_peer * peer,u32 portid,u32 seq,int flags)629 static int ovpn_nl_send_peer(struct sk_buff *skb, const struct genl_info *info,
630 			     const struct ovpn_peer *peer, u32 portid, u32 seq,
631 			     int flags)
632 {
633 	const struct ovpn_bind *bind;
634 	struct ovpn_socket *sock;
635 	int ret = -EMSGSIZE;
636 	struct nlattr *attr;
637 	__be16 local_port;
638 	void *hdr;
639 	int id;
640 
641 	hdr = genlmsg_put(skb, portid, seq, &ovpn_nl_family, flags,
642 			  OVPN_CMD_PEER_GET);
643 	if (!hdr)
644 		return -ENOBUFS;
645 
646 	attr = nla_nest_start(skb, OVPN_A_PEER);
647 	if (!attr)
648 		goto err;
649 
650 	rcu_read_lock();
651 	sock = rcu_dereference(peer->sock);
652 	if (!sock) {
653 		ret = -EINVAL;
654 		goto err_unlock;
655 	}
656 
657 	if (!net_eq(genl_info_net(info), sock_net(sock->sk))) {
658 		id = peernet2id_alloc(genl_info_net(info),
659 				      sock_net(sock->sk),
660 				      GFP_ATOMIC);
661 		if (nla_put_s32(skb, OVPN_A_PEER_SOCKET_NETNSID, id))
662 			goto err_unlock;
663 	}
664 	local_port = inet_sk(sock->sk)->inet_sport;
665 	rcu_read_unlock();
666 
667 	if (nla_put_u32(skb, OVPN_A_PEER_ID, peer->id))
668 		goto err;
669 
670 	if (nla_put_u32(skb, OVPN_A_PEER_TX_ID, peer->tx_id))
671 		goto err;
672 
673 	if (peer->vpn_addrs.ipv4.s_addr != htonl(INADDR_ANY))
674 		if (nla_put_in_addr(skb, OVPN_A_PEER_VPN_IPV4,
675 				    peer->vpn_addrs.ipv4.s_addr))
676 			goto err;
677 
678 	if (!ipv6_addr_equal(&peer->vpn_addrs.ipv6, &in6addr_any))
679 		if (nla_put_in6_addr(skb, OVPN_A_PEER_VPN_IPV6,
680 				     &peer->vpn_addrs.ipv6))
681 			goto err;
682 
683 	if (nla_put_u32(skb, OVPN_A_PEER_KEEPALIVE_INTERVAL,
684 			peer->keepalive_interval) ||
685 	    nla_put_u32(skb, OVPN_A_PEER_KEEPALIVE_TIMEOUT,
686 			peer->keepalive_timeout))
687 		goto err;
688 
689 	rcu_read_lock();
690 	bind = rcu_dereference(peer->bind);
691 	if (bind) {
692 		if (bind->remote.in4.sin_family == AF_INET) {
693 			if (nla_put_in_addr(skb, OVPN_A_PEER_REMOTE_IPV4,
694 					    bind->remote.in4.sin_addr.s_addr) ||
695 			    nla_put_net16(skb, OVPN_A_PEER_REMOTE_PORT,
696 					  bind->remote.in4.sin_port) ||
697 			    nla_put_in_addr(skb, OVPN_A_PEER_LOCAL_IPV4,
698 					    bind->local.ipv4.s_addr))
699 				goto err_unlock;
700 		} else if (bind->remote.in4.sin_family == AF_INET6) {
701 			if (nla_put_in6_addr(skb, OVPN_A_PEER_REMOTE_IPV6,
702 					     &bind->remote.in6.sin6_addr) ||
703 			    nla_put_u32(skb, OVPN_A_PEER_REMOTE_IPV6_SCOPE_ID,
704 					bind->remote.in6.sin6_scope_id) ||
705 			    nla_put_net16(skb, OVPN_A_PEER_REMOTE_PORT,
706 					  bind->remote.in6.sin6_port) ||
707 			    nla_put_in6_addr(skb, OVPN_A_PEER_LOCAL_IPV6,
708 					     &bind->local.ipv6))
709 				goto err_unlock;
710 		}
711 	}
712 	rcu_read_unlock();
713 
714 	if (nla_put_net16(skb, OVPN_A_PEER_LOCAL_PORT, local_port) ||
715 	    /* VPN RX stats */
716 	    nla_put_uint(skb, OVPN_A_PEER_VPN_RX_BYTES,
717 			 atomic64_read(&peer->vpn_stats.rx.bytes)) ||
718 	    nla_put_uint(skb, OVPN_A_PEER_VPN_RX_PACKETS,
719 			 atomic64_read(&peer->vpn_stats.rx.packets)) ||
720 	    /* VPN TX stats */
721 	    nla_put_uint(skb, OVPN_A_PEER_VPN_TX_BYTES,
722 			 atomic64_read(&peer->vpn_stats.tx.bytes)) ||
723 	    nla_put_uint(skb, OVPN_A_PEER_VPN_TX_PACKETS,
724 			 atomic64_read(&peer->vpn_stats.tx.packets)) ||
725 	    /* link RX stats */
726 	    nla_put_uint(skb, OVPN_A_PEER_LINK_RX_BYTES,
727 			 atomic64_read(&peer->link_stats.rx.bytes)) ||
