1 // SPDX-License-Identifier: GPL-2.0
2 /* OpenVPN data channel offload
3 *
4 * Copyright (C) 2020-2025 OpenVPN, Inc.
5 *
6 * Author: Antonio Quartulli <antonio@openvpn.net>
7 */
8
9 #include <linux/netdevice.h>
10 #include <linux/types.h>
11 #include <net/genetlink.h>
12
13 #include <uapi/linux/ovpn.h>
14
15 #include "ovpnpriv.h"
16 #include "main.h"
17 #include "netlink.h"
18 #include "netlink-gen.h"
19 #include "bind.h"
20 #include "crypto.h"
21 #include "peer.h"
22 #include "socket.h"
23
24 MODULE_ALIAS_GENL_FAMILY(OVPN_FAMILY_NAME);
25
26 /**
27 * ovpn_get_dev_from_attrs - retrieve the ovpn private data from the netdevice
28 * a netlink message is targeting
29 * @net: network namespace where to look for the interface
30 * @info: generic netlink info from the user request
31 * @tracker: tracker object to be used for the netdev reference acquisition
32 *
33 * Return: the ovpn private data, if found, or an error otherwise
34 */
35 static struct ovpn_priv *
ovpn_get_dev_from_attrs(struct net * net,const struct genl_info * info,netdevice_tracker * tracker)36 ovpn_get_dev_from_attrs(struct net *net, const struct genl_info *info,
37 netdevice_tracker *tracker)
38 {
39 struct ovpn_priv *ovpn;
40 struct net_device *dev;
41 int ifindex;
42
43 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_IFINDEX))
44 return ERR_PTR(-EINVAL);
45
46 ifindex = nla_get_u32(info->attrs[OVPN_A_IFINDEX]);
47
48 rcu_read_lock();
49 dev = dev_get_by_index_rcu(net, ifindex);
50 if (!dev) {
51 rcu_read_unlock();
52 NL_SET_ERR_MSG_MOD(info->extack,
53 "ifindex does not match any interface");
54 return ERR_PTR(-ENODEV);
55 }
56
57 if (!ovpn_dev_is_valid(dev)) {
58 rcu_read_unlock();
59 NL_SET_ERR_MSG_MOD(info->extack,
60 "specified interface is not ovpn");
61 NL_SET_BAD_ATTR(info->extack, info->attrs[OVPN_A_IFINDEX]);
62 return ERR_PTR(-EINVAL);
63 }
64
65 ovpn = netdev_priv(dev);
66 netdev_hold(dev, tracker, GFP_ATOMIC);
67 rcu_read_unlock();
68
69 return ovpn;
70 }
71
ovpn_nl_pre_doit(const struct genl_split_ops * ops,struct sk_buff * skb,struct genl_info * info)72 int ovpn_nl_pre_doit(const struct genl_split_ops *ops, struct sk_buff *skb,
73 struct genl_info *info)
74 {
75 netdevice_tracker *tracker = (netdevice_tracker *)&info->user_ptr[1];
76 struct ovpn_priv *ovpn = ovpn_get_dev_from_attrs(genl_info_net(info),
77 info, tracker);
78
79 if (IS_ERR(ovpn))
80 return PTR_ERR(ovpn);
81
82 info->user_ptr[0] = ovpn;
83
84 return 0;
85 }
86
ovpn_nl_post_doit(const struct genl_split_ops * ops,struct sk_buff * skb,struct genl_info * info)87 void ovpn_nl_post_doit(const struct genl_split_ops *ops, struct sk_buff *skb,
88 struct genl_info *info)
89 {
90 netdevice_tracker *tracker = (netdevice_tracker *)&info->user_ptr[1];
91 struct ovpn_priv *ovpn = info->user_ptr[0];
92
93 if (ovpn)
94 netdev_put(ovpn->dev, tracker);
95 }
96
ovpn_nl_attr_sockaddr_remote(struct nlattr ** attrs,struct sockaddr_storage * ss)97 static bool ovpn_nl_attr_sockaddr_remote(struct nlattr **attrs,
98 struct sockaddr_storage *ss)
99 {
100 struct sockaddr_in6 *sin6;
101 struct sockaddr_in *sin;
102 struct in6_addr *in6;
103 struct nlattr *scope;
104 u32 scope_id = 0;
105 __be16 port = 0;
106 __be32 *in;
107
108 ss->ss_family = AF_UNSPEC;
109
110 if (attrs[OVPN_A_PEER_REMOTE_PORT])
111 port = nla_get_be16(attrs[OVPN_A_PEER_REMOTE_PORT]);
112
113 if (attrs[OVPN_A_PEER_REMOTE_IPV4]) {
114 ss->ss_family = AF_INET;
115 in = nla_data(attrs[OVPN_A_PEER_REMOTE_IPV4]);
116 } else if (attrs[OVPN_A_PEER_REMOTE_IPV6]) {
117 ss->ss_family = AF_INET6;
118 in6 = nla_data(attrs[OVPN_A_PEER_REMOTE_IPV6]);
119 scope = attrs[OVPN_A_PEER_REMOTE_IPV6_SCOPE_ID];
120 if (scope)
121 scope_id = nla_get_u32(scope);
122 } else {
123 return false;
124 }
125
126 switch (ss->ss_family) {
127 case AF_INET6:
128 /* If this is a regular IPv6 just break and move on,
129 * otherwise switch to AF_INET and extract the IPv4 accordingly
130 */
131 if (!ipv6_addr_v4mapped(in6)) {
132 sin6 = (struct sockaddr_in6 *)ss;
133 sin6->sin6_port = port;
134 sin6->sin6_scope_id = scope_id;
135 memcpy(&sin6->sin6_addr, in6, sizeof(*in6));
136 break;
137 }
138
139 /* v4-mapped-v6 address */
140 ss->ss_family = AF_INET;
141 in = &in6->s6_addr32[3];
142 fallthrough;
143 case AF_INET:
144 sin = (struct sockaddr_in *)ss;
145 sin->sin_port = port;
146 sin->sin_addr.s_addr = *in;
147 break;
148 }
149
150 return true;
151 }
152
ovpn_nl_attr_local_ip(struct nlattr ** attrs)153 static u8 *ovpn_nl_attr_local_ip(struct nlattr **attrs)
154 {
155 u8 *addr6;
156
157 if (!attrs[OVPN_A_PEER_LOCAL_IPV4] && !attrs[OVPN_A_PEER_LOCAL_IPV6])
158 return NULL;
159
160 if (attrs[OVPN_A_PEER_LOCAL_IPV4])
161 return nla_data(attrs[OVPN_A_PEER_LOCAL_IPV4]);
162
163 addr6 = nla_data(attrs[OVPN_A_PEER_LOCAL_IPV6]);
164 /* this is an IPv4-mapped IPv6 address, therefore extract the actual
165 * v4 address from the last 4 bytes
166 */
167 if (ipv6_addr_v4mapped((struct in6_addr *)addr6))
168 return addr6 + 12;
169
170 return addr6;
171 }
172
ovpn_nl_family_get(struct nlattr * addr4,struct nlattr * addr6)173 static sa_family_t ovpn_nl_family_get(struct nlattr *addr4,
174 struct nlattr *addr6)
175 {
176 if (addr4)
177 return AF_INET;
178
179 if (addr6) {
180 if (ipv6_addr_v4mapped((struct in6_addr *)nla_data(addr6)))
181 return AF_INET;
182 return AF_INET6;
183 }
184
185 return AF_UNSPEC;
186 }
187