728 	    nla_put_uint(skb, OVPN_A_PEER_LINK_RX_PACKETS,
729 			 atomic64_read(&peer->link_stats.rx.packets)) ||
730 	    /* link TX stats */
731 	    nla_put_uint(skb, OVPN_A_PEER_LINK_TX_BYTES,
732 			 atomic64_read(&peer->link_stats.tx.bytes)) ||
733 	    nla_put_uint(skb, OVPN_A_PEER_LINK_TX_PACKETS,
734 			 atomic64_read(&peer->link_stats.tx.packets)))
735 		goto err;
736 
737 	nla_nest_end(skb, attr);
738 	genlmsg_end(skb, hdr);
739 
740 	return 0;
741 err_unlock:
742 	rcu_read_unlock();
743 err:
744 	genlmsg_cancel(skb, hdr);
745 	return ret;
746 }
747 
ovpn_nl_peer_get_doit(struct sk_buff * skb,struct genl_info * info)748 int ovpn_nl_peer_get_doit(struct sk_buff *skb, struct genl_info *info)
749 {
750 	struct nlattr *attrs[OVPN_A_PEER_MAX + 1];
751 	struct ovpn_priv *ovpn = info->user_ptr[0];
752 	struct ovpn_peer *peer;
753 	struct sk_buff *msg;
754 	u32 peer_id;
755 	int ret, i;
756 
757 	if (GENL_REQ_ATTR_CHECK(info, OVPN_A_PEER))
758 		return -EINVAL;
759 
760 	ret = nla_parse_nested(attrs, OVPN_A_PEER_MAX, info->attrs[OVPN_A_PEER],
761 			       ovpn_peer_nl_policy, info->extack);
762 	if (ret)
763 		return ret;
764 
765 	if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_PEER], attrs,
766 			      OVPN_A_PEER_ID))
767 		return -EINVAL;
768 
769 	/* OVPN_CMD_PEER_GET expects only the PEER_ID, therefore
770 	 * ensure that the user hasn't specified any other attribute.
771 	 *
772 	 * Unfortunately this check cannot be performed via netlink
773 	 * spec/policy and must be open-coded.
774 	 */
775 	for (i = 0; i < OVPN_A_PEER_MAX + 1; i++) {
776 		if (i == OVPN_A_PEER_ID)
777 			continue;
778 
779 		if (attrs[i]) {
780 			NL_SET_ERR_MSG_FMT_MOD(info->extack,
781 					       "unexpected attribute %u", i);
782 			return -EINVAL;
783 		}
784 	}
785 
786 	peer_id = nla_get_u32(attrs[OVPN_A_PEER_ID]);
787 	peer = ovpn_peer_get_by_id(ovpn, peer_id);
788 	if (!peer) {
789 		NL_SET_ERR_MSG_FMT_MOD(info->extack,
790 				       "cannot find peer with id %u", peer_id);
791 		return -ENOENT;
792 	}
793 
794 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
795 	if (!msg) {
796 		ret = -ENOMEM;
797 		goto err;
798 	}
799 
800 	ret = ovpn_nl_send_peer(msg, info, peer, info->snd_portid,
801 				info->snd_seq, 0);
802 	if (ret < 0) {
803 		nlmsg_free(msg);
804 		goto err;
805 	}
806 
807 	ret = genlmsg_reply(msg, info);
808 err:
809 	ovpn_peer_put(peer);
810 	return ret;
811 }
812 
ovpn_nl_peer_get_dumpit(struct sk_buff * skb,struct netlink_callback * cb)813 int ovpn_nl_peer_get_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
814 {
815 	const struct genl_info *info = genl_info_dump(cb);
816 	int bkt, last_idx = cb->args[1], dumped = 0;
817 	netdevice_tracker tracker;
818 	struct ovpn_priv *ovpn;
819 	struct ovpn_peer *peer;
820 
821 	ovpn = ovpn_get_dev_from_attrs(sock_net(cb->skb->sk), info, &tracker);
822 	if (IS_ERR(ovpn))
823 		return PTR_ERR(ovpn);
824 
825 	if (ovpn->mode == OVPN_MODE_P2P) {
826 		/* if we already dumped a peer it means we are done */
827 		if (last_idx)
828 			goto out;
829 
830 		rcu_read_lock();
831 		peer = rcu_dereference(ovpn->peer);
832 		if (peer) {
833 			if (ovpn_nl_send_peer(skb, info, peer,
834 					      NETLINK_CB(cb->skb).portid,
835 					      cb->nlh->nlmsg_seq,
836 					      NLM_F_MULTI) == 0)
837 				dumped++;
838 		}
839 		rcu_read_unlock();
840 	} else {
841 		rcu_read_lock();
842 		hash_for_each_rcu(ovpn->peers->by_id, bkt, peer,
843 				  hash_entry_id) {
844 			/* skip already dumped peers that were dumped by
845 			 * previous invocations
846 			 */
847 			if (last_idx > 0) {
848 				last_idx--;
849 				continue;
850 			}
851 
852 			if (ovpn_nl_send_peer(skb, info, peer,
853 					      NETLINK_CB(cb->skb).portid,
854 					      cb->nlh->nlmsg_seq,
855 					      NLM_F_MULTI) < 0)
856 				break;
857 
858 			/* count peers being dumped during this invocation */
859 			dumped++;
860 		}
861 		rcu_read_unlock();
862 	}
863 
864 out:
865 	netdev_put(ovpn->dev, &tracker);
866 
867 	/* sum up peers dumped in this message, so that at the next invocation
868 	 * we can continue from where we left
869 	 */
870 	cb->args[1] += dumped;
871 	return skb->len;
872 }
873 
ovpn_nl_peer_del_doit(struct sk_buff * skb,struct genl_info * info)874 int ovpn_nl_peer_del_doit(struct sk_buff *skb, struct genl_info *info)
875 {
876 	struct nlattr *attrs[OVPN_A_PEER_MAX + 1];
877 	struct ovpn_priv *ovpn = info->user_ptr[0];
878 	struct ovpn_peer *peer;
879 	u32 peer_id;
880 	int ret;
881 
882 	if (GENL_REQ_ATTR_CHECK(info, OVPN_A_PEER))
883 		return -EINVAL;
884 
885 	ret = nla_parse_nested(attrs, OVPN_A_PEER_MAX, info->attrs[OVPN_A_PEER],
886 			       ovpn_peer_del_input_nl_policy, info->extack);
887 	if (ret)
888 		return ret;
889 
890 	if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_PEER], attrs,
891 			      OVPN_A_PEER_ID))
892 		return -EINVAL;
893 
894 	peer_id = nla_get_u32(attrs[OVPN_A_PEER_ID]);
895 	peer = ovpn_peer_get_by_id(ovpn, peer_id);
896 	if (!peer) {
897 		NL_SET_ERR_MSG_FMT_MOD(info->extack,
898 				       "cannot find peer with id %u", peer_id);
899 		return -ENOENT;
900 	}
901 
902 	netdev_dbg(ovpn->dev, "del peer %u\n", peer->id);
903 	ret = ovpn_peer_del(peer, OVPN_DEL_PEER_REASON_USERSPACE);
904 	ovpn_peer_put(peer);
905 
906 	return ret;
907 }
908 
ovpn_nl_get_key_dir(struct genl_info * info,struct nlattr * key,enum ovpn_cipher_alg cipher,struct ovpn_key_direction * dir)909 static int ovpn_nl_get_key_dir(struct genl_info *info, struct nlattr *key,
910 			       enum ovpn_cipher_alg cipher,
911 			       struct ovpn_key_direction *dir)
912 {
913 	struct nlattr *attrs[OVPN_A_KEYDIR_MAX + 1];
914 	int ret;
915 
916 	ret = nla_parse_nested(attrs, OVPN_A_KEYDIR_MAX, key,
917 			       ovpn_keydir_nl_policy, info->extack);
918 	if (ret)
919 		return ret;
920 
921 	switch (cipher) {
922 	case OVPN_CIPHER_ALG_AES_GCM:
923 	case OVPN_CIPHER_ALG_CHACHA20_POLY1305:
924 		if (NL_REQ_ATTR_CHECK(info->extack, key, attrs,
925 				      OVPN_A_KEYDIR_CIPHER_KEY) ||
926 		    NL_REQ_ATTR_CHECK(info->extack, key, attrs,
927 				      OVPN_A_KEYDIR_NONCE_TAIL))
928 			return -EINVAL;
929 
930 		dir->cipher_key = nla_data(attrs[OVPN_A_KEYDIR_CIPHER_KEY]);
931 		dir->cipher_key_size = nla_len(attrs[OVPN_A_KEYDIR_CIPHER_KEY]);
932 
933 		/* These algorithms require a 96bit nonce,
934 		 * Construct it by combining 4-bytes packet id and
935 		 * 8-bytes nonce-tail from userspace
936 		 */
937 		dir->nonce_tail = nla_data(attrs[OVPN_A_KEYDIR_NONCE_TAIL]);
938 		dir->nonce_tail_size = nla_len(attrs[OVPN_A_KEYDIR_NONCE_TAIL]);
939 		break;
940 	default:
941 		NL_SET_ERR_MSG_MOD(info->extack, "unsupported cipher");
942 		return -EINVAL;
943 	}
944 
945 	return 0;
946 }
947 
948 /**
949  * ovpn_nl_key_new_doit - configure a new key for the specified peer
950  * @skb: incoming netlink message
951  * @info: genetlink metadata
952  *
953  * This function allows the user to install a new key in the peer crypto
954  * state.