ovpn_nl_peer_check_vpn_addrs(const struct in_addr * addr4,const struct in6_addr * addr6,struct genl_info * info)188 static int ovpn_nl_peer_check_vpn_addrs(const struct in_addr *addr4,
189 const struct in6_addr *addr6,
190 struct genl_info *info)
191 {
192 int addr6_type;
193
194 if (addr4->s_addr == htonl(INADDR_ANY) && ipv6_addr_any(addr6)) {
195 NL_SET_ERR_MSG_MOD(info->extack,
196 "at least one VPN IP must be configured in MP mode");
197 return -EINVAL;
198 }
199
200 if (ipv4_is_multicast(addr4->s_addr) || ipv4_is_lbcast(addr4->s_addr) ||
201 ipv4_is_loopback(addr4->s_addr)) {
202 NL_SET_ERR_MSG_MOD(info->extack,
203 "VPN IPv4 address must be valid unicast or any");
204 return -EADDRNOTAVAIL;
205 }
206
207 if (!ipv6_addr_any(addr6)) {
208 addr6_type = ipv6_addr_type(addr6);
209
210 if (!(addr6_type & IPV6_ADDR_UNICAST) ||
211 (addr6_type & (IPV6_ADDR_LOOPBACK | IPV6_ADDR_COMPATv4))) {
212 NL_SET_ERR_MSG_MOD(info->extack,
213 "VPN IPv6 address must be valid unicast or any");
214 return -EADDRNOTAVAIL;
215 }
216 }
217
218 return 0;
219 }
220
ovpn_nl_peer_precheck(struct ovpn_priv * ovpn,struct genl_info * info,struct nlattr ** attrs)221 static int ovpn_nl_peer_precheck(struct ovpn_priv *ovpn,
222 struct genl_info *info,
223 struct nlattr **attrs)
224 {
225 sa_family_t local_fam, remote_fam;
226
227 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_PEER], attrs,
228 OVPN_A_PEER_ID))
229 return -EINVAL;
230
231 if (attrs[OVPN_A_PEER_REMOTE_IPV4] && attrs[OVPN_A_PEER_REMOTE_IPV6]) {
232 NL_SET_ERR_MSG_MOD(info->extack,
233 "cannot specify both remote IPv4 or IPv6 address");
234 return -EINVAL;
235 }
236
237 if (!attrs[OVPN_A_PEER_REMOTE_IPV4] &&
238 !attrs[OVPN_A_PEER_REMOTE_IPV6] && attrs[OVPN_A_PEER_REMOTE_PORT]) {
239 NL_SET_ERR_MSG_MOD(info->extack,
240 "cannot specify remote port without IP address");
241 return -EINVAL;
242 }
243
244 if ((attrs[OVPN_A_PEER_REMOTE_IPV4] ||
245 attrs[OVPN_A_PEER_REMOTE_IPV6]) &&
246 !attrs[OVPN_A_PEER_REMOTE_PORT]) {
247 NL_SET_ERR_MSG_MOD(info->extack,
248 "cannot specify remote IP address without port");
249 return -EINVAL;
250 }
251
252 if (!attrs[OVPN_A_PEER_REMOTE_IPV4] &&
253 attrs[OVPN_A_PEER_LOCAL_IPV4]) {
254 NL_SET_ERR_MSG_MOD(info->extack,
255 "cannot specify local IPv4 address without remote");
256 return -EINVAL;
257 }
258
259 if (!attrs[OVPN_A_PEER_REMOTE_IPV6] &&
260 attrs[OVPN_A_PEER_LOCAL_IPV6]) {
261 NL_SET_ERR_MSG_MOD(info->extack,
262 "cannot specify local IPV6 address without remote");
263 return -EINVAL;
264 }
265
266 /* check that local and remote address families are the same even
267 * after parsing v4mapped IPv6 addresses.
268 * (if addresses are not provided, family will be AF_UNSPEC and
269 * the check is skipped)
270 */
271 local_fam = ovpn_nl_family_get(attrs[OVPN_A_PEER_LOCAL_IPV4],
272 attrs[OVPN_A_PEER_LOCAL_IPV6]);
273 remote_fam = ovpn_nl_family_get(attrs[OVPN_A_PEER_REMOTE_IPV4],
274 attrs[OVPN_A_PEER_REMOTE_IPV6]);
275 if (local_fam != AF_UNSPEC && remote_fam != AF_UNSPEC &&
276 local_fam != remote_fam) {
277 NL_SET_ERR_MSG_MOD(info->extack,
278 "mismatching local and remote address families");
279 return -EINVAL;
280 }
281
282 if (remote_fam != AF_INET6 && attrs[OVPN_A_PEER_REMOTE_IPV6_SCOPE_ID]) {
283 NL_SET_ERR_MSG_MOD(info->extack,
284 "cannot specify scope id without remote IPv6 address");
285 return -EINVAL;
286 }
287
288 /* VPN IPs are needed only in MP mode for selecting the right peer */
289 if (ovpn->mode == OVPN_MODE_P2P && (attrs[OVPN_A_PEER_VPN_IPV4] ||
290 attrs[OVPN_A_PEER_VPN_IPV6])) {
291 NL_SET_ERR_MSG_FMT_MOD(info->extack,
292 "unexpected VPN IP in P2P mode");
293 return -EINVAL;
294 }
295
296 if ((attrs[OVPN_A_PEER_KEEPALIVE_INTERVAL] &&
297 !attrs[OVPN_A_PEER_KEEPALIVE_TIMEOUT]) ||
298 (!attrs[OVPN_A_PEER_KEEPALIVE_INTERVAL] &&
299 attrs[OVPN_A_PEER_KEEPALIVE_TIMEOUT])) {
300 NL_SET_ERR_MSG_FMT_MOD(info->extack,
301 "keepalive interval and timeout are required together");
302 return -EINVAL;
303 }
304
305 return 0;
306 }
307
308 /**
309 * ovpn_nl_peer_modify - modify the peer attributes according to the incoming msg
310 * @peer: the peer to modify
311 * @info: generic netlink info from the user request
312 * @attrs: the attributes from the user request
313 *
314 * Return: a negative error code in case of failure, 0 on success or 1 on
315 * success and the VPN IPs have been modified (requires rehashing in MP
316 * mode)
317 */
ovpn_nl_peer_modify(struct ovpn_peer * peer,struct genl_info * info,struct nlattr ** attrs)318 static int ovpn_nl_peer_modify(struct ovpn_peer *peer, struct genl_info *info,
319 struct nlattr **attrs)
320 {
321 struct sockaddr_storage ss = {};
322 void *local_ip = NULL;
323 u32 interv, timeout;
324 bool rehash = false;
325 int ret;
326
327 spin_lock_bh(&peer->lock);
328
329 if (ovpn_nl_attr_sockaddr_remote(attrs, &ss)) {
330 /* we carry the local IP in a generic container.
331 * ovpn_peer_reset_sockaddr() will properly interpret it
332 * based on ss.ss_family
333 */
334 local_ip = ovpn_nl_attr_local_ip(attrs);
335
336 /* set peer sockaddr */
337 ret = ovpn_peer_reset_sockaddr(peer, &ss, local_ip);
338 if (ret < 0) {
339 NL_SET_ERR_MSG_FMT_MOD(info->extack,
340 "cannot set peer sockaddr: %d",
341 ret);
342 goto err_unlock;
343 }
344 dst_cache_reset(&peer->dst_cache);
345 }
346
347 /* In a multipeer-to-multipeer setup we may have asymmetric peer IDs,
348 * that is peer->id might be different from peer->tx_id.
349 */
350 if (attrs[OVPN_A_PEER_TX_ID])
351 peer->tx_id = nla_get_u32(attrs[OVPN_A_PEER_TX_ID]);
352
353 if (attrs[OVPN_A_PEER_VPN_IPV4]) {
354 rehash = true;
355 peer->vpn_addrs.ipv4.s_addr =
356 nla_get_in_addr(attrs[OVPN_A_PEER_VPN_IPV4]);
357 }
358
359 if (attrs[OVPN_A_PEER_VPN_IPV6]) {
360 rehash = true;
361 peer->vpn_addrs.ipv6 =
362 nla_get_in6_addr(attrs[OVPN_A_PEER_VPN_IPV6]);
363 }
364
365 /* when setting the keepalive, both parameters have to be configured */
366 if (attrs[OVPN_A_PEER_KEEPALIVE_INTERVAL] &&
367 attrs[OVPN_A_PEER_KEEPALIVE_TIMEOUT]) {
368 interv = nla_get_u32(attrs[OVPN_A_PEER_KEEPALIVE_INTERVAL]);
369 timeout = nla_get_u32(attrs[OVPN_A_PEER_KEEPALIVE_TIMEOUT]);
370 ovpn_peer_keepalive_set(peer, interv, timeout);
371 }
372
373 netdev_dbg(peer->ovpn->dev,
374 "modify peer id=%u tx_id=%u endpoint=%pIScp VPN-IPv4=%pI4 VPN-IPv6=%pI6c\n",
375 peer->id, peer->tx_id, &ss,
376 &peer->vpn_addrs.ipv4.s_addr, &peer->vpn_addrs.ipv6);
377
378 spin_unlock_bh(&peer->lock);
379
380 return rehash ? 1 : 0;
381 err_unlock:
382 spin_unlock_bh(&peer->lock);
383 return ret;
384 }
385
ovpn_nl_peer_new_doit(struct sk_buff * skb,struct genl_info * info)386 int ovpn_nl_peer_new_doit(struct sk_buff *skb, struct genl_info *info)
387 {
388 struct in_addr vpn_addr4 = { .s_addr = htonl(INADDR_ANY) };
389 struct in6_addr vpn_addr6 = IN6ADDR_ANY_INIT;
390 struct ovpn_priv *ovpn = info->user_ptr[0];
391 struct nlattr *attrs[OVPN_A_PEER_MAX + 1];
392 struct ovpn_socket *ovpn_sock;
393 struct socket *sock = NULL;
394 struct ovpn_peer *peer;
395 u32 sockfd, peer_id;
396 int ret;
397
398 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_PEER))
399 return -EINVAL;
400
401 ret = nla_parse_nested(attrs, OVPN_A_PEER_MAX, info->attrs[OVPN_A_PEER],
402 ovpn_peer_new_input_nl_policy, info->extack);
403 if (ret)
404 return ret;
405
406 ret = ovpn_nl_peer_precheck(ovpn, info, attrs);
407 if (ret < 0)
408 return ret;
409
410 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_PEER], attrs,
411 OVPN_A_PEER_SOCKET))
412 return -EINVAL;
413
414 /* in MP mode VPN IPs are required for selecting the right peer */
415 if (ovpn->mode == OVPN_MODE_MP) {
416 if (attrs[OVPN_A_PEER_VPN_IPV4])
417 vpn_addr4.s_addr =
418 nla_get_in_addr(attrs[OVPN_A_PEER_VPN_IPV4]);
419 if (attrs[OVPN_A_PEER_VPN_IPV6])
420 vpn_addr6 =
421 nla_get_in6_addr(attrs[OVPN_A_PEER_VPN_IPV6]);
422
423 ret = ovpn_nl_peer_check_vpn_addrs(&vpn_addr4, &vpn_addr6,
424 info);
425 if (ret < 0)
426 return ret;
427 }
428
429 peer_id = nla_get_u32(attrs[OVPN_A_PEER_ID]);
430
431 peer = ovpn_peer_new(ovpn, peer_id);
432 if (IS_ERR(peer)) {
433 NL_SET_ERR_MSG_FMT_MOD(info->extack,
434 "cannot create new peer object for peer %u: %ld",
435 peer_id, PTR_ERR(peer));
436 return PTR_ERR(peer);
437 }
438
439 /* lookup the fd in the kernel table and extract the socket object */
440 sockfd = nla_get_u32(attrs[OVPN_A_PEER_SOCKET]);
441 /* sockfd_lookup() increases sock's refcounter */
442 sock = sockfd_lookup(sockfd, &ret);
443 if (!sock) {
444 NL_SET_ERR_MSG_FMT_MOD(info->extack,
445 "cannot lookup peer socket (fd=%u): %d",
446 sockfd, ret);
447 ret = -ENOTSOCK;
448 goto peer_release;
449 }
450
451 /* Only when using UDP as transport protocol the remote endpoint
452 * can be configured so that ovpn knows where to send packets to.
453 */
454 if (sock->sk->sk_protocol == IPPROTO_UDP &&
455 !attrs[OVPN_A_PEER_REMOTE_IPV4] &&
456 !attrs[OVPN_A_PEER_REMOTE_IPV6]) {
457 NL_SET_ERR_MSG_FMT_MOD(info->extack,
458 "missing remote IP address for UDP socket");
459 sockfd_put(sock);
460 ret = -EINVAL;
461 goto peer_release;
462 }
463
464 /* In case of TCP, the socket is connected to the peer and ovpn
465 * will just send bytes over it, without the need to specify a
466 * destination.
467 */
468 if (sock->sk->sk_protocol == IPPROTO_TCP &&
469 (attrs[OVPN_A_PEER_REMOTE_IPV4] ||
470 attrs[OVPN_A_PEER_REMOTE_IPV6])) {
471 NL_SET_ERR_MSG_FMT_MOD(info->extack,
472 "unexpected remote IP address with TCP socket");
473 sockfd_put(sock);
474 ret = -EINVAL;
475 goto peer_release;
476 }
477
478 ovpn_sock = ovpn_socket_new(sock, peer);
479 /* at this point we unconditionally drop the reference to the socket:
480 * - in case of error, the socket has to be dropped
481 * - if case of success, the socket is configured and let
482 * userspace own the reference, so that the latter can
483 * trigger the final close()
484 */
485 sockfd_put(sock);
486 if (IS_ERR(ovpn_sock)) {
487 NL_SET_ERR_MSG_FMT_MOD(info->extack,
488 "cannot encapsulate socket: %ld",
489 PTR_ERR(ovpn_sock));
490 ret = -ENOTSOCK;
491 goto peer_release;
492 }
493
494 rcu_assign_pointer(peer->sock, ovpn_sock);
495
496 ret = ovpn_nl_peer_modify(peer, info, attrs);
497 if (ret < 0)
498 goto sock_release;
499
500 ret = ovpn_peer_add(ovpn, peer);
501 if (ret < 0) {
502 NL_SET_ERR_MSG_FMT_MOD(info->extack,
503 "cannot add new peer (id=%u) to hashtable: %d",
504 peer->id, ret);
505 goto sock_release;
506 }
507
508 return 0;
509
510 sock_release:
511 ovpn_socket_release(peer);
512 peer_release:
513 /* For UDP, the peer is unreachable until added to the hashtables, so
514 * dropping the initial reference is enough. For TCP, the peer may be
515 * concurrently reachable via sk_user_data->peer until
516 * ovpn_socket_release() detaches; rely on the refcount.