955  * Each peer has two 'slots', namely 'primary' and 'secondary', where
956  * keys can be installed. The key in the 'primary' slot is used for
957  * encryption, while both keys can be used for decryption by matching the
958  * key ID carried in the incoming packet.
959  *
960  * The user is responsible for rotating keys when necessary. The user
961  * may fetch peer traffic statistics via netlink in order to better
962  * identify the right time to rotate keys.
963  * The renegotiation follows these steps:
964  * 1. a new key is computed by the user and is installed in the 'secondary'
965  *    slot
966  * 2. at user discretion (usually after a predetermined time) 'primary' and
967  *    'secondary' contents are swapped and the new key starts being used for
968  *    encryption, while the old key is kept around for decryption of late
969  *    packets.
970  *
971  * Return: 0 on success or a negative error code otherwise.
972  */
ovpn_nl_key_new_doit(struct sk_buff * skb,struct genl_info * info)973 int ovpn_nl_key_new_doit(struct sk_buff *skb, struct genl_info *info)
974 {
975 	struct nlattr *attrs[OVPN_A_KEYCONF_MAX + 1];
976 	struct ovpn_priv *ovpn = info->user_ptr[0];
977 	struct ovpn_peer_key_reset pkr;
978 	struct ovpn_peer *peer;
979 	u32 peer_id;
980 	int ret;
981 
982 	if (GENL_REQ_ATTR_CHECK(info, OVPN_A_KEYCONF))
983 		return -EINVAL;
984 
985 	ret = nla_parse_nested(attrs, OVPN_A_KEYCONF_MAX,
986 			       info->attrs[OVPN_A_KEYCONF],
987 			       ovpn_keyconf_nl_policy, info->extack);
988 	if (ret)
989 		return ret;
990 
991 	if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs,
992 			      OVPN_A_KEYCONF_PEER_ID))
993 		return -EINVAL;
994 
995 	if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs,
996 			      OVPN_A_KEYCONF_SLOT) ||
997 	    NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs,
998 			      OVPN_A_KEYCONF_KEY_ID) ||
999 	    NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs,
1000 			      OVPN_A_KEYCONF_CIPHER_ALG) ||
1001 	    NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs,
1002 			      OVPN_A_KEYCONF_ENCRYPT_DIR) ||
1003 	    NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs,
1004 			      OVPN_A_KEYCONF_DECRYPT_DIR))
1005 		return -EINVAL;
1006 
1007 	pkr.slot = nla_get_u32(attrs[OVPN_A_KEYCONF_SLOT]);
1008 	pkr.key.key_id = nla_get_u32(attrs[OVPN_A_KEYCONF_KEY_ID]);
1009 	pkr.key.cipher_alg = nla_get_u32(attrs[OVPN_A_KEYCONF_CIPHER_ALG]);
1010 
1011 	ret = ovpn_nl_get_key_dir(info, attrs[OVPN_A_KEYCONF_ENCRYPT_DIR],
1012 				  pkr.key.cipher_alg, &pkr.key.encrypt);
1013 	if (ret < 0)
1014 		return ret;
1015 
1016 	ret = ovpn_nl_get_key_dir(info, attrs[OVPN_A_KEYCONF_DECRYPT_DIR],
1017 				  pkr.key.cipher_alg, &pkr.key.decrypt);
1018 	if (ret < 0)
1019 		return ret;
1020 
1021 	peer_id = nla_get_u32(attrs[OVPN_A_KEYCONF_PEER_ID]);
1022 	peer = ovpn_peer_get_by_id(ovpn, peer_id);