517 */
518 ovpn_peer_put(peer);
519
520 return ret;
521 }
522
ovpn_nl_peer_set_doit(struct sk_buff * skb,struct genl_info * info)523 int ovpn_nl_peer_set_doit(struct sk_buff *skb, struct genl_info *info)
524 {
525 struct ovpn_priv *ovpn = info->user_ptr[0];
526 struct nlattr *attrs[OVPN_A_PEER_MAX + 1];
527 struct in6_addr vpn_addr6;
528 struct in_addr vpn_addr4;
529 struct ovpn_socket *sock;
530 struct ovpn_peer *peer;
531 u32 peer_id;
532 int ret;
533
534 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_PEER))
535 return -EINVAL;
536
537 ret = nla_parse_nested(attrs, OVPN_A_PEER_MAX, info->attrs[OVPN_A_PEER],
538 ovpn_peer_set_input_nl_policy, info->extack);
539 if (ret)
540 return ret;
541
542 ret = ovpn_nl_peer_precheck(ovpn, info, attrs);
543 if (ret < 0)
544 return ret;
545
546 if (attrs[OVPN_A_PEER_SOCKET]) {
547 NL_SET_ERR_MSG_FMT_MOD(info->extack,
548 "socket cannot be modified");
549 return -EINVAL;
550 }
551
552 peer_id = nla_get_u32(attrs[OVPN_A_PEER_ID]);
553 peer = ovpn_peer_get_by_id(ovpn, peer_id);
554 if (!peer) {
555 NL_SET_ERR_MSG_FMT_MOD(info->extack,
556 "cannot find peer with id %u", peer_id);
557 return -ENOENT;
558 }
559
560 /* when using a TCP socket the remote IP is not expected */
561 rcu_read_lock();
562 sock = rcu_dereference(peer->sock);
563 if (sock && sock->sk->sk_protocol == IPPROTO_TCP &&
564 (attrs[OVPN_A_PEER_REMOTE_IPV4] ||
565 attrs[OVPN_A_PEER_REMOTE_IPV6])) {
566 rcu_read_unlock();
567 NL_SET_ERR_MSG_FMT_MOD(info->extack,
568 "unexpected remote IP address with TCP socket");
569 ovpn_peer_put(peer);
570 return -EINVAL;
571 }
572 rcu_read_unlock();
573
574 spin_lock_bh(&ovpn->lock);
575
576 vpn_addr4 = peer->vpn_addrs.ipv4;
577 vpn_addr6 = peer->vpn_addrs.ipv6;
578
579 /* reject peer with conflicting VPN address */
580 if (attrs[OVPN_A_PEER_VPN_IPV4]) {
581 vpn_addr4.s_addr = nla_get_in_addr(attrs[OVPN_A_PEER_VPN_IPV4]);
582 if (ovpn_peer_vpn_addr_conflict4(ovpn, peer, &vpn_addr4))
583 goto addr_conflict;
584 }
585 if (attrs[OVPN_A_PEER_VPN_IPV6]) {
586 vpn_addr6 = nla_get_in6_addr(attrs[OVPN_A_PEER_VPN_IPV6]);
587 if (ovpn_peer_vpn_addr_conflict6(ovpn, peer, &vpn_addr6))
588 goto addr_conflict;
589 }
590
591 /* in MP mode VPN IPs are required for selecting the right peer */
592 if (ovpn->mode == OVPN_MODE_MP) {
593 ret = ovpn_nl_peer_check_vpn_addrs(&vpn_addr4, &vpn_addr6,
594 info);
595 if (ret < 0)
596 goto unlock;
597 }
598
599 ret = ovpn_nl_peer_modify(peer, info, attrs);
600 if (ret < 0)
601 goto unlock;
602
603 /* ret == 1 means that VPN IPv4/6 has been modified and rehashing
604 * is required
605 */
606 if (ret > 0) {
607 ovpn_peer_hash_vpn_ip(peer);
608 ret = 0;
609 }
610 /* if the remote endpoint was updated, the by_transp_addr hash bucket
611 * also needs to be refreshed, otherwise incoming packets from the new
612 * remote address would fail the lockless lookup
613 */
614 if (attrs[OVPN_A_PEER_REMOTE_IPV4] || attrs[OVPN_A_PEER_REMOTE_IPV6])
615 ovpn_peer_hash_transp_addr(peer);
616
617 unlock:
618 spin_unlock_bh(&ovpn->lock);
619 ovpn_peer_put(peer);
620
621 return ret;
622 addr_conflict:
623 NL_SET_ERR_MSG_FMT_MOD(info->extack,
624 "VPN IP is already assigned to another peer");
625 ret = -EADDRINUSE;
626 goto unlock;
627 }
628
ovpn_nl_send_peer(struct sk_buff * skb,const struct genl_info * info,const struct ovpn_peer * peer,u32 portid,u32 seq,int flags)629 static int ovpn_nl_send_peer(struct sk_buff *skb, const struct genl_info *info,
630 const struct ovpn_peer *peer, u32 portid, u32 seq,
631 int flags)
632 {
633 const struct ovpn_bind *bind;
634 struct ovpn_socket *sock;
635 int ret = -EMSGSIZE;
636 struct nlattr *attr;
637 __be16 local_port;
638 void *hdr;
639 int id;
640
641 hdr = genlmsg_put(skb, portid, seq, &ovpn_nl_family, flags,
642 OVPN_CMD_PEER_GET);
643 if (!hdr)
644 return -ENOBUFS;
645
646 attr = nla_nest_start(skb, OVPN_A_PEER);
647 if (!attr)
648 goto err;
649
650 rcu_read_lock();
651 sock = rcu_dereference(peer->sock);
652 if (!sock) {
653 ret = -EINVAL;
654 goto err_unlock;
655 }
656
657 if (!net_eq(genl_info_net(info), sock_net(sock->sk))) {
658 id = peernet2id_alloc(genl_info_net(info),
659 sock_net(sock->sk),
660 GFP_ATOMIC);
661 if (nla_put_s32(skb, OVPN_A_PEER_SOCKET_NETNSID, id))
662 goto err_unlock;
663 }
664 local_port = inet_sk(sock->sk)->inet_sport;
665 rcu_read_unlock();
666
667 if (nla_put_u32(skb, OVPN_A_PEER_ID, peer->id))
668 goto err;
669
670 if (nla_put_u32(skb, OVPN_A_PEER_TX_ID, peer->tx_id))
671 goto err;
672
673 if (peer->vpn_addrs.ipv4.s_addr != htonl(INADDR_ANY))
674 if (nla_put_in_addr(skb, OVPN_A_PEER_VPN_IPV4,
675 peer->vpn_addrs.ipv4.s_addr))
676 goto err;
677
678 if (!ipv6_addr_equal(&peer->vpn_addrs.ipv6, &in6addr_any))
679 if (nla_put_in6_addr(skb, OVPN_A_PEER_VPN_IPV6,
680 &peer->vpn_addrs.ipv6))
681 goto err;
682
683 if (nla_put_u32(skb, OVPN_A_PEER_KEEPALIVE_INTERVAL,
684 peer->keepalive_interval) ||
685 nla_put_u32(skb, OVPN_A_PEER_KEEPALIVE_TIMEOUT,
686 peer->keepalive_timeout))
687 goto err;
688
689 rcu_read_lock();
690 bind = rcu_dereference(peer->bind);
691 if (bind) {
692 if (bind->remote.in4.sin_family == AF_INET) {
693 if (nla_put_in_addr(skb, OVPN_A_PEER_REMOTE_IPV4,
694 bind->remote.in4.sin_addr.s_addr) ||
695 nla_put_net16(skb, OVPN_A_PEER_REMOTE_PORT,
696 bind->remote.in4.sin_port) ||
697 nla_put_in_addr(skb, OVPN_A_PEER_LOCAL_IPV4,
698 bind->local.ipv4.s_addr))
699 goto err_unlock;
700 } else if (bind->remote.in4.sin_family == AF_INET6) {
701 if (nla_put_in6_addr(skb, OVPN_A_PEER_REMOTE_IPV6,
702 &bind->remote.in6.sin6_addr) ||
703 nla_put_u32(skb, OVPN_A_PEER_REMOTE_IPV6_SCOPE_ID,
704 bind->remote.in6.sin6_scope_id) ||
705 nla_put_net16(skb, OVPN_A_PEER_REMOTE_PORT,
706 bind->remote.in6.sin6_port) ||
707 nla_put_in6_addr(skb, OVPN_A_PEER_LOCAL_IPV6,
708 &bind->local.ipv6))
709 goto err_unlock;
710 }
711 }
712 rcu_read_unlock();
713
714 if (nla_put_net16(skb, OVPN_A_PEER_LOCAL_PORT, local_port) ||
715 /* VPN RX stats */
716 nla_put_uint(skb, OVPN_A_PEER_VPN_RX_BYTES,
717 atomic64_read(&peer->vpn_stats.rx.bytes)) ||
718 nla_put_uint(skb, OVPN_A_PEER_VPN_RX_PACKETS,
719 atomic64_read(&peer->vpn_stats.rx.packets)) ||
720 /* VPN TX stats */
721 nla_put_uint(skb, OVPN_A_PEER_VPN_TX_BYTES,
722 atomic64_read(&peer->vpn_stats.tx.bytes)) ||
723 nla_put_uint(skb, OVPN_A_PEER_VPN_TX_PACKETS,
724 atomic64_read(&peer->vpn_stats.tx.packets)) ||
725 /* link RX stats */
726 nla_put_uint(skb, OVPN_A_PEER_LINK_RX_BYTES,
727 atomic64_read(&peer->link_stats.rx.bytes)) ||