1023 	if (!peer) {
1024 		NL_SET_ERR_MSG_FMT_MOD(info->extack,
1025 				       "no peer with id %u to set key for",
1026 				       peer_id);
1027 		return -ENOENT;
1028 	}
1029 
1030 	ret = ovpn_crypto_state_reset(&peer->crypto, &pkr);
1031 	if (ret < 0) {
1032 		NL_SET_ERR_MSG_FMT_MOD(info->extack,
1033 				       "cannot install new key for peer %u",
1034 				       peer_id);
1035 		goto out;
1036 	}
1037 
1038 	netdev_dbg(ovpn->dev, "new key installed (id=%u) for peer %u\n",
1039 		   pkr.key.key_id, peer_id);
1040 out:
1041 	ovpn_peer_put(peer);
1042 	return ret;
1043 }
1044 
ovpn_nl_send_key(struct sk_buff * skb,const struct genl_info * info,u32 peer_id,enum ovpn_key_slot slot,const struct ovpn_key_config * keyconf)1045 static int ovpn_nl_send_key(struct sk_buff *skb, const struct genl_info *info,
1046 			    u32 peer_id, enum ovpn_key_slot slot,
1047 			    const struct ovpn_key_config *keyconf)
1048 {
1049 	struct nlattr *attr;
1050 	void *hdr;
1051 
1052 	hdr = genlmsg_put(skb, info->snd_portid, info->snd_seq, &ovpn_nl_family,
1053 			  0, OVPN_CMD_KEY_GET);
1054 	if (!hdr)
1055 		return -ENOBUFS;
1056 
1057 	attr = nla_nest_start(skb, OVPN_A_KEYCONF);
1058 	if (!attr)
1059 		goto err;
1060 
1061 	if (nla_put_u32(skb, OVPN_A_KEYCONF_PEER_ID, peer_id))
1062 		goto err;
1063 
1064 	if (nla_put_u32(skb, OVPN_A_KEYCONF_SLOT, slot) ||
1065 	    nla_put_u32(skb, OVPN_A_KEYCONF_KEY_ID, keyconf->key_id) ||
1066 	    nla_put_u32(skb, OVPN_A_KEYCONF_CIPHER_ALG, keyconf->cipher_alg))
1067 		goto err;
1068 
1069 	nla_nest_end(skb, attr);
1070 	genlmsg_end(skb, hdr);
1071 
1072 	return 0;
1073 err:
1074 	genlmsg_cancel(skb, hdr);
1075 	return -EMSGSIZE;
1076 }
1077 
ovpn_nl_key_get_doit(struct sk_buff * skb,struct genl_info * info)1078 int ovpn_nl_key_get_doit(struct sk_buff *skb, struct genl_info *info)
1079 {
1080 	struct nlattr *attrs[OVPN_A_KEYCONF_MAX + 1];
1081 	struct ovpn_priv *ovpn = info->user_ptr[0];
1082 	struct ovpn_key_config keyconf = { 0 };
1083 	enum ovpn_key_slot slot;
1084 	struct ovpn_peer *peer;
1085 	struct sk_buff *msg;
1086 	u32 peer_id;
1087 	int ret, i;
1088 
1089 	if (GENL_REQ_ATTR_CHECK(info, OVPN_A_KEYCONF))
1090 		return -EINVAL;
1091 
1092 	ret = nla_parse_nested(attrs, OVPN_A_KEYCONF_MAX,
1093 			       info->attrs[OVPN_A_KEYCONF],
1094 			       ovpn_keyconf_get_nl_policy, info->extack);
1095 	if (ret)
1096 		return ret;
1097 
1098 	if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs,
1099 			      OVPN_A_KEYCONF_PEER_ID))
1100 		return -EINVAL;
1101 
1102 	if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs,
1103 			      OVPN_A_KEYCONF_SLOT))
1104 		return -EINVAL;
1105 
1106 	/* OVPN_CMD_KEY_GET expects only the PEER_ID and the SLOT, therefore
1107 	 * ensure that the user hasn't specified any other attribute.
1108 	 *
1109 	 * Unfortunately this check cannot be performed via netlink
1110 	 * spec/policy and must be open-coded.