728 nla_put_uint(skb, OVPN_A_PEER_LINK_RX_PACKETS,
729 atomic64_read(&peer->link_stats.rx.packets)) ||
730 /* link TX stats */
731 nla_put_uint(skb, OVPN_A_PEER_LINK_TX_BYTES,
732 atomic64_read(&peer->link_stats.tx.bytes)) ||
733 nla_put_uint(skb, OVPN_A_PEER_LINK_TX_PACKETS,
734 atomic64_read(&peer->link_stats.tx.packets)))
735 goto err;
736
737 nla_nest_end(skb, attr);
738 genlmsg_end(skb, hdr);
739
740 return 0;
741 err_unlock:
742 rcu_read_unlock();
743 err:
744 genlmsg_cancel(skb, hdr);
745 return ret;
746 }
747
ovpn_nl_peer_get_doit(struct sk_buff * skb,struct genl_info * info)748 int ovpn_nl_peer_get_doit(struct sk_buff *skb, struct genl_info *info)
749 {
750 struct nlattr *attrs[OVPN_A_PEER_MAX + 1];
751 struct ovpn_priv *ovpn = info->user_ptr[0];
752 struct ovpn_peer *peer;
753 struct sk_buff *msg;
754 u32 peer_id;
755 int ret, i;
756
757 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_PEER))
758 return -EINVAL;
759
760 ret = nla_parse_nested(attrs, OVPN_A_PEER_MAX, info->attrs[OVPN_A_PEER],
761 ovpn_peer_nl_policy, info->extack);
762 if (ret)
763 return ret;
764
765 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_PEER], attrs,
766 OVPN_A_PEER_ID))
767 return -EINVAL;
768
769 /* OVPN_CMD_PEER_GET expects only the PEER_ID, therefore
770 * ensure that the user hasn't specified any other attribute.
771 *
772 * Unfortunately this check cannot be performed via netlink
773 * spec/policy and must be open-coded.
774 */
775 for (i = 0; i < OVPN_A_PEER_MAX + 1; i++) {
776 if (i == OVPN_A_PEER_ID)
777 continue;
778
779 if (attrs[i]) {
780 NL_SET_ERR_MSG_FMT_MOD(info->extack,
781 "unexpected attribute %u", i);
782 return -EINVAL;
783 }
784 }
785
786 peer_id = nla_get_u32(attrs[OVPN_A_PEER_ID]);
787 peer = ovpn_peer_get_by_id(ovpn, peer_id);
788 if (!peer) {
789 NL_SET_ERR_MSG_FMT_MOD(info->extack,
790 "cannot find peer with id %u", peer_id);
791 return -ENOENT;
792 }
793
794 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
795 if (!msg) {
796 ret = -ENOMEM;
797 goto err;
798 }
799
800 ret = ovpn_nl_send_peer(msg, info, peer, info->snd_portid,
801 info->snd_seq, 0);
802 if (ret < 0) {
803 nlmsg_free(msg);
804 goto err;
805 }
806
807 ret = genlmsg_reply(msg, info);
808 err:
809 ovpn_peer_put(peer);
810 return ret;
811 }
812
ovpn_nl_peer_get_dumpit(struct sk_buff * skb,struct netlink_callback * cb)813 int ovpn_nl_peer_get_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
814 {
815 const struct genl_info *info = genl_info_dump(cb);
816 int bkt, last_idx = cb->args[1], dumped = 0;
817 netdevice_tracker tracker;
818 struct ovpn_priv *ovpn;
819 struct ovpn_peer *peer;
820
821 ovpn = ovpn_get_dev_from_attrs(sock_net(cb->skb->sk), info, &tracker);
822 if (IS_ERR(ovpn))
823 return PTR_ERR(ovpn);
824
825 if (ovpn->mode == OVPN_MODE_P2P) {
826 /* if we already dumped a peer it means we are done */
827 if (last_idx)
828 goto out;
829
830 rcu_read_lock();
831 peer = rcu_dereference(ovpn->peer);
832 if (peer) {
833 if (ovpn_nl_send_peer(skb, info, peer,
834 NETLINK_CB(cb->skb).portid,
835 cb->nlh->nlmsg_seq,
836 NLM_F_MULTI) == 0)
837 dumped++;
838 }
839 rcu_read_unlock();
840 } else {
841 rcu_read_lock();
842 hash_for_each_rcu(ovpn->peers->by_id, bkt, peer,
843 hash_entry_id) {
844 /* skip already dumped peers that were dumped by
845 * previous invocations
846 */
847 if (last_idx > 0) {
848 last_idx--;
849 continue;
850 }
851
852 if (ovpn_nl_send_peer(skb, info, peer,
853 NETLINK_CB(cb->skb).portid,
854 cb->nlh->nlmsg_seq,
855 NLM_F_MULTI) < 0)
856 break;
857
858 /* count peers being dumped during this invocation */
859 dumped++;
860 }
861 rcu_read_unlock();
862 }
863
864 out:
865 netdev_put(ovpn->dev, &tracker);
866
867 /* sum up peers dumped in this message, so that at the next invocation
868 * we can continue from where we left
869 */
870 cb->args[1] += dumped;
871 return skb->len;
872 }
873
ovpn_nl_peer_del_doit(struct sk_buff * skb,struct genl_info * info)874 int ovpn_nl_peer_del_doit(struct sk_buff *skb, struct genl_info *info)
875 {
876 struct nlattr *attrs[OVPN_A_PEER_MAX + 1];
877 struct ovpn_priv *ovpn = info->user_ptr[0];
878 struct ovpn_peer *peer;
879 u32 peer_id;
880 int ret;
881
882 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_PEER))
883 return -EINVAL;
884
885 ret = nla_parse_nested(attrs, OVPN_A_PEER_MAX, info->attrs[OVPN_A_PEER],
886 ovpn_peer_del_input_nl_policy, info->extack);
887 if (ret)
888 return ret;
889
890 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_PEER], attrs,
891 OVPN_A_PEER_ID))
892 return -EINVAL;
893
894 peer_id = nla_get_u32(attrs[OVPN_A_PEER_ID]);
895 peer = ovpn_peer_get_by_id(ovpn, peer_id);
896 if (!peer) {
897 NL_SET_ERR_MSG_FMT_MOD(info->extack,
898 "cannot find peer with id %u", peer_id);
899 return -ENOENT;
900 }
901
902 netdev_dbg(ovpn->dev, "del peer %u\n", peer->id);
903 ret = ovpn_peer_del(peer, OVPN_DEL_PEER_REASON_USERSPACE);
904 ovpn_peer_put(peer);
905
906 return ret;
907 }
908
ovpn_nl_get_key_dir(struct genl_info * info,struct nlattr * key,enum ovpn_cipher_alg cipher,struct ovpn_key_direction * dir)909 static int ovpn_nl_get_key_dir(struct genl_info *info, struct nlattr *key,
910 enum ovpn_cipher_alg cipher,
911 struct ovpn_key_direction *dir)
912 {
913 struct nlattr *attrs[OVPN_A_KEYDIR_MAX + 1];
914 int ret;
915
916 ret = nla_parse_nested(attrs, OVPN_A_KEYDIR_MAX, key,
917 ovpn_keydir_nl_policy, info->extack);
918 if (ret)
919 return ret;
920
921 switch (cipher) {
922 case OVPN_CIPHER_ALG_AES_GCM:
923 case OVPN_CIPHER_ALG_CHACHA20_POLY1305:
924 if (NL_REQ_ATTR_CHECK(info->extack, key, attrs,
925 OVPN_A_KEYDIR_CIPHER_KEY) ||
926 NL_REQ_ATTR_CHECK(info->extack, key, attrs,
927 OVPN_A_KEYDIR_NONCE_TAIL))
928 return -EINVAL;
929
930 dir->cipher_key = nla_data(attrs[OVPN_A_KEYDIR_CIPHER_KEY]);
931 dir->cipher_key_size = nla_len(attrs[OVPN_A_KEYDIR_CIPHER_KEY]);
932
933 /* These algorithms require a 96bit nonce,
934 * Construct it by combining 4-bytes packet id and
935 * 8-bytes nonce-tail from userspace
936 */
937 dir->nonce_tail = nla_data(attrs[OVPN_A_KEYDIR_NONCE_TAIL]);
938 dir->nonce_tail_size = nla_len(attrs[OVPN_A_KEYDIR_NONCE_TAIL]);
939 break;
940 default:
941 NL_SET_ERR_MSG_MOD(info->extack, "unsupported cipher");
942 return -EINVAL;
943 }
944
945 return 0;
946 }
947
948 /**
949 * ovpn_nl_key_new_doit - configure a new key for the specified peer
950 * @skb: incoming netlink message
951 * @info: genetlink metadata
952 *
953 * This function allows the user to install a new key in the peer crypto
954 * state.