1111 	 */
1112 	for (i = 0; i < OVPN_A_KEYCONF_MAX + 1; i++) {
1113 		if (i == OVPN_A_KEYCONF_PEER_ID ||
1114 		    i == OVPN_A_KEYCONF_SLOT)
1115 			continue;
1116 
1117 		if (attrs[i]) {
1118 			NL_SET_ERR_MSG_FMT_MOD(info->extack,
1119 					       "unexpected attribute %u", i);
1120 			return -EINVAL;
1121 		}
1122 	}
1123 
1124 	peer_id = nla_get_u32(attrs[OVPN_A_KEYCONF_PEER_ID]);
1125 	peer = ovpn_peer_get_by_id(ovpn, peer_id);
1126 	if (!peer) {
1127 		NL_SET_ERR_MSG_FMT_MOD(info->extack,
1128 				       "cannot find peer with id %u", peer_id);
1129 		return -ENOENT;
1130 	}
1131 
1132 	slot = nla_get_u32(attrs[OVPN_A_KEYCONF_SLOT]);
1133 
1134 	ret = ovpn_crypto_config_get(&peer->crypto, slot, &keyconf);
1135 	if (ret < 0) {
1136 		NL_SET_ERR_MSG_FMT_MOD(info->extack,
1137 				       "cannot extract key from slot %u for peer %u",
1138 				       slot, peer_id);
1139 		goto err;
1140 	}
1141 
1142 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1143 	if (!msg) {
1144 		ret = -ENOMEM;
1145 		goto err;
1146 	}
1147 
1148 	ret = ovpn_nl_send_key(msg, info, peer->id, slot, &keyconf);
1149 	if (ret < 0) {
1150 		nlmsg_free(msg);
1151 		goto err;
1152 	}
1153 
1154 	ret = genlmsg_reply(msg, info);
1155 err:
1156 	ovpn_peer_put(peer);
1157 	return ret;
1158 }
1159 
ovpn_nl_key_swap_doit(struct sk_buff * skb,struct genl_info * info)1160 int ovpn_nl_key_swap_doit(struct sk_buff *skb, struct genl_info *info)
1161 {
1162 	struct nlattr *attrs[OVPN_A_KEYCONF_MAX + 1];
1163 	struct ovpn_priv *ovpn = info->user_ptr[0];
1164 	struct ovpn_peer *peer;
1165 	u32 peer_id;
1166 	int ret;
1167 
1168 	if (GENL_REQ_ATTR_CHECK(info, OVPN_A_KEYCONF))
1169 		return -EINVAL;
1170 
1171 	ret = nla_parse_nested(attrs, OVPN_A_KEYCONF_MAX,
1172 			       info->attrs[OVPN_A_KEYCONF],
1173 			       ovpn_keyconf_swap_input_nl_policy, info->extack);
1174 	if (ret)
1175 		return ret;
1176 
1177 	if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs,
1178 			      OVPN_A_KEYCONF_PEER_ID))
1179 		return -EINVAL;
1180 
1181 	peer_id = nla_get_u32(attrs[OVPN_A_KEYCONF_PEER_ID]);
1182 	peer = ovpn_peer_get_by_id(ovpn, peer_id);
1183 	if (!peer) {
1184 		NL_SET_ERR_MSG_FMT_MOD(info->extack,
1185 				       "no peer with id %u to swap keys for",
1186 				       peer_id);
1187 		return -ENOENT;
1188 	}
1189 
1190 	ovpn_crypto_key_slots_swap(&peer->crypto);
1191 	ovpn_peer_put(peer);
1192 
1193 	return 0;
1194 }
1195 
ovpn_nl_key_del_doit(struct sk_buff * skb,struct genl_info * info)1196 int ovpn_nl_key_del_doit(struct sk_buff *skb, struct genl_info *info)
1197 {
1198 	struct nlattr *attrs[OVPN_A_KEYCONF_MAX + 1];
1199 	struct ovpn_priv *ovpn = info->user_ptr[0];
1200 	enum ovpn_key_slot slot;
1201 	struct ovpn_peer *peer;
1202 	u32 peer_id;
1203 	int ret;
1204 
1205 	if (GENL_REQ_ATTR_CHECK(info, OVPN_A_KEYCONF))
1206 		return -EINVAL;
1207 
1208 	ret = nla_parse_nested(attrs, OVPN_A_KEYCONF_MAX,
1209 			       info->attrs[OVPN_A_KEYCONF],
1210 			       ovpn_keyconf_del_input_nl_policy, info->extack);
1211 	if (ret)
1212 		return ret;
1213 
1214 	if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs,
1215 			      OVPN_A_KEYCONF_PEER_ID))
1216 		return -EINVAL;
1217 
1218 	if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs,
1219 			      OVPN_A_KEYCONF_SLOT))
1220 		return -EINVAL;
1221 
1222 	peer_id = nla_get_u32(attrs[OVPN_A_KEYCONF_PEER_ID]);
1223 	slot = nla_get_u32(attrs[OVPN_A_KEYCONF_SLOT]);
1224 
1225 	peer = ovpn_peer_get_by_id(ovpn, peer_id);
1226 	if (!peer) {
1227 		NL_SET_ERR_MSG_FMT_MOD(info->extack,
1228 				       "no peer with id %u to delete key for",
1229 				       peer_id);
1230 		return -ENOENT;
1231 	}
1232 
1233 	ovpn_crypto_key_slot_delete(&peer->crypto, slot);
1234 	ovpn_peer_put(peer);
1235 
1236 	return 0;
1237 }
1238 
1239 /**
1240  * ovpn_nl_peer_del_notify - notify userspace about peer being deleted
1241  * @peer: the peer being deleted
1242  *
1243  * Return: 0 on success or a negative error code otherwise
1244  */
ovpn_nl_peer_del_notify(struct ovpn_peer * peer)1245 int ovpn_nl_peer_del_notify(struct ovpn_peer *peer)
1246 {
1247 	struct ovpn_socket *sock;
1248 	struct sk_buff *msg;
1249 	struct nlattr *attr;
1250 	int ret = -EMSGSIZE;
1251 	void *hdr;
1252 
1253 	netdev_info(peer->ovpn->dev, "deleting peer with id %u, reason %d\n",
1254 		    peer->id, peer->delete_reason);
1255 
1256 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
1257 	if (!msg)
1258 		return -ENOMEM;
1259 
1260 	hdr = genlmsg_put(msg, 0, 0, &ovpn_nl_family, 0, OVPN_CMD_PEER_DEL_NTF);
1261 	if (!hdr) {
1262 		ret = -ENOBUFS;
1263 		goto err_free_msg;
1264 	}
1265 
1266 	if (nla_put_u32(msg, OVPN_A_IFINDEX, peer->ovpn->dev->ifindex))
1267 		goto err_cancel_msg;
1268 
1269 	attr = nla_nest_start(msg, OVPN_A_PEER);
1270 	if (!attr)
1271 		goto err_cancel_msg;
1272 
1273 	if (nla_put_u32(msg, OVPN_A_PEER_DEL_REASON, peer->delete_reason))
1274 		goto err_cancel_msg;
1275 
1276 	if (nla_put_u32(msg, OVPN_A_PEER_ID, peer->id))
1277 		goto err_cancel_msg;
1278 
1279 	nla_nest_end(msg, attr);
1280 
1281 	genlmsg_end(msg, hdr);
1282 
1283 	rcu_read_lock();
1284 	sock = rcu_dereference(peer->sock);
1285 	if (!sock) {
1286 		ret = -EINVAL;
1287 		goto err_unlock;
1288 	}
1289 	genlmsg_multicast_netns(&ovpn_nl_family, sock_net(sock->sk), msg, 0,
1290 				OVPN_NLGRP_PEERS, GFP_ATOMIC);
1291 	rcu_read_unlock();
1292 
1293 	return 0;
1294 
1295 err_unlock:
1296 	rcu_read_unlock();
1297 err_cancel_msg:
1298 	genlmsg_cancel(msg, hdr);
1299 err_free_msg:
1300 	nlmsg_free(msg);
1301 	return ret;
1302 }
1303 
1304 /**
1305  * ovpn_nl_peer_float_notify - notify userspace about peer floating
1306  * @peer: the floated peer
1307  * @ss: sockaddr representing the new remote endpoint
1308  *
1309  * Return: 0 on success or a negative error code otherwise
1310  */
ovpn_nl_peer_float_notify(struct ovpn_peer * peer,const struct sockaddr_storage * ss)1311 int ovpn_nl_peer_float_notify(struct ovpn_peer *peer,
1312 			      const struct sockaddr_storage *ss)
1313 {
1314 	struct ovpn_socket *sock;
1315 	struct sockaddr_in6 *sa6;
1316 	struct sockaddr_in *sa;
1317 	struct sk_buff *msg;
1318 	struct nlattr *attr;
1319 	int ret = -EMSGSIZE;
1320 	void *hdr;
1321 
1322 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
1323 	if (!msg)
1324 		return -ENOMEM;
1325 
1326 	hdr = genlmsg_put(msg, 0, 0, &ovpn_nl_family, 0,
1327 			  OVPN_CMD_PEER_FLOAT_NTF);
1328 	if (!hdr) {
1329 		ret = -ENOBUFS;
1330 		goto err_free_msg;
1331 	}
1332 
1333 	if (nla_put_u32(msg, OVPN_A_IFINDEX, peer->ovpn->dev->ifindex))
1334 		goto err_cancel_msg;
1335 
1336 	attr = nla_nest_start(msg, OVPN_A_PEER);
1337 	if (!attr)
1338 		goto err_cancel_msg;
1339 
1340 	if (nla_put_u32(msg, OVPN_A_PEER_ID, peer->id))
1341 		goto err_cancel_msg;
1342 
1343 	if (ss->ss_family == AF_INET) {
1344 		sa = (struct sockaddr_in *)ss;
1345 		if (nla_put_in_addr(msg, OVPN_A_PEER_REMOTE_IPV4,
1346 				    sa->sin_addr.s_addr) ||
1347 		    nla_put_net16(msg, OVPN_A_PEER_REMOTE_PORT, sa->sin_port))
1348 			goto err_cancel_msg;