955 * Each peer has two 'slots', namely 'primary' and 'secondary', where
956 * keys can be installed. The key in the 'primary' slot is used for
957 * encryption, while both keys can be used for decryption by matching the
958 * key ID carried in the incoming packet.
959 *
960 * The user is responsible for rotating keys when necessary. The user
961 * may fetch peer traffic statistics via netlink in order to better
962 * identify the right time to rotate keys.
963 * The renegotiation follows these steps:
964 * 1. a new key is computed by the user and is installed in the 'secondary'
965 * slot
966 * 2. at user discretion (usually after a predetermined time) 'primary' and
967 * 'secondary' contents are swapped and the new key starts being used for
968 * encryption, while the old key is kept around for decryption of late
969 * packets.
970 *
971 * Return: 0 on success or a negative error code otherwise.
972 */
ovpn_nl_key_new_doit(struct sk_buff * skb,struct genl_info * info)973 int ovpn_nl_key_new_doit(struct sk_buff *skb, struct genl_info *info)
974 {
975 struct nlattr *attrs[OVPN_A_KEYCONF_MAX + 1];
976 struct ovpn_priv *ovpn = info->user_ptr[0];
977 struct ovpn_peer_key_reset pkr;
978 struct ovpn_peer *peer;
979 u32 peer_id;
980 int ret;
981
982 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_KEYCONF))
983 return -EINVAL;
984
985 ret = nla_parse_nested(attrs, OVPN_A_KEYCONF_MAX,
986 info->attrs[OVPN_A_KEYCONF],
987 ovpn_keyconf_nl_policy, info->extack);
988 if (ret)
989 return ret;
990
991 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs,
992 OVPN_A_KEYCONF_PEER_ID))
993 return -EINVAL;
994
995 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs,
996 OVPN_A_KEYCONF_SLOT) ||
997 NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs,
998 OVPN_A_KEYCONF_KEY_ID) ||
999 NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs,
1000 OVPN_A_KEYCONF_CIPHER_ALG) ||
1001 NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs,
1002 OVPN_A_KEYCONF_ENCRYPT_DIR) ||
1003 NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs,
1004 OVPN_A_KEYCONF_DECRYPT_DIR))
1005 return -EINVAL;
1006
1007 pkr.slot = nla_get_u32(attrs[OVPN_A_KEYCONF_SLOT]);
1008 pkr.key.key_id = nla_get_u32(attrs[OVPN_A_KEYCONF_KEY_ID]);
1009 pkr.key.cipher_alg = nla_get_u32(attrs[OVPN_A_KEYCONF_CIPHER_ALG]);
1010
1011 ret = ovpn_nl_get_key_dir(info, attrs[OVPN_A_KEYCONF_ENCRYPT_DIR],
1012 pkr.key.cipher_alg, &pkr.key.encrypt);
1013 if (ret < 0)
1014 return ret;
1015
1016 ret = ovpn_nl_get_key_dir(info, attrs[OVPN_A_KEYCONF_DECRYPT_DIR],
1017 pkr.key.cipher_alg, &pkr.key.decrypt);
1018 if (ret < 0)
1019 return ret;
1020
1021 peer_id = nla_get_u32(attrs[OVPN_A_KEYCONF_PEER_ID]);
1022 peer = ovpn_peer_get_by_id(ovpn, peer_id);
1023 if (!peer) {
1024 NL_SET_ERR_MSG_FMT_MOD(info->extack,
1025 "no peer with id %u to set key for",
1026 peer_id);
1027 return -ENOENT;
1028 }
1029
1030 ret = ovpn_crypto_state_reset(&peer->crypto, &pkr);
1031 if (ret < 0) {
1032 NL_SET_ERR_MSG_FMT_MOD(info->extack,
1033 "cannot install new key for peer %u",
1034 peer_id);
1035 goto out;
1036 }
1037
1038 netdev_dbg(ovpn->dev, "new key installed (id=%u) for peer %u\n",
1039 pkr.key.key_id, peer_id);
1040 out:
1041 ovpn_peer_put(peer);
1042 return ret;
1043 }
1044
ovpn_nl_send_key(struct sk_buff * skb,const struct genl_info * info,u32 peer_id,enum ovpn_key_slot slot,const struct ovpn_key_config * keyconf)1045 static int ovpn_nl_send_key(struct sk_buff *skb, const struct genl_info *info,
1046 u32 peer_id, enum ovpn_key_slot slot,
1047 const struct ovpn_key_config *keyconf)
1048 {
1049 struct nlattr *attr;
1050 void *hdr;
1051
1052 hdr = genlmsg_put(skb, info->snd_portid, info->snd_seq, &ovpn_nl_family,
1053 0, OVPN_CMD_KEY_GET);
1054 if (!hdr)
1055 return -ENOBUFS;
1056
1057 attr = nla_nest_start(skb, OVPN_A_KEYCONF);
1058 if (!attr)
1059 goto err;
1060
1061 if (nla_put_u32(skb, OVPN_A_KEYCONF_PEER_ID, peer_id))
1062 goto err;
1063
1064 if (nla_put_u32(skb, OVPN_A_KEYCONF_SLOT, slot) ||
1065 nla_put_u32(skb, OVPN_A_KEYCONF_KEY_ID, keyconf->key_id) ||
1066 nla_put_u32(skb, OVPN_A_KEYCONF_CIPHER_ALG, keyconf->cipher_alg))
1067 goto err;
1068
1069 nla_nest_end(skb, attr);
1070 genlmsg_end(skb, hdr);
1071
1072 return 0;
1073 err:
1074 genlmsg_cancel(skb, hdr);
1075 return -EMSGSIZE;
1076 }
1077
ovpn_nl_key_get_doit(struct sk_buff * skb,struct genl_info * info)1078 int ovpn_nl_key_get_doit(struct sk_buff *skb, struct genl_info *info)
1079 {
1080 struct nlattr *attrs[OVPN_A_KEYCONF_MAX + 1];
1081 struct ovpn_priv *ovpn = info->user_ptr[0];
1082 struct ovpn_key_config keyconf = { 0 };
1083 enum ovpn_key_slot slot;
1084 struct ovpn_peer *peer;
1085 struct sk_buff *msg;
1086 u32 peer_id;
1087 int ret, i;
1088
1089 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_KEYCONF))
1090 return -EINVAL;
1091
1092 ret = nla_parse_nested(attrs, OVPN_A_KEYCONF_MAX,
1093 info->attrs[OVPN_A_KEYCONF],
1094 ovpn_keyconf_get_nl_policy, info->extack);
1095 if (ret)
1096 return ret;
1097
1098 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs,
1099 OVPN_A_KEYCONF_PEER_ID))
1100 return -EINVAL;
1101
1102 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs,
1103 OVPN_A_KEYCONF_SLOT))
1104 return -EINVAL;
1105
1106 /* OVPN_CMD_KEY_GET expects only the PEER_ID and the SLOT, therefore
1107 * ensure that the user hasn't specified any other attribute.
1108 *
1109 * Unfortunately this check cannot be performed via netlink
1110 * spec/policy and must be open-coded.
1111 */
1112 for (i = 0; i < OVPN_A_KEYCONF_MAX + 1; i++) {
1113 if (i == OVPN_A_KEYCONF_PEER_ID ||
1114 i == OVPN_A_KEYCONF_SLOT)
1115 continue;
1116
1117 if (attrs[i]) {
1118 NL_SET_ERR_MSG_FMT_MOD(info->extack,
1119 "unexpected attribute %u", i);
1120 return -EINVAL;
1121 }
1122 }
1123
1124 peer_id = nla_get_u32(attrs[OVPN_A_KEYCONF_PEER_ID]);
1125 peer = ovpn_peer_get_by_id(ovpn, peer_id);
1126 if (!peer) {
1127 NL_SET_ERR_MSG_FMT_MOD(info->extack,
1128 "cannot find peer with id %u", peer_id);
1129 return -ENOENT;
1130 }
1131
1132 slot = nla_get_u32(attrs[OVPN_A_KEYCONF_SLOT]);
1133
1134 ret = ovpn_crypto_config_get(&peer->crypto, slot, &keyconf);
1135 if (ret < 0) {
1136 NL_SET_ERR_MSG_FMT_MOD(info->extack,
1137 "cannot extract key from slot %u for peer %u",
1138 slot, peer_id);
1139 goto err;
1140 }
1141
1142 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1143 if (!msg) {
1144 ret = -ENOMEM;
1145 goto err;
1146 }
1147
1148 ret = ovpn_nl_send_key(msg, info, peer->id, slot, &keyconf);
1149 if (ret < 0) {
1150 nlmsg_free(msg);
1151 goto err;
1152 }
1153
1154 ret = genlmsg_reply(msg, info);
1155 err:
1156 ovpn_peer_put(peer);
1157 return ret;
1158 }
1159
ovpn_nl_key_swap_doit(struct sk_buff * skb,struct genl_info * info)1160 int ovpn_nl_key_swap_doit(struct sk_buff *skb, struct genl_info *info)
1161 {
1162 struct nlattr *attrs[OVPN_A_KEYCONF_MAX + 1];
1163 struct ovpn_priv *ovpn = info->user_ptr[0];
1164 struct ovpn_peer *peer;
1165 u32 peer_id;
1166 int ret;
1167
1168 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_KEYCONF))
1169 return -EINVAL;
1170
1171 ret = nla_parse_nested(attrs, OVPN_A_KEYCONF_MAX,
1172 info->attrs[OVPN_A_KEYCONF],
1173 ovpn_keyconf_swap_input_nl_policy, info->extack);
1174 if (ret)
1175 return ret;
1176
1177 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs,
1178 OVPN_A_KEYCONF_PEER_ID))
1179 return -EINVAL;
1180
1181 peer_id = nla_get_u32(attrs[OVPN_A_KEYCONF_PEER_ID]);
1182 peer = ovpn_peer_get_by_id(ovpn, peer_id);
1183 if (!peer) {
1184 NL_SET_ERR_MSG_FMT_MOD(info->extack,
1185 "no peer with id %u to swap keys for",
1186 peer_id);
1187 return -ENOENT;
1188 }
1189
1190 ovpn_crypto_key_slots_swap(&peer->crypto);
1191 ovpn_peer_put(peer);
1192
1193 return 0;
1194 }
1195
ovpn_nl_key_del_doit(struct sk_buff * skb,struct genl_info * info)1196 int ovpn_nl_key_del_doit(struct sk_buff *skb, struct genl_info *info)
1197 {
1198 struct nlattr *attrs[OVPN_A_KEYCONF_MAX + 1];
1199 struct ovpn_priv *ovpn = info->user_ptr[0];
1200 enum ovpn_key_slot slot;
1201 struct ovpn_peer *peer;
1202 u32 peer_id;
1203 int ret;
1204
1205 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_KEYCONF))
1206 return -EINVAL;
1207
1208 ret = nla_parse_nested(attrs, OVPN_A_KEYCONF_MAX,
1209 info->attrs[OVPN_A_KEYCONF],
1210 ovpn_keyconf_del_input_nl_policy, info->extack);
1211 if (ret)
1212 return ret;
1213
1214 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs,
1215 OVPN_A_KEYCONF_PEER_ID))
1216 return -EINVAL;
1217
1218 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs,
1219 OVPN_A_KEYCONF_SLOT))
1220 return -EINVAL;
1221
1222 peer_id = nla_get_u32(attrs[OVPN_A_KEYCONF_PEER_ID]);
1223 slot = nla_get_u32(attrs[OVPN_A_KEYCONF_SLOT]);
1224
1225 peer = ovpn_peer_get_by_id(ovpn, peer_id);
1226 if (!peer) {
1227 NL_SET_ERR_MSG_FMT_MOD(info->extack,
1228 "no peer with id %u to delete key for",
1229 peer_id);
1230 return -ENOENT;
1231 }
1232
1233 ovpn_crypto_key_slot_delete(&peer->crypto, slot);
1234 ovpn_peer_put(peer);
1235
1236 return 0;
1237 }
1238
1239 /**
1240 * ovpn_nl_peer_del_notify - notify userspace about peer being deleted
1241 * @peer: the peer being deleted
1242 *
1243 * Return: 0 on success or a negative error code otherwise
1244 */
ovpn_nl_peer_del_notify(struct ovpn_peer * peer)1245 int ovpn_nl_peer_del_notify(struct ovpn_peer *peer)
1246 {
1247 struct ovpn_socket *sock;
1248 struct sk_buff *msg;
1249 struct nlattr *attr;
1250 int ret = -EMSGSIZE;
1251 void *hdr;
1252
1253 netdev_info(peer->ovpn->dev, "deleting peer with id %u, reason %d\n",
1254 peer->id, peer->delete_reason);
1255
1256 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
1257 if (!msg)
1258 return -ENOMEM;
1259
1260 hdr = genlmsg_put(msg, 0, 0, &ovpn_nl_family, 0, OVPN_CMD_PEER_DEL_NTF);
1261 if (!hdr) {
1262 ret = -ENOBUFS;
1263 goto err_free_msg;
1264 }
1265
1266 if (nla_put_u32(msg, OVPN_A_IFINDEX, peer->ovpn->dev->ifindex))
1267 goto err_cancel_msg;
1268
1269 attr = nla_nest_start(msg, OVPN_A_PEER);
1270 if (!attr)
1271 goto err_cancel_msg;
1272
1273 if (nla_put_u32(msg, OVPN_A_PEER_DEL_REASON, peer->delete_reason))
1274 goto err_cancel_msg;
1275
1276 if (nla_put_u32(msg, OVPN_A_PEER_ID, peer->id))
1277 goto err_cancel_msg;
1278
1279 nla_nest_end(msg, attr);
1280
1281 genlmsg_end(msg, hdr);
1282
1283 rcu_read_lock();
1284 sock = rcu_dereference(peer->sock);
1285 if (!sock) {
1286 ret = -EINVAL;
1287 goto err_unlock;
1288 }