1349 	} else if (ss->ss_family == AF_INET6) {
1350 		sa6 = (struct sockaddr_in6 *)ss;
1351 		if (nla_put_in6_addr(msg, OVPN_A_PEER_REMOTE_IPV6,
1352 				     &sa6->sin6_addr) ||
1353 		    nla_put_u32(msg, OVPN_A_PEER_REMOTE_IPV6_SCOPE_ID,
1354 				sa6->sin6_scope_id) ||
1355 		    nla_put_net16(msg, OVPN_A_PEER_REMOTE_PORT, sa6->sin6_port))
1356 			goto err_cancel_msg;
1357 	} else {
1358 		ret = -EAFNOSUPPORT;
1359 		goto err_cancel_msg;
1360 	}
1361 
1362 	nla_nest_end(msg, attr);
1363 	genlmsg_end(msg, hdr);
1364 
1365 	rcu_read_lock();
1366 	sock = rcu_dereference(peer->sock);
1367 	if (!sock) {
1368 		ret = -EINVAL;
1369 		goto err_unlock;
1370 	}
1371 	genlmsg_multicast_netns(&ovpn_nl_family, sock_net(sock->sk), msg,
1372 				0, OVPN_NLGRP_PEERS, GFP_ATOMIC);
1373 	rcu_read_unlock();
1374 
1375 	return 0;
1376 
1377 err_unlock:
1378 	rcu_read_unlock();
1379 err_cancel_msg:
1380 	genlmsg_cancel(msg, hdr);
1381 err_free_msg:
1382 	nlmsg_free(msg);
1383 	return ret;
1384 }
1385 
1386 /**
1387  * ovpn_nl_key_swap_notify - notify userspace peer's key must be renewed
1388  * @peer: the peer whose key needs to be renewed
1389  * @key_id: the ID of the key that needs to be renewed
1390  *
1391  * Return: 0 on success or a negative error code otherwise
1392  */
ovpn_nl_key_swap_notify(struct ovpn_peer * peer,u8 key_id)1393 int ovpn_nl_key_swap_notify(struct ovpn_peer *peer, u8 key_id)
1394 {
1395 	struct ovpn_socket *sock;
1396 	struct nlattr *k_attr;
1397 	struct sk_buff *msg;
1398 	int ret = -EMSGSIZE;
1399 	void *hdr;
1400 
1401 	netdev_info(peer->ovpn->dev, "peer with id %u must rekey - primary key unusable.\n",
1402 		    peer->id);
1403 
1404 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
1405 	if (!msg)
1406 		return -ENOMEM;
1407 
1408 	hdr = genlmsg_put(msg, 0, 0, &ovpn_nl_family, 0, OVPN_CMD_KEY_SWAP_NTF);
1409 	if (!hdr) {
1410 		ret = -ENOBUFS;
1411 		goto err_free_msg;
1412 	}
1413 
1414 	if (nla_put_u32(msg, OVPN_A_IFINDEX, peer->ovpn->dev->ifindex))
1415 		goto err_cancel_msg;
1416 
1417 	k_attr = nla_nest_start(msg, OVPN_A_KEYCONF);
1418 	if (!k_attr)
1419 		goto err_cancel_msg;
1420 
1421 	if (nla_put_u32(msg, OVPN_A_KEYCONF_PEER_ID, peer->id))
1422 		goto err_cancel_msg;
1423 
1424 	if (nla_put_u16(msg, OVPN_A_KEYCONF_KEY_ID, key_id))
1425 		goto err_cancel_msg;
1426 
1427 	nla_nest_end(msg, k_attr);
1428 	genlmsg_end(msg, hdr);
1429 
1430 	rcu_read_lock();
1431 	sock = rcu_dereference(peer->sock);
1432 	if (!sock) {
1433 		ret = -EINVAL;
1434 		goto err_unlock;
1435 	}
1436 	genlmsg_multicast_netns(&ovpn_nl_family, sock_net(sock->sk), msg, 0,
1437 				OVPN_NLGRP_PEERS, GFP_ATOMIC);
1438 	rcu_read_unlock();
1439 
1440 	return 0;
1441 err_unlock:
1442 	rcu_read_unlock();
1443 err_cancel_msg:
1444 	genlmsg_cancel(msg, hdr);
1445 err_free_msg:
1446 	nlmsg_free(msg);
1447 	return ret;
1448 }
1449 
1450 /**
1451  * ovpn_nl_register - perform any needed registration in the NL subsustem
1452  *
1453  * Return: 0 on success, a negative error code otherwise
1454  */
ovpn_nl_register(void)1455 int __init ovpn_nl_register(void)
1456 {
1457 	int ret = genl_register_family(&ovpn_nl_family);
1458 
1459 	if (ret) {
1460 		pr_err("ovpn: genl_register_family failed: %d\n", ret);
1461 		return ret;
1462 	}
1463 
1464 	return 0;
1465 }
1466 
1467 /**
1468  * ovpn_nl_unregister - undo any module wide netlink registration
1469  */
ovpn_nl_unregister(void)1470 void ovpn_nl_unregister(void)
1471 {
1472 	genl_unregister_family(&ovpn_nl_family);
1473 }
1474