1289 genlmsg_multicast_netns(&ovpn_nl_family, sock_net(sock->sk), msg, 0,
1290 OVPN_NLGRP_PEERS, GFP_ATOMIC);
1291 rcu_read_unlock();
1292
1293 return 0;
1294
1295 err_unlock:
1296 rcu_read_unlock();
1297 err_cancel_msg:
1298 genlmsg_cancel(msg, hdr);
1299 err_free_msg:
1300 nlmsg_free(msg);
1301 return ret;
1302 }
1303
1304 /**
1305 * ovpn_nl_peer_float_notify - notify userspace about peer floating
1306 * @peer: the floated peer
1307 * @ss: sockaddr representing the new remote endpoint
1308 *
1309 * Return: 0 on success or a negative error code otherwise
1310 */
ovpn_nl_peer_float_notify(struct ovpn_peer * peer,const struct sockaddr_storage * ss)1311 int ovpn_nl_peer_float_notify(struct ovpn_peer *peer,
1312 const struct sockaddr_storage *ss)
1313 {
1314 struct ovpn_socket *sock;
1315 struct sockaddr_in6 *sa6;
1316 struct sockaddr_in *sa;
1317 struct sk_buff *msg;
1318 struct nlattr *attr;
1319 int ret = -EMSGSIZE;
1320 void *hdr;
1321
1322 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
1323 if (!msg)
1324 return -ENOMEM;
1325
1326 hdr = genlmsg_put(msg, 0, 0, &ovpn_nl_family, 0,
1327 OVPN_CMD_PEER_FLOAT_NTF);
1328 if (!hdr) {
1329 ret = -ENOBUFS;
1330 goto err_free_msg;
1331 }
1332
1333 if (nla_put_u32(msg, OVPN_A_IFINDEX, peer->ovpn->dev->ifindex))
1334 goto err_cancel_msg;
1335
1336 attr = nla_nest_start(msg, OVPN_A_PEER);
1337 if (!attr)
1338 goto err_cancel_msg;
1339
1340 if (nla_put_u32(msg, OVPN_A_PEER_ID, peer->id))
1341 goto err_cancel_msg;
1342
1343 if (ss->ss_family == AF_INET) {
1344 sa = (struct sockaddr_in *)ss;
1345 if (nla_put_in_addr(msg, OVPN_A_PEER_REMOTE_IPV4,
1346 sa->sin_addr.s_addr) ||
1347 nla_put_net16(msg, OVPN_A_PEER_REMOTE_PORT, sa->sin_port))
1348 goto err_cancel_msg;
1349 } else if (ss->ss_family == AF_INET6) {
1350 sa6 = (struct sockaddr_in6 *)ss;
1351 if (nla_put_in6_addr(msg, OVPN_A_PEER_REMOTE_IPV6,
1352 &sa6->sin6_addr) ||
1353 nla_put_u32(msg, OVPN_A_PEER_REMOTE_IPV6_SCOPE_ID,
1354 sa6->sin6_scope_id) ||
1355 nla_put_net16(msg, OVPN_A_PEER_REMOTE_PORT, sa6->sin6_port))
1356 goto err_cancel_msg;
1357 } else {
1358 ret = -EAFNOSUPPORT;
1359 goto err_cancel_msg;
1360 }
1361
1362 nla_nest_end(msg, attr);
1363 genlmsg_end(msg, hdr);
1364
1365 rcu_read_lock();
1366 sock = rcu_dereference(peer->sock);
1367 if (!sock) {
1368 ret = -EINVAL;
1369 goto err_unlock;
1370 }
1371 genlmsg_multicast_netns(&ovpn_nl_family, sock_net(sock->sk), msg,
1372 0, OVPN_NLGRP_PEERS, GFP_ATOMIC);
1373 rcu_read_unlock();
1374
1375 return 0;
1376
1377 err_unlock:
1378 rcu_read_unlock();
1379 err_cancel_msg:
1380 genlmsg_cancel(msg, hdr);
1381 err_free_msg:
1382 nlmsg_free(msg);
1383 return ret;
1384 }
1385
1386 /**
1387 * ovpn_nl_key_swap_notify - notify userspace peer's key must be renewed
1388 * @peer: the peer whose key needs to be renewed
1389 * @key_id: the ID of the key that needs to be renewed
1390 *
1391 * Return: 0 on success or a negative error code otherwise
1392 */
ovpn_nl_key_swap_notify(struct ovpn_peer * peer,u8 key_id)1393 int ovpn_nl_key_swap_notify(struct ovpn_peer *peer, u8 key_id)
1394 {
1395 struct ovpn_socket *sock;
1396 struct nlattr *k_attr;
1397 struct sk_buff *msg;
1398 int ret = -EMSGSIZE;
1399 void *hdr;
1400
1401 netdev_info(peer->ovpn->dev, "peer with id %u must rekey - primary key unusable.\n",
1402 peer->id);
1403
1404 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
1405 if (!msg)
1406 return -ENOMEM;
1407
1408 hdr = genlmsg_put(msg, 0, 0, &ovpn_nl_family, 0, OVPN_CMD_KEY_SWAP_NTF);
1409 if (!hdr) {
1410 ret = -ENOBUFS;
1411 goto err_free_msg;
1412 }
1413
1414 if (nla_put_u32(msg, OVPN_A_IFINDEX, peer->ovpn->dev->ifindex))
1415 goto err_cancel_msg;
1416
1417 k_attr = nla_nest_start(msg, OVPN_A_KEYCONF);
1418 if (!k_attr)
1419 goto err_cancel_msg;
1420
1421 if (nla_put_u32(msg, OVPN_A_KEYCONF_PEER_ID, peer->id))
1422 goto err_cancel_msg;
1423
1424 if (nla_put_u16(msg, OVPN_A_KEYCONF_KEY_ID, key_id))
1425 goto err_cancel_msg;
1426
1427 nla_nest_end(msg, k_attr);
1428 genlmsg_end(msg, hdr);
1429
1430 rcu_read_lock();
1431 sock = rcu_dereference(peer->sock);
1432 if (!sock) {
1433 ret = -EINVAL;
1434 goto err_unlock;
1435 }
1436 genlmsg_multicast_netns(&ovpn_nl_family, sock_net(sock->sk), msg, 0,
1437 OVPN_NLGRP_PEERS, GFP_ATOMIC);
1438 rcu_read_unlock();
1439
1440 return 0;
1441 err_unlock:
1442 rcu_read_unlock();
1443 err_cancel_msg:
1444 genlmsg_cancel(msg, hdr);
1445 err_free_msg:
1446 nlmsg_free(msg);
1447 return ret;
1448 }
1449
1450 /**
1451 * ovpn_nl_register - perform any needed registration in the NL subsustem
1452 *
1453 * Return: 0 on success, a negative error code otherwise
1454 */
ovpn_nl_register(void)1455 int __init ovpn_nl_register(void)
1456 {
1457 int ret = genl_register_family(&ovpn_nl_family);
1458
1459 if (ret) {
1460 pr_err("ovpn: genl_register_family failed: %d\n", ret);
1461 return ret;
1462 }
1463
1464 return 0;
1465 }
1466
1467 /**
1468 * ovpn_nl_unregister - undo any module wide netlink registration
1469 */
ovpn_nl_unregister(void)1470 void ovpn_nl_unregister(void)
1471 {
1472 genl_unregister_family(&ovpn_nl_family);
1473 }
1